NTI - Computer Forensics Processing Tips

SafeBack 3.0 and ILook Compatibility

Elliott Spencer, the developer of ILook, was granted legal rights to access the file formats created by SafeBack version 2.2 prior in his creation of software for free use by enforcement agencies free of charge. For the record, NTI wants to continue that relationship for the benefit of law enforcement concerning SafeBack version 3.0. Currently we are in communication with the Federal Bureau of Investigation (FBI) to see how we can make that happen (free of charge) for the benefit of law enforcement computer crime specialists. NTI was a big supporter of the FBI's development and distribution of the Automated Computer Examination System (ACES) and NTI granted the FBI the legal rights to access the SafeBack 2.2 file format. When the FBI abandon the ACES project in favor of free ILook distribution and training for law enforcement, NTI was also a supporter and we were glad that ILook was already compatible with SafeBack version 2.2. Nothing has changed and NTI stands ready to work with the FBI to make ILook compatible with the new and improved SaveBack version 3.0.

It has always been NTI's intent to support law enforcement efforts and to help them stretch limited law enforcement budgets. Unfortunately, the file format for SafeBack 3.0 was changed to accommodate much larger mathematical hashes. The original design of SafeBack did not reserve any extra space in its output file format to accommodate larger hashes, e.g., SHA256. Nor did the original design of SafeBack foresee the advances in hard disk drive storage capacities. In 1990 when the original SafeBack program was created, a standard hard disk drive had the capacity to store approximately 20 to 40 million bytes of data. Today, hard disk drive capacities exceed 100 gigabytes. As the data sizes increase, the need for stronger mathematical verification increases as well and larger hashing algorithms are needed to ensure accuracy.

SafeBack 3.0 relies upon the NIST tested SHA256 algorithm to ensure accuracy with todays huge hard disk drives and with hard disk drives that will be created in the future. The incorporation of this more robust hashing algorithm necessitated a change in the SafeBack file format. Other minor changes in the file format were also changed to enhance the evidence value of the program and to avoid unauthorized uses of the SafeBack file format and related technology. It is unfortunate but we could not increase the hash sizes and still keep the SafeBack file format the same. It was therefore impossible for us to maintain compatibility with ILook and increase the mathematical hash values.

NTI has no control over the software development efforts of government agencies, e.g., ILook computer forensics software. However, NTI is always willing to license access to the SafeBack file format to any U. S. Government agency for use with any free distribution of computer forensics software to assist law enforcement agencies. Concerning ILook, this offer has been extended to the U. S. Government and we waiting to see how we can assist with that implementation. The only stipulation is that NTI's intellectual property must be protected from private sector competitors. NTI will continue to make it a priority to support law enforcement agencies and to pass along discounts and free software when possible.

Back To NTI's Home Page