Zombie-Cases:  Did you ever have a case that just wouldn’t die?

I just finished up Case Study #8, with one of those types of cases that just won’t die.  If you ever had a case like that, you know what I mean.  If you don’t know, it simply means that as much as you try to close a case (“kill it”), it keeps coming back to life.  This happens with both civil and criminal cases (and internal corporate matters as well).

A few reasons that a case may live on well past the time you wish it would are; 

  •          You keep finding more evidence, even after the investigation is over
  •          Corners were cut and now the devil is calling
  •          The attorney keeps asking for more work on it
  •          Trial comes and goes, then comes back again, then goes, then…
  •          Evidence you initially found is now found to be inaccurate
  •          Interrogatories and interviews come and go and come and go and keep coming
  •          More jurisdictions join in
  •          Case agents/officers keep changing and rotating and being reassigned
  •          Errors that were made are now coming to light, just in time for court
  •          Reports are missing or don’t contain necessary information
  •          And worse yet, the case hits the news

Case Study #8 takes a case that has a few of these things, but as for how to keep a case from coming back to life, there are things you can do to reduce the risk.   The most important method is to do a thorough job.  Doing a good job will reduce the chances of a zombie case by 90%.  Do good work, double-check your work, triple-check it, and you have less than a 10% chance of it biting you later. 

The remaining 10% chance of your case turning into a zombie is probably out of your control.  If you are given the wrong information, evidence is misinterpreted, or workers in your case don’t do a good job, there is a good chance that the 10% zombie case is coming for you.  And of course, if the suspect wants to fight tough-and-nail, it will drag on.  However, if it is bad enough (ie: news worthy because of investigator ERRORS), and someone leaks it to the news media, you now have a full-blown zombie breakout that will last not only years, but perhaps the better part of your career.

Back to preventing the zombie-case outbreak

Do a good job.  Even on those cases that seem minuscule at the time.  You never know how one seemingly insignificant case can end up reaching the Supreme Court, and not because you did a good job, but just the opposite.  Trust me.  I’ve seen it.  Seriously.  Do a good job, because when it happens, it is so much better to be the person that did a good job in the case and not be the one that screwed something up.

0
  160 Hits
  0 Comments

"I don’t want to learn.  Just give me the answer."

Figure it out

It’s been more than a few years since I was in the Marines, even though it still feels like yesterday.  Although it has been decades (has it really been that long?), it seems that I am still learning lessons today that the Marine Corps exposed me to back then.  I mean that in the sense that many times I come across an obstacle in life or work that is solved by falling back on the little things I learned way-back-when.  One of the biggest lessons I ever learned: Figure it out.

I give credit to technology for making our lives easier, which doesn’t always mean for the better.  If you don’t know something, you can ask Google and get the answer.  In fact, as you type your question, Google practically reads your mind and finishes your question for you while at the same time, giving you an answer.  I believe that this part of technology is a disservice, especially those in the DFIR field because being told the answer is not the most important thing compared to personally finding the answer. It is the journey, not the destination.

My first response to being asked “how to do something” is “Did you try everything you know before asking me?”  Whether it is a student or a peer, if I am asked a question, I naturally assume that everything possible was tried before asking me.  If not, I question the question of asking in the first place because asking without trying to figure it out yourself is simply asking for the answer.  You are asking to get to your destination without taking the journey.  You are asking someone to do your homework for you.  This is the easy way, the wrong path to take, and will gradually put a cap on your skills.  Try before asking.  Then try again.  At some point you will run out of different attempts and then when you ask, I know (or will assume) that you tried everything you know how to try.  Hopefully before that comes, you will find the answer before asking for your sake. Giving the answer will not be helpful if you have the ability to figure it out yourself.  By the way, it is way easier for me to answer a question than it is to push and prod for the student to figure it out.  Answering takes me 15 seconds while being patient to watch the process can take a lot longer...

I teach the Figure It Out* method because the Eureka!  moments are those times where you learn something that you will never forget. It is embedded into your cranial cavity as if you were the first person to ever discover that answer.  In reality, everyone could have known the answer before you, but as far as your brain is concerned, you did it first and therefore, will remember it forever because you discovered it.  This doesn’t work if someone tells you that “C” is the correct answer.  You will forget being given “C” as the answer minutes afterward but you will remember the “Ah ha!” discovery for a lifetime.  You will actually be able to figure out more problems because of increased confidence.  It's a good cycle to be in.

But, I have found that some people don’t want to take the journey to discovery.  They truly just want the answer for a varied number of reasons, which are technically defined as excuses.  Procrastination is not a reason.  Laziness is not a reason.  Not caring is not a reason.  Because Google answers it for you is not a reason.  I tend to feel that we need ‘figuring it out by yourself’ as a high school class, where cell phones are not allowed, nor any Internet, in order to teach that using our own brain is what solves problems. 

As far as how the Marines do it….when given the order to “Have your squad at this point by 0300” or "get across that river in the next 45 minutes", there were no answers on how to do it, what to take, what to eat, what to wear, or when to leave.  There were no expectations of failure or answers to what happens if you fail.  No Google either. Simply, you are given a mission and you figure out how to complete it.  That is what we do in DFIR.  We figure it out.  We have to.

 

How to figure it out

I'd be remiss in not giving some guidance on how to figure it out, or at least how to ask a question.  Firstly, depending on what you are doing, figuring it out is going to be different every time.  Basically;

1. Read the instructions, try and fail.

2. Figure out where the problem started and,

3. Try again.  If fail..

4. Go back, read the instructions and guides again, try to find where the error may be solved.

5. Try again.  If fail...

6. Get online and search.  Forums, support/chat rooms, email lists.  Find someone who has documented the same problem.

7. Try the suggestions that you found.  If fail...

8. Put together your question.  Do not ever ask, "Hey, this thing doesn't work.  Can you make it work for me?".  Rather, write up your question like a mini-research project: 

   -"I wanted to do this."

   -"But I got this error."

   -"So I tried this and got this error."

   -"Then I searched for an answer and found these suggestions."

   -"I tried again with the suggestions and got this error."

