Let's start.
Good afternoon, everyone.
My name is Bruno Pérez and I'm going to give you a talk.
It's a talk that they say has to be for young people to get new professions, new concerns.
It's a talk of a very basic level.
There will be more didactic resources for you to learn, for people to know what a forensic is.
There won't be any applications or anything.
Then, if you want, when we finish, I'm at your complete disposal.
Let's start.
For you to know, we are going to make a comparison between an autopsy, a forensic anatomy, and a computer autopsy.
By doing this comparison, we will be able to explain to everyone what a forensic is.
As I said, my name is Bruno Pérez.
I come from Figueres.
Figueres is in the province of Girona, at the top of everything, to the east, at the end of everything.
Do you know this character?
This is Dalí, he is a relative of mine, he is from my area.
For you to know, more or less, the people who were born there.
In this image you see, this is the tomb of the illustrious people of Figueres.
Here is all the famous people.
Dalí is not here, by the way.
But there is Narcís Monturiol, who made the submarine.
There is Pep Ventura, who made the sardine.
And there is a tradition that is, since five years, four people.
One of them puts between 6,000 and 8,000 candles, illuminates the whole cemetery.
And the other three, one is a forensic doctor, the other is a biologist, and the other is a person dedicated to the history of art.
And a guided visit is made at night.
Let's see, if I am not a forensic doctor, I am not an art historian, and I am not a biologist, who am I?
I am the one with the candles.
I have a hobby, to break this profession, to break the profession of forensic computer science, I have a hobby that is that I like to illuminate things with candles.
And then you will understand why I explain this to you, the candles.
I illuminate things with candles, but things to the beast.
Like, for example, the Cathedral of Burgos, with exactly 15,000 candles.
Do you light candles at home, more or less?
Few, but 15,000.
Don't you get questions with 15,000 candles?
Questions like, how do you put them, how do you light them, how...
This is where I want to take you.
I don't just make monuments, but I also make little drawings on the floor.
But little drawings on the floor, little drawings of more than 40 meters, this circle you have here, these are two people, so that you have some references.
Currently, I have the Guinness World Record for lighting candles, I did it this month of September, with 82,000 candles.
And the question is, the candles, do you know how the candles are lit?
One by one.
Do you know how they are lit?
One by one.
And how do they go out?
One by one.
And how do they go out?
Well, with a backache that I don't want to tell you.
When I refer to these candles, I want to refer to an important topic, which is the topic of humility.
Notice that a piece of crap candle, put in the middle of a square, does nothing, it's useless.
But when you have clear ideas, you know what you have to do, the set of candles can make really beastly recreations.
When you are going to do a forensic autopsy of a file system, how many files are you going to find?
200,000?
1 million?
2 million?
Do you know how you are going to look at them?
One by one?
No man, no, that's why we are computer scientists, that's why we have tools.
Here is the difference.
But yes, we have to have a point of humility.
Sometimes the smallest file is the one that can lead us to the most important evidence.
That's why I have this hobby, and when you have to face something big, you know that you are not going to achieve the goal at once, but you have to do things step by step.
The most important thing is to take a step.
Many times you find cases that you really don't know where to start, and you would really like to have it solved.
Well , think about the candles, about a small candle, and so you can achieve it.
As I was saying, of these four characters, there is a very important one, which is the forensic doctor.
This character here, that you have, he is dedicated, when we are running through the cemetery, and then, if we have time, I will tell you an anecdote that scared me, this character is dedicated to explain things about forensic cases, but medical cases,
how people died, what, how, and it really gives a lot of morbidity.
This character is called Narcís Vardalet.
He was director of the Forensic Anatomy Institute for many years.
He is an international reference.
When there was that misfortune, when there were those terrible tides in the Asian part, he was the director, he was the coordinator of the international team.
So, no kidding.
With him we have this friendship, this personal friendship, that we are from this same population.
We have this hobby, which is the subject of the cemetery.
And, precisely, when we were in this event, a colleague commented that we had two forensic scientists in the autopsy room.
And I was very angry because everyone understood that he was a medical forensic scientist, everyone knew that Narcís Vardalet was a forensic scientist, but, on the other hand, I didn't know what he was doing.
And even he told me, and you too, and I said, yes, you know I am.
And I asked him a favor, which is, hey, would you dare, a forensic scientist like you, would you dare to do an autopsy on a computer?
And he said, but, let's see, if you know the truth, you know that I, technologically, know that green lights up, red turns off.
I mean, don't mess with me.
And I said, no, no, don't worry, you will see how you will know how to do it.
Why?
Because we are going to use the protocol of an autopsy, of a forensic anatomist, the real one.
This talk, above all, I give it in schools.
In schools, the kids hallucinate.
And today we can talk about CSIs, we can talk about forensics.
If we had talked about this topic 20 years ago, no one would have talked about forensics.
Why?
Because everyone imagined a morgue, a dark, gloomy morgue, and people didn't talk about it.
