We had out first live show this last weekend (audio podcast will be posted soon). It seems to have been very well received by all who watched. I would love nothing more than to conduct live 4cast shows every two weeks but we have some minor drawbacks.

1) Video quality sux. There is no getting around this. It was blocky and barely watchable. More bandwidth is necessary. I would also like to have guests on cam too.

2) I tried, and failed, to get something set up whereby we could have live callers. My current equipment is somewhat limited (i.e. I have none) and investment is this area is looking more necessary with each passing week.

My current setup is amateur, at best (some may even say “What? You call that a setup?”). I want to make 4cast a lot more professional looking but, in order to do this I would need to upgrade my internet connection (recurring cost) and try to find some more adequate equipment (one-off cost). In order to facilitate this I am going to sell my soul and find some sponsorship. You may say “You’re already sponsored by Digital Forensic Magazine”, well, in short that is an agreement that we have in place but no money trades hands.

What I plan on offering is “on-screen” advertisements, and a spoken advert during the show. We can also offer limited advertising on the website.

If you know of anyone who would be looking to reach over 1000 digital forensic investigators each month with their message please let me know.

Also don’t forget that we are still taking donations. If you have some spare cash and would like to contribute please feel free to live a little and send us some money. Ideally this would have been the way to do things but the donations don’t cover all the costs and allow us to grow how we want.

Please get in touch if you can help!

Watch live video from Forensic 4cast on Justin.tv

I’m happy to say that we now have that set up. For you geeky types (which is pretty much everyone) the IRC channel can be reached by using the following settings in your favourite IRC client.

Chat Room

IRC Server: Lifeline.WyldRyde.org

Port: 6667

Channel: #f4c

If you prefer things to be a little more simple you can get there by following this link http://www.forensic4cast.com/chat.html

All of these details have also been provided on the static page http://www.forensic4cast.com/live/

This coming Sunday (August 15) we’re going to have another first. Episode 33 will be broadcast live.

In order to make this a success we will need a lot of interaction. We currently have Jesse Kornblum and Mark McKinnon lined up as guests so if you want to ask them a question or comment on anything we discuss you can do so in a couple of ways. First you can participate via Skype. Sadly Skype isn’t particularly great at adding calls to current conversations so we’ll have to work backwards meaning that I’ll have to call you on Skype. If you want to participate you can let me know during the show by sending a message on Twitter, emailing, commenting on our Facebook group or page, or by some other means. PLEASE DO NOT SKYPE ME as this will interrupt the broadcast.

Second, I have found a hashtag that we can use on Twitter #f4c. Anything posted with this hashtag will be scrolled along the bottom of the screen during the broadcast. You can use this to ask questions, comment, or just poke fun at me.

You can watch listen to the live broadcast at http://forensic4cast.com/live/ or http://justin.tv/schizophreud

We have our own chat room set up at http://forensic4cast.com/chat.html Just enter a username and you’re good to go (no password needed).

The broadcast will begin at 8pm BST, 3pm Eastern, 12pm Pacific. Hope to see you then!

This is a real report prepared by a real defence ‘expert’. Any references to those involved have been changed.

Sadly I can’t take the credit for finding this gem. The folks at Cranfield University know its origin and share it with their students as a very very bad example. I’d love to hear your thoughts on the report. I’ve also included a pdf of the report at the following location http://www.forensic4cast.com/wp-content/uploads/2010/08/report.pdf

REPORT

1.1 My Qualifications

I am Alfie Moon, MBCS. I work as a Director for The Queen Victoria PH plc, an IT business Management Consultancy. I have worked for The Queen Victoria PH since 1997 and prior- to that I was a Director of Angie’s Den. As a consultant my primary fields of activity are project and organisational effectiveness reviews, in a variety of technical environments and the production of expert reports under Civil Procedure Rules. I am a member of the British Computer Society.

I have worked full-time in the IT industry since 1963. Over this period I have been a programmer, designer, analyst, team leader, project manager and line manager responsible for several hundred staff. I have always, professionally and personally, been an advocate for, and a user of, the PC and internet environment. I have written code, reviewed organisational intra/internets and developed web sites.

1.2 The Charges

I have taken the charges from the Indictment and have addressed the 18 counts individually in the section on findings. Note that these charges all address the possession of indecent photographs of children, not of making them. I have not addressed the issue of whether such photographs were made by Dermis Watts.

1.3 Questions addresses

I was given the following instructions and have responded as indicated in italics

• Nothing that the prosecution expert computer witness asserts in his witness statement should be taken at face value. The evidence presented by Grant Mitchell and DC Phil Mitchell has been reviewed and verified by examination of the floppy disks and computer hard disk.

