Webinar: Accelerating Investigations Using Advanced eDiscovery Techniques

Join this free webinar from Nuix to find out how to deal with large volumes of electronic evidence while balancing business demands including reduced budgets and resources, spiralling case backlogs and ever decreasing timescales.

Date: Thursday March 6, 2014
Time: 4:00pm-5:00pm GMT/11:00am-12:00pm ET
Duration: 45min + Q&A
Presenters: Paul Slater, Director of Forensic Solutions EMEA and Ady Cassidy, Director of Investigation Solution Consultancy - Global

Today, investigators face a constant battle to find the truth in ever larger, more varied and increasingly complex stores of electronic evidence. As the growing volume of data has stretched traditional forensic tools to capacity, it has become more difficult to examine everything in deep forensic detail. To improve the efficiency of investigations we need to more effectively zoom in on critical data from the outset, and then focus the time-consuming deep forensic analysis on this data only. This webinar will share workflows and techniques from the legal world of electronic discovery (eDiscovery), which typically has even larger volumes of digital evidence than found in forensic investigations.

Register now at http://info.nuix.com/InvestigationsMar62014_Registration.html

Interview with Andrew Rector, Digital Forensics Student, Bloomsburg University

Andrew, you’re currently studying Digital Forensics at Bloomsburg University. Could you tell us more about the course and what drew you to it?

Digital Forensics is the acquisition and analysis of any digital medium for the purpose of finding and reporting evidence to Government agencies, police, and/or private contractors. At Bloomsburg University we are taught first to have a low-level understanding of what we will be looking at (Binary/Hexadecimal, File System Analysis, and Windows Artifacts), and then we are taught how to use our skills to do real Forensics cases using the prevalent Digital Forensics tools (FTK, EnCase, X-Ways). What really drew me to Digital Forensics the most was the investigative mindset you have to have. When you are doing a case, it’s almost like a chess match between you and the “bad guy”. For me, that’s very exciting, every case is different, and has its own brand of excitement.

You’re also Lab Manager at the Pennsylvania Center for Digital Forensics, doing research on GPS devices and mobile telephones. How did you become interested in this area and what can you tell us about your research?

Cell phones and GPS devices were one of my first major areas of research. They interest me a lot because of the challenge they present, cell phones especially. Forensically analyzing a phone is completely different than analyzing a HDD (Hard Disk Drive). For one, the sheer volume of types of phones make it a challenge, not to mention the different operating systems on each one. Each phone is a new challenge. One of my most exciting research projects with the PACDF was the analysis of a Garmin Nuvi GPS. By analyzing the Garmin forensically, I was able to completely retrace a person’s whereabouts, down to the exact time, date, and location. It’s really very amazing the data that can be found on those types of devices...

Read More

Forensic Software in Child Protection Cases

According to recently released statistics from ICAC, an agency whose aim is to make the internet safer for children, only 2% of reported child protection cases are investigated in the United States each year. Often the media seize every opportunity to disparage forensics organisations, child protection charities and law enforcement agencies for not coming up with more effective solutions to these cases, but the reality is that the investigation of illicit image distribution is a wide-ranging and complex area, fraught with difficulties.

Digital forensics professionals will undoubtedly come across such cases as part of their general workload. Sometimes a case will begin with an investigator specifically looking for suspicious images, whilst at other times the illicit nature of the images will be discovered in the course of an unrelated process. Regardless of the initial push, however, it is undoubtedly one of the most taxing and time-consuming parts of the job.

Internet Watch Foundation – on the frontline

The Internet Watch Foundation in the UK understands the issues around child protection investigation better than most. The IWF fields reports from the public about illicit imagery around the internet, and has been dealing with potentially criminal internet content since 1997. The organisation receives around forty thousand submissions per year, and manages to deal with around ten thousand of these...

Read More

Webinar: Geolocation Artifacts and Timeline Analysis in Digital Forensics

Using Geolocation Artifacts and Timeline Analysis to Solve the Case: A Digital Forensics Case Study

http://info.magnetforensics.com/Digital-Forensics-Case-Study-Webinar/

Date: Wednesday December 11, 2013
Time: 11:00am GMT (6:00am EST)
Duration: 60 mins

In this webinar, Jad Saliba of Magnet Forensics will take you through a fictional case study involving child luring that led to murder. You will discover how digital forensics, geolocation artifacts and timeline analysis in particular can be critical in solving cases like these and where you can look to find the artifacts. The data analyzed will include a PC image and a mobile device image, showing how both sources of evidence can provide valuable insight into what happened, where to start a search for a missing person, and the corroborating evidence to support criminal charges.