   -"I don't know what else to try.  Can you point me in the right direction?"

When I get a question like this in class, I am happy.  Maybe a few more tries would have done it, but there is a point where if each try is simply repeating the exact process without changes, it is time to stop and ask.  Part of the learning process in DFIR is self-learning.  That which you cannot teach yourself, take a course in that topic.  Read books.  Engage in conversations about the topic.  Practice and research.  The last thing that should on your mind is thinking that "I'll just ask for the answer" without first making some effort to learn first.  

*I can't claim credit for the "Figure It Out" method, since it was yelled at me by many senior Marines until I Figured It Out.

1
  506 Hits
  0 Comments

5 Cool Things You Can Do with the Windows Forensic Environment (WinFE)

I’m a fan of WinFE.  I’ve used it, written about it, helped develop it, taught it, and assisted others to teach it.   The way that I talk about it, you’d think that WinFE is the best thing that ever came along, does everything you need in forensics, and nothing can out do what it does.    Actually, WinFE doesn’t do much at all.  But that for what it does, it does ingeniously.

The top 5 cool things

#5 Forensically boot a Windows, Mac, Linux machine to a Windows Forensic Environment

#4 Forensically Boot a Surface Pro to a Windows Forensic Environment

#3 Image storage drives (full, sparse, or targeted) with Windows tools

#2 Perform a triage or preview with Windows tools

#1 Do a complete exam with Windows tools on the evidence machine

There are even more things you can do as well that makes WinFE cool, but this is a good start.  Being a free tool makes it cool too.

What’s the big deal?

WinFE forensically boots to Windows. That means you can use Windows-based forensic tools!

The numbers

3,447  *  Years ago, I threw together a quick WinFE online class for free.  Over 3,000 took the course before I eventually took it offline since WinFE has had several updates since the course was developed. 

5,592  * I recently put on a longer Forensic Operating System course (that focused on WinFE more than other live CDs) and as of today, more than 5,500 have taken that course.  

15,000  * That’s the number where I stopped counting the downloads of the WinFE script and various WinFE builders from over the years.  That doesn’t mean 15,000 WinFE users, just that it is a lot of downloads of past and current WinFE build projects.  That also does not include WinFE basic builds where Microsoft downloads are required (and not a WinFE project).

The point is that WinFE is a valid tool used by many, and since there is no marketing department for it, I'm marketing it because I use it and prefer that it remain relevant in the community...so I can keep using it :)

The latest WinFE course

I had been asked for a new course just on WinFE and not any of the other live CDs, so here it is.  I included the multiple types of WinFE builds including Windows To Go in order to cover everything about a Windows-based, forensically sound, bootable operating system.  This course is only for those who did not take the Forensic Operating System course, since the WinFE information is the same in both courses.

Of course there is a promotion 😊

For any course I publish, you probably noticed that for a few days, I have a promotional discount.  This course is no different.  I ask that you share the promotion because invariably I get emails asking to extend the promotion (no extensions….sorry).


 


The Windows Forensic Environment social group

Since WinFE isn’t a commercial tool, with no developers or support staff, it has been pretty much living on its own, being pushed about by its community of users.  Searching for WinFE gets you about a dozen websites, most of which is outdated information, without any sole collection point.  Therefore, there is now a group for it. 

 

I will be putting everything in the social group as it comes up in terms of updates to WinFE building, usage, powerpoints for training, and curriculum if you want to have a turn-key model to add it in a forensic course that you teach.  Only those who have registered for either this new WinFE or Forensic Operating System course are invited.  The social group is a repository for community support, related downloads, and updates to the WinFE projects; it is not a beginner’s class in what WinFE is.

The time to self-learn WinFE can take days. There is no help desk, tech support, help line, or single point of reference information for WinFE.  If you don’t have patience to self-learn how to build it, you will give up.  Even tho the Internet is full of instructional guidelines, the good is intermingled with the outdated.  This course is the most current and up-to-date WinFE building and the WinFE social group will have all future updates for you to get it right the first time.

ps: Pass the quiz at the end of the course and receive a certificate of course completion (3 hours) in the instruction of building and using WinFE.

1
  285 Hits
  0 Comments

Make DFIR easier to learn with visual aids (and teach students to share their work)

In my most recent course that I was teaching, the question of imaging speed came up during the hands-on imaging practicals (it's always the same question, "How can I make it go faster?").  My go-to illustration of imaging tests has been referring to Eric Zimmerman's imaging tests.  However, I tried something different this time.   I used Eric's tests (both imaging and software testing) and converted the spreadsheet data as visuals.   The visuals made all the difference, especially given mixed language in the course (as the course was not just in English…so it was a bit more difficult to get points across at times).  

With the visuals, it was easier for the class to see that some speed differences in the tests are slight enough to be irrelevant (in that personal preference of a tool may override the speed of another tool without detriment), while other speed differences are glaringly too far apart to rationalize a personal choice over a more logical choice when speed is important.  I ended up adding a separate lesson in doing personal testing, documenting the tests in the fashion of Eric Zimmerman's, and using the results to base decisions upon.  Nearly every slide had the same suggestion: "SHARE YOUR WORK'.   By sharing, I mean giving it away or selling it or teaching it or sharing it in any means you desire for fun or profit.  Just get your work out there.  

Eric set a standard in documenting imaging speed tests, but he also did something else; he showed that documenting and sharing tests results impacts the community globally for years as it is referenced constantly.  His test also shows that this is something any of us can also do.  If you think that your work is but a sliver in what can or should be done in sharing, keep in mind that a sliver to you is most likely an amazing bit of knowledge for someone else.  And by sharing, I mean publish, teach, show, or compare your work with others.  Most of the innovative developments in history have been inspired by a sliver of an idea.

The fear that your public work will be critiqued is real, not just because it will be, but because it must be.  Public peer-reviews require thick skin and a willingness to accept being wrong, and how to improve our work.  It also shows that you have the guts to put yourself out front, which any job in DFIR requires anyway.  Do it and be prepared to learn from your peers when your work is peer reviewed.  That is your goal: peer reviewed research that you personally conducted.  As a side benefit of sharing your work, software developers will certainly look at what you have documented to see where their tool stands.  Regardless of their tool is on the top or bottom, the tests show how developers can improve their tools, which benefits you (and me) directly.

