So hopefully you guys are all here to see and listen to me talk about Alice and Bob.
So this is a talk that I've been very excited to put together.
I hope you get the Sherlock theme.
And I'll be watching you while we do this.
All right, so here's the agenda.
This talk, unlike a lot of forensics talks, will not focus on specific tooling.
So if you're here for, you know, real specific tooling, we'll talk about some tools.
But that's really not the focus.
That's not the purpose of this talk.
We're going to be focused more on the investigative process and breaking down those steps.
And we're going to look at the different areas and where things can go horribly wrong.
And we're going to do that in the context of a story.
So I'm going to tell you a story.
And hopefully you will participate a little bit in the story.
Don't worry, I'm not going to ask anything really challenging or complicated.
All right, so these are the sections of our agenda though.
So first a little bit about me.
I have been doing this sort of thing for a long time.
I've been with the University at Buffalo for 24 years.
And I speak at a lot of things.
And I help out with a lot of things.
And I run a lot of things.
And most importantly on this slide, I love sloths.
And that is my adopted sloth at the Buffalo Zoo.
His name is Flash.
So now let's focus on the investigative process, shall we?
First I want to talk a little bit about the difference between traditional and digital forensics.
There are a lot of folks that know the word forensics.
How many folks have watched like CSI or NCIS?
Anybody out there watch those shows?
Good, because you'll recognize some of the pictures at least that are in this talk.
So one of the things that I learned early on, so my background with regard to forensics is a little unusual.
I came into forensics because I became a firefighter .
And when I became a firefighter, I became very, very interested in fire investigation.
So my first dappling in forensics, if you will, was actually in fire investigation.
And that is really more traditional forensics.
When I made the jump to doing digital forensics, because I was already doing IT as my day job, the fire thing was on the side as a volunteer, what I ultimately determined was, and we were taught actually, one very important distinction between the two.
When you think about any of the kind of data that we are responsible for as digital forensicators, we are not allowed to alter it without very, very specific documentation.
You need to take a memory capture, you need to do something live, you better document the heck out of that and explain why you need to do it.
But in traditional forensics, check it out.
You want to do DNA?
You're destroying your evidence to do that.
It's very different.
It's a very different way of thinking about things.
So I think it's important to just keep that in mind.
Have to mention my man, Locard, right?
Who's heard of Locard before?
At least a few of you.
For those of you who have not, Locard, Edmund Locard, was really, he's really the father of forensics at this point.
There have been some other folks who did forensics before him, but he's really the person that brought this into contemporary forensics.
And this quote of his about leaving traces of his presence, this idea that, you know, anybody who comes into a crime scene, always going to leave something there and you're always going to take something away.
It's about this idea of trace.
Well, when we're talking about digital forensics, that is also true.
And in this case, it often involves logs.
All right, so now let's get into the investigative process.
You'll kind of see a pattern with this talk where each of these sections is going to break down into sort of little subsections.
And, you know, that'll give us a chance to examine each one more carefully.
So we start with a meeting of the minds, the scoping call.
Detective Olivia Hart sat in her dimly lit office, the soft glow of her desk lamp casting long shadows across the worn wooden surface.
The room was silent, save for the occasional creak of the floorboards beneath her feet.
She leaned back in her chair, running a hand over her tired eyes.
Her cell phone rang, shattering the eerie silence.
Detective, it's Captain Anderson.
We've gathered some members of the digital forensics team to assist us with this latest homicide.
The victim is Bob Byte.
See, I told you Bob would be in this.
The sound of shuffling papers filled the air as the team members began to take notes and prepare themselves for the investigation ahead.
The captain ran through the basics, the time of discovery, the initial observations, and the victim's identity.
Any leads, Hart asked, her voice cutting through the background noise on the line.
We're focused on Alice Askey.
See, I told you Alice would be in this.
We're currently interviewing friends and neighbors that they interacted with regularly.
So now we have a little bit of our scenario.
So in this stage of scoping, we have a number of goals.
And these are sort of your standard things you would, I would assume, even if you've watched things like CSI.
And of course, we all know that, you know, some of that is drastically fiction.
And some of it, in my experience, is real, but the time frames are completely out of whack.
Nobody does DNA in an hour.
Like, that's not a thing.
But some of the tools that we see really are legitimate, and they do what they claim to.
But during the scoping call, we're sitting down, we're having a conversation, we're going to get a summary, we're going to get a bunch of details about what happened, who those people are that were affected.
And ultimately, we're going to be told what the objectives are that the entity bringing us in, whether it's us coming in as folks who are, you know, working, just working with law enforcement, or if you're in law enforcement, you're being brought in, this is what's being requested.
So this is what you learn in that initial scoping call.
We know Bob's dead, right?
Think y'all got that?
Bob's dead.
He lived at 456 Central Avenue.