Today, thanks to CSI Las Vegas, CSI New York, CSI, I don't know, Paraguayos del Jarama, CSI Santander, I mean, here everyone has CSIs, everyone dares to talk about autopsies, etc, etc.
Because of this, we dared, we did this.
We agreed on a date, and yes, yes, indeed, with all the public like you, I put a computer, which is this computer you see here.
Besides, I found this computer in a garbage container.
I don't know if it has happened to you to find computers.
If someone wants to practice forensics, you go to a place of selective recycling, you take any computer, you take it home, and when you start to apply programs and things, you are going to hallucinate about the amount of data you get from a person.
People are very unconscious about the subject of their data.
I like all day that if I read about data protection, that it is denounced here, denounced there, but go to any market, you can buy any computer, and you know that you quickly recover the data.
People are not aware.
One of the problems that I am currently finding in my day-to-day as a forensic computer is in companies.
In companies, they fire workers.
They ask you, the forensic service, to recover data from this phone of the worker who has just left and has deleted it.
Or from this laptop of this worker who has just left and has deleted it.
Legally, you have to do it.
Why?
Because the computer belongs to the company, so that you understand me.
And they are asking you for a data recovery.
You recover the data.
What happens is that when you recover the data, you are realizing that you are recovering security copies of iTunes, photos of... if, for example, the boss is called Manolo, he goes in a bikini and he is very good, so it is not him.
And this is one of the things.
People have to realize that when they leave their workplaces, they ask for a data destruction certificate.
Antiforensic services.
Look, we have forensic services, but there are also antiforensic services.
They have to ask for this service so that when you deliver your device, with this certificate, you know that they are not going to pick you up and look at you.
This happens in workplaces, but in town halls...
I am telling you, in town halls it is amazing.
But now there will be political changes, and it is amazing how the new councilors receive, from the hands of a head of IT in a town hall, a configured laptop, a configured phone, and everything is configured.
And as you can imagine, there can be a lot of things in there.
Forensic service?
Forensic service is, hey, bring it here, let's see what kinder surprise they have put in here.
As I was saying, with this computer that I found in a container, I told him, let's do an autopsy.
We put the computer on top of it and I tell him, come on, let's start.
And he tells me, I don't even know where to start.
I close my eyes and I say, imagine that this is a body, that this is a corpse.
He says, okay.
I say, what is the first thing you would do?
And what is the first thing you have to do with a corpse?
Do you know?
The first thing you have to do...
These guys are very funny right away.
I look at his ear and I take out what is in his ear.
The other one, no, no, I take it and I open it directly.
No.
What you have to do in front of a corpse, or what you have to do in front of a test, is to protect yourself.
Why?
Because by protecting yourself, you protect the evidence.
And he tells me, the first thing I have to do is, I protect myself, I put on gloves, I put on my coat, I put on my cap, I put on my mask.
And I tell him, just like me.
He says, what do you mean?
Yes, yes, just like me.
I always use gloves.
When I have to touch keyboards that are not my keyboard, I always wear gloves.
For a reason.
Because you know that keyboards have more bacteria than a vacuum cleaner.
And if you don't take a keyboard, you turn it around, you shake it a little bit, and let's see who has the guts to touch that.
The mask, when I put on the mask, you know that what are computers, the fans of the power supplies, that has more garbage than anything.
Well, I have to take it, nothing goes into my laboratory if it doesn't go through the compressor.
And when I touch the compressor, I don't breathe that air, no way.
I put on my mask.
Also, you always have to wear gloves in case you have to extract a disk, or clone a disk, and you have the notary, and you have the notary to file a report.
Why?
Because when you put your hand into the computer, you are going to come out totally disgusting.
And then, when you sign the papers and you dirty it, be prepared that the angry notary is going to mess you up a lot.
And then, the robe, I put on the robe for two reasons.
The first one, to find my glasses.
And the second one, because it is like a click, it is a commutation, to know that I am working.
Throughout my career, as a forensic scientist, I have screwed up many times.
I have made mistakes.
And big mistakes.
Mistakes that I have loaded with evidence.
Because of the rush, because of the pressure, because I have made mistakes.
And the robe makes me make the change of chip and I know that what I am touching is very important for a case.
You can load an evidence that is quite vital.
And someone can escape you and then you really have a bad time.
Come on.
We are protected.
As I was saying, we have many more similarities than you can imagine.
People think that in the technological world we are totally weird.
And it is not true.
We have many similarities.
And I showed you this image.
This image is very good.
Because this is a guy who has created an empty bell, a clean air bell, to be able to disassemble disks.
And he shows you how it is done, etc.
And you see here that gloves are used.
I also explained to you that there are really many similarities.
Look at this slide.
In this slide we are seeing how the incubator is almost similar to this clean table where the heads of the disks are disassembled, etc.
In the world of medicine, we have a very big similarity and this goes to the people of the world of hacking.