About the critiques of your shared research….in a perfect world, everyone plays nice, is polite to each other, and we support the work of our peers with respectful and productive discussion.  But don’t expect that every time, and accept that some folks just aren’t nice.  Actually, be prepared for someone to be dismissive, impolite, and even downright disrespectful.  It happens because people are people.  My personal opinion is that everyone should be respectful or not say anything at all.  However, “polite” is not a word in the vocabulary of some.   Still, don’t let that stop you moving DFIR forward with your shared work and ideas.  Each of us have a choice to follow the path that others have blazed or we can blaze a trail that others will follow.  Blazing a trail sometimes means going the wrong way or hitting a dead end...you will be wrong on occasion.  

Back to the point of visuals in training: Here one example of turning Eric’s work into visual aids.  The takeaway in these visuals is not that a visual is ‘better’ than a spreadsheet, but that it is (1) different, and maybe (2) more appropriate for specific audience types.  The imaging example is just an example of practically anything in DFIR that can be more easily described in a visual compared to rows and columns, depending upon your goal of showing data.

I will post my slidedeck at some point, but I hope you got the point of taking complex data and painting a picture with it to make it easier to digest.

 

1
  623 Hits
  0 Comments

Dragnet: 2018

Definition of dragnet

1a : a net drawn along the bottom of a body of water

   b : a net used on the ground (as to capture small game)

2: a network of measures for apprehension (as of criminals)

 

In Hollywood movies, citizens have virtually no expectation of privacy and no practically no protection from unreasonable searches and seizures.  The movies typically depict cops routinely committing dozens of felonies in search of the criminal.  Given any cop movie, I can (and usually do) count more than a dozen felonies committed before the credits roll.  In some movies, the lead police character actually commit more crimes of more seriousness than the suspect they are chasing...

We must keep the Hollywood movie fantasy separate from reality otherwise we risk moving over the line.

Case in point: Blanket search warrants

http://www.wral.com/Raleigh-police-search-google-location-history/17377435/

 “The demands Raleigh police issued for Google data described a 17-acre area that included both homes and businesses. In the Efobi homicide case, the cordon included dozens of units in the Washington Terrace complex near St. Augustine's University.” http://www.wral.com/Raleigh-police-search-google-location-history/17377435/ 

Where a warrant is supposed to describe a specific person, place, or thing, going beyond that criteria is getting close to the line, if not clearly jumping over it.   Creating an analogy of searching a person/place/thing using high tech methods (non-invasive) and physically searching a person/place/thing (invasive) escapes most.  Few want a stranger, police officer or otherwise, to open their closets and toss items around, but when it comes to digital information, it seems that many people don’t have the same concerns over privacy and their protections against unreasonable searches and seizures.

"…Another review would further cull the list, which police would use to request user names, birth dates and other identifying information of the phones' owners….At the end of the day, this tactic unavoidably risks getting information about totally innocent people," Wessler said. "Location information is really revealing and private about people's habits and activities and what they're doing." http://www.wral.com/Raleigh-police-search-google-location-history/17377435/ 

Our data privacy problem resides partly in the service providers and partly with us, the users.   For example, to have the convenience in finding a specific type of restaurant based on your location, a service provider needs to know (1) your location, and (2) your desires.  The service provider stores each of your location way-points and all of your typed desires. They keep this information well past your immediate use of the service.  Your consent is key to making this data fair game to advertisers, spammers, criminals, and the government today and into your foreseeable lifetime and after death.

The difference between your home being searched by the government and your data being searched by the government is that when it is your data stored by a service provider, you are not generally aware that it is going on.  It doesn’t feel invasive because it happens without you seeing it.  You don’t see an investigator reading details about your life and would not expect it happen anyway.   

For investigators, it is so much easier to search the private data of every citizen in an entire city than it is to physically go house-to-house and physically search the homes.  By the way, if there comes a day where we see blanket warrants to search house-to-house, we probably are not having a good day.  But that is what happens to our personal data.

My hope is that law enforcement doesn’t lose the ability to use high-tech methods because of an over-reaching search warrant, but I know that this is what invariably happens because the easy way is going to be chosen by someone when they should have chosen the more reasonable way.

I’m curious to see where the fine line will be drawn in using dragnets to obtain everything to search for a specific something.

 

 

 

 

0
  299 Hits
  0 Comments

Some things about training, education, and learning in DFIR

In theory, if you know what you are doing and are competent, that is all you need.  In practice, being competent is rarely enough. You probably need documentation....

The importance of documentation was hammered into me for years by my employers as a government employee (military and LE).  Courts made sure that anything that I did not realize was important to document before testifying, better be documented next time.  

TL/DR aka Cliff Notes: Don't just download some DFIR tool and use it. Create documentation to justify your self-training/education/experience in using that tool, especially if you will be facing a jury or hiring manager.

 One example I had early in police work was that of drug field tests (not the kind you see on TV, where the cop puts some unknown substance on their tongue and says, "That's good stuff").  Getting trained on how to do field drug test wasn't something that we'd get in the academy, or as a normal part of the job.  Most would just follow the instructions on the test kit and call it good.  I think I may have been the first person in my department to be eaten up on the stand for a drug test in my report because I said, "I followed the instructions on the kit", yet had no formal or informal training in it.  My field test result was confirmed by the state lab, but I was badgered for a bit on the stand by the defense attorney on the drug test because I had no formal training in how to do it.  I did nothing wrong, I followed the instructions perfectly, the case was fine, but I didn't like getting attacked for something minor like not having a piece of paper showing 'training'.  


Here is what I did that day after court.
 I found the most senior narc in the department, who had testified to field testing drugs, who had taught narcotic work at the academy, who did major cases, and most important, someone who would spend a few minutes with me.  The senior narc (who was a Commander at the time), spent 30 minutes teaching me what I already knew, but also gave me some things that I did not.  Before I left his office, I had a department head memo detailing the 'training' I just received with a brief bio of the Commander who taught me.  That memo went into my training record, which I would use any time I were to testify to a field test of drugs in a case.  