REGISTER TODAY HERE

Please share this invitation with any friends or colleagues who might also be interested, thank you.

ForGe – Computer Forensic Test Image Generator

by Hannu Visti

Creating test material for computer forensic teaching or tool testing purposes has been a known problem. I encountered the issue in my studies of Computer Forensics at the University of Westminster. We were assigned a task to compare computer forensic tools and report results. Having already analysed test images by Brian Carrier (http://dftt.sourceforge.net) over and over again, I found myself creating images manually, which appears to be the best and only way of doing this. One of my lecturers, Sean Tohill, confirmed this is indeed the case and a test image generator is long overdue.

The need for such a tool is twofold. In educational setting, the problem of plagiarism can be mitigated by giving each student an individual image to analyse. In application quality testing, one of the tests should be to feed several similar but not identical images to the forensic tool, and compare results, which should be identical...


http://articles.forensicfocus.com/2013/10/18/forge-computer-forensic-test-image-generator/

Interview with Carole Phillips, Trustee, BulliesOut

Carole, you're currently a trustee for BulliesOut. How did you become involved with the charity?

I first heard of BulliesOut through being involved in the charity Children in Wales and contacted the CEO, Linda James, via LinkedIn. We met as I was interested in what the charity did and what involvement the charity had with schools and other professionals working with young people. I was impressed with the dedication of Linda and her desire to get the message out there to young people that no-one has to put up with bullying. The charity looks at all aspects of bullying, working with the bully as well as the victim and also the bystanders who have a crucial role to play. BulliesOut operates in other countries as well as the UK but it was encouraging to learn that it is a Wales based charity and one that is well respected. I was asked to become a Trustee, and although I was not sure what being a Trustee involved, I was happy to join the team. I promote the charity as much as I can with other professionals and young people and although my time is limited due to working full-time and my University studies, I do what I can.

There has been increased coverage of cyber bullying in the media recently. How large a problem is cyber bullying? Is it really growing as fast as the media seem to suggest?

When the tragic deaths of young people such as Hannah Smith and Daniel Perry hit the headlines, the spotlight is rightly focused on social networking sites and how bad they are and what can be done to prevent further deaths. Because of the publicity, it appears that all of a sudden social media has become a problem, yet the truth is that concerns about young people inappropriately using social networking sites have never gone away. Schools can vouch for this in the increased number of incidents they deal with; almost always at the centre of bullying incidents is a social network site or messaging service such as Ask.fm. As was the case in the summer with Ask.fm, there was a public outcry to get the site closed down, but this is not the answer. Whilst publicity about messaging services pushes for stricter monitoring and moderation and to take more responsibility for the care of its primarily young users, educating young people about their behaviour online is vital in driving home the message about safer use...

http://www.forensicfocus.com/c/aid=67/interviews/2013/carole-phillips-trustee-bulliesout/

Interview with John Huperetes, Senior Forensics Instructor

John Huperetes is a sub-contractor to the US Department of Defense and any views herein do not represent those of his contractor or of the DoD.

John, please tell us about your current role.

I am contracted to be "senior forensics instructor" and assist in developing and delivering cyber investigation training courses for DoD organizations, Defense Criminal Investigative Organizations (DCIO), military counterintelligence agencies, and law enforcement organizations.

This gives me the opportunity to review and sometimes experiment with bleeding edge digital forensics, and transfer the acquired knowledge to others.

I started off tinkering with electronics at a very early age. I was much better at shredding electronics than putting them back together. I moved to programming, first for processors, memory and controllers, thereafter databases and finally networks. A few consulting stints and I shifted to security permanently.

Incident response in security naturally pushes into forensics. A few more permanent and consulting jobs, and about a decade ago I took a job with a large financial firm working on forensics.

I got a call from a contractor for my current job, and that is how I ended up here.

What is the most challenging thing about your job? What do you find the most enjoyable?

The most challenging part of my job is always having an open mind toward new techniques and ideas. It is not just a time consuming but also an exhausting process. It is not unusual in our field to learn something, just to later discover that there are caveats galore! I enjoy the camaraderie of the experts, instructors and students, and the new discoveries I get to make...

http://www.forensicfocus.com/c/aid=66/interviews/2013/john-huperetes-senior-forensics-instructor/

Interview with Benjamin Fung, Associate Professor, McGill University

Benjamin, you're an Associate Professor of Information Studies at McGill University - can you tell us more about the role and how you entered academia?