• Nothing that Dennis Watts says in his police interview should be taken at face value.Noted
• The Defence needs to know whether the images or traces of images of child pornography are actually on the hard disk in Mr Watts’s computer. Internet cache on the hard disk was reviewed; deleted files were recovered where possible and also reviewed.
• Mr Watts cannot remember the dates and times at which he was at home.Noted
• What dates and times were the child pornographic images downloaded from various websites on the internet by Mr Watts’s computer? Addressed in findings
• Can it be confirmed whether or not Mr Watts’s computer was used to download child pornographic images onto floppy disks? Addressed in findings

1.4 Evidence provided

On the 13th May 2002 I was provided with:

1. the Indictment on 18 counts.
2. Statements / Evidence from

• Dennis Watts, draft and final
• Pauline Fowler
• Ian Beale
• Katherine Slater
• Dorothy Cotton
• Phil Mitchell
• Grant Mitchell

On 17^th May 2002 I was provided with:

• PF/1, four floppy disks and KS/1 Time Computer Tower

2. METHOD

2.1 Unsolicited email

Dennis Watts admits to providing his address to an unspecified number of pornographic web sites. In this circumstance I believe that he had no control over the material that might be sent to him, whether it is soft porn, hard porn or child pornography.

I tested this assumption by setting up a free Hotmail account (the web mail service used by Dennis Watts), surfing for porn sites and providing my Hotmail address to the first site that requested it. I received about 5 unsolicited emails, over a 3-day period, as a result.

2.2 Computer

I received the computer for examination on Friday 17^th May 2002. It appears to be a standard Windows 98 machine using Internet Explorer for internet access through Orange Net. I have not used it to connect to the internet.

• There is no password protection in place. This is normal domestic behaviour but it does mean that the full range of facilities provided can be used by a casual user.
• The date and time were incorrect. Specifically the date was 16th April 2002, the time about 05.00. Thus the machine was running about one month, one day and 12 hours slow. I corrected the date and time using normal Windows facilities. I note that the evidence of DC Phil Mitchell of 13th November 2001 states that on initial examination of the computer the date was correct, the time nearly so. I conclude that the machine had been without power for some time.

I installed an undelete facility on the computer to allow me to examine any files that had been deleted by the user. The facility usually allows deleted files to be recovered and viewed. Where the defragmenter utility had been run (to make disk access more efficient or to hide deleted files) this utility is unable to recover deleted files. Note however that the defragmentation process is not selective. It can only be applied to a complete disk.

I undeleted all files possible, 2486 files. The earliest was dated 05/08/93, the latest, prior to my intervention was dated 10/07/01. Prior to that the latest dated 24/06/01. There were no deleted files dated 14/06/01.

I also created a set of folders on the hard drive to contain the floppy disk contents and working images from the internet cache and deleted files.

Once this report was completed I defragmented the hard drive to verify that all the deleted files had in fact been deleted, uninstalled the undelete utility and deleted the hard drive folders that I had previously set up.

2.3 Floppy disks

I received cloned copies of the four disks with the computer. I copied the contents to temporary folders on the hard drive for speed of access and ran the undelete utility on the disks themselves. No deleted files were found on any of the four disks.

2.4 Internet Cache

The intern et cache is a key issue in internet access and it is worth describing the fole it fulfils. All

internet files (formatting, text or images) are, in the first instance, received from the internet into the cache and in this process is not under user control. Where pages are requested from the internet the browser (Internet Explorer in this instance) will, in the interests of speed, first attempt to find the file in the cache. If it cannot be found it will access the file from the internet. As the cache fills up the space occupied by the oldest files will be reused.

While there are exceptions to this general rule (some pages can force the browser to access the internet for a more up to date version), the cache is essentially a good record of intemet access activity. If the user elects to save files then the saving process will copy the files from the cache to the selected location. The original will remain in the cache.

3. Findings

All photographs in the charges are stated to have been in Watts’s possession on 18th June 2001. Findings on them are given individually in the table below.

3.1 Conclusions

There are 18 ‘photographs’ defined in the table above, all located on floppy disks, of which the first 15 are actually photographs. I propose to ignore items 16-18, the .htm files for the reasons given above.

While the computer has clearly been used to surf the net for pornographic sites, some of which deal with incest and child pornography, to interact with internet chat rooms and receive emailed images it should be stressed that, according to my examination, none of the images on the floppy disks that are presented in the charges can be found on the computer hard drive, whether in the internet cache, in deleted files or elsewhere.