Having gone into narcs years afterward, I created a formal in-service class and taught every patrol officer in field-testing to make sure they didn't get eaten up on the stand for not having any training in field-testing drugs.  It's a little thing, a memo or a training record, until it's a big thing.

I apply the same concept in the DFIR world.  Every breakout session at every conference I attend incurs labor on my part.  I write up the specific session, with the name of the presenter, with notes I take, plus the time spent in that session.  If there is hands-on, I document that as well.  All the better if there is a booklet of the sessions that I get in the swag bag to keep me organized.  I have a spot on my shelf with these for reference. For anything that I learn on my own, guess what...I document that too.  I never ever get on the stand to testify about something I did in which I do not have documentation at the ready.  If/when asked, I know:

  • The names of the presenters that I have learned from at the specific courses and conferences I've attended, and/or
  • The number of hours that I have researched practiced with a tool or process (learning hours, not case hours), and/or
  • The tools that I have written (itty bitty things that I have written) and the tests done with them.

I have documented formal education/training and documented informal training.  Anything that is not documented, I don't even refer to it.  I don't comment on it.  I don't list it.  If you have ever been on the stand to testify about your training, education, and experience, then you know that if you don't have documentation to support it, you will be under a microscope about it.  If you are new to DFIR, you are lucky because you can start saving your documentation now.  If you have been doing this for some time and not been saving your documentation, then you have lots of work to do.  

For anyone who doesn't feel the need to keep training records or documentation, either you don't have court appearances in your planned future, haven't met the devil of an opposing counsel yet, or are in a job you don't ever plan to leave.

I tend to create online courses for the benefit of getting something on paper for those wanting something on paper.  I believe we can do this job without taking a class or getting a degree.  I believe that if you are in DFIR, you are smart enough to learn on your own.  Actually, if you can't learn on your own, you may have a difficult time in this field.  But that's not how it works if court appearances or job interviews are in your future.  You need paper, and lots of it.  Degrees, certifications, conferences, courses, and personally documented research & practice.  The learning is implied if you do these things.  Competence is assumed if you have them.  All becomes clear when you employ them (clear as in, your employer will see if you actually know what you are doing or not). 

If you are in a position of authority, leadership, or mentorship, teach others something.  In classes I teach, whether a LE course, college course, online course, or in person at coffee, I implore the learner to take seriously what I am saying in documenting what I am teaching them, because it may become useful later.  In one way that I have used this in my testimony is that I have specifically stated, "I have been trained in the use of this tool by the developer of the tool."  Or, "I have been taught this forensic process by name of person, who developed the process".  Or even, "I have been trained by the person who wrote a book on it."  This is all the better if you are the author, tool or process developer, but second best is being taught by the tool or process developer, or the organization that developed the tool or process you used.  

In a perfect world, everyone accepts that we are competent because we say that we are and we can prove it.  In reality, even proving it is sometimes not enough if you don't have a document that says it. 

 

1
  540 Hits
  0 Comments

Windows Forensic Environment - Newest project is complete

Forensic Operating Systems

The time has come!  The Windows Forensic Environment (aka Windows FE, aka WinFE) project and course has been updated.  

**COURSE IS CURRENTLY AT CAPACITY**  However, send me an email (This email address is being protected from spambots. You need JavaScript enabled to view it.) to be put on a wait list for when it re-opens.

 



The course is arranged that you can skip over any topic to go right to what you need right now.  So, if you need a WinFE build right now, go to that section first and get the info you are looking for.  Complete the entire course for a cert of completion for training hours documentation (5 hours documented training time).

But it’s 2018.  Aren’t bootable forensic discs outdated?

We’ve come a long way from using bootable floppies to image drives with Safeback, but it seems the only thing that changed was the bootable media, not the method. 

Booting any system to external media is not my first choice, until it is.  Some systems can only be acquired, accessed, previewed, triaged, or touched by booting it to external media.  Some situations would best be approached by booting to external media. 

The real benefits are being able to more quickly acquire data, acquire data forensically when you can’t otherwise, acquire data that you couldn’t acquire at all, find evidence faster, eliminate and prioritize forensic examinations, and make your work more productive.

Who uses WinFE?

·         It is taught world-wide by training providers in government, universities, and private courses

·         It has been used in criminal and civil cases, and internal corporate matters (and courts!)

·         Over 3,500 users signed up and completed the first online WinFE course (now updated)

·         Over 10,000 downloads of the WinFE projects in the past 5 years

I am certain that Troy Larson had not idea that giving me instructions to build a WinFE would eventually turn out like this…

With the new WinFE build, the total time from start to finish is less than ten minutes.  That includes downloading the WinFE project, setting it up, creating the WinFE.iso, and finally creating a bootable CD/DVD/USB.  This means that if you were to build a WinFE today, you’d have it in your DFIR toolbox ready to go anytime in minutes.

But Linux and Mac!

I go over Linux distros and Mac options in the online course, and credit the best of each for what they do best for different needs.  I also go over negative points of each as well.  Working in this field requires walking into unknown environments all the time, therefore, be prepared with options before you end up in a situation where you find that you should have done this earlier. 

What's the big deal?

It's another tool in your toolbox.  I can't count the number of times I have been emailed by someone asking me to give them the 2 minute version of how they can build a WinFE, right now, while are onsite dealing with something they were ill-prepared to deal with.  Now is the best time to get your bootable forensic operating systems in order, because you will be in that spot one day.  Hint: emailing me isn't going to make a WinFE disc magically appear....you have to build it on your own.  The good news, you can do it in a few minutes and have a tool that might get you out of a jam that you otherwise would be stuck.  Your bootable media should also include Linux and Mac solutions as well, which are discussed in the course too.

The days of Safeback and floppies may be over, but we have been seeing more systems requiring forensic OS boots than ever before by sheer necessity due to hardware configurations.