We find out he was discovered at 1201 a.m.
on February 13, 2022.
And his time of death is approximately three hours before he was discovered.
Initial reports suggest Bob was stabbed, and we know he had this pre-existing relationship of some kind with Alice Askey.
The police, in this early phone call with you, suggest they think, because they know a little bit about these individuals, that Alice went to Bob's house, she's the one that killed him, and you've been asked to investigate the relevant digital equipment and determine Alice's involvement.
So these are the initial objectives, as we just more or less covered them.
They want you to analyze the data and the evidence that you're given, and they want you to prove Alice killed Bob.
And they want to know why she killed Bob.
Now, I put this out to the audience.
Are these good questions for forensics?
No.
These are terrible questions.
So... what?
The real questions, yes.
So these are terrible questions.
And so what this brings out, and the point of this, is we have challenges with the scoping call, right?
So during this particular section, there's a lot of open-ended questions.
Why did somebody do something?
Questions that are not meant for digital forensics.
Why and who?
Terrible questions for digital forensics.
And we'll see why as we sort of progress through this.
We also see something about assumptions, right?
Do we not see that the police are making an assumption, Alice killed Bob.
Is that a good thing, again, with anything in forensics?
No, it's not.
But I would ask you, can you always be 100% objective in your investigation?
Nope, you can't be 100% objective.
You're always going to have some skew, whether it's something you're told, something you see, experiences you've had.
So the lens that you're going to have that challenge.
And so you're going to have assumptions, whether or not you intend to.
You need to take a step back and kind of think about that when you go to figure out what your objectives are, and whether something about what you're being asked to do is somehow problematic because of that.
There are also some other issues, right?
Time frames could be unrealistic.
The scope could be way too large for that time frame.
There could be issues with what you're able to recover.
Sometimes recovery is only as good as the tool set you have, so maybe that's just not even possible.
And you could get incomplete requests.
A great example of an incomplete request is, I would like the chat data from this phone.
What does that mean?
Well, to some people, it might mean give me all the SMS data.
Okay, what about the other messaging apps like Facebook Messenger, right?
WhatsApp.
Pick your favorite messaging thing.
So it is not uncommon for somebody to specifically say, I want Messenger, I want Facebook Messenger, all the Facebook Messenger, but what they really mean is, I want every form of communication you have.
So don't hesitate to ask those questions.
So based on the fact that we have these problems, we want to revise those objectives, and that's part of the scoping call.
So they come to you and say, we want you to do this, and you push back at them and say, you know, this is really not what forensics is meant to do.
This is, you know, beyond the limitations of what we can handle.
So these are the objectives that you've all agreed that will get them what they want.
So is there activity on their devices around that time of death?
Is there, you know, anything to indicate a person involved, regardless of who it is?
And, you know, relevant digital communication from any of these things, right?
A little more broad, a little less skewed, so that is a much better set of objectives.
All right, so now that we know what we're doing, we move to the data gathering stage.
The forensic team sprang into action, setting up their equipment and connecting cables to Bob's laptop.
One technician began the process of creating a forensic image, while another meticulously documented every step, ensuring the integrity of the evidence.
Meanwhile, Detective Hart scanned the room for any other digital devices that might hold clues.
She spotted a smartphone lying on the floor near the victim's body and carefully bagged it for further analysis.
Finally, after what felt like an eternity, the forensics team finished their work.
They carefully packed up their equipment, leaving the room as they had found it.
Simultaneously, additional police officers pay Alice Askey a visit at home.
They encourage her to, quote, do the right thing if she has nothing to hide, and they convince her to provide her laptop and cell phone for them to investigate, along with the subsequent passwords.
This evidence, along with the items collected at the scene, were quickly turned over the forensic lab for imaging and processing.
So that's kind of our next steps.
So what are the goals of this stage?
Well, we want to gather data, right?
This is fairly self-explanatory.
We want to gather all the relevant data that we have access to in meeting the objectives.
And to do that, you might actually need stuff that isn't digital, and we'll see why that's a thing eventually.
So here are just a bunch of different data examples of things that, you know, we might pull, whether it's a full image of a machine or a partial image, credentials, email addresses.
I mean, this could widely vary depending on the particulars of the case.
In this case, obviously we're talking about a murder.
So here's... I told you we talk about tools, but without getting into details.
So for those of you who are really interested in tools, here are some tools for you.
So these are very standard forensic tools.
There is no way for me to write down every single tool that we ever use in forensics, so I didn't even try.
I chose a handful of well-known things that I use, and I, you know, asked some of my other friends who work in the space and said, you know, what do you think should be here?
What do you see is most common?
And that's how this, you know, winds up.
Do not discount things like pen and paper, because honestly, you might be gathering based on notes.
Doesn't have to be just the technology.
Now with this particular section, we have some related questions that need to be asked, and this is, generally speaking, could be part of the previous area.
