OCFA is a modular open-source computer forensics framework designed to automate the analysis of digital evidence in large-scale investigations. It was originally developed by the Dutch National Police Agency to manage the overwhelming volume of data from criminal cases.
Key Concepts & Architecture
- Message-Passing Concurrency: OCFA uses a message bus where specialized modules process evidence and pass results to others, enabling scalable, distributed processing across multiple machines.
- Recursive Processing: The system uses a router to automatically dissect compound files (archives, disk images, mailboxes) and extract embedded files until all possible information is derived and indexed.
- Backend Components: The framework runs on Linux and uses a PostgreSQL database for metadata, a Lucene index for full-text search, and content-addressable storage for efficient data storage.
Core Features & Workflow
- Automation: OCFA automates the analysis, saving investigators time by automatically identifying file types and extracting metadata.
- Integration: It integrates numerous existing open-source forensic tools as modules, including The Sleuth Kit, Scalpel, Photorec, antiword, and others.
- Two-Part Process: It splits the workflow into two stages: specialists extract content from devices, then investigators use a web interface to search and analyze the processed data.
- Hash Filtering: To reduce noise, it can integrate hash databases to identify and ignore known, irrelevant files like system files.
Important Notes & Current Status
- Discontinued: Development and official support by the Dutch National Police ended in 2012. The project is now considered archived.
- Limitations: The official graphical front-end was never open-sourced due to licensing issues.
- Legacy: While no longer maintained, OCFA pioneered many concepts in scalable forensic frameworks.
- Target Audience: OCFA was designed for professional, large-scale investigations within a law enforcement lab environment. It requires strong Linux, database, and forensic knowledge to install and operate.