You find that you have what is the cow's milk doctor, who is the one who, when he finds a small problem, helps you a little.
When the problem gets bigger, then you have to go to a specialist.
But there is a higher level, which are the researchers.
They are these people who find medicines, who find things that are saving our lives.
There is quite the world of hacking, the world of the researchers of cybersecurity.
Really, look, they are above everything.
A maximum respect to this profession.
What happens is that sometimes, things are not explained well.
It is as if they give you a pill and tell you that it cures the cataract.
But how many clinical trials have there been?
How many tests have there been?
How many nights have there been?
In the world of cybersecurity, of cybersecurity researchers, sometimes it would also have to be explained.
That, look, we take and open a Tesla.
Yes, José, but explain the whole procedure that has to be done.
A computer scientist has to be a really organized person.
Not everyone can be a computer scientist.
Not because you have four knowledge, it can't be.
There is also a very important part of attitude.
I sometimes say who can be, who can't be, looking, for example, at the communication rack he has.
If a person comes to you, who comes from the system administrator, if you see that he has his system, he knows all the assets he has, he knows the IPs, who he is, who he is not, what he enters, what he does not enter, all the ports he has, he has it well documented,
he has his cables well placed, so that anyone other than him can find and know how the system works, he can be.
On the other hand, the typical little piece of paper, I got lost with a octopus in the disco, no.
Remember that when you touch the subject of evidence, when you touch an evidence that then you have to go to court, you have to show that the steps you take, another person doing the same, with the same version, with everything, has to give exactly the same result.
For this reason, the attitude of a forensic is organized, very organized.
Patience, candles, yes?
Always.
This is one of the most important virtues that a forensic has to have.
Come on, we are already protected, we continue with our autopsy, what is the next thing we have to do?
The next thing we have to do, Narcís Bartolet, the forensic doctor, tells me, the next thing we will do is document the evidence to the maximum, with photographs, with videos, etc.
And I say, okay, me too.
You too?
Yes.
It is very important when you find evidence, 5,000 photographs.
It does not come from here, that now we do not spend money, that now the photographs are not revealed.
In addition, we all have on the phone some brutal cameras.
Take pictures of everything, for serial numbers, for whatever.
In addition, I was one of the first who had to set up a forensic laboratory.
And not to break the chain of custody, when they give you a phone that the notary recognizes it, of course, how do I do it to show that I am not touching the phone, that I am not manipulating it in any way?
Well, what I did is, in the laboratory room, I set up a team with 12 video cameras, in which there is no dead angle, there is none, and this is constantly recording from the moment you break the chain of custody until the moment you re-chain it.
And everything is recorded there.
If for the extraction of the phone I am two hours, I am two hours.
If they are three hours, three hours.
And all this is recorded.
All this is documented.
Documentation issue, very important.
Another piece of advice I give you, work in real time.
Do not do today an extraction and after two months, well, I will look at it, I will give the report.
No.
Memory fails.
And the older you get, you will see that really this is a good advice.
As I said, we have documented, we have made 5,000 million photographs.
Let's go to the next step of the autopsy.
The next step of the autopsy is to examine the body from the outside.
He says, I'm going to examine.
This, above all, the kids tell you.
Yes, yes, let's see if it has purple, if it has scratches.
Signs that you have to look for in a body.
Apart from purple, scratches, what are you going to look for?
For example, that will give you a lot of information.
Tattoos, yes?
If it comes from the military world, if it comes from the motor world, this will give you many clues.
In a computer autopsy, what are you going to look for?
Well, the same.
You are going to look for marks.
You will look for barcodes, you will look for e-mail numbers, you will look for serial numbers.
Precisely in this computer that I was showing you, the careless person who threw the computer, also at the bottom had the Wi-Fi, yes?
The key to the Wi-Fi, the name of the Wi-Fi, okay?
You know that with this little information and automatically we get quite close.
Well, we have to look at all these details.
After we have already done this exam, after we have already documented everything, we have seen all these marks, we have seen all these codes, we are going to go to the important issue, which is, let's get to it, we are going to open the body, okay?
He told me that, of course, first of all, what you have to do is prepare your tools.
Hey, we are exactly going to do the same.
We are going to prepare our tools.
Of the tools that I advise you to have, even if they are laptop computers, I advise you to have the typical tools to disassemble phones.
Why?
Because every time the laptops, to open them, have more joints, okay?
They have to go to pressure and you are going to load it.
I explain to you how you really work every day.
If, for example, you find that you have to go get a disk to clone it in front of a notary, what you will never do is go there with the laptop, you are going to be four and a half hours to try to open the laptop, take out the disk and clone the disk, because the notary is going to hit you,
okay?
What is always done?
Good habits.
You take this laptop, you look at how it is assembled, how it is disassembled and you do your tests, your practices, so that when you have to present yourself to the notary, you are really resolutive.