Download the Mini-WinFE used in this course at: http://www.brettshavers.cc/index.php/mini-winfe-download 

0
  1596 Hits
  0 Comments

Cyber Health

I was a spectator to a conversation between a law enforcement DFIRer and corporate computer user this week, and it got interesting when the name-calling started. 

The point of the conversation was about corporate computer users being ‘lazy’ with computer systems (whether it be managing the organizations website content or just basic cyber health such as not falling for phishing emails).  Then a point about law enforcement never calling victims back started another tangent of complaints.  And then a few other little complaints.  I felt like I was watching a tennis match being played on two separate courts.

The takeaway I got was that there is still a chasm of disconnect between the users and the examiners/investigators/responders.  For the DFIRrs, we practice good Cyber Health.  We would not think of leaving any building with any device that was not encrypted.  Phishing emails? We love them because we want to learn from them, not fall for them.  We care for our passwords as much as we care for our teeth by brushing and our hands by washing.  It is our way of life and we assume everyone is like us.  When we hear that a non-encrypted laptop containing tons of PII was stolen from the trunk of a car, we shake our heads at how that is even possible.

For the average home and corporate computer user….Cyber Health is inconvenient, unimportant, too much work, and not in their job description.  There is no way they will want to learn anything about lateral movement or tracing IP addresses. 

That is the chasm that needs a bridge.  Until every computer user (home or corporate) is literate in the dangers of bad cyber health, we will always be inundated with work.  If you don’t brush your teeth, eventually there will be lots of pain and maybe loss of a tooth.  This is no different when your life is derailed from ID theft, ransomware, or the loss of business revenue due to compromised systems.  User must learn more about the systems they use, just like they must know something about taking care of their physical health.

The chasm also includes law enforcement’s lack of understanding (or caring about) the frustrations of victims who (1) don’t know the extent of damage a computer compromise can be, and (2) what the response actually does.  Most victims don’t know that their case may never be investigated.  From the day it was reported by the victim, the case might be put into a file cabinet and marked ‘information only’ because it has no solvability factors.  The case may not ever have an investigator assigned to it, simply because of a heavy caseload or have a suspect that cannot be identified. Other cases may take years before anything happens, due to delays in getting information back from service providers or worse, delays in someone actually working the case at all due to reasons I care not to say publicly.  

Prevention is key, and so is education.  As a personal example, there is a local government organization in my area that has been hit with some pretty good phishing emails lately.  The response from IT has been to send generic emails to everyone in the organization about not clicking ‘suspicious’ emails.  So far, every time a user falls for one of the phishing emails, IT sends out another reminder to not click any suspicious email links, and then another user falls for another phishing email, and then cycle repeats.  There has been no education for the computer users, other than email from IT asking users to “stop falling for suspicious emails.”  I’m waiting for the entire system to go down before they have to call someone…

We have always worked to be the translator of tech talk for the layman, but we still fail at it.  Blaming the user isn’t going to help.  Name calling makes it worse.  But being patient and understanding the user’s perspective will help. 

When we expect users to do what we would do, without telling them what we would do or how to do it, we frustrate them and us, because we will always get the same thing happening over and over.  Most of use are Type A, driven, and have high personal expectations.  We have to tone that down to help the organizations that ask us to help them.  This includes those working in LE.  

The amazing thing that users don't know is that a simple and innocent (ignorant) click of a single phishing email can cause a cascading amount of highly complex, extremely expensive, and mind-numbing work by a team of highly trained DFIRrs to fix over a period of days, weeks, or months.  Users don’t get that because no one tells them.  They just want their computer to work so they can email clients.  Maybe Cyber Hygiene should be taught in schools in the same class where Personal Hygiene is taught?

 

0
  487 Hits
  0 Comments

Making Ham Sandwiches in DFIR

Following up on some points made about DFIR writing on Twitter, here are my opinions on the subject of writing up your work in DFIR:

1: Write it up (or else your work didn’t happen)

2: Write it for your audience (or it won’t matter what you did anyway)

If you follow those two tips, your writing will be fine.

In police work, report writing is frequently given the analogy of “Painting a picture”, in that you should write a story that doesn’t need explaining outside of what you wrote.  The canvas should tell the entire story.  Search warrant affidavits work the way in that the probable cause for the warrant must be contained (and comprehended) within the four corners of the affidavit.  An independent party should be able to read what was written without requiring outside information to either support the words or interpret them.  The report (aka, the picture) stands on its own to describe the story.   I usually use the analogy of making a ham sandwich instead of painting a picture.

When I read a report that doesn’t make sense to me, I typically say to myself, this person can’t make a ham sandwich.  I can see the tomatoes, the bread, and the ham, but it just doesn’t look like a ham sandwich.  If I need the writer to verbally explain to me what was written, then the report is meaningless.  It may be 100% technically accurate, but 100% worthless at the same time.  I do not mean to say 'worthless' in an insulting manner, as a technical report can be very well done for a technical audience. I mean worthless in the manner that if the intended audience can't understand it, then why write in the first place.

If any of these are true, then the report wasn’t written correctly.

1: The writer needs to explain the report.

2: There is no story.

 

You can do the best DFIR work in the world and yet write a report that ruins it all.  Or, you can write up what you did in a manner that the report can be read on national television, in full, without needing a word of exposition to translate it to the audience. 

Few of us are great DFIR’rs and great writers.  We tend to favor one side over the other.  Some of us however, tend to ignore the writing part completely.  We don’t like to write.  We don’t like to edit.  We don’t like to write for an audience who doesn’t know what a MFT is, after all, doesn’t everyone know what the MFT is?

The reality is, you have to write up what you did so that others can understand it.  Embrace writing.  Showcase your DFIR labor in your writing, so that the reader completely understands what you did, what you found, and what needs to be done next.   

Make that ham sandwich.