We could be talking about scope here, but ultimately there are things we really should know even as we're doing the data gathering.
And one of them, probably one of the most important, is do we need to prioritize any particular piece of data?
Is there something in particular?
So what we have seen in this scenario is they want communications.
That's the priority in this case.
But it may be, in some cases, that folks need other things.
Email, web searches, who knows.
So that's something to keep in mind as part of this stage.
And they'll want to know, like, was there anything interesting observed on scene?
You may or may not, as a digital forensics person, be the person on scene doing the collection.
It might be some other folks.
One of the big problems I see with a lot of these TV shows, right?
So a bunch of you said you watch these shows.
How many of you see these shows and the exact same people who are in the lab futzing with the things in the lab are the ones out in the field collecting all of the stuff?
Okay, so sometimes there are people that do both.
Most of the time, the people in the field and the people in the labs are completely different people.
So there needs to be communication between them.
And you need to ask them.
Even non-forensic people, you know, beat cop who happened to be walking the street.
Maybe he's the one who, you know, stumbled across the fact that there was something about this case that led them to finding the dead body.
I mean, we don't know too much about that because, you know, we're focused on the digital side.
But the point is, you never know where you could get, you know, useful information.
And you really need to know if there are any time restrictions.
With any kind of murder case or investigation where you're working with law enforcement, there are always initial analysis restrictions.
Because in some cases, it has to do with a suspect where you have a minimum amount of time where you have to process that data because they can't keep them longer than so many hours or a day or whatever.
And it may be that you have a little more time.
It really just varies.
So make sure that you have that clear.
Challenges with data gathering, right?
There are a bunch of challenges here.
Maybe we pull a bunch of data we didn't need.
So one example, not in this particular case, but that you might find, is that you're looking for stuff that is part of an active situation and you find a really old hard drive that's sitting covered in dust.
Well, if you are time restrained, maybe you don't pull that drive.
Or maybe you pull it and, you know, squirrel it away and then if it looks like you might need to look at it, you can.
But be aware of that time frame.
The necessary data that you're looking for that you think is going to be really pivotal might not be available.
Maybe the device is encrypted.
Maybe what you're looking for is inaccessible because it's behind some kind of login that you don't have or are not necessarily allowed to use, which is a thing.
You have to have permission in most cases to act as the person that owns those accounts.
Sometimes law enforcement by default has that.
Sometimes they don't.
So, you know, whether you're working for law enforcement or not, be aware that you can't just because you have credentials doesn't mean you can go looking at whatever.
There might other be, you know, regulations involved.
You might not have the right tools for the job.
As we made the transition from doing like platter drive forensics to doing, you know, SSDs and now some of the more complicated systems, you need different hardware.
And, you know, I can think of at least two instances in the last six years where I've had to request that the university buy for me additional hardware because I didn't have it.
So the machine just kind of sat until I got what I needed.
But it is possible you don't have what you need.
You might not have the right size media.
You come into something, you think you have a laptop that has, you know, a terabyte drive and it turns out, nope, it's got like six times that space and you don't have room for it.
You might have stuff that can't read a particular type of file system.
So I want to bring this to your attention.
Oh, I had this working.
I don't know why it's not working.
Hang on.
I apologize.
What I want to show you here and what I'm trying to get to is I'm going to show you... there we go.
Take a look at that.
The digital forensics team informs you Bob's laptop is encrypted.
And therefore, because no one has the password, they have to create a logical image of the machine unseen.
They're going to collect the machine because that way if they ever get a password, they could take a whole image.
But this is a great example of what I was just talking about.
So they determine this machine is encrypted by looking at the bit that I just highlighted.
That's what tells you this has been bitlockered.
And so when they go and look, if they were to take a full disk image of the whole drive without considering this and then have no password, now you have no data.
Definitely not what you want to see.
The whirring of the hard drives mingled with the soft glow of computer screens in the brightly lit forensics lab.
Detective Hart stands at the helm, her eyes sharp and calculating, scanning the array of devices laid out before her, two laptops and two cell phones, each holding secrets waiting to be unearthed.
Beside her, Maya Patel, the team's lead forensic expert, delicately examines the data retrieved from Alice and Bob's laptops.
Meanwhile, across the room, Agent Mark Thompson meticulously dissects the data from their cell phones, his brow furrowed in concentration.
With each tap of his fingers, he peels back layers of text messages and call logs, his determination unwavering as he hunts for clues.
So this gets into actually analyzing the data, right?
Now we start to look for the things that we essentially have a sense of, whether it's a username, various leads about people, right?
That's part of what we're supposed to be looking for is the people.
And any sort of pivot from where we start to somewhere else.
You need to make sure you document all your findings.
So we in the forensic space love UTC.
UTC is your friend.