A very important topic that I have to talk to you about is how we get the evidence, those of us who are the experts, the forensics, a little bit on the side, those of us who are not body and security forces, okay?
The tests, we do not seize them, not at all.
The tests are given to us, the client himself gives them to us, or the interested person gives them to us, okay?
Steps you have to follow.
Step number one.
Whenever you talk to a client, hello, how are you?
Before I explain anything to you, do not explain anything to me.
Name, last name, address, and automatically, the first thing you do is fill out a confidentiality agreement , so that everything I explain to you is protected.
This gives a lot of security to the client.
Second, once he is explaining to you what is going on, you have to be alive and you are filling out your budget.
Precedents.
The client explains to me, what happens, this, this, this, what I advise him, this, this, and so on.
And we will do this operation, this other, and this is worth so much money.
If the client accepts, clink, clink, 50% in advance, or here it does not move, neither God.
And this is where it shows that I am Catalan.
First of all, here, clink, clink, or here you do not move.
Automatically, the person accepts.
The most important thing is that you always have to have the consent documents.
As this person proves that the element he gives you is his, and he gives you permission to act.
Tell him social networks, tell him email, tell him massive device, or tell him whatever you want.
If you do not have, if you do not have this permission, you do not touch anything.
You do not touch anything because it can explode in your nose.
I remember a case, I started working very hard, especially with deceased people.
Some time ago, you found that people were dying and the Facebook profiles were a little bulging.
You also find that there are people that inside their computers there are car accidents every day.
The person has a documentation that is necessary for his company.
You have to enter that computer and you have to help him.
You have to extract this information.
I found a case of a widow that asked me, well, she knew about my services, and she asked me to stay one day to bring me her husband's laptop and to extract everything from it.
We stayed and you can see that things are not going well.
She gave me a laptop that I had to extract everything from.
It turns out that the laptop was her husband's, one of the best lawyers in Barcelona.
And the lady had suspicions that he was unfaithful to her.
Imagine that I fall, I take everything away, I give it to her, and well, I think that I would not be giving this presentation, I would have a problem.
That's why, rules.
Sometimes it is true that we work with one leg on each side.
This is typical in my area, because as we are 20 km from the border, when you are little, your parents take you to the border and you put one foot on one side and one foot on the other.
And you say, look, I'm not here or there.
It is true that sometimes we work to this limit.
It is true.
And quite to the limit.
But there is a line.
And I give you a piece of advice, the line does not cross.
The line does not cross because if you do not cross the line, when you go to a trial, when you have to defend your report, when you have to defend yourself, this gives you a lot of strength.
Yes ?
Advice.
Well, gentlemen, we are at the moment that we take, we are going to open the computer, we are going to open the laptop.
I have already told you to always do practices in advance.
We have our tools, we all have them.
And with Dr.
Narcís Bardaez, we take and, also, I have already prepared it for you, click, click, we take out the cover.
And you see this man hallucinating.
And I say, what do you see?
And he said, strange thing, circuits.
I say, no, man, no.
I say, imagine it's the dead man.
In addition, here I made a quite a big mistake, which is to go from smart, that's why I always tell you, humility .
Also, on the subject of experts.
If you are going to dedicate yourself to new technologies, or you are going to dedicate yourself to computer science, there are no experts.
This goes so fast that it changes already .
And the expert does not exist .
On the contrary, always this point of humility.
And a piece of advice I will give you is you have to learn to forget.
Why?
Because today you are working with tools that make you feel super safe, but they update you and this has changed you.
I mean, what you did before is not valid anymore.
It was very good, yes, but no, you have to do it again, you have to adapt, you do not have to take, but not at all, to the past.
As I told you, I screwed up, I was smart and I told him, man, Dr.
Narcís, I know that for a forensic anatomist, when you open a body, there is a technique that they make you a Y in the body and it opens to extract the organs, just like in the head.
In the head they cut you here through the ear, up, up, up, and and they open you, right?
And he tells me, no, this is the technique, it is and I use the technique of Strudel, and I say, let's see, what is this?
And he explains to me that he cuts from the hip here, here, through the armpit, it comes here, it opens you like a tongue, it goes down through the armpit, and then it opens you and so it takes out the organs, you know?
And it is that moment that you remember what your mother tells you, that she tells you, hey, Bruno, how nice that you are quiet.
Well, yes, certainly, that was the moment when I said, I'm not going to say anything else because the subject is really quite macabre.
As I told you, we have what is the open computer.
Dr.
Alonso Isbarret looks and I say, what do you see?
And he says, no, I don't know what I see.
I say, think they are organs.
He says, true, they are organs.
I say, look, the most important organ for us is the hard disk.
In this hard disk, we really have all the organs that we are going to do, we are going to examine.
And I explained to him that the first thing you always have to do is a evidence cloning.
Of course, this man said, but let's see, how is it cloned?
How do you clone?
I say, you have to imagine that you have your body and I, with a 3D printer , I make you another body, and you work on the copy.