0
  904 Hits
  0 Comments

DFIR Case Studies #7

As I was going through Case Studies #7, I found several some reminders on tips for working a case.  The simple obstacles that make some investigators quit only make others drive forward with creativity.  One example is the suspect in Case Study #7 using open WiFi to be anonymous.  Sometimes, investigators quit once they find that the suspect used a public WiFi or Tor.  This case shows why you should not do that, and in fact, can make a really good case by following basic investigative principles regardless of what the suspect has used to try to stay anonymous.

And with every new case study I release (until I stop making case studies), I'm giving a promo for training bundles.  Until midnight Friday (16th), you can get the entire DFIR Case Studies series PLUS X-Ways Forensics Practitioner's Guide online course for only $25!  This is one of the better bundles I've done.  If you have already taken the X-Ways Course, you can choose the Case Studies Series with the Placing the Suspect Behind the Keyboard Course at the same promo price of $25.

Don't forget.  Registration with this promo ends midnight, Friday, February 16Promo extended through Feb 20 for the first 25 registrations as @PhillMoore linked the course to his ThisWeekin4n6 blog.  

When you see the price go back to $150, the 25 promotional registration spots will have been used up.  

Case Studies Series + X-Ways Forensics Practitioner's Guide online course:  http://courses.dfironlinetraining.com/series/case-studies-with-x-ways-forensics?pc=cs7gdfxwf 

Case Studies Series + Placing the Suspect Behind the Keyboard online course:   http://courses.dfironlinetraining.com/series/case-study-series-and-placing-the-suspect-behind-the-keyboard-training-bundle?pc=cs7gbspsbk 

 

 

*books not included!

0
  990 Hits
  0 Comments

How many exposure dollars do you need to buy a cup of coffee?

I am always flattered to be asked to speak in front of an audience on something that I know something about.  I have fun sharing information with great people about the ‘secrets’ on how to do neat things in forensics and investigations.

However, I find it odd to be asked to speak at conferences out of the state or out of the country, with the sole benefit of “exposure”.  I do not consider “waived tuition” to be a benefit to a conference that I wasn’t planning on attending anyway.

There are plenty of websites that talk about this topic, but here is my take on the topic as it applies to the DFIR field:

  • Speaking for free:  Gets old fast, unless it’s your hobby to personally foot the expenses for a one-line by-line on your CV.  Tax write-off? Spending money on travel and lodging to get a tax write off is probably not the best way to make money.
  • Don’t spend money to speak at a conference: Seriously.  Don’t spend money on expenses to speak at a conference where they charge attendees to attend.  Attendees pay to learn.  You should not be paying to teach.  That’s crazy.
  • Turn down “opportunities”.  You can’t buy a cup of coffee with exposure dollars. 

If the organization wants you bad enough, they will pay (in real money).  If they don’t truly want you, they are not going to pay.  I have turned down conference requests for that reason alone.  I figure that if they are not willing to foot the bill to at least cover the expenses, that they didn’t want me in the first place. They wanted a donation of time and money for their commercial endeavor.

If you speak at conferences, and the only payment is waived tuition with benefit of exposure, you can bet that other speakers were paid. In one instance,  while I waited in a prep room, I listened to other speakers complaining about having shell out to speak at the conference.  The whole time I was thinking, “Why did these speakers agree to come here without getting paid and then complain about not getting paid, and then believe the organizer’s excuse that speakers don’t get paid.  By the way, I was getting paid at this conference….”

I am not saying that money is your only goal or the most important thing in speaking at conferences.  I am saying that your time is valuable and limited.   Time is precious.

Exceptions!

  • -A local non-profit org asks for your donated time to speak for an hour? Sure. Why not.  It's a good cause at the cost of a short drive.
  • -Potential revenue generation: You can sell something, like your company’s service or product at the conference to attendees?  Sure.  That’s business marketing.
  • First time presenting?  Probably a good idea to get the experience and name branding (and charge later..).

Once you start getting paid, your next thoughts are going to be:

  • -Am I charging too much?
  • -Should I charge more?
  • -How much is the other speaker charging?

There are no correct answers to these questions.  I can say that at one event, I learned that a co-speaker had charged $20,000 for a 45 minute talk...  Closed training events are a completely different animal.  When you get a call to talk in front of a closed audience, the only questions on getting paid are, "How much do we write the check and where do we mail it?".

The moral of the story is: If you don’t ask, you will never be paid. And yes, I did ask the guy on the phone if he'd fly out and wash my car for free but he still didn't get the point.

 

***A little more information*** 2/4/18

Ok.  Don't get me wrong.  Speaking for free is good for many reasons, such as building your resume, sharing information, and being part of a quality event.  If you agree to speak for free at a conference that costs you money for travel, lodging, and meals, that's OK too (but stop complaining about not getting paid to the speakers who got paid at the same event....).

My point in this post is that if a conference organization directly contacts you and asks that you volunteer your time and money to speak at their event, where they are charging thousands of dollars to attendees, then it is a different animal all together.  In that case, you have a choice to volunteer your time and money or simply ask at a minimum to have your expenses covered.   No one has more than 52 weeks a year.  Use the weeks wisely.

0
  758 Hits
  0 Comments

Rub some dirt on it.

Failing hurts helps.

Not that long ago, I would listen in awe at the DFIR experts presenting at conferences and wondered how some people can just glide right through this work like a slip-n-slide without taking a second breath.  I mean, this work is usually pretty difficult to do but easy to make a mistake.  Missing an important artifact or misinterpreting data that gets caught by an opposing expert happens, and when it does, embarrassment sets in quite quickly.  How do these experts get away without making any mistakes?

The short answer

They made the same mistakes you make and are still making mistakes.  They fail every day.

The longer answer

We all fail and no one gets out of here alive (without failing).  The difference is what you do after you fail.  Having grown up in the South, whenever I would skin my knee or crash my bicycle, I was generally told to ‘rub some dirt on it' and get up.  I’ve pretty much lived with that advice and even raised my kids on it.  For my kids, I changed the ‘rub some dirt on it’ with ‘if you don’t see bone sticking out, get back up’.  

That’s as simple as it gets.  Fall down. Get back up.  There’s plenty of complex advice you can find on breaking this down into reflecting on how the fail happened, what steps you could have taken to prevent it, and how you can prevent the fail from happening again.  I take those steps as a given and simply know that I’ll rub dirt on it and keep going, making sure to not do that particular error again.