If you go to any other time zone, it will drive everyone else mad.
Everything should always be in UTC, period.
And make sure you document a lack of findings.
So if you expect to see something and you don't, write it down.
So that is a goal here.
Again, here we go.
A bunch of more tools because I mentioned we talk about tools at least a little.
So here are some tools we can use for data analysis.
Some of these are free, like autopsy, Eric Zimmerman's collection.
Some of them are paid.
The magnet tools are paid.
NCASE is X-Ways.
STRAIGHT, FTK, NUIX, those kinds of things are paid.
So a bunch of different tools that you can use.
We have challenges here with this section too.
Again, needing permission to see the data in certain cases.
Ignoring relevant evidence, like for example, you think something's just, you know, a regular text file, but it actually contains some kind of important code or hidden message.
What about, as I said, we don't have the right tools?
Or what if we look at data that's, you know, not relevant to the case?
All of a sudden we've discovered malware on this machine.
So let me ask you this.
You're a criminal.
You're doing bad things.
What do you think the odds are that your machine got infected by something at some point?
Because you're not paying attention, right?
So if you're working a case and what you're looking for is evidence of murder and what you find is some sort of worm, maybe it's not relevant and you don't want to go down that rabbit hole.
Now, it's not impossible.
It could be relevant, but maybe that's a secondary thing you want to look at.
Obviously, tunnel vision is bad because you're never going to see the forest through the trees.
And lack of following through means you're never going to know the end of the story.
So here we have another example of evidence.
And I'll read this to you because I know you can't really see it.
Agent Thompson shows you the first piece of evidence he uncovers from Alice's cell phone.
It appears to be a conversation between Alice and Bob.
And it illustrates a somewhat stormy relationship.
Bob, we need to talk.
What's up, Alice?
Everything okay?
No, everything's not all right.
You've been holding out on me.
And I'm going to skip some of the details here.
Calm down.
I had to cover some payments.
Just, you know, relax.
I'll take care of it.
Well, you'd better.
Right?
The language in this is threatening.
So now we see a threat.
And just in case any of you are curious, anything that's in here that came from a cell phone was pulled using magnet gray key and then processed with magnet axiom.
So we can see... I'll fix it.
Just don't do anything reckless.
Well, it's too late for that.
You've already pushed me to the edge.
Please, Alice, let's talk this out in person.
We can work through this.
Fine.
But don't expect me to be all forgiving when I see you.
I'll take what I can get.
See you soon.
Yeah, you better hope so.
So what does that leave you thinking now that you've seen that?
What do you think?
Thoughts?
Yeah.
We know for some point they met in person.
Absolutely.
Anything else?
Yep.
That they met in person.
It's a stormy relationship.
Anything else?
Yep.
I did.
Yes.
So he said, I read that Alice part with a very mean voice.
And so therefore, you know, we can kind of expect that Alice is very mean person.
Yes, you are absolutely correct.
Because if I read it in monotone, it would be really boring.
Other things.
Yes.
The time.
Yeah, it's a good observation.
So let's let's take a look here.
Remember, this is all in UTC.
So we'll just we'll just make mental notes of that.
Okay.
Interesting.
All right.
Let's move forward.
So here's another piece of evidence.
Oh, we had another.
What was that?
Yes.
The phone may or may not had a weak passcode.
Well, remember, that was.
Yeah, that's right.
Because because we know that was Alice's phone.
We have her passcode.
She gave it to us.
But you're right.
You're absolutely right.
It could have been either way.
So this is the next little piece of evidence.
This is an email.
Sent to Alice Askey, A.
Askey at Gmail.
And this is a Lyft receipt.
Going from 123 Main Street to 456 Central Avenue.
What do we know about Main Street?
About that address on Main Street.
Who lives at Main Street?
Alice.
Who lives on Central Avenue?
Bob.
So what happened here?
She got dropped off to Bob.
Hmm.
Interesting.
All right.
The plot thickens.
As the hours stretched on, the team's efforts began to yield results.
Maya unearthed a number of potentially important emails from the laptops, while Mark's fingers fly across the keyboard, cross-referencing timestamps and GPS coordinates in a relentless pursuit of the truth.
His analysis of the metadata ultimately reveals a pattern of communication that can be linked to the prime suspect in the case.
Through trial and error, they each piece together fragments of information, every breakthrough bringing them one step closer to unlocking the answers they're seeking.
So this next stage, we've gathered the data, right?
We've done some analysis.
We've pulled things out.
Now we're going to correlate that data.
So these are the goals of that stage.
We're going to bring all these bits of data together from different sources.
We're going to normalize the findings where necessary, doing things like matching timestamps, and we're going to look for patterns.
Who has played with puzzles?
Whether it's a box puzzle or cipher type puzzles.
Anybody play with puzzles?
Yeah, people play with puzzles all the time, right?