Instead, the original, you keep it in the fridge, so you understand me.
I say, this is cloning, so you can work.
I say, look, we have differences.
We also talk about the differences of doing an autopsy live or doing an autopsy dead.
And I consulted him.
I had to consult him.
I say, you have done an autopsy live?
No, of course not, it would be missing.
He said no.
Autopsies always in dead.
We do find autopsies live.
I will also tell you, the simile that I am giving you now of a human body, it is good for a computer, for a laptop, but also think that we can find that we have to do an autopsy or go to extract data, for example, from a cpd.
Of course, when you enter a cpd, how do we do it?
It is the same, in a more veterinary plan, it is as if you get inside a whale and there you start to get things out.
We have the hard disk cloned and from here we are going to start getting things out.
And I started to give him the following similarities.
Of the organs that we are going to examine from this body of ours, from this autopsy, we can examine the ear.
In addition, the ear, above all, in the issue of CSIs, is brutal.
Because, take a good look, from the ears they put a stick and they extract 50 liters of oil, of mustang, of 74, etc., etc.
We, in our case, what are the ears?
The ears can simply be, perfectly, you know that we have some commands that give us the WIFIs where they have been connected.
Through some databases, public, semi-public, or whatever, you can know and have geolocated these WIFIs.
So this evidence that you are getting is geolocating you to a person.
From this auditory case, I will tell you, a real case that I found, was a father, hearing disabled, that years ago, they didn't give him custody of his daughter, because he couldn't communicate well with her.
But technology has evolved, the father sent WhatsApps, the father sent e-mails, through Skype they spoke with signs, and he wanted to present these proofs, to show that he had a fluid communication with his daughter.
Pay attention to the importance.
Sometimes we talk about technological crimes, and it seems that there are only a few crimes, that are the ones that are typified, and it is not true.
I mean, a forensic investigator intervenes when there is a device , in any case.
Pay attention, we are talking about a custody.
Indeed , it was shown that all these e-mails were true, that all these communications were actually good.
Another important issue of the forensic investigator is that you have to ratify your report, you have to ratify it in front of the judge.
Here you can already be a very good technician.
The characteristics of a forensic investigator have to be that you have to know a lot about everything.
I believe that good forensic investigators are those who have years, those who have traveled.
There are things in life that I am very sorry about, but it is experience.
I advise that a forensic investigator comes from the world of programming.
That he has really high knowledge of operating systems.
That he knows, at least, how a file system works .
You know that in our profession we are finding right now that there are many people who are getting in the way, and no, at least you have to have a profession that is regulated.
You have to be, at least, a computer scientist.
At least.
But you find yourself in people who do not even know what a metadata is, or what an extension of a file is.
And you find this in judges arguing with the other party.
Apart from operating systems, I think it is very good that you come from the world of systems too.
That you have knowledge of virtualization.
But not only that things sound familiar to you, but that you have really worked on it.
Here I go back to the famous subject of candles.
Candles are not placed alone.
I have already told you how you end up.
You end up with a terrible pain in the kidneys.
This profession is not easy.
It is like technology.
It makes me very angry.
Technology is not easy.
You have to study technology .
You have to learn it.
You have to put hours in it.
Here nobody gives anything.
With the subject of candles, I also make you another simile, which is the famous red button.
Red button and the candles turn on.
It is shit.
It does not work like that.
Well, here exactly the same.
Do not think that here you take an application.
It is not that they have told me that you take an autopsy, you put it in, you take it out, they give you a report.
Yes, and the autopsy report you give it to the judge and you are going to come out with hot ears.
This does not exist.
And many things you have to work on yourself, because they are not done.
And this is the attitude that a good forenser has to have.
What I was saying, in courts, it is very important to know how to defend your client.
That's where you really play it.
The report can be fantastic.
Think that a report of five emails normally takes me between 60 and 80 pages.
This is a police report of five emails.
The judge is not going to read this.
The judge is really going to look at the conclusions and little else.
And it is your performance in court what really can decant one or the other.
Therefore, practical things.
Put yourself in public, start talking, start explaining things.
You have to be fluid.
If not, you have a problem.
Other things, other organs that we were talking about while we were doing the autopsy.
I already told you that this is an example, it is a very didactic resource, especially for young people.
Of the things you know we can do doing a computer autopsy is to have the relationship of the USBs that have been pricked in this machine.
This would be, in the case of the deceased, to say, hey, how important, how scratched, you know that the C6 look at your nails to see if it has desert dust or whatever.
Well, we have the ability to know which devices have been extracted.
For me it was very important, in a case that I found, also very funny, it turns out that it is a partner of a company that gets angry, wants to leave, and asks the computer the issue of the server, how it works.
The computer explains that it has a hard disk, which is where the information is.
It explains that it has a second hard disk, which is in mirroring, which is in constant image, which also has all the information, has all the backup, and this character stays with this data.