Certainly. As you say, I am currently an Associate Professor of Information Studies at McGill University and previously was an Associate Professor of Information Systems Engineering at Concordia University. I am particularly interested in developing new, scalable data mining methods for privacy protection and crime investigation.

In 2003, after working in the software industry for four years, I noticed there was a need for scalable data mining methods. As a result, I resigned from my job at SAP Business Objects and studied a Ph.D. in computing science, specializing in data mining, at Simon Fraser University. Recently, there is a hot research topic called "big data", but data miners have been working on "big data" for more than 20 years already.

Your research focuses on designing intelligent systems for the purpose of crime investigation. How did you become interested in these topics?

After joining the Computer Security team at Concordia in 2007, I had a lot of opportunities to interact with different law enforcement units in Canada. In the meetings, I found that there is a big gap between the state-of-the-art data mining methods in the literature and the current software tools used by law enforcement officers. A lot of important evidence can be collected from the suspects' digital devices, from laptops to smart phones. The challenge is how to efficiently retrieve the relevant information from such a large volume of (unstructured) textual data...

http://www.forensicfocus.com/c/aid=64/interviews/2013/benjamin-fung-associate-professor-mcgill-university/

Forensic Focus Forum Round-Up

How much does having a disability affect working in forensics? Chime in on the forum.

Are Facebook private messages retrievable?

Forum members discuss the best way to clean flash drives.

To triage or not to triage? That is the question.

Convicted murderer Bradley Cooper has been granted a retrial following accusations of a judge holding back testimony concerning Google maps.

Forum members discuss verification of ATA to USB bridges on hard drives of more than 2TB.

Interview with Jacopo (forum member 'jaclaz')

Jacopo, you’re an active member of the Forensic Focus forums. How did you become interested in digital forensics?

My interests are oriented towards OS booting, filesystems and data recovery. These fields are of course closely linked to digital forensics.

I was one of those kids that disassembled things to see what was inside them and understand how they worked (and I even managed to reassemble a few items properly!) Computers have been a hobby since the time I built (some of the readers may be old enough to remember the good ol'times) my first computer, a Sinclair ZX-80, and more generally I have been always interested in any kind of technology. If the term had been already invented at the time I could have easily been defined as a "geek".

Then, in my professional life, I had a few occasions to find what I call "the IT wall". At least here in Italy in the years when computers entered the corporate world there was an abundance of a particular kind of IT guy, that took advantage of the fact that no one else was familiar with the way computers worked and either provided answers like "it is not possible" or "you can't do that", or "well, we will need to hire a professional programmer and it will take 6 months to have that". Due to some peculiarities of my character, "it is impossible" or "you can't do that" are like magic words to induce me to prove that it is actually possible and that I can do it (or at least find the actual reason why something is impossible). On a couple of occasions it happened that everything that was needed to create a Work Progress Report was somehow stuck in a corrupt hard disk or in a program database that went astray. Due to Murphy's Law these events normally happened on Saturdays or during the holiday periods, and something needed to be done, and quickly, and most probably with the help of some luck and ingenuity, I was able to recover the hard disk contents or rebuild the broken database, etc. This made me take an interest in the field, and since then I studied a bit more in this niche...

http://www.forensicfocus.com/c/aid=65/interviews/2013/jacopo-forum-member-jaclaz/

Interview with Robert Bond, Product Marketing Manager, Guidance Software

Robert, please tell us a little about yourself and your role at Guidance Software

I’m the new Product Marketing Manager of Forensic Solutions which includes EnCase Forensic, Encase Portable and Tableau products.

I have been in marketing for over 15 years with technology brands like Hewlett Packard, Kodak, and most recently in e-Discovery with Ricoh Legal.

Version 7 of EnCase introduced significant changes, the reaction to some of which was mixed within the forensic community. What kind of feedback did you receive from users?

For our customers who have been using EnCase, the new look of Version 7 was a bit of a transition and took some adjustment. For new users however, the interface is similar to the look and feel of other popular programs so we’ve seen the learning curve for users new to the software become shorter.

From a customer experience perspective, Guidance marketing and technical support has provided webinars and other tools to assist users in making a smooth transition. We believe their investment in getting comfortable with the new interface will increase their efficiency.