3.1.1 Emailed Items

Items 1 to 5 above were received, according to the prosecution evidence with which I have no reason to disagree, in a single email on the 5th June. Dennis Watts admits to having given his email address to an unspecified number of pornography web sites or chat rooms and, in this circumstance, he had no control on what might have been sent to him as a result. It seems to me that, while he had advertised his willingness to receive pornographic mail, he had not advertised a specific interest in child pornography.

The same observation holds for items 6 to 10 and item 11 above for emails received on the 5th and 6^th June.

3.1.2 Were images viewed?

A general question arises on whether Dermis Watts actually viewed any images sent to him. He states that he always loaded pornographic images to his A drive (the floppy disk) for review later. Hotmail was developed for the US market where local calls to internet numbers tend to be free. This is not the case in the UK and Hotmail users here do develop behaviour to limit the cost of telephone calls. While Hotmail will generally open (and therefore present images to the user) any attachments in emails (photographs in this case) it is not invariably so. While my own equipment will do so I have friends who are not able to. It depends on a number of circumstance which can exist in complex combinations:

• The format in which the sender has sent the mail.
• The capability of the receiving computer
• The extent to which the user is ‘computer literate’
• Whether Hotmail itself has been modified, e.g. by the user changing security settings, to accept attachments

My view is that it cannot be proven that Dennis Watts would invariably view any email attachment sent to him before he saved it to a floppy disk.

3.1.3 Items 12 to 14

As noted in the table above I can find no evidence that these images exist on the computer hard drive in either the internet cache or as deleted files.

3.1.4 Item 15

As noted in the table above I can find no evidence that this image exists on the computer hard drive in either the internet cache or as deleted files.

This image appears to be from a Yippee site in Holland. I note that, in Dennis Watts’s witness statement, the police view that he would have needed a password to access this. It seems to me that Yippee is freely available in any language, if he were sent a hyperlink to such a site (as ‘here’s an interesting site, look at it’) then clicking on the hyperlink would have yielded the image. I have accessed the Yippee site directly; though it was empty it appeared to be available for access. I find it unlikely that access to images in this way would be possible without viewing the image.

3.1.5 Were the images on the floppy disk from the computer?

Dennis Watts does not claim that the floppy disks were given to him. It would be possible someone else to ‘fake’ the floppy disk contents but this would require time (to access the appropriate files using another computer, then to transfer them to a floppy disk) and the technical ability (changing the clock on the computer used to ‘fake’ the disk to give the desired time and date). Such a process would not need to make use of Dennis Watt’s computer. As noted the computer is not protected (i.e. it does not requirea user name and password to function).

It should be noted that (unless ‘faking’ was involved) all images written to the floppies would pass via the internet cache on the computer. It is possible, using utilities freely available to Dennis Watts, to delete the content of the internet cache, or to be more complex, to rename them such that they appear to be something completely different.

On balance, if files exist on the floppy disks and also on the hard drive, it can be reasonably assumed that they are the same. The corollary, that If they exist on the floppies but not on the hard drive, leads to the conclusion that:

• The content of the floppies have been faked or
• The contents of the hard drive have been modified

If the contents of the hard drive had been modified by deletion, this should have been visible in the contents of the deleted files.

I believe that the case for ‘faking’ the contents of the floppy disks is supported by the following set of observations:

• Disk 3 contains a number of folders but, in the root segment, are 7 images of children, 3 of one child, 4 of a second child. One image of the second child (0704.jpg) is presented in the charges
• These 7 images on disk 3 all have a modification date (i.e. the date on which they were saved to the floppy disk) of 14/06/01, timed between 10.08 and 10:45
• There is no activity identified (access to the internet or otherwise, or in the deleted files) on the computer hard drive for the date of 14/06/01 other than a game of minesweeper whlch is timed at 17.33.

SCHEDULE SHOWING WHICH IMAGES CAME FROM

WHICH FLOPPY DISK

End of Report

Following expert examination of the hard disk and floppy drives which resulted in the extraction and de-coding of link files from both allocated and unallocated space the defendant pleaded guilty to all (amended) counts and was sentenced to 12 months imprisonment. The above report was NOT submitted in evidence by the defence or used as any basis for mitigation.

Issue 4, released online on August 1st, takes a look at how effective traditional digital forensic techniques are at obtaining forensically sound data in scenarios where computer misuse has been used in attempts to frame the innocent. The DFM team also investigates and details the state of digital forensics in law enforcement around the world identifying which countries are doing well and which have much to do, highlighting the disparity in skills and qualifications between each. In a world that is getting ever more interconnected and one in which international online crime is on the increase, the industry should look to establish and apply minimum standards .