He says, oh, there are two hard disks, are they the same?
Well, that's it, I have it very clear.
And what did the phenomenon do?
Well, one day at night, the company introduces itself, also a company with about 20 security cameras, no kidding, the man comes in, alarm, his code, fantastic, cameras recording, he approaches the server, hot, starts the hard disk, but also, with the bad luck that the computer days before had put a third hard disk with four things of his,
with four tools and four things.
The phenomenon goes, the disk is wrong and also takes the computer disk.
But, so that they did not realize, so that they did not realize, he goes to a computer, disassembles the hard disk, but all this recorded in cameras, disassembles a hard disk, puts it inside the bay and returns it on the server.
Well, you have to do an appraisal of this, in which you have to show in a timeline how this crack enters the office, how the cameras managed, you have to say that these video cameras are real, they have not been manipulated, these images, etc.
And then the operating system itself, by registration, already shows you that it has been started, it has an incidence, a device has been started and another device has been pricked, with its serial number, etc., etc., etc.
That is, from the nails of the devices we really get a lot of information.
Another important part of the things we can do when we do an autopsy, if we did the dead man, one of the most important parts is the stomach.
What has the dead man eaten?
The CSI are the milk when they do it.
We have some commands, which is the last activity, so, what is the last thing he has done?
What has he executed?
What has he looked at?
What has he done?
I want to refer you to this slide, because when you open your stomach, disgusting things come out.
Ok?
When you are a computer scientist, you have to have a stomach, because you also see disgusting things.
And you have to be prepared.
I get very angry always when you finish a lecture or when you finish a talk, the typical one comes to you and says I want to enter the computer of so-and-so, my girlfriend...
I mean, get into a computer, in the private life of another person, be careful, because it can explode in your hands.
Yes ?
Also think about one thing, we do not stop being people.
And sometimes we see things that you have to know how to swallow.
And as people we also fall, and we fall quite hard.
From here, another moral with the candles is the 15,000 candles, I did not put them, I mean, not only me, I put them with a team of people, it is true that I directed.
If you are going to dedicate yourself to the world of Forense, it is very important to have colleagues, and I will tell you more, to have friends.
You know that you are under confidentiality, but there are many times that you need to explain what you are touching, without giving data, but you really need it.
Also think about one thing, a few years ago the world of cybersecurity and the world of Forense, there was a book a year, and you freaked out.
Right now we are at a spectacular volume of information that you cannot manage, and you need these groups, you need these colleagues, so that they also filter a lot of information.
Know that it is a task that you touch things that you have to be prepared, and you have to have your own resources to get out of this.
As you can see, resource, candles to the side.
One of the good things that we can see is to know what a person has seen.
This, above all, I am finding a lot in work cases.
From here I want to explain to you, the majority of autopsies, or the majority of jobs that you do, do not go to court.
They do not go to court, they simply stay in a report.
The superior of the company can come to you, the manager of the company, the manager of the company, and he will tell you, hey, I want to know what this employee does.
Be careful, be careful.
What have I always told you?
Consent.
To know if you can really look at it or not.
Because if not, you are getting into a big problem.
And then you can make your report, explaining really what time this person comes in, how he works, and really if he is looking pages of his work, or if he is really looking things that do not touch.
So that you know that we have these tools that allow us to know what is seen.
On the subject of what is seen, this is a demonstration that I did, even if it is in Catalan, that sometimes what you see is not what it is.
And here I get into a subject of false evidence.
Forensics, their obligation is to discover the truth.
They are trying to sneak a lot of false evidence.
Evidence can be manipulated, and you know it.
You can change WhatsApp conversations, in this example that I am putting here.
Well, first of all, how can you know that this conversation is false?
So, at sight.
Fast.
Do you know it is false?
Because it is 19.21 and it has 72% of battery.
I mean, and this in my house normally does not happen.
Well, here one of the demonstrations that is usually done when you talk to law schools, when you talk to notaries or judges, you explain that evidence can be manipulated, and that there are some applications that allow you to make the perfect montage of a WhatsApp conversation .
Then this person tells you that he deleted the conversation because he was ashamed, but he has a screenshot.
And this screenshot presents it to you.
Well, you have to show if yes or if no.
Because from here a person can have a big problem, but very big.
Yes ?
Be careful with the false evidence .
Like this one that mounts a WhatsApp, you know, you can mount a Facebook conversation , you can mount a totally false Facebook profile.
I mean , for false is that not even the Pokémon.
You know that the Pokémon, what people learned was not to look for Pokémon, but what people learned is to make a fake GPS and modify its GPS position to play.
Well, now I tell you, to all this generation of Pokémon, that in four days they are going to have a girlfriend, they are going to have a mother, etc., etc., etc., when I tell them where it is, are you going to believe where it is?
Well, this is a reality, that can be changed.
Here we go to the part that interests me the most.
Reproductive apparatus.
In a forensic anatomist, the forensic loves to have a woman.
