How CaseScan is Transforming CSAM Forensics: Real Stories from the Field

In the battle against child exploitation and human trafficking, digital forensics is crucial. Law enforcement officers often have to sift through hundreds of thousands of media files to find child sexual abuse material (CSAM) and related files. The priority is always to find new production of CSAM. Still, traditional hash matching won't find new files, so AI CSAM classifiers are the only way to automate this process effectively. Enter CaseScan by Netspark—a tool that's changing the game. Several professionals, including Detective Jerod Lecher from the Manitowoc Police Department, an unnamed digital forensics examiner from a state police agency, and Ana Fields from the University of Alabama, have shared their experiences with this innovative tool.

Discovering CaseScan

Detective Jerod Lecher first saw CaseScan at the Wisconsin ICAC conference. With over 20 years of service, including 12 years in the Internet Crimes Against Children (ICAC) task force, Lecher has seen his share of disappointing AI tools. Initially skeptical, he dug deeper into CaseScan and was pleasantly surprised by its efficiency and time-saving capabilities. “Every AI tool I’ve ever tried to use has been mostly useless,” Lecher admitted. “But something about CaseScan caught my eye. I went back the next day with hard questions. How can this thing be great when it’s all AI?” He received answers that intrigued him enough to give it a try.

Ana Fields, a forensic analyst with the University of Alabama Police Department’s REACT Team, tested CaseScan after a colleague set up a demo. Used to trying out new products regularly, Fields was impressed by how CaseScan performed, especially its on-scene triage capability and ease of use. “Your tool does what it says it does,” she said. “I’ve sat through so many demos where everything works perfectly and then we test it and it’s nowhere near as easy or effective. But CaseScan was quick and easy.”

An unnamed digital forensics examiner from a state police agency also tested CaseScan. Despite initial doubts, the examiner found CaseScan to be highly accurate and efficient, effectively filtering out irrelevant data and highlighting critical evidence. “I was skeptical at first, but after running it against a couple of cases I had done manually with Griffeye, I was impressed,” he shared. “CaseScan only missed 9 or 10 files out of 5000, and there were some false positives, but I’d rather see everything than miss stuff.”

Putting CaseScan to the Test

Lecher ran several terabytes of data through CaseScan and found that tasks that used to take 6-8 hours were now done in under an hour. "The amount of time it saves is incredible," he shared. “I ran it through several cases that I had run through other tools, and where it took me 6-8 hours to process and sort, with CaseScan all that was done in under an hour.”

Fields noted that CaseScan processed data in just a few hours which previously took her team several days to handle. She highlighted the tool’s ability to quickly identify crucial evidence without going through thousands of irrelevant images. “Not having to go through tens to hundreds of thousands of images and finding the material we are looking for right up front is critical. I have never used a tool that could do what CaseScan does,” Fields said.

The unnamed examiner tested CaseScan against other tools and found it very accurate, with only a few missed files out of 5000. The examiner appreciated CaseScan’s ability to detect CSAM even better than traditional HashSet methods. “CaseScan does all the dirty work, filters all the garbage out, and brings out the material we are interested in. Whereas before it might take us a week to go through a device, now with CaseScan we can do it in less than a day.”

Benefits of CaseScan

One of the best features of CaseScan, according to Lecher, is how quickly it identifies devices with evidence, allowing him to focus on the important ones right away. He also praised its low computer processing demands and its ability to tell apart regular family photos from CSAM. “It helps figure out quickly which devices have evidence. It allows me to focus on the important devices within a short amount of time rather than spending two days,” Lecher said.

Fields found CaseScan invaluable for on-scene triage, enabling her to identify crucial evidence quickly and efficiently. She plans to use it regularly for search warrants and on-scene investigations. Fields was also impressed by the product’s pricing, considering its capabilities. “I was stunned at the pricing for how good the product is. The ability to speed up the processing and see evidence right away is invaluable,” she shared.

The unnamed examiner highlighted the time savings and reduced stress thanks to CaseScan. The tool’s accuracy and efficiency allowed the examiner to process cases much faster than traditional methods. “I’ve found it to be very accurate. I don’t worry about it missing stuff and that is less stress and pressure,” he said. They also praised Netspark’s customer service and responsiveness to feedback. “Customer service has been great. They are very good about answering our questions and issues.”

Areas for Improvement

Lecher mentioned that while CaseScan is highly effective, its workflow and interface could use some improvement. However, he appreciated Netspark’s willingness to listen to feedback and make necessary changes. “The workflow needs a better interface. I am providing feedback and they are very amenable to it,” he noted. Fields and the unnamed examiner shared similar sentiments about the company’s commitment to improving the tool.

Adoption and Future Use

Detective Lecher has already bought a CaseScan license and plans to use it actively in new cases, both for triaging mobile devices and full lab processing. He encourages others to try CaseScan, emphasizing that it exceeded his expectations. “Give it a try. My initial thoughts were that it’s too good to be true. If this does half of what they say it can do I’ll buy it. It does way more than that! I bought it.”

Fields plans to use CaseScan as much as possible, citing its ease of use and the company’s genuine support for law enforcement’s mission. “Ori and Yaron genuinely care about our mission. I had an issue and Ori was at a conference but immediately jumped on a call with me to get it figured out quickly. They are invested in our work and want to help law enforcement,” she shared. The unnamed examiner also recommended testing CaseScan on pre-processed cases to see its capabilities firsthand. “Test it on a case you have already processed and analyzed with other tools and compare it. I think you will be surprised that it works. I was very skeptical but this does everything they say it does.”

Final Thoughts

CaseScan by Netspark is proving to be a game-changer in digital forensics. It saves time, increases efficiency, and provides accurate results, making it an invaluable tool in the fight against child exploitation and human trafficking. While no tool is perfect, the experiences of these professionals highlight CaseScan’s potential to transform digital forensics and support the critical work of protecting children.