By the way, a failure by anyone feels the same as you do when you fail.  The difference is choosing to move past it as a learning experience.

A warning sign

If you don’t make mistakes, errors, or fails, then you are not moving forward.  You are not gaining experience or learning.  Obviously, the fewer fails you have, the better.  But having none is probably an indication that you are not trying to go beyond that what you already know.  You may not be testing your limits and pushing yourself to be better. You gotta know your limitations..

One of the worst pieces of advice that I have ever been given was from a 30-year police veteran when I was a new guy in patrol.  His advice was “never do anything and you’ll never get in trouble”.   Technically he was correct.  Don’t do any aggressive patrol and the risk of making a mistake drastically decreases.  Practically, that means you’d never get any better at the job you are getting paid to do.  Happily, I did the opposite and made enough mistakes to become so good at my job that a small-town cop traveled the world working international organized crime cases with just about every alphabet soup federal agency in North America.  I brought that attitude to digital forensics and believe me….I’ve made plenty of mistakes and fails, from forgetting to bring my presentation materials for a conference to totally missing a blatantly obvious piece of electronic evidence on a drive on a case.  Fails still smart, but rub dirt on it and learn from it.

What I am not saying

I am certainly not saying to intentionally make mistakes in order to learn or get better.  You will fail at something no matter how hard you try to succeed, so don’t worry about that.  The fails are coming, maybe in the next hour or next week.  As long as you work to learn and improve your skills, employ what you learned and master them, the mistakes will be there as you work through the process.  Try to keep the mistakes small and the learning big.  Worst are the big mistakes and small learning.  Fail small.  Learn big. 

Remember: Rub some dirt on it.  Learn from it.   Don’t do it again. 

 

 

1
  1128 Hits
  0 Comments

Don’t look back.  Try to keep up.  This is #DFIR.

I do a lot of peer-reviews.  Much like a case study (another one is coming up by the way…), a peer-review of the sort I am talking about is a line-by-line read of a forensic analyst’s report.  Then reading it again, then again, and a few more times, all the while red-lining items of interest.  Basically, I am hired to read your reports and tear them apart.  Before you take that the wrong way, sometimes I am hired to read a report written by an expert that was hired by the same attorney that hired me to tear apart the report.  My aim is to make sure the report is good, insofar as my opinion goes.  I’m not a spell-checker or grammar cop, but I work on finding inconsistencies and where the analyst may be weak in their work, experience, or training.  I help with what to expect on the stand, and conversely, I help attorneys where they can focus on opposing witnesses during cross examination.

Now that this is out of the way…

Here is something I come across often: lack of continued education.

In the world of computing, if you don’t keep up your skills with today’s information, you will be outdated in a year or two.  That which you believed to be true yesterday may have been proven to be false last year or is no longer relevant.  If you plant your feet on what you know today and refuse to move forward, you will grow roots and the DFIR world will pass you by faster than a long-tailed cat running out of a room full of rocking chairs.  I would go so far to say that if you spend 5 years in college learning DFIR, by the time you graduate, much of what you learned in the first year or two will be severely outdated.

Some of the rationales to not continually attend training or education that I have heard include;

“I’ve been doing this for 10 years and know how to do it better than anyone.”

“I’ve been doing this before you got out of diapers.”

“I don’t need training because I can teach it better than anyone can teach me.”

“The technology is basically the same.”

The problem is that during a peer review, when I see a boilerplate bio or CV that shows the last training or conference attended being over two or more years ago, it screams to me “OUTDATED!”.  This is not always the case of course, but for the clear majority of us, if you aren’t updating your knowledge with some sort of formalized training or education, you might get called out on it at some point.  How valuable is a Computer Science degree from 2002 if nothing has been done since 2002 to keep up on technology?

Exceptions!
Of course, if you are a researcher, or you publish the information you discover, or you research-teach-research, you are probably exempt from “taking a class” as you are on the cutting edge.  You are part of those who create the information to be taught in the classroom.  You are the source of DFIR information.  That looks great in court by the way.  For everyone else, be sure to sit in some classroom or conference on a regular basis or it will not look like you are working to keep abreast of the field.  If for no other reason to show that you are current, keep current.  Pick a class.  Any class, but pick one.
 

You don’t need to spend $20K a year on training to stay current.  You don’t need to attend conferences that are out-of-state every year either.  If you can do either or both, more power to you.  But most of us are (1) busy, and if we are not busy, we are (2) really busy.  But you can do some things.  You do these things for “credit”, aka credibility.  You need to look at what you do to stay current a little differently.  Everything you are doing outside a classroom is assumed to be informal or unstructured (aka: not credible).  I suggest that you structure your efforts to give some formality that you can use for credibility.  Turn yourself into a living classroom.  If you do something outside the classroom that would be have been good to have learned in a classroom, write it down.  

  • Read.
  • Test-practice.
  • Research.
  • Talk.

Your reading should be DFIR heavy (whichever part of DFIR that you do – DF or IR, or both).  Books are good for a few good reasons.  You put them on a shelf and you can pull them down anytime as reference.  You can list them in your CV.  You can state references to them in reports.  The book will last your lifetime because books can’t be deleted or be hacked and defaced like a website can.

On one court case, the court wanted to physically see every DFIR book I owned and had read because I said I read a lot of DFIR books.  The next day in court, I brought the books I still had (previously donated older books). This made an impact in the case, especially when I made sure to point out the extensive notes I have made in most of my books.  I needed a dolly to bring the boxes of books in....today, more than half my books are on my iPad :)

Blogs are great because the information is hot.  Sometimes, the information is so hot that the research and testing was completed only hours before you may have read it online.  You cannot get fresher information than that than you can with blogs!  Pro-tip:  when you find something really good in a blog, download it (PDF it, download, etc…).  Blogs disappear without notice and you don’t want to reference something that doesn’t exist anymore.