Further, as we have upgraded the software culminating with Version 7.05; we are learning that the increased speed of processing data and several of the new features including prioritized processing are dramatically helping our customers increase their productivity...

Read more

Internet Evidence Finder (IEF) review

Reviewed by BitHead (discussion thread here).

When this review started at the beginning of August 2012, Internet Evidence Finder (IEF) was a project of Jad Saliba of JADSoftware. At that time the version was 5.41.

The interface was simple, and IEF was an easy to use tool that found a lot of artifacts and displayed them in an easy to follow report.

In the middle of August I was contacted by Adam Belsher of JADSoftware and told there was going to be a few major changes coming to JADSoftware. A week later Saliba announced “JADsoftware has a new identity, including a new company name – Magnet Forensics.”

In his first blog post on the Magnet Forensics site, Saliba wrote, “A lot has changed since I launched JADsoftware and first developed Internet Evidence Finder (or IEF) while working as a police officer and forensic examiner. After a couple of years juggling both jobs, I realized IEF had enormous potential to help you perform better investigations, so I decided to dedicate myself to developing the software full-time. The growth the company has experienced since then has exceeded my highest expectations.”

And there were a lot more changes than just the name...

Read more

Interview with Eddie Sheehy, CEO, Nuix

Eddie, can you tell us something about your background and your current role as CEO of Nuix?

I joined Nuix as CEO in 2006 after working for quite a few high-growth finance and technology businesses. What I loved about Nuix was the precise detail the software could expose about the information it indexed. Having that degree of detail at scale could make a huge difference to the way an investigation played out.

After about a year with Nuix, it became clear to me we couldn’t take on Access Data and Guidance directly –they owned the forensic investigation market. So we expanded into eDiscovery, and later information governance, as a way of growing the business. In 2011, having reached a more tenable scale, we decided to go back into investigations. That has been one of the most satisfying aspects of my time at Nuix.

What products and solutions does Nuix offer?

Nuix offers products and solutions for forensic investigation, eDiscovery and information governance. There’s a fair amount of overlap between those categories, for instance our Enterprise Collection Center technology for gathering evidence in the field is used by investigators and for eDiscovery and our processing engine underpins all three verticals.

Indeed, at the heart of these products is our patent pending unstructured data indexing engine. The Nuix engine has unique load balancing, fault tolerance and intelligent processing technologies that enable it to process huge volumes of unstructured data at high speed and with forensic certainty...

Read more

Interview with Jonathan Krause, Managing Director, First Response

Jonathan, we last interviewed you back in 2008, what have you been doing since then?

In early 2008 I started Forensic Control after four years as a computer forensic employee. It began as a vehicle for my contract work but soon developed into a business in its own right, becoming relatively well known – albeit within the fairly small world of computer forensics! I moved further and further away from my roots in public sector work, and found myself really enjoying the faster pace and challenges in the corporate world; there was no going back for me. During this time I was fortunate enough to work on some very interesting cases including the Deepwater Horizon oil spill and the estate of Elvis Presley.

You recently became the Managing Director of First Response. Tell us more about the company and your involvement.

First Response was set up in January 2012, and at present is being run alongside Forensic Control. There are three joint owners of the company; myself, John Douglas and Bill Lindley. John (the Operations Director), Bill (the Chairman) and I bring together over 30 years’ experience of working in the industry. We decided to bring the forensic operations of our separate companies under one roof which was a natural progression for each of our companies. We think we complement each other very well! There’s some more background on First Response in the recent Forensic Focus news item.

I’ve known Bill and John professionally and socially for years; as well as offering what we believe is a first-class service, we enjoy our work and enjoy working with each other – for me, this is of fundamental importance.

In terms of my involvement, I’m a typical managing director/CEO though with a very much hands-on role. You’re as likely to find me imaging an unusual server configuration, analysing the content and reporting back to the client as much as dealing with the behind scenes management.

Can you give us some recent examples of cases First Response has worked on?

Sure. I think First Response’s main strength is in having both a great technical depth and an ability to communicate complex matters in a way that an average lawyer or director can easily understand and then act on. This helps our clients tremendously as it did in the two examples of cases I'll outline...

Read more

Webinar (online now): Pitfalls of Interpreting Forensic Artifacts in the Windows Registry

The webinar "Pitfalls of Interpreting Forensic Artifacts in the Windows Registry" is now online here.

If you encounter any difficulties viewing the above page, the webinar is also available on YouTube here.

