With Football (soccer) season just around the corner I have been bombarded with requests to join many different fantasy football leagues. While I was deleting one such email a thought entered my mind. Why not start a Fantasy Forensicator League?

The idea is quite simple, as with other fantasy leagues you’d get a certain amount of virtual cash with which to build your elite team of forensicators. You could choose, lets say, five people to be on your crack squad. Points would be awarded for various accomplishments. I thought something like the following would be awesome:

Giving a presentation – 10 points

Writing a whitepaper/blog post – 5 points

Being on a podcast – 10 points

Releasing a new piece of software – 20 points

Appearing on local radio – 15 points

Appearing on national radio – 20 points

Appearing on local TV – 20 points

Appearing on national TV – 30 points

I’m sure there are loads more. What can you think of?

The event itself was fantastic I was able to watch presentations given by some of the biggest and best in the field today including Jesse Kornblum, Harlan Carvey, Troy Larson and many others. Mark and I also had the opportunity to give our presentation on Volume Shadow Copies and show a little of what Shadow Analyser will do once we release it. We seem to have gotten some positive feedback from it too. Thanks to the presentation I was even allowed to walk away with on of the SANS ‘Lethal Forensicator’ RMO. It is very nice and more people should carry them.

On the Thursday night we held the second annual Forensic 4cast Awards, the winners have already been listed on here so I won’t do it again but I will say that it was well attended and a lot of fun. I’m working on providing some more footage of the event to post online.

All in all this whole thing was awesome. Well worth attending. Next year’s summit will be moving from Washington DC to Austin, Texas. As you have nearly a year until then it is worth your time making sure that you can attend.

On a side note, while we were in DC Mark and I had the chance to go to see the Iwo Jima memorial and the Arlington Cemetery thanks to our friend Jerod. While the visit didn’t have anything to do with forensics I thought that I would share my feeling about this place.

It is both tragic and inspiring at the same time. Seeing the rows upon rows of graves of those who faithfully served their country until the end humbles me. I think of their contributions to the world, for their shortened lives, and feel not only gratitude but also a deep sense that I need to do more. Why should people like that waste their lives for me to be satisfied with mediocrity? No. I will make sure that, whatever I am and whatever I become, I’ll strive to be the best so that people like them did not, and will not, die in vain.

Now, this DOES apply to forensics. There are many in this field who continue to ‘coast’. They do their work and go home. While this is admirable I fear that it is not enough for the future. We should be actively engaged in researching and presenting our research so that all in the field can benefit from our cumulative knowledge. Let’s not wait for someone else to make the big discoveries, let’s jump in and do it ourselves.

The 2010 winners are listed below:

Outstanding Contribution to Digital Forensics – Individual
Rob Lee

Outstanding Contribution to Digital Forensics – Company
SANS

Best Digital Forensics Blog
SANS

Best Digital Forensics Book
Windows Forensic Analysis 2E

Best Digital Forensic Podcast
Inside the Core

Best Computer Forensic Hardware
Tableau T8

Best Computer Forensic Software
FTK Imager

Best Phone Forensic Hardware
Cellebrite UFED

Best Phone Forensic Software
Mobilyze

Digital Forensic Investigator of the Year
Nick Furneaux

Lifetime Achievement
Craig Wilson

You can place your votes here:

http://forensic4cast.com/2010/06/16/forensic-4cast-awards-2010-voting-is-open/

Happy voting!

As you may (or may not) know Mark McKinnon, Disklabs and I are working together on a project that we call ‘Shadow Analyser’. We have put a lot of time and effort into this and hope to have it released very soon.

This last week The Register published an article about our upcoming software. If you have a few minutes it is well worth a read. It is funny to see my own name being published in such a reputable web page. Maybe I really AM the Amy Winehouse of digital forensics, then again…

Anyway, here’s the link:

http://www.theregister.co.uk/2010/06/30/shadow_analyser_digital_forensics/

JUMPING OUT OF A FREAKING AEROPLANE!!!

I’m trying to get hold of the video and will post it as soon as I have it. But it raises several questions; Have any of you tried to do anything to liven up your day-to-day forensics work? Will this spur on more radical behaviour? What other extreme forensics can you think of?

Anyway, here they are. Feedback is appreciated and, if you’re in contention for an award this year – how much more do you want one now? If you’re not in contention for an award – go out and convince people to nominate and vote for you in 2011.

And yes, that is pin-point accurate laser engraving. Nice.

SANS have announced that both the Forensic Challenge Awards and the Forensic 4Cast Awards will be open to anyone that wishes to attend. This will be the case whether or not you are a delegate for the summit.

