U.S. flag

An official website of the United States government, Department of Justice.

Dot gov

The .gov means it’s official.
Federal government websites always use a .gov or .mil domain. Before sharing sensitive information online, make sure you’re on a .gov or .mil site by inspecting your browser’s address (or “location”) bar.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

USB Live Acquistion and Triage Tool (US-LATT)

Award Information

Award #
2007-DN-BX-K021
Location
Congressional District
Status
Closed
Funding First Awarded
2007
Total funding (to date)
$187,486

Description of original award (Fiscal Year 2007, $137,500)

This project will develop a USB Live Acquisition and Triage Tool to provide the ability for forensic examinations to be performed on a live system prior to seizure. US-LATT is intended to capture common stateful information from systems and in addition, target data immediately relevant to cases involving subject matter such as youth exploitation, parole violations, and possible terrorism. The tool can be used as both a pre-seizure function to collection the live system information before the system is turned off and as a triage tool to determine if further consideration is merited for a given system.

ca/ncf

Investigators and first-responders are in dire need of tools that quickly and efficiently acquire volatile evidence from live running computers. The development of a USB Live Acquisition and Triage Tool (US-LATT) will provide the ability for forensic examinations to be performed on live system prior to seizure. The US-LATT intent is to capture common information from systems. In addition, target data immediately relevant to cases involving subject matter such as youth exploitation, parole violations and possible terrorism. All forensic analysis of the collected information on the US-LATT will be done in the Forensic Lab using standard analysis tools like FTK or EnCase. This project contributes to the reduction of crime laboratory computer evidence backlog by allowing forensic computer analysts to more quickly process cases, using the volatile information gathered from a live acquisition. nca/ncf

Date Created: September 11, 2007