Hansken digital search engine continues to grow and develop

Hansken needs to develop continuously in order to remain forensically relevant. ‘Globally, many new apps and file formats appear every day. We are flooded with this kind of new digital traces. This new information also needs to find its way to Hansken. If it doesn’t, Hansken very quickly becomes obsolete’, says Hans Henseler, one of the organisers of the Hansken Community Days. He points out: ‘If we don’t innovate, we may still be able to analyse the traces of yesterday and the day before yesterday, but Hansken will no longer be up to date and able to deal with today’s traces.’

According to Henseler, while it is the NFI that developed Hansken, maintenance and expansion is really something that requires all Hansken users. ‘Hansken can only remain relevant if all parties using it keep the digital forensic knowledge up to date and add it to the search engine. This could be information about new file formats, for example of photos or word processors. Hansken needs to know those new formats to be able to find and read that information.’ In order to develop Hansken, Henseler believes it is important that people know each other. ‘If you want to feel responsible for Hansken together, there has to be a sense of a collective. That is why we began the Community Days.’ The first edition took place in December 2020.

Demo plug-ins

A demonstration of extraction plug-ins for (future) Hansken users was planned for Wednesday. ‘With a plug-in, users can link their own programs and tools to Hansken. This further expands the possibilities for Hansken users’, Bart Broere explains. He works for the NFI’s Forensic Big Data Analysis team and provided the demo, showing Hansken users how a plug-in like this one is developed.

Using an example, he illustrates the power of such a link. Broere: ‘Say the police confiscate a phone or a computer: of course, you want to retrieve as many traces as possible from it. Hansken already gives you a lot of information. But linking Hansken to tools and programs developed by the partners themselves allows you to get even more digital traces, such as photos or documents, from a phone or a computer.’ The more traces you recover, the more relevant this is to a forensic investigation. Thanks to a plug-in, a home-made program can be added to Hansken quickly.

‘Plug-ins are ideal’

According to organiser Hans Henseler, for now plug-ins are a fast way of allowing Hansken to meet the wishes and needs of its various users. ‘We could also make an entirely new version of Hansken each time, adapting everything to everyone’s wishes. But it’s just not doable to take everyone into account. That’s why these plug-ins are ideal. Moreover, users can also share them with each other.’

This online demonstration was open to current and potential new users of Hansken. Over eighty participants from various countries watched. ‘We got enthusiastic feedback during and after the demo. I believe a number of users have already gone to work on developing their own extraction plug-in’, says Broere.

Over a hundred (future) users of Hansken were present via Webex on Thursday. They were shown presentations, among others, by the European Anti-Fraud Office (OLAF) on the fight again international fraud and corruption. In addition, Zeno Geradts, professor by special appointment of Forensic Data Analysis at the University of Amsterdam and employed by the NFI, discussed scientific developments in the field of artificial intelligence and Hansken’s position in this. The police held a presentation about a real-life case and how they were able to solve it thanks in part to Hansken. The next Hansken Community Days are planned for the first week of July.