Software forensics for embedded systems developers

Robert Zeidman, Zeidman Consulting
EETimees (8/14/2011 2:08 PM EDT)

In this chapter from his book "The Software IP Detective's Handbook," Bob Zeidman describes some of the concepts behind the new field of software forensics, and how they can be used to safeguard the unique and proprietary Intellectual Property incorporated into your design.

The word forensic comes from the Latin word forensis meaning “of or before the forum.” In ancient Rome, an accused criminal and the accusing victim would present their cases before a group in a public forum. In this very general sense it was not unlike the modern U.S. legal system where plaintiffs and defendants present their cases in a public forum. Of course, the rules and procedures of the presentation, of which there are very many, differ from those days. Also, whether in a civil trial or a criminal trial, all parties can be represented by lawyers trained in the intricacies of these rules and procedures.

At these ancient Roman forums, both parties would present their cases to the forum and one party would be declared a winner. The party with the better presentation skills, regardless of innocence or guilt, would often prevail.

The modern system relies on the fact that attorneys representing the parties make the arguments rather than the parties themselves. The entire system relies on the assumption that lawyers, trained in law and skilled at presenting complex information, will present both parties’ cases in the best possible manner and that ultimately a just outcome will occur. I don’t want to say that the truth will prevail, not only because that’s a cliché but because there is often some amount of truth in the arguments of both parties. Rather, more often than not, justice will be served.

This model works very well—not perfectly, but very well. With regard to highly technical cases, however, the percentage of cases where justice is served is lower because the issues are difficult for judges and juries to grasp. Technical experts can throw around highly technical terms, sometimes without realizing it and other times to purposely confuse a judge or jury. This is why two things are required to improve the analysis of software for the legal system:

Create a standard method of quantizing software comparisons.
Create a standard methodology for using this quantization to reach a conclusion that is usable in a court of law.

These two things are embodied in what is called “software forensics.” Before we arrive at a working definition, let us look at the definitions of related terms: “forensic science,” “forensic engineering,” and “digital forensics.”

Click here to read more ...