ComputerForensicsDigest.com

A massive investigation by federal, state, and local law enforcement officials led to the arrest last week of Najibullah Zazi, 24, on charges that he was preparing to manufacture and use the same type of explosives used in the London subway bombings in 2005.

According to a memorandum filed in support of the government's motion for a permanent order of detention, Zazi received bomb-manufacturing training in Pakistan in 2008, and then returned to the United States (although Afghan-born, Zazi is a legal resident). He moved from his home in Queens, NY to Denver, Colorado, and over a period of several months, began acquiring the ingredients to make a powerful explosive called Triacetone Triperoxide (TATP).

As National Public Radio pointed out in a recent broadcast, the case illustrates the powerful surveillance and forensic tools now available to law enforcement officers. Following a tip from Pakistani officials that Zazi met with al-Qaeda operatives during his time in Pakistan, federal agents applied for and received a roving wiretap warrant, a new type of warrant authorized under the Foreign Intelligence Surveillance Act that allows investigators to track all of a suspect's communications, regardless of what method--landline, cellphone, text message, email, etc.--is actually used.

Through that wiretap, agents learned that Zazi was actively seeking bomb-making advice from unnamed individuals, and was actively searching himself for the necessary components. The government says that it has receipts and store surveillance footage of Zazi purchasing the types of products that are commonly used to make TATP.

Zazi traveled back to Queens in early September, in part to look for additional ingredients. While he was there, the FBI had his car towed and executed a new Patriot Act procedure, the "sneak and peek," in which agents minuted examined the contents of Zazi's car for possible evidence. Among the contents was Zazi's laptop; agents removed the hard drive, mirrored it, and then returned everything to where they found it.

On the hard drive was a variety of electronic evidence, including searches for bomb components and jpegs of handwritten notes on bomb-making procedures (allegedly emailed by Zazi to himself from Pakistan). When Zazi returned to Colorado, authorities there obtained a search warrant for his residence and seized the laptop a second time. But Zazi apparently suspected something, because the hard drive in the laptop at the time did not match the mirror image created by federal agents in New York.

The full extent of the government's forensic efforts will probably not be revealed until trial, and even then, some techniques may remian dark. Nonetheless, the early proceedings amply demonstrate the powerful resources available to law enforcement, and the increased rapidity with which those tools can be brought to bear on a particular investigative target.