Other features include:

• Preservation of Evidence – How an organization should establish its policy regarding the investigation of a computer crime scenarios
• Psychosocial Forensics – A novel approach to operational forensics
• iPhone Forensics – An exploration of the challenges that the iPhone has introduced for the digital forensic investigator
• In “Meet the DF Professionals”, DF Mag interviews viaForensics’ Andrew Hoog
• Live Data Collection – Ron Tasker asks why we should or shouldn’t capture live data at a crime scene
• Real Time Stenography – A use case for Real Time Network Forensics
• SANS’ Rob Lee asks, “Do you have what it takes to be a digital forensics pro?”

As well as the usual book reviews, legal section and product reviews, readers are given the chance to win a free ticket to the SANS Digital Forensics and Incident Response summit either in the UK in September 2010, or in the US next July 2011.

Digital Forensics Magazine issue 4 is published online on August the 1st and digital subscriptions start at under GBP30. Users can upgrade their subscription to the print and digital version for only GBP10 at any time.

To subscribe to Digital Forensics Magazine please visit www.digitalforensicsmagazine.com.

Digital Forensics Magazine is the flagship publication of TR Media Limited, a UK-based company which specializes in publishing academic quality consumer magazines and books for the information security sector. Digital Forensics Magazine combines the depth and research of the best academic journals with the more traditional consumer feel of a trade magazine. For more information, please visit www.digitalforensicsmagazine.com

With Football (soccer) season just around the corner I have been bombarded with requests to join many different fantasy football leagues. While I was deleting one such email a thought entered my mind. Why not start a Fantasy Forensicator League?

The idea is quite simple, as with other fantasy leagues you’d get a certain amount of virtual cash with which to build your elite team of forensicators. You could choose, lets say, five people to be on your crack squad. Points would be awarded for various accomplishments. I thought something like the following would be awesome:

Giving a presentation – 10 points

Writing a whitepaper/blog post – 5 points

Being on a podcast – 10 points

Releasing a new piece of software – 20 points

Appearing on local radio – 15 points

Appearing on national radio – 20 points

Appearing on local TV – 20 points

Appearing on national TV – 30 points

I’m sure there are loads more. What can you think of?

The event itself was fantastic I was able to watch presentations given by some of the biggest and best in the field today including Jesse Kornblum, Harlan Carvey, Troy Larson and many others. Mark and I also had the opportunity to give our presentation on Volume Shadow Copies and show a little of what Shadow Analyser will do once we release it. We seem to have gotten some positive feedback from it too. Thanks to the presentation I was even allowed to walk away with on of the SANS ‘Lethal Forensicator’ RMO. It is very nice and more people should carry them.

On the Thursday night we held the second annual Forensic 4cast Awards, the winners have already been listed on here so I won’t do it again but I will say that it was well attended and a lot of fun. I’m working on providing some more footage of the event to post online.

All in all this whole thing was awesome. Well worth attending. Next year’s summit will be moving from Washington DC to Austin, Texas. As you have nearly a year until then it is worth your time making sure that you can attend.

On a side note, while we were in DC Mark and I had the chance to go to see the Iwo Jima memorial and the Arlington Cemetery thanks to our friend Jerod. While the visit didn’t have anything to do with forensics I thought that I would share my feeling about this place.

It is both tragic and inspiring at the same time. Seeing the rows upon rows of graves of those who faithfully served their country until the end humbles me. I think of their contributions to the world, for their shortened lives, and feel not only gratitude but also a deep sense that I need to do more. Why should people like that waste their lives for me to be satisfied with mediocrity? No. I will make sure that, whatever I am and whatever I become, I’ll strive to be the best so that people like them did not, and will not, die in vain.

Now, this DOES apply to forensics. There are many in this field who continue to ‘coast’. They do their work and go home. While this is admirable I fear that it is not enough for the future. We should be actively engaged in researching and presenting our research so that all in the field can benefit from our cumulative knowledge. Let’s not wait for someone else to make the big discoveries, let’s jump in and do it ourselves.

The 2010 winners are listed below:

Outstanding Contribution to Digital Forensics – Individual
Rob Lee

Outstanding Contribution to Digital Forensics – Company
SANS

Best Digital Forensics Blog
SANS

Best Digital Forensics Book
Windows Forensic Analysis 2E

Best Digital Forensic Podcast
Inside the Core

Best Computer Forensic Hardware
Tableau T8

Best Computer Forensic Software
FTK Imager

Best Phone Forensic Hardware
Cellebrite UFED

Best Phone Forensic Software
Mobilyze

Digital Forensic Investigator of the Year
Nick Furneaux

Lifetime Achievement
Craig Wilson

You can place your votes here:

http://forensic4cast.com/2010/06/16/forensic-4cast-awards-2010-voting-is-open/

Happy voting!