Not because he has a woman, but because the woman provides more data than a man.
Because you can quickly know if he has had relationships, what kind of relationships, what he has inside, and it gives a lot more information.
In our case, I am going to explain a topic, which are Facebook extortions.
I made a protocol to give it to all bodies and forces for security bodies so that they could help people.
This is a case I am going to explain in which I show you that you do not have to have technical knowledge.
Of the characteristics, I will also tell you, or of my profession, what really fills me up is being able to help.
Because you find yourself in cases where you really see that the person needs help.
And this case that I am going to tell you, it is nothing technical, but you do help the person.
Also, this is true, this one, before yesterday, just when I took the plane, this girl asks me for friendship.
Does anyone see something strange?
Do you see it normal?
Well, yes, it is normal.
Why?
It is normal that an aunt like this, yes, of the 55,000 million guys there are on Facebook, has chosen me.
It shows intelligence, it shows good taste, it really shows many things.
But not only this, it is also that her friend asked me for friendship.
These are the profiles that are used, you know, the typical case of sextortion on Facebook consists of this.
An aunt who is tremendous asks you for friendship.
What I was telling you about humility, let's see kids, let's touch our feet to the ground, do you believe yourself?
No, but people fall.
We are not anyone to judge when we have a victim next to us.
And this is where I touch you and I emphasize you.
The people we deal with, all the people we deal with are victims.
They are victims who are suffering a type of psychological harassment, they are suffering a loss, they have suffered a robbery, and they are people that you really have to know how to deal with.
This is also something that you have to prepare.
You may be a very good technician, but you don't have empathy.
No, work on it, because people really need you.
What I was telling you about the case of Facebook.
An aunt who is tremendous asks you for friendship.
It used to work that in a couple of days she would tell you where she was, she would tell you that she came close to your town, that she was in a room, that she was alone.
And since you had been talking for two days and she had so much confidence, she would tell you, now that we have confidence, I want to ask you a question.
And you, come on, ask.
And she says, do you like sex?
Let's see, an aunt like this asks you, do you like sex?
What will you tell her?
Man, I'm more into poetry, theater, these things, but if you want, let's talk, I'll do it for you.
Let's talk about sex.
Hey, I have a webcam, I do cybersex, wait, Google, cybersex, how does this work?
Okay, cybersex, yes, I know how it works.
And automatically it plugs you into a video in which this aunt puts a montage on you, she makes a striptease, that your ears come out hot from everywhere.
When this video ends, which is a montage, which also tells you, oh, my microphone today, but today I was typing, they are also doing playback, it has roots.
Well, when you've seen it all and you're hot from your ears, it tells you, now you, of course, I've done all this for you, now you do it for me.
Come on, don't be shy, show me your neck, show me your pectorals, show me the only abdominal you have, you see going down, etc., etc.
Okay?
And there are people who come up, okay?
What happens?
When the thing is already totally up, it tells you, I'm going to show you an erotic video and you, yes, come on, bring the video here.
It puts the video on you, and who is the video?
You.
They have recorded you.
And that's when the omelette turns, you go from a party situation to a shit situation, I have a problem and I'm fat.
What is it?
They have my member hanging out there.
And they tell you, as you are a friend of mine of Facebook, your girlfriend is this, your co-workers are these, and your relatives are these.
I'm going to take this video, I'm going to tag you, etc., etc., etc.
Either you pay or problem.
A lot of people get really stuck because they are in a state of shock totally.
The problem was with these cases of sextortion, it was that a lot of people kept quiet and what did they do?
They paid.
And you have a problem because as you pay the first day, you will pay the second and you will pay the third.
The second day will contact not this aunt, but her sister who will tell you, oh, I've seen what you've done to my sister, you're bad, I don't know, I don't know how much.
And from here, click, click, click, to pay.
The people who did not pay, ran to the security guards of the state and said, hey, I have a problem.
What did they do to you?
A complaint.
Also, you stayed there with the face of, hello, I'm explaining here the thousand and one nonsense, it depends on who took you the complaint, because he had a good time.
And that's it.
What happened?
That you went home with a complaint, with a pretty stupid face and with a nose problem.
Why?
Because the sextortionist to whom you came home, beat you to death.
The police had not solved this problem for you.
Okay?
I found cases in which people were really critical and were jumping out of the motorcycle.
Okay?
Because this is one.
But there is also a modality of this that they record you and when they get to the waist, when they get to the abdomen, there is a camera movement, there are some fades, some dark ones, and another body continues, which is not your body.
Okay?
A dummy comes out, which is not your dummy, then it shows that it is not, but a nine-year-old girl comes out next to it .
And the title of the video is Don, uh, uh, great pedophile masturbates in front of a nine-year-old girl.
As you hang these on social networks, goodbye, to life.
Okay?
Well, I managed to create a protocol of how you have to act in these cases.