This is where you get to start putting the puzzle pieces together.
So we use some tools for that.
Some folks use stuff like mind mapping software, but it's just as easy to use pen and paper or spreadsheets if you're so inclined.
So nothing real fancy there.
There are some challenges.
Context.
If you read my abstract, and that's partly what brought you here, you'll note context is key.
If we get data with no context, we're going to see quickly it leads to badness.
Again, we could have some irrelevant information.
We could not be looking at the right timestamps.
We could have all kinds of issues when we're trying to correlate all of this.
You might just not take the time because you think, there's not that much information.
I can just run with this.
Ooh, we got a report from PD.
Check that out.
They report Alice's fingerprints were identified all over the victim's home, including on a kitchen knife that has a profile that seems to be similar to that of the murder weapon.
So tell me why we might find that in his home.
Yes.
She came to cook.
That's absolutely possible.
Yes.
It's his.
Okay.
So these are just some things we can think about.
We got another report from PD.
They report interviews from witnesses and neighbors indicate some folks are really concerned about Bob because, man, Alice has a wicked temper.
And they also notice that Bob gets these visitors at all hours of the day and night.
So maybe drugs are involved here.
Who knows?
So the next stage here is timeline analysis.
We need to take a look carefully at the timeline.
We've already talked about UTC and how important that is.
In the hushed confines of the digital forensics lab, the team gathered around a large whiteboard, their eyes fixed on the intricate timeline taking shape before them.
Detective Hart stands at the forefront, her gaze intent as she directs the assembly of evidence in a coherent narrative.
Next to her, Maya and Mark meticulously arranged time stamps and digital artifacts, weaving together threads of data to reveal a chronological sequence of events they uncovered.
Each piece of information begins to fit into the puzzle that was the grand design of their investigation.
Across the room, Dr.
Maya Rodriguez, the forensic psychologist, examines the psychological profiles of the individuals involved, her insights providing a crucial layer of context to the timeline.
With each revelation, she covers the layers of motive and intent, shedding light on the human elements driving the digital drama.
So with the timeline, we want to make sure we've looked at all the evidence we have and whether there are timelines associated with it.
I've already mentioned UTC at least like half a dozen times.
Make sure you know the attributes because different tools provide different kinds of attributes.
So you want to make sure that you're not trying to cross map different types of time data.
And then you're ultimately going to create some kind of timeline for your findings.
And again, here's some tools that you can use.
There's quite a number of them.
These just tend to be fairly common.
And there's some challenges we have with timelines.
What if something doesn't have a time stamp at all?
Maybe somebody's not paying attention and didn't hear me tell them six billion times UTC is a thing and you should pay attention.
And maybe they didn't look at time stamps at all.
So here we have some basic timeline of what we know so far about this case.
We know Alice sends Bob threatening texts.
We did in fact call out the time that we saw that.
And again, this is in UTC.
This translates to about 8 p.m., 8.36 p.m.
UTC.
I'm doing this in eastern time for anyone who actually cares because that's where I live.
We know Bob is killed approximately 9.01 p.m.
and he's discovered at what becomes midnight the next day, 12.01.
So this is our timeline.
This is our basic timeline.
So our initial hypothesis, Alice killed Bob.
Anybody surprised by this?
No?
Okay.
And that's how it could have happened.
Detective Hart looks at your initial hypothesis and says, hmm, I agree.
There's definitely evidence to suggest this may have been what happened.
Have you exhausted your search of the evidence?
I'm told PD are working on some additional leads and may have more information for us soon.
So how about this?
And before I go any further, who recognizes these couple of slides?
Clue!
Yes, it's from the movie Clue, which technically had more than one ending.
The team returns to analyzing the evidence at hand looking carefully for any clues they might have missed.
So they return to this one.
And while we saw the date was in fact the same day as we know Bob was killed, we kind of overlooked something.
So in looking at those time stamps, anything jump out at anybody?
These are not in UTC, by the way.
This is the original.
Yes.
Yeah.
Yep.
So his comment, he had two parts.
One was the fact that this timeline shows that this trip took place an hour after he was killed.
And then the other piece is, you know, when was this message sent?
Was it sent right away when she got there?
Was it sent like the next day?
Like there could be all kinds of issues with the time and day when the message itself is sent.
In this particular case, what was overlooked was the fact that it was an hour after he was dead.
Maya also discovers Bob's machine appears to have some web activity that occurred after his time of death.
So, you know, if you kind of go through these, I mean, what does this kind of tell you?
So if somebody is looking for information on couples counseling, maybe their relationship is not so great.
Right?
Holiday travel for couples, et cetera.
But again, the important bit here is this seems to be after Bob's dead.
That's kind of weird.
And then Maya also discovers a partial draft of an email on Alice's machine that seems to be written to herself.
And it contains what appears to be Bob's credentials.
