Lightroom forensics - in forensis

I came across an outstanding paper from Sam Peisert, Matt Bishop (both from UC Davis), and Keith Marzullo (UC San Diego) called Computer Forensics In Forensis.

Here's the abstract:

"Different users apply computer forensic systems, models, and terminology in very different ways. They often make incompatible assumptions and reach different conclusions about the validity and accuracy of the methods they use to log, audit, and present forensic data. In fact, it can be hard to say who, if anyone is right. We present several forensic systems and discuss situations in which they produce valid and accurate conclusions and also situations in which their accuracy is suspect. We also present forensic models and discuss areas in which they are useful and areas in which they could be augmented. Finally, we present some recommendations about how computer scientists, forensic practitioners, lawyers, and judges could build more complete models of forensics that take into account appropriate legal details and lead to scientifically valid forensic analysis."

It's written about Computer Forensics, but a lot of the themes carry over to our work and our on-going discussion and debate about how to best utilise these artistic tools in a "forensic" setting.

Here's a good quote:

"Those involved in computer forensics often do not understand one other. Groups have evolved separately with only little interaction. Each group has largely separate conferences, journals, and research locations, and few attempts have successfully brought these groups together. Indeed, the language used to describe computer forensics and even the denition of the term itself varies considerably among those who study and practice it: computer scientists, commercial ventures, practitioners, and the legal profession. As a result, it is dicult for these groups to communicate and understand each others' goals." Amen.

Computer crimes folks preach removing the power cord as a method of shutting down a system. Yet, do that to many Linux based DVRs and you'll loose everything. We seem to be working in the same area of technology, but we each have our issues and the things that are of vital importance.

It's an outstanding paper and well worth reading.

Enjoy.

Lightroom catalogs

I wasn't sure how well the last post would go off when I put it up here. I said that I was looking into the issue and believed that I owed everyone the answer, good or bad or otherwise. The week's e-mails let me know how everyone felt about what I had to say. The responses weren't all that favourable. Here's a response to many of them:

"A catalog is how Lightroom tracks the location of files and remembers information about them. It’s like a database that contains a record of your photos. This record is stored in the catalog and contains data, such as preview information, links that indicate where the photos are located on your computer, metadata that describes the photos, and editing instructions recorded in the Develop module. When you rate photos, add metadata and keyword tags, organize photos into collections, or remove photos from the catalog—even when the original photo files are offline—the settings are stored in the catalog." - From Adobe.com

"The Lightroom catalog is a database ..." - From Adobe.com

Over on the Forensic Photoshop blog, I've posted a description of a recent decision regarding Metadata and discovery from the 2nd Cir. "Examples include ... database information."

If the Lightroom Catalog is a database that contains information, including Metadata, which may pertain to a case; and Metadata is discoverable ... then is your Lightroom catalog discoverable? With the latest trends in e-discovery, why would anyone not want to know the answers?

I never said it was or wasn't. I said to check with your council and to use it with caution. I also said that I love using it in private work, which is where I use it (exclusively). 

With this discussion behind us ... let's move on. Until then, enjoy.

Yah, yah ... I know

I know it's been a while since I've posted here. It's certainly not from a lack of working on and in Lightroom. I've been bouncing off the walls validating the program, then the upgrade ... talking with the engineers ... talking with legal experts ... and much more.

The update to all this and the determination we've all been waiting for:

Use Adobe Photoshop Lightroom with caution in the criminal justice / law enforcement world ... and only after having a serious discussion with your legal team.

This opinion (which is entirely my own) has nothing to do with how Lightroom works with images (edits, tonal controls, etc.) It has everything to do with e-discovery and record retention rules and how they vary from state to state.

For those like Adobe's Rick Miller and Julieanne Kost, who have photography passions outside their office, Lightroom is a great tool. They may have one catalog for personal stuff, and one catalog for professional stuff. Organising things inside each catalog is simple and efficient.

Unfortunately, those of us in the LE world have to deal with discovery. Depending on the jurisdiction, that catalog may be discoverable (it is, after all, a "document" that relates to the case). If the catalog is open for discovery, then you don't necessarily want to mix cases within the same catalog (you may in "serial" situations). This leaves you with hundreds or thousands of catalogs over time.

Again, this isn't necessarily a bad thing. It's just an organisational headache. Additionally, there isn't a way (currently) to search across catalogs. This combined with a (current) lack of network support makes it harder to manage in multi-user environments.

From what I've gathered, these issues won't be addressed soon. Remember, the LE market is tiny compared to the prosumer and professional photography market. We may be professional photographers ... but we have to answer to an entirely different client once that image has been captured.

Don't get me wrong. As a professional photographer, I love the program and use it almost daily (in private practice). For the "one-man cop shop" it may be the best thing for you in terms of asset management. Just use it with care and with a sound knowledge of how the program works under the hood.

I'd be happy to get into more detail off-line. In the mean time ... we'll resume the previously scheduled weekly posts next Thursday. We've got a lot of catching up to do.

Until then ... enjoy.