Gentlemen, it's cold blood, and all you have to do is cut the communication with this sextortionist.
You cut the communication and this person, um, forget it, can't contact you, can't sextortion you, they are mafias, they don't care about anything, honestly.
They don't care about anything.
They go to the number of people.
I had found in cases when I was talking to the sextortionists that I was speaking to them in Spanish and they started speaking to me in Italian or German.
I mean, excuse me?
I mean, that the translator, besides that you are with others, giving them, giving them, yes?
Well, sometimes, look how it is solved, it is solved simply by cutting it.
And our mission is, those of us who have knowledge, well, we have to offer them, yes?
And we have to help our society and we have to help people because this really is a big scourge , ok?
I have five minutes, I'm going very fast.
Um , more things we were talking about, I have told you about the web browser.
One of the things you know we can do in a car is get the passwords that are in the browsers.
This is a really useful tool when you find cases of deceased people.
The subject of deceased people is a subject that is going to be discussed a lot, the subject of digital heritage.
I have found a case recently, a woman, forty-something years old, car accident, yes?
Dead, brutal family grief, husband, takes the phone and social networks and begins to discover the life this person had.
This person gets angry and begins to threaten, using the profile of the deceased woman, begins to threaten all lovers or supposed lovers, yes?
Before there was no record of anything, now there is a record of everything, yes?
And I could tell you about cases of these, I could tell you, but a lot more.
The same with the mail password, which also allows you to extract the passwords, and you know that when you extract a few passwords from the browser and the email account, bingo, we have the password, because you know that everyone uses the same.
And this is where I always stay with all the guys, and I tell them, but do you think that the Forensics use these four little things?
No, really no.
Really tools are used as God commands.
It is also important that people know that not only the bad guys can do whatever they want, but also know that there are people behind that we dedicate ourselves to looking for these evidence and that there is no impunity.
Here everyone thinks that anonymity and impunity, no, no, no.
There is not so much anonymity and there is not so much impunity.
And from here we take care that this is not like that.
I could explain more things about profiles, but I also prefer to give you five minutes in case you want to ask me or consult me about something.
Any questions?
Consult me, please.
Why do they give you the microphone if we don't hear anything?
I have a question.
In the judicial environment, being a computer expert does it need any approval?
Good question.
How is it approved?
If it is legally admitted, well, you are a computer technician and then you are approved and then you go to court to make a report and the judge takes it into account.
Or is there a kind of certificate, a professional competence unit, I don't know how to say it.
No , look, in this slide about profiles, I want to give you some advice.
When you go to study cybersecurity, be careful where you study, because there are courses, courses and other things.
There are associations of experts that are very flamboyant, that when it comes to the truth, they are nothing.
They are a scam like a piano.
Formation is regulated, and the subject of the experts, there we are trying to see if an official school can be created.
Because right now you find that the president of the association owes money to the baker and gives him a title of technological expert quickly.
That's why I tell you that you find in court people who have no level.
You, as a technological expert, you can go either as an official or as a part.
As a part is if the lawyer or the client comes to you, rents your services and you make your report and present it.
And if you go as an official, it's because you're on a list and because you have to, they claim you.
But, unfortunately, right now you only have to prove that you have a technological expertise.
More and more judges are starting to ask and request what real studies you have, what regulated training you have.
I will also tell you, if you like the world of forensics, the world of research, stop going for free.
Hey, there are bodies and forces of the state, which is a very good option.
And each time there is a greater need.
If I were many years younger, right now I would point to that sector.
Tell me.
First of all, thank you for the talk, super interesting.
I wanted to make a comment, well, a little home.
I am in the Computer Engineering School of Cantabria.
There we manage the lists of experts, the judicial list, which we pass to the judges, and the list for part-experts.
Anyone who gets in touch with the school can apply for an expert, we manage it, the circular list, it goes by name, and the requirements that you have to have, basically, first is to be a schoolboy, that is, to be a computer engineer, superior technician,
to have a master's degree, which are the equivalents, and then to have attended at least some of the courses we teach, or that the person believes that he has been in some computer engineering course.
Very good.
If you allow me, to finish, I want to say a sentence, after all the mess of the autopsy, which, I tell you, we had a great time, it was a very fun session, it was a mess, it was a mess.
Dr.
Narcís Bardalet, whom I have the utmost respect for, said a sentence that I kept with her, and it is what I transmit to you here.
And he said to me, you can do more damage with a computer, a technological device, than with a gun .
With a gun, you either threaten or kill.
But how much damage, how much damage can you do with a computer?
We have spoken to you, I have spoken to you about the victims.
These people will also need people prepared to assist them.
Take a good look at the number of new professions that are opening up, thanks to the world of cybersecurity.
And what is for my part, I close this lecture, I leave it at your complete disposal.
You have here my email.
If someone wants this resource, I have it much more worked, this lecture, to give it in their area, in their school, wherever, I tell you that I leave it at your complete disposal.
Thank you very much.