This is superb news and I’d like to say a huge thankyou to SANS for making this possible. If you’re going to be in the DC area on July 8 2010 please make sure to stop by and attend the awards. If you can’t be in DC for the awards, I would first ask “WHY NOT?” but then I’d console you and tell you not worry too much as SANS are also pushing the awards out by simulcast. We’ll have the link for you closer to the time but that is awesome. This means that you have no excuse to not attend in some capacity.

I’ve also been informed of the possibility of food (this is yet to be confirmed though). Even if the entertainment of the awards doesn’t entice you to come the food should!

This should be an exceptional event as there all kinds of people will be there, from Rob Lee, to Harlan Carvey, to Mark McKinnon. Its your chance to meet these pillars our our community and to commiserate them when someone else wins their awards

The times for the awards are:

• 630 PM Forensic Challenge Awards
• 730 PM Forensic 4Cast Awards

The events will be held at:

Fairmont Washington DC
2401 M Street, NW
Washington, DC 20037

Now, on to the next item of business… anyone out there willing to perform a song or two for the awards?

I have a day job doing forensic investigations. This is a full time job and quite demanding at times, but I’m paid well enough by Disklabs to see past the less enjoyable parts of the job and focus on the upside.

When I come home in the evenings I can often be found preparing for the next episode of the podcast, doing some research, or writing an article. Am I paid for doing any of this? No. I receive donations from time to time but these are used to sustain the podcast. I also receive items from time to time, t-shirts, software, and so on. These are sent to me by kind people that are associated with Forensic 4cast in some way.

I have poured hundreds of hours into Forensic 4cast over the last two years, none more so than with the Forensic 4cast Awards. This event is held at my own expense. It is entirely voluntary. I receive no payment of any kind for organising and hosting the event. Yes, this year SANS have been kind enough to provide a venue for this, for which I’m very grateful, and someone else has kindly offered to provide the physical awards for distribution. Let me reiterate…

I do not receive ANYTHING for this event. I do not take sponsorship, I do not take payment, I do this  for the sole purpose of giving a few hard working people, those that are the pillars of the forensic community, some much needed recognition. I completely resent any implication that I’m doing this for some ulterior motive.

Next year things will change. I’m going to get a bit more organised and get in some volunteers to assist. I’m also going to remove ‘Forensic 4cast’ from the title of the awards and call it the ‘Digital Forensic Awards’. That way people can’t complain that I’m even doing it for publicity purposes. I do this because I love doing it.

Sorry, I just wanted to make sure that everyone knew exactly what benefit there is for me in organising the awards and maintaining the podcast. As for the naysayers (and no its not Luby or Kovar) why don’t you try doing something more productive than tearing others down. Why not focus all of that energy into doing something productive and bettering the field instead of trying to pull people down? </rant>

You will also notice that the categories will have two, three, or four nominees. This is because the nominations were so close. We didn’t want to pick and choose so we’ve just left it all up to you.

Finally. We’ve decided to take the ‘Lifetime Achievement’ award off. We will still be presenting an award for this but it will be at the discretion of Forensic 4cast. This is likely to be the case for this category from now on.

Anyway, as before we’ve asked that you give your name and email address just so that we can stop people from spamming.

Voting will close on July 6 2010. That’s only three weeks so get voting!

A couple of weeks ago I wrote a post about how there is a growing trend for forensic investigators to feel like they know enough and that there is little else to learn. I defy anyone to attend this summit and walk away not feeling as if they have a lot more to learn.

That being said, what will be discussed at this summit? I’m not going to give a summary of every presentation and panel, but I’m going to provide you with some of the highlights that I’m looking forward to.

Harlan Carvey will be presenting on Registry and Timeline Analysis. If you know Harlan or have used Regripper you know that this is Harlan’s area of expertise. What a tremendous opportunity to learn straight from one of the best in the field.

Jeff Hamm and Robert Shullich are presenting on the dissecting of the exFAT file system. I’m personally very interested to hear all about this.

Troy Larson of Microsoft (a small Seattle -based software company) will be presenting on forensic issues relating to Windows 7. With Windows 7 taking an increased percentage of the OS market we can’t afford to stand by and ignore these issues.

Jesse Kornblum will be presenting on fuzzy hashing. A key method of identifying known data. Should be a great presentation.

And that leaves me. Of course I’m going to talk about  my presentation the most, mostly because I’m a shameless self-promoter, but also because I believe my presentation has significant value. My presentation ‘Shadow Warriors’ will take place from 3:20pm until 4:20pm on the second day. I will be presenting with Mark McKinnon of Red Wolf Computer Forensics. Our presentation will focus on how to manually dissect Microsoft ‘difference files’ (commonly known as volume shadow copies), but this is not all. We will also be demonstrating our upcoming forensic software ‘Shadow Analyser’. It is well worth your time to go to the summit just for this presentation

There are many other reasons to attend but one more item that I want to discuss (again due to the shameless self promotion) is the Forensic 4cast Awards. This event will take place on the evening of the first day and will be fantastic. Speaking of which don’t forget to post your nominations and votes.

