Federal Bureau of Investigation, Room 6875 JEH-FBI Building, 10th & Pennsylvania Ave., N.W., Washington, D.C. 20535

A -- FORENSIC RECOGNITION, ANALYSIS, AND TECHNOLOGIES FOR COMPUTER BASED SYSTEMS POC Kenton D. Jenkins, Contract Specialist, (202) 324-5725. BROAD AGENCY ANNOUNCEMENT: The Federal Bureau of Investigation (FBI) is soliciting proposals in two broad areas of forensic computer science in support of the FBI's Computer Analysis and Response Team (CART) in the FBI Laboratory. Proposal Abstracts are desired in one or both areas: I) Technology Development in the area of Computer Forensics - DUE 7/8/95; II) Studies, Plans, Evaluations, Modeling, and Simulation of Computer Forensic Technology - DUE 7/15/95. DESCRIPTION: I) Technology Development in the area of Computer Forensics: Proposal abstracts are desired for all or portions of the design and development of a comprehensive forensic examination system for computers and computer media. This system is expected to consist of the following three major components: 1) forensic analysis utilities, 2) media recognition tools, and 3) graphically oriented user interface software integrating various tools and utilities into a single, workflow-oriented Automated Computer Examination System (ACES). 1) The forensic analysis utilities will be used to examine and analyze computer evidence which includes, but is not limited to, many different types of computers and operating systems and various types of storage media. These utilities must be able to execute in a stand-alone environment and as part of an integrated, menu-driven examination system. Developers will design, build, test and document forensic examination utilities. Some of the functionality will be directed by the FBI and some will be developer initiated. Computer related evidence is encountered on all known operating systems. However, special emphasis should be given to Winows NT/NTAS, Netware 3.x/4.x, UNIX, and MacOS. Typical examination utilities include, but are not limited to, software to prevent writing to computer disks (write blockers); text string search programs; software providing comprehensive file listings that include filenames, date-time stamps and attributes; data extraction utilities for free space, slack space and reserved space; and tools to locate and recover deleted files. Advanced examination utilities include, but are not limited to, swap file analysis; linking file fragments with the appropriate application software; file system reconstruction; and decryption. 2) The media recognition utilities will be used in the forensic examination of computer evidence. Given a piece of magnetic or digital media, these utilities should identify the software used to populate the media. Magnetic and digital media include, but are not limited to, hard disks, floppy disks, magnetic tapes, flash memory, and magneto-optical drives. Special emphasis should be given to magnetic tapes. These utilities must be able to execute in a stand-alone environment and as part of an integrated, menu-driven examination system. CART often receives computer evidence (e.g., reel-to-reel tapes, floppies, QIC tapes, etc.) without any indication of what software was used to create and populate the media. Media recognition utilities must identify the environment used to create the media, so it can be replicated in the laboratory. This may include, but is not limited to, the type and version of the operating system, backup software used, and compression method used (if any). Proposed solutions may include both software and any specialized hardware. It is important that utilities be designed to allow for future modification to support new software packages and new releases of existing software. 3) Development of software to integrate the analysis utilities developed is necessary for fast reliable and comprehensive analysis of computer evidence. This component of ACES will be the user interface to all developed tools and utilities. This component should use a graphical user interface (GUI), be menu driven, capable of including any or all tools and utilities appropriate to a given examination, and maintain audit trail information on the actions of the examiner and results of all examination utilities. The audit trail information should be maintained in a form that will allow for gathering and analyzing statistical information about computer examinations. II) Studies, Plans, Evaluations, Modeling, and Simulation of Computer Forensic Technology: Proposal abstracts are being solicited to provide studies, plans, evaluations, modeling, or simulation related to the area of forensic computer science. These studies should provide an evaluation of current or emergent technological capabilities that would allow significant advances in forensic computer science technologies, such as the area of computer identification of humans for any given computer graphic file or recognition and evaluation of encrypted data. PROPOSAL ABSTRACT: Joint industry-academia proposals, collaborative efforts, and teaming are encouraged. This announcement constitutes a Broad Agency Announcement (BAA) as contemplated in the FAR 6.102(d)(2)(i). Offerors responding to Section I should provide three (3) hard copies and one soft copy on a 3.5'' floppy disk in Wordperfect 5.1 or higher of a proposal abstract by 7/8/95. Offerors responding to Section II should provide three (3) hard copies and one soft copy on a 3.5'' floppy disk in Wordperfect 5.1 or higher of a proposal abstract by 7/15/95. Abstracts shall be submitted in the following format: A) 8.5 x 11 inches, single or double spaced, in at least ten point type; B) Title Page - Clearly Labeled ''PROPOSAL ABSTRACT'', including the section title, plus the Offeror's Administrative and Technical Points of Contact along with telephone and facsimile numbers, and signed by an authorized officer; C) Summary (five single-sided pages maximum) to include: technical ideas proposed and their