So now what are we thinking?
Anybody?
Bob's not dead.
No, we know Bob's dead.
Yes.
Yeah.
So we have a comment that it is entirely possible, because now we know that Alice had Bob's credentials, that she might have logged into his machine and searched for stuff after he was dead.
So thinking back to the challenges that we had about the kinds of questions we ask in digital forensics, and in particular what the original police objectives were, what do we see here is severely problematic?
What is happening?
What are we trying to do that we really can't do?
Well, were they in a relationship or not?
No, we know they were in a relationship.
That's kind of a given piece.
But what is it that digital forensics has a real challenge with here?
Proving whether or not Bob or Alice is at the machine.
Well, you're close.
You're in the right direction.
What's the bigger overarching problem here?
Motive what?
Repudiation.
So to take it even a step further, how do we put a human behind a keyboard?
Forensics is exceptionally good at telling you what happened on a machine in a particular day and time.
It can't put a human behind a keyboard by itself.
And it used to be that people would say, well, that's fine.
If you have a camera, you can see the person's behind the keyboard.
And you can just match it.
Okay.
So one double word for you.
Deep fake.
So can we even do that now?
So be aware there are these limitations.
So then PD reports further.
They interviewed Alice.
Because of course they would.
And they learned when she got to Bob's house and she found him dead, she was just a little worried they might try to pin it on her, right?
So she got on his computer and she admitted to using it as if he were still alive.
So spot on, folks.
Wait, it's not Alice.
Uh-oh.
Now we have a problem.
So the first hypothesis does not seem to be likely at this point.
So here's what really happened.
Just as they thought they were closing in on their target, a new challenge presented itself.
A strange file containing a bunch of random characters buried deep within the directory of Bob's computer.
Determined not to be thwarted, the team pooled their expertise, each member contributing their unique skills to uncover this latest mystery, which turned out to be an encrypted file.
And finally, as the first light of dawn filtered through the windows of the lab, they triumphed, the encrypted file yielding its secrets and providing the missing piece of the puzzle they needed to solve the case.
So this is what they found.
Maya noticed this weird file that contained a bunch of random characters and she immediately suspects the file may be encrypted.
Then by looking at the registry on the machine to see what is installed, she notices there's something here called VeriCrypt.
And she knows VeriCrypt can be used, in fact, to create encrypted files.
So she decides she's going to test that theory, that weird file she found, and she runs a tool called tcDetective.
tcDetective is a Python script that can be used to determine whether or not something was encrypted using VeriCrypt.
And using that, she confirmed that is, in fact, what it is.
Taking it a step further, she runs a tool called Shell Bags Explorer as part of her standard forensic process.
And she's looking for evidence of secret files and she finds a mount point, this strange thing called secret stuff.
She thinks there's evidence there now that perhaps something was mounted.
Then the police report they found some passwords on a post-it note.
Gee, it would have been nice to have these earlier, right?
But this is what always happens.
We get stuff after when we really would like it.
So then Maya, knowing now that VeriCrypt is installed and that this is a VeriCrypt file, and now we have some passwords, she says, I'm going to try some of these passwords and see where I go.
So she tries the first one and it yields six hidden files in an encrypted space called secret stuff.
These are the files she finds.
Folded currency and what seems to be some sort of ledger.
And she recognizes one of these names, Alice A.
And she recognized Bob B.
But this is a new name she sees, Charlie C.
And what the heck are these folded dollars?
Like what is up with that?
So in a discussion with Detective Hart, the forensic team learns, gee, there's a Charlie C.
who is known for drug dealings.
And his real name is Charlie Cyber.
Because of course it is.
Agent Thompson, if you remember, was the one looking at the cell phones.
He finds another text conversation between Bob and someone else, but we don't know who the someone else is.
And he really didn't think it was important.
But since this case is going in another direction, he figures, eh, what the heck.
And he asks PD to look into it and find out who owns this other phone number.
And so there is this interesting conversation.
Look, I think I'm going to start handling things solo from now on.
What do you mean?
I mean, I think it's best if I operate on my own, you know?
Seriously?
Yeah, it's just business.
So when the forensicator was looking at this, he didn't think it was particularly relevant and figured, you know, but now maybe.
But now that they've seen these things that were hidden, police tells the forensicators the portion of those photographs that they've found.
So I'm going to defer to Wolf and Stephanie here talking about identity.
You want an interesting way to identify people?
Drug dealers do it with serial numbers on money.
So you send them a picture of a dollar or five dollar.
It's always low, usually low number currency.
The first four digits.
And then when you meet in person, you bring the whole dollar bill with you to prove you are who you say you are.
So here's a way to identify yourself that doesn't require any of your personal information, but in theory can tell one drug dealer to another, a buyer and a seller, I'm me.
So there's an interesting way of doing identity.