In this webinar, Jacky Fox, student at UCD School of Computer Science and Informatics, presents the results of her dissertation on Windows Registry reporting. Jacky will be available in this forum thread for about an hour to answer any questions.

Guidance Software Releases EnCase® Forensic v7.05

Guidance Software Inc. has announced the release of EnCase® Forensic version 7.05. This latest version of the industry-standard forensics software features key enhancements that enable investigators to work with data sets earlier and faster in order to both begin and close cases faster than ever before. Speed enhancements in the EnCase Forensic v7.05 evidence processor have reduced significantly the processing time for both small and large data sets. Digital investigators can now rapidly process evidence files of virtually unlimited size, dramatically reducing case backlogs. With EnCase Forensic v7.05, investigators can uncover evidence up to nine times faster than previous versions using the greatly enhanced evidence processor...

EnCase Forensic v7.05 also improves investigative efficiency by automating common investigation tasks and significantly reducing manual efforts. Prioritized processing lets users process an early subset of evidence and make it available more quickly for analysis by investigators. They can also choose to continue or to stop processing remaining evidence. Enhancements to the analytic capabilities of the product’s built-in Case Analyzer offer forensic examiners deeper insight into computer systems through higher-level reports on metadata and the ability to compare potentially related artifacts side-by-side. Examiners can establish hyperlinks to original documents and images within reports. In addition, the results of a keyword search can be viewed and analyzed while that search is ongoing...

Read more

Webinar: Pitfalls of Interpreting Forensic Artifacts in the Windows Registry

In this webinar, Jacky Fox, student at UCD School of Computer Science and Informatics, presents the results of her dissertation on Windows Registry reporting - focusing on automating correlation and interpretation. After the webinar Jacky will be available in the Forensic Focus webinars forum to answer any questions.

Date: Thursday, November 1st 2012
Time: 12PM (midday) EDT US / 4PM GMT UK / 5PM CET Europe
Duration: 20 mins

There is no need to register for this webinar, simply visit http://www.forensicfocus.com/webinars at the above time (the webinar has been pre-recorded and will be archived for viewing later if you are unable to attend)

Interview with Lindy Sheppard, F3 (First Forensic Forum) Secretary

Lindy, tell us something about the cases you have been involved in.

I have been involved in quite a variety of cases, from counter terrorism to the importation of drugs, fraud, missing children and sadly, far too often, the abuse of children. Working alongside Tony Sammes has meant that I have been involved in many high profile and often ground breaking cases. It has always been good to see the outcome of a trial in the news and feel a sense of satisfaction at a job well done. Although not working on the technical side of the industry I have been the link between Tony and the case officer and/or OIC in far more cases than I can number - I do know that I have handled well in excess of 600 exhibits...

Read more

Interview with Philip Anderson, Senior Lecturer at Northumbria University

Philip, can you tell us something about your background and why you decided to teach digital forensics?

I graduated from Northumbria University with a BSc (Hons) in Business Information Technology in 1997 and gained an MSc in Distance Education with Athabasca University, Canada by distance learning in 2008.

After I graduated I started working at Northumbria University in a number of different IT Support/Developer roles for different departments within Northumbria University before becoming a Lecturer in 2001. I started teaching programming and also web design and development modules. It was in 2004 and 2005 alongside colleagues that we developed the undergraduate Computer Forensic degree. Once validated and in its first year I naturally changed to teach computer forensic modules (and more) as the degree progressed.

I have over seven years’ extensive teaching experience involving Guidance Software (i.e. EnCase) in taught computer forensic modules. I have also successfully worked in the field, on a number of different forensic examinations of digital media for external clients, involving examination, analysis and production of extensive reports.

I was appointed a European Network and Information Security Agency (ENISA) expert in 2010 for two years for identifying emerging and future ICT risks in the area of Information Security Risk Assessment and Management. I also served as a Special Constable with Durham Constabulary for over 14 years.

For me, the reason I chose and enjoy teaching digital forensics is my computing background and the application of that knowledge in conjunction with strong investigative skills...

Read more

Windows 8 Forensics webinar - alternative URL

Sincere apologies to anyone having difficulty connecting to the Meetingburner service to view the Windows 8 Forensics presentation - please try the following URL on YouTube instead:

http://youtu.be/uhCooEz9FQs

Josh is available in the webinars forum to answer any questions. Please go here if you would like to join in the discussion.

Additionally, a PDF with slides from the presentation can be downloaded here.

I will get these gremlins out of the system soon, I promise!

Jamie