anticipated contribution to enhanced forensic computer science technologies, anticipated deliverables and total estimated cost. Offerors should submit abstracts (original, two copies, and floppy disk) to: FBI, Contract Review Unit, Attn: Mr. Kenton D. Jenkins, Room 6875, 10th & Pennsylvania Avenue, NW, Washington, DC 20535. NO FAX OR E-MAIL ABSTRACTS WILL BE ACCEPTED. The FBI intends to respond to abstracts within seven (7) days of receipt, providing an assessment of the likely viability of a full proposal. This procedure is intended to minimize unnecessary effort in proposal preparation and review. Those proposal abstracts found to be consistent with the intent of the BAA and of interest to the Government may be invited to submit a technical and cost proposal. Complete instructions for proposal preparation and submission will be forwarded with any proposal invitation. The FBI anticipates that initial contractor selections will be made during the fourth quarter of Fiscal Year 1995. Section I: Proposals should be structured as multi-phased projects with each phase lasting six months and may include multiple year phased options that extend beyond the initial six month period. Present planning is that up to $1 million may be made available to fund the first year efforts in response to this announcement. Out-year funding has not yet been defined. Depending on the amount of work proposed on elements 1, 2, and 3 of section I, multiple cost-plus-fixed fee contracts may be awarded as a result of this BAA. Section II: Prposals should be structured as multi-phased projects with each phase lasting six months and may include multiple year phased options that extend beyond the initial six month period. Present planning is that up to $200K may be made available to fund the first year efforts in response to this announcement. Out-year funding has not yet been defined. Multiple cost-plus-fixed fee contracts may be awarded as a result of this BAA. EVALUATION CRITERIA: Sources for research and development will be selected by a formal technical/scientific/business decision review process. A diverse range of expertise in areas such as computer science, foresic science, software applications (i.e., databases, spreadsheets, word processors, accounting and financial systems), operating systems (i.e., UNIX, OS/2, Windows NT, Macintosh, etc.), cryptographic (i.e., software encryption systems), compression and decompression algorithms, security products, and computer networks is required for the ACES project. It is anticipated that the collective pool of all selected proposals will provide representative sampling of that diverse range of expertise. Individual proposal evaluations will be based on acceptability or unacceptability without regard to other proposals submitted under this announcement. Selected proposals may not be funded due to bugetary constraints and the need to construct a balanced program meeting the FBI's needs. The evaluation criteria are listed in descending order of relative importance: 1) Relevance of the effort to the CART mission; 2) Overall scientific and technical merit of the proposal abstract; 3) Compatibility with the ''ACES Program Description'' document; 4) Qualifications, capabilities, and experience of the proposed team leader and key personnel who are critical to achieving the proposal objective; 5) Technical creativity; 6) The offeror's qualifications, capabilities, and experience in related technical areas; 7) The offeror's facilities and demonstrated ability for achieving the proposal objectives. This will include the ability (either in-house, through subcontract, or throuh industrial affiliates) of design and manufacturing tools appropriate to the proposal; 8) Cost realism and amount of the proposed cost and cost sharing. ADMINISTRATIVE ISSUES: This CBD notice itself constitutes a Broad Agency Announcement as contemplated in FAR 6.102(d). Unless otherwise stated herein, no additional written information is available, nor will a formal Request for Proposals (RFP) or other solicitation regarding this announcement be issued. Requests for the same will be disregarded. The Government reserves the right to select for award all, some, or none of the proposal abstracts and subsequent proposals received in response to this announcement. All responsible sources capable of satisfying the Government's needs may submit a proposal abstract which shall be considered by the FBI. Proposals selected for funding may result in a contract or other agreement depending upon the nature of the proposed work. While no portions of this BAA will be set aside for Historically Black Colleges or Universities (HBCU) and Minority Institutions (MI) participation due to the impracticability of reserving discrete or severable areas of research in advanced computing systems for the exclusive competition among these entities, HBCUs and MIs are encouraged to submit proposal abstracts and join other organizations in submitting proposal abstracts. Offerors may submit separate proposal abstracts on any or all of the specified areas of interest. DO NOT SEND FULL PROPOSALS AT THIS TIME. Proposal invitations to prospective offerors may be issued only after FBI review of the offeror abstract proposal. It is the policy of the FBI to treat all proposals and abstracts as competitive information and to disclose the contents only for the purposes of evaluation. Offerors must be able to certify that they have, or can obtain, a TOP SECRET facility clearance, and key personnel must be certified as holding, or can obtain, a TOP SECRET clearance if the proposed work requires access to classified material or the FBI Headquarters Building. Questions of a technical or contractual nature should be addressed in writing and forwarded to the following at the address for receipt of proposal abstracts: Mr. Kenton D. Jenkins, (202) 324-5725, FAX (202) 324-6641. (0160)

Loren Data Corp. http://www.ld.com (SYN# 0001 19950612\A-0001.SOL)