And the forensics folks never knew what that was.
They just thought it was this like weird set of pictures.
PD comes back after doing a search on the phone number and strangely enough, they discover it belongs to Charlie Cyber.
So PD reports further inquiry revealed the neighbor has a ring camera and it has a direct view toward the victim's back door.
And the camera footage shows Charlie Cyber entered Bob's house via the back door just before Bob's death and exited shortly thereafter.
So the final conclusion is in fact Charlie killed Bob because Bob tried to cut him out of the business.
That's what that text message was that seemed completely irrelevant until we have all of the context.
Now a lot of presentations would stop here.
We now know what happened and we're done, wrong.
Because there always should be a post-incident.
The team sat down to discuss the case they had just concluded.
Each one took their place around the table, their expressions a mix of exhaustion and satisfaction, a testament to the arduous journey they had undertaken to solve the mystery.
Detective Hart opened the meeting with a solemn nod signaling the start of their post-incident analysis.
Her gaze swept across the room acknowledging each member of the team before settling on the whiteboard at the front of the room where a timeline of events was displayed in meticulous detail.
All right everyone, let's begin she said, her voice steady and authoritative.
So after every forensic case there needs to be some sort of post-incident section that happens.
The goals of that are to review what went well, what didn't, was enough information processed, did we perhaps not get information in a timely enough manner to get the answers that we needed when we needed it.
Is there anything more that needs to be completed now that we have a pretty good picture of what cases maybe we have some extra time and we can perhaps process just a little bit of extra evidence.
Feedback from everybody, everybody who was working on the case, the forensics folks, the you know traditional detectives, you know anybody who is involved in this should be providing some good and bad feedback if they have any.
Were there technical challenges?
Did you need different tools?
Is there stuff we should buy now to prevent problems in the future?
And everything needs to be documented.
All the things.
Doesn't matter how you do it, but it needs to be done.
There are of course some post-incident challenges, right?
We don't document because we're in a hurry because we need to get this done and we need to be done yesterday.
What about we forgot we did stuff or we did things you know and we're like it's not really important we just won't write it down we're just going to do it.
If it didn't get written down, it didn't happen, it doesn't matter whether it actually happened or not, what you document is all that matters.
And that can be really frustrating.
The full story has to be told through that documentation.
While a real murder would include obviously way more than what I had, you would at least have the core pieces of information that led to perhaps one hypothesis working and another one not.
One of the things that I meant to mention earlier is the fact that you're using a version of the scientific method here.
You are gathering data, you are building a hypothesis, you are testing the hypothesis.
In early forensics, and I can tell you firsthand especially in places like fire investigation, that was not a thing.
Instead it was, well we have spalling on the concrete, spalling is where concrete breaks up, that must mean an accelerant was present and it must be arson.
Well I have news for you.
Anyone know why concrete spalls?
Yeah.
What?
Water damage?
You're really close.
Spalling happens when something really hot suddenly gets really cold from, you know, water or something else and it starts to break down.
So yes, water damage effectively is the case, right?
But for years we didn't use no scientific evidence, we just said this is our observation, we run with it.
But all forensic sciences are now held to a very similar standard.
So I'm just about out of time here.
I always love to end with this quote because my background, where I ultimately started from, whether I'm talking about forensics, in which case I'm talking about doing fire investigations, or my space in IT slash, you know, the security world that we know today,
where I started actually was in music industry, that's what my first degree was in.
So it was not exactly where I intended to go, but I think ultimately I'm exactly where I need to be.
And I have to show my book because I do, it's mine.
This doesn't talk specifically about forensics, this talks more generally about being a defender, and it's through the lens of offensive security.
So the TLDR is, if you are a defender and you don't know anything about offensive security, you're missing half the story, and you really need to learn the other half of that story.
And I wrote this for the community because I thought it would be really beneficial, it's stuff I wish I'd known when I joined this community.
And with that, we still have a couple minutes, any questions?
So the question has to do with if you're a developer in the room and you're building software, and eventually if your system is attacked, what can you do as a dev to make that software better for that purpose later?
Number one thing, timestamps.
Make sure that what you report, if it doesn't give you a choice, it's in UTC, make sure that if nothing else, that's probably one of the number one things.
And that it plays nicely with forensic tools, so that it doesn't hide fields, it doesn't illustrate anything in a weird way, and what I mean by that is... so one of the important things to understand is that any forensic tool you are looking at is doing an interpretation of the data,
that's what it's doing.
So if you write code in a way that your traditional forensic tools are going to interpret differently, so for example, NCASE and FTK, which are the two of the main products used these days, paid products, there are certain things that they interpret differently.
One does little endian, one does big endian, that kind of thing.
So pay attention to those standards, because there's a reason why they exist.
So it might be tempting to just be like, ah, it doesn't really matter, that's the kind of thing that a developer can absolutely help with.