As you may (or may not) know Mark McKinnon, Disklabs and I are working together on a project that we call ‘Shadow Analyser’. We have put a lot of time and effort into this and hope to have it released very soon.

This last week The Register published an article about our upcoming software. If you have a few minutes it is well worth a read. It is funny to see my own name being published in such a reputable web page. Maybe I really AM the Amy Winehouse of digital forensics, then again…

Anyway, here’s the link:

http://www.theregister.co.uk/2010/06/30/shadow_analyser_digital_forensics/

JUMPING OUT OF A FREAKING AEROPLANE!!!

I’m trying to get hold of the video and will post it as soon as I have it. But it raises several questions; Have any of you tried to do anything to liven up your day-to-day forensics work? Will this spur on more radical behaviour? What other extreme forensics can you think of?

Anyway, here they are. Feedback is appreciated and, if you’re in contention for an award this year – how much more do you want one now? If you’re not in contention for an award – go out and convince people to nominate and vote for you in 2011.

And yes, that is pin-point accurate laser engraving. Nice.

SANS have announced that both the Forensic Challenge Awards and the Forensic 4Cast Awards will be open to anyone that wishes to attend. This will be the case whether or not you are a delegate for the summit.

This is superb news and I’d like to say a huge thankyou to SANS for making this possible. If you’re going to be in the DC area on July 8 2010 please make sure to stop by and attend the awards. If you can’t be in DC for the awards, I would first ask “WHY NOT?” but then I’d console you and tell you not worry too much as SANS are also pushing the awards out by simulcast. We’ll have the link for you closer to the time but that is awesome. This means that you have no excuse to not attend in some capacity.

I’ve also been informed of the possibility of food (this is yet to be confirmed though). Even if the entertainment of the awards doesn’t entice you to come the food should!

This should be an exceptional event as there all kinds of people will be there, from Rob Lee, to Harlan Carvey, to Mark McKinnon. Its your chance to meet these pillars our our community and to commiserate them when someone else wins their awards

The times for the awards are:

• 630 PM Forensic Challenge Awards
• 730 PM Forensic 4Cast Awards

The events will be held at:

Fairmont Washington DC
2401 M Street, NW
Washington, DC 20037

Now, on to the next item of business… anyone out there willing to perform a song or two for the awards?

I have a day job doing forensic investigations. This is a full time job and quite demanding at times, but I’m paid well enough by Disklabs to see past the less enjoyable parts of the job and focus on the upside.

When I come home in the evenings I can often be found preparing for the next episode of the podcast, doing some research, or writing an article. Am I paid for doing any of this? No. I receive donations from time to time but these are used to sustain the podcast. I also receive items from time to time, t-shirts, software, and so on. These are sent to me by kind people that are associated with Forensic 4cast in some way.

I have poured hundreds of hours into Forensic 4cast over the last two years, none more so than with the Forensic 4cast Awards. This event is held at my own expense. It is entirely voluntary. I receive no payment of any kind for organising and hosting the event. Yes, this year SANS have been kind enough to provide a venue for this, for which I’m very grateful, and someone else has kindly offered to provide the physical awards for distribution. Let me reiterate…

I do not receive ANYTHING for this event. I do not take sponsorship, I do not take payment, I do this  for the sole purpose of giving a few hard working people, those that are the pillars of the forensic community, some much needed recognition. I completely resent any implication that I’m doing this for some ulterior motive.

Next year things will change. I’m going to get a bit more organised and get in some volunteers to assist. I’m also going to remove ‘Forensic 4cast’ from the title of the awards and call it the ‘Digital Forensic Awards’. That way people can’t complain that I’m even doing it for publicity purposes. I do this because I love doing it.

Sorry, I just wanted to make sure that everyone knew exactly what benefit there is for me in organising the awards and maintaining the podcast. As for the naysayers (and no its not Luby or Kovar) why don’t you try doing something more productive than tearing others down. Why not focus all of that energy into doing something productive and bettering the field instead of trying to pull people down? </rant>

You will also notice that the categories will have two, three, or four nominees. This is because the nominations were so close. We didn’t want to pick and choose so we’ve just left it all up to you.

Finally. We’ve decided to take the ‘Lifetime Achievement’ award off. We will still be presenting an award for this but it will be at the discretion of Forensic 4cast. This is likely to be the case for this category from now on.

Anyway, as before we’ve asked that you give your name and email address just so that we can stop people from spamming.

Voting will close on July 6 2010. That’s only three weeks so get voting!