The SANS Forensic Summit 2010 will take place on 8th and 9th July 2010 at the Fairmont, Washington DC.  Full details can be found at http://www.sans.org/forensics-incident-response-summit-2010/. Hope to see you there.

Whereas last year Simon and I stood in front of a camera and broadcast the event live, this time a live audience will be in attendance meaning that several of the winners will be there to pick up their awards, give speeches, etc. Yes, you did read that right… there will be actual physical awards presented this year too.

What should you do next?

Well, sadly the nominations for this year’s awards are now closed. Nominations will reopen next year.

I’ve been working at Disklabs for a few weeks now. I’ve mostly been confined to the digital forensics lab but I’ve been able to poke my head out from time to time and see what the data recovery department are up to. I’m happy for this opportunity as it has taught me some interesting things that are useful for computer forensics, and some things that are potentially dangerous.

Over the next few weeks I’ll be posting articles about how data recovery has the potential to impact computer forensics in ways that few have thought possible.

A scenario occurred recently in which an employee left a company on less than gracious terms. The next day the employee’s former colleagues showed up for work and realised that the file server was inoperable. Upon closer inspection they found that all of the server’s drives were blank. Forensic analysis was conducted and nothing was found. If the drive had been wiped it had been done so with undetectable software. The forensic investigator, and the tools at his disposal, had failed to provide an adequate answer.

What would you do in a situation like this? I imagine that my report would be very sparse and contain very little information at all. You could look at wiping software artefacts, such as the sequence of bytes used, in order to determine if this individual had maliciously wiped the data from the drive but, failing this, what other avenues of investigation could be followed?

One of the first things I learned after starting at Disklabs was that each hard drive contains certain information that is not stored on the platters, but on the system area of the drive. The two items that I found to be of most interest are the number of times the drive has been powered on and the number of hours that the drive has been active. This may not seem like a huge finding but the implications are awesome.

Going back to our scenario the hard disk drives were turned over to a data recovery expert who was able to unequivocally state that the drive had only been powered on a handful of times and only had only been in operation for a few hours. What does this means in terms of this investigation? We can draw one of two conclusions either the drives had been replaced as a result of drive failure or they were replaced as a deliberate act intended to deceive. As it turns out the IT department of this company stated that the original drives should still be in operation inside the file server and that the information provided by the data recovery expert contradicted their own opinions.

The original drives were recovered from the former employee’s home a few days later.

My short time at Disklabs has proven to me that we need to educate ourselves on these matters. How can we offer opinion or facts in our reports if we haven’t covered every possibility?

CriminoBlogica is a high-quality internet resource for people interested in criminology, forensics, and general law enforcement. Their authors write articles focusing on collecting useful criminology resources from all over the web, as well as offering general advice to anyone interested in pursuing a career in criminology.

I take great pride in this website so it is always nice to have some recognition now and again.

The article can be found here:

http://www.mastersincriminology.com/top-50-criminology-blogs.html

The same goes for any new developments in the field. If we don’t keep up with all the latest developments how do we expect to be able to conduct a full investigation?

I have noticed a worrying arrogance lately in that digital forensic investigators believe that they know all that they need to know. They’ve been on all the AccessData and Guidance courses that are on offer, so they have all the knowledge they could ever hope to amass. There is no more room for progression.

This is incredibly dangerous not only to the analyst, but to the people that we represent.

A little while ago a friend of mine conducted an investigation for a police force. I remember him working very hard to experiment and test his findings, like any good examiner. He sent his report to the relevant authorities and got on with his next case.

Some months later the defence report arrived on our doorstep. This report was compiled by a digital forensic investigator professing nearly 20 years experience in the field.

His report went on to attack my colleague’s findings. This is not unusual but the manner in which he tried to do this left me feeling completely stunned.

The report was simply dismissive. This ‘veteran’ stated that he did not believe my colleague’s finding were accurate. He did not give any justification for this, he did not conduct any testing, he just said something along the lines of “I know of no method to recover this data so his findings must be incorrect.”

What?

I couldn’t believe this. At what point does an investigator allow himself to interpret his own limited knowledge as fact? It is disturbing and I hope that I never fall into this trap.

The question I would ask is: How do we safeguard against such arrogance? Clearly our field is intellectual and we know a great deal but how do we stop ourselves from becoming like this examiner? How do we keep ourselves firmly anchored?

In this episode we discuss the Gizmodo/Apple situation, the death of privacy, forensicating photocopiers, more on schools spying on students, and a potentially dangerous exploit that could put digital forensic investigations at risk.