Any other questions?
Yes?
Have I ever run into cases where you can't trust timestamps, where they're spoofed or whatnot?
Yes, absolutely.
And so what I would say about that is, here context is even more important, because now you can't rely on the timestamps.
So the more you can find out about whatever it is you're looking at, even within the... so in some cases, if a timestamp series gets spoofed, sometimes you'll see it spoofed consistently.
So it'll totally be changed from one place to another.
Sometimes you see a weird spoof that's in the middle of stuff that isn't spoofed, and it kind of stands out.
So you have to look for the things that may not jump out as obvious.
And when you suddenly realize that those timestamps don't seem to fit with anything else, you have to make some decisions and look at other data to bring in context.
Is this a situation where something was manipulated?
Could it be... so one great example, and this is not where it's actually manipulated.
This is where it's a situation where traditional Microsoft patching changes things in weird ways, right?
So it is occasionally the case where a patch gets applied and it overwrites timestamps of earlier things, and then you're like, what the hell am I looking at?
But you need to know that.
You need to understand that, challenging.
Any other questions?
Yes.
So the question was, have I ever, or anyone else on the team, and FYI on my team, there's me, myself, and I.
I'm the only one who does forensics in my space.
Have we ever run into anything where the data was maliciously altered in some way, whether internally or externally, is that right?
And after it was collected.
So I have not, because in all the cases I personally do, I'm the one usually doing the collection, and there isn't anyone else looking at them, but it does happen.
There's an insider threat with that, just like there's an insider threat with anything.
So you can have, you know, there are bad cops, there are bad investigators, just like anything else.
So it's definitely a thing.
I personally have not experienced that.
And for what it's worth, just quick side note, the whole thing with the dollar bills and all, that is real, and that did actually come from a drug case.
And I see a couple people nodding, so you've either run into it, or for any of you who saw Chris Roberts spoke, when I showed him that slide, he started laughing.
He knew right away what it was.
Yes.
Am I using Celebrite for extractions?
I don't do phones, so I was asking other colleagues of mine who do phones.
I personally, fortunately, don't touch phones.
So my day job is at a university, and it is rare that at the university that we pay for phones.
So it's usually personal phones, and that's crossing a complicated line that law enforcement touches directly, and I do not.
But I know there are folks who still use Celebrite, for good or for ill.
And I don't know whether it's effective.
Unfortunately, I can't speak to that.
I just know it is still used, and it's still used in some law enforcement spaces.
Yes.
How common is it that law enforcement brings in researchers to help with these kinds of cases, right?
So the answer is, it's not quite that straightforward.
I work for the university in their security office, and I get asked on a regular basis, I am the point of contact to do investigations with PD.
If it falls into a criminal space, and they have to take an image of a machine, then that winds up actually going to a regional forensic lab downtown, and I don't touch it.
But if it's the kind of thing where we have somebody who is missing, and there's a life safety question, and so I'm checking logs looking for information.
If there's an employee relations case, which I'm actually working on an employee relations case right now, I will dovetail with legal employee relations, university police, I do that sort of stuff all the time.
Any other questions?
Because I think we're almost out of time.
We got a couple minutes.
Yes.
I'm going to do my best to summarize here, because this is a kind of lengthy question.
So the observation is that the scenario I presented very much is collaborative, and has folks from all different areas being part of this.
And so what happens when that's not the case, such that it's a handoff situation, or you don't have the scoping call, or whatever?
And does that, you know, can that impede the investigation?
Is that, did I get all of it more or less?
Okay, great.
So what I can say is, that should, first of all, the fact that you're not doing a scoping call, and, oh, and the other piece is you might get a piece of data from a SIM or from some other tool that shows you have a problem.
There should always be a scoping call, even if it's with you and your supervisor, to say, I see something I need to research, beyond just the day-to-day stuff you sort of normally see, right?
So if you see something where it could be something bigger, tell someone else.
Make sure that they know you're going down a rabbit hole.
You know, to the sort of broader picture, I would say it depends on the nature of what you're investigating.
If it is something way beyond the scope of, say, a single machine, and you're really looking at human action, I think it can really seriously impede you, because as I pointed out with some of these examples, you may not have the context for the whole story because you haven't talked to all the relevant participants.
I do that when anytime I have to do an employee relations case, I have lengthy conversations with the folks.
I ask them all kinds of things about the people involved and what they know, and same with PD.
You cannot do this in a vacuum.
That is absolutely critical, even if you are the only person wearing the hat.
And I think I'm about out of time, so I want to thank you so much for coming, especially toward the very end of CypherCon, and I wish you a great journey when you are done here.
I hope you have a fabulous rest of your time, and if you have further questions, I'm on all the things as investigator chick, C-H-I-C, not C-H-I-C-K.
And again, thank you very much.