Sieve
During a criminal investigation, the police may find millions of photos and videos. These may be stored on phones, laptops, hard drives and servers. Digital forensic investigators collect and select this material so that the tactical investigators can assess it. Sieve supports this process by automatically finding and selecting files.
Sieve is a software that finds photos and videos on digital storage devices. Its name reflects how it works: as a digital sieve. Sieve searches large collections of digital files for photos and videos and copies them so that tactical investigator can examine them further. The software can also use ‘hash lists’ to exclude or flag specific files during processing.
How does Sieve work?
The police make forensic copies of the data on seized devices. Sieve searches these copies as thoroughly as possible. For example, it can extract an image from a PDF file, even if the PDF is inside a ZIP file attached to an email.
Sieve calculates a ‘hash’ for each photo and video it finds. This is a unique code based on the contents of a file. An identical file always produces the same hash. Sieve compares these hashes with hash lists loaded by the user. For example, a list may contain hashes of files that investigators have previously identified as child sexual abuse material.
If a hash matches one on the list, Sieve marks the file as a ‘hit’. Sieve does not assess the images or determine their relevance for a case. It only selects files based on technical criteria.
By automating this extraction, Sieve reduces how often digital forensic investigators are exposed to distressing images and videos. It also helps them search large numbers of files more quickly and focus on specialised investigative work.
Development of Sieve
In late 2009, the Netherlands Forensic Institute (NFI) delivered the first version of Sieve to the Rotterdam-Rijnmond police. The software was developed as part of Proeftuin Zambezi, a pilot project focused on tackling child sexual abuse material.
NFI continues to improve Sieve in cooperation with the Dutch police’s Team Bestrijding Kinderporno en Kindersekstoerisme (TBKK) team. This team combats child sexual abuse material and child sex tourism. In addition to the Dutch police, law enforcement agencies in Germany and Luxembourg also use the software.
More information
For more information about Sieve or to discuss its possible uses, contact accountsupport@nfi.nl. For questions about the software itself, contact sieve@nfi.nl.