Computer Forensics Software

HSCG23-15-I-COMPUTERFORENSICS Request for Information (RFI) BACKGROUND This RFI is part of a market research effort by the United States Coast Guard (USCG), Office of Contract Operations, Formal Contract Division II, on behalf of the USCG Investigative Services (CGIS). The mission of CGIS is to support and protect Coast Guard personnel, operations, integrity and assets worldwide. We prevent and defeat criminal threats through objective and independent investigations. CGIS conducts investigations of actual, alleged or suspected criminal activity; is authorized to carry and use firearms; they execute and serve warrants; and make federal arrests. Since 2004, CGIS has conducted Document and Media Exploitation (DOMEX) and Digital Forensics in support of Criminal Investigations. DOMEX / Digital Forensics is the legally defensible and systematic processing, extraction, exploitation, translation, analysis, reporting, and dissemination of information obtained from diverse operating systems and file types, collected from various suspect electronic devices and digital media, which can be replicated using industry standard hardware and software tools. This investigative process is for producing intelligence, answering information requirements, and discovering information that is critical to investigations or operational requirements. Currently, CGIS DOMEX utilizes a suite of digital forensics software available on the commercial marketplace. The USCG is currently seeking information to determine whether it is in the best interest of the government to continue with its current software implementation or to procure a new software solution. As such, CGIS now seeks to query the market in regards to potentially replacing its currently utilized software suite: Access Data's Forensic Toolkit, Guidance Software's Encase Forensics, Black Bag Forensics' MacQuitions, and Magnet Forensic's Internet Evidence Finder. CURRENT SOFTWARE INFORMATION The following bulleted list's capture, in very general terms, the capabilities of these software packages that is currently being utilized by CGIS: Access Data - Forensic Toolkit - Integrated Digital Investigation Solution - Processing Capabilities - Log2timeline CVS Support - Broad File system, File type & Mail support - Broad Encryption Support - Data Visualization and Explicit Image Detection (EID) - Comprehensive Index & Binary Searching - Single-node Remote Investigations - Advanced Volatile / Memory Analysis - Microsoft PhotoDNA Integration - Volume Shadow Copy (VSC) file review - Automated Language Identification - Internet and Chat Analysis - Exceptional Apple iOS Analysis - Rich Reporting Guidance Software - Encase Forensics - Perform quick triage Instantly view images on the target machine - Review documents in real-time - Collect only relevant information quickly - Use keywords, metadata, hash values, and other criteria to perform targeted triage and collection - Perform memory acquisition - Perform full-disk imaging - Integrated Smartphone and Tablet Acquisition with borad support across multiple platforms - Evidence formatting: Evidence Search Types Including GREP, Conditional, Boolean, and Word searches - Advanced Analysis Multiple File Viewer Support - Case Analyzer - Reporting Capability Black Bag Forensics - MacQuitions Targeted Data Collection - Target and forensically acquire files, folders, and user directories while avoiding known system files and other unresponsive data. - Preserve valuable metadata by maintaining its association with the original file. - Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash functions. - Thoroughly log data acquisitions and source device attributes throughout the collection process. - Selectively acquire email, chat, address book, calendar, and stickies on a per user, per volume basis. Live Data Acquisition - Capture important live data such as Internet, chat, and multimedia files in real time. - Soundly acquire and save volatile Random Access Memory (RAM) contents to a destination device. - Choose from 21 unique system data collection options including active system processes, current system state, and print queue status. - Extensively log live data acquisition information throughout the collection process. Forensic Imaging - Avoid time consuming take-aparts. Use the source machine's own system to create a forensic image by booting from the MacQuisition USB swivel key. - Image over 185 different Mac laptop, desktop, and OS X server models. - Write-protect source devices while maintaining read-write access on destination devices. - Extensively log forensic image acquisition processes, disk and volume attributes, and corresponding hash values. Magnet Forensic - Internet Evidence Finder Searches Capabilities: - Brower Activity - Instant Messaging and Chat Apps - Social Networking - P2P File sharing - Web searches and toolbars - Media files - Webmail - Cloud drives - Mappings - Documents - Operating Systems - Drives - Live Ram - Disk Encryption - Volatile Data - Keyword Searches - Native Mobile OS Applications Analysis Capabilities: - Filters - Bookmarks and notes - Timelines - World map - Picture analysis - Chat thread visualization - Webpage rebuilding RESPONDING TO THIS RFI The USCG is seeking RFI responses that analyze other software packages available on the commercial marketplace that could potentially rival the capability of the software currently used by CGIS. The USCG is not interested in developing unique software at this time and is only interested in commercially available products. When responding to the RFI, please include the following information: A) A one page cover letter that provides the business size, business category information for your company, NAICS code, and DUNS for your company. B) A capabilities statement containing information on your software that could potentially fulfill the same criteria as any of the software currently being employed. These capabilities statements must be detailed enough for a professional in the field of forensic investigations to understand the complexity and depth of the product's abilities. If your company does not offer equivalent products for all four software packages, please provide a statement for the software you do offer that could fulfill one of the package's capabilities. C) If multiple products are presented by the same reply, the responses to this RFI should be specific to each product. D) Provide specific operational systems requirements for the products. E) Provide any currently available certifications that can be obtained for your product, either through your company or other commercially available training contractors. F) Please provide an estimated price or a rough order of magnitude (ROM) for any proposed products. This ROM should include the following: i) the cost of the product; ii) the costs of being trained and certified in the use of the product; and, iii) the out-year license and maintenance costs outwards to five years.. The CGIS program intends to use the information collected from this RFI to conduct an operational analysis that evaluates the merits of refreshing and/or replacing existing software to achieve the minimum effectiveness within the current operational budget (which shall remain undisclosed). As such, your responses are very important. Send your responses to this RFI to James.R.Robinson@uscg.mil before the closing time of this RFI. SUPPLEMENTAL INFORMATION This RFI is issued for information and planning purposes only and does not constitute an official solicitation. No contract will be awarded on the basis of responses received to this notice alone. No compensation for any responses to this RFI shall be paid by the Government and by responding to this RFI your company accepts all financial costs for its response.