Your regular work doesn’t really count for practice, but you can develop practice scenarios based on your regular work.  For example, when you put in documentation about Shellbags in a report, be sure that you have practiced it too.  If/when ever asked about “how do you know” something, you want to be able to answer with (1) I was taught in this specific class, (2) I read it in these specific books, (3) corresponded with these specific experts x, y, and z, and (4) I tested-practiced the same scenario in controlled environments.  My common answer in cross examination to ‘how do you know’ is ‘because I personally tested it’.   I saw it with my own eyes.  I have seen this exact issue in a dozen prior examinations.

Research is fun.  Seriously.  When you research for an answer and find it, the retention of what you learn is so much better than posting a question on a forum and waiting for someone to spoon feed you the answer.  When you uncover the answer yourself, you will remember it and understand it much more than you can otherwise.   Document your research because you get credit for research only when you document it!

Some of us don’t like talking with others.  The computer is an easier companion.  Sure, a computer can cause some grief by not doing exactly what we want, but generally we can make the computer do what we want.  Talking with people is a skill that we also need.  When you talk to others in the field, you are learning.  You are forwarding your knowledge.  That goes both ways because by talking with someone else about DFIR, you are both sharing and both learning at the same time.  When you can say that you conferred with another practitioner, discussed the issue, shared experiences, and walked away with more information than before, you earned credit.

I give this advice mostly because this is the one area I see totally lacking in reporting (for legal documents such as a forensic analysis report, not internal documentation on a security breach), yet it is the easiest hole to shore up.  Take a class.  Read a book.  Research and practice. Talk with a peer.  Do these things and you’ll be 75% ahead of the game.  

2
  1029 Hits
  0 Comments

X-Ways Forensics & eDiscovery

Following up on a discussion with an eDiscovery consultant, I wanted to show how X-Ways Forensics is a good (if not better at times) tool to have for the eDiscovery folks in ESI collection jobs.  Not that XWF can replace eDiscovery tools, but certainly can complement collection efforts.

I would even go as far to say that an entire eDiscovery matter can be done by solely using X-Ways Forensics depending on the case matter.  For example, if the collection just involves workstations and laptops (even many aspects of server collections), you may not only ‘get by’ using XWF, but can do a more thorough job of collection.  However, when you get into the cloud, XWF is not going to be your best choice for a collection tool.

Here is a short video on how you can use XWF to collect data in a given eDiscovery matter.  

And, Case Studies #5 is published. 

The promo for this week is $75 for the Case Studies series which includes:

  • X-Ways Forensics Practitioner’s Guide Online Course for FREE, and
  • Placing the Suspect Behind the Keyboard Course for FREE, and
  • Advanced Internet Investigations Course for FREE.

Register here (discount will be applied automatically) for the 2-day promo: http://courses.dfironlinetraining.com/series/training-bundle-psbkxwfaitcs?pc=cs-bundle-02-11-17

This promo is only good for 2 days!  The first time I did this promo, it was for 2 weeks and I under estimated the number of registrations.  From now the promos will be a lot shorter.  Get in while you can, you have 2 days this time and the clock has started….

0
  1048 Hits
  0 Comments

When you think you know enough

If you ever have a day in the DF/IR field when you think you know enough, take the rest of the day off and reflect a bit before doing any more work.  The reasoning is that we can never know enough, in the DF/IR field or any field.  Usually, there is something that kicks me right where it hurts and screams at me, "DUDE, YOU DON'T KNOW ANYTHING!  YOU BETTER KEEP LEARNING!"

When that happens, I quietly back into a dark corner and reflect upon how I either (1) screwed something up or (2) didn't have a clue as to what I was doing but thought I knew.  My goal is to reduce the number of times this happens to me.  One of the ways that I do this, and I've blogged about it before, is reading cases.  I just uploaded Case Study #4 today.  It was an easy, clear cut case with college students changing their grades.  The thing is, when you get an easy case, and if you don't put forth the same amount of focus as you do with a complex case, you will be kicked in the behind for doing something stupid or missing something that was really obvious.  

Occasionally, I may print out an entire affidavit and write all over it with notes if it is a really good case.  Usually that happens when I miss something easy on a case that I should have caught. I go overboard to get my mind back into focusing on analysis and investigations.  So, when I did today's case study, I picked an easy case and still I reflected on my mind being in the game, especially on the easy cases.  You don't want to mess up an easy case.  There aren't any excuses to miss the easy stuff.

I've been getting great feedback on the Case Study series for the same reasons I'm talking about.  Sure, DF/IR students learn a lot from case studies, but for those working cases, you have to keep your head in the game constantly.  Read cases.  Compare how you would have done the same case.  Would you do anything differently?  Anything better? Could you have worked it at all?  When you ask yourself these questions, your focus is sharpened.  When you read what others do, your brain is processing the case as if you are working it.  Other than working a case and learning the hard way, case studies are the best way to learn casework, do casework, and master casework.

But don't forget. The second that you master DF/IR work, take the rest of the day off... 

 


The Black Friday extreme promotion I had expired yesterday, but since Phill Moore mentioned it on his blog today, I'm extending through Sunday.

Use this link to turn $1,129 in online courses to only $95.  http://courses.dfironlinetraining.com/series/training-bundle-psbkxwfaitcs?pc=blackfriday 

The promo includes X-Ways Forensics, Case Studies Series, Placing the Suspect Behind the Keyboard, and Internet Investigations.

0
  826 Hits
  0 Comments

DFIR Mentors.  You just might be one and not know it.

If you share information, openly discuss that which you can, and sincerely try to help others in the DF/IR field, you are probably someone’s mentor and do not even know it.   I have always understood the term of “mentor” seriously as it implies a responsibility to teach others, and also suggests that you know a lot more than you think you know.

When you are in that position of being a mentor, know that your words are heavy.  You may not have asked to be someone’s mentor.  You may not want to be anyone’s mentor.  You may refuse to even being called a mentor.  But guess what…you are, whether you like it or not.   My advice is to run with it.  Your words can make an incredible difference in someone’s career (aka: substantial part of their life).

Harlan Carvey may not remember the day I first spoke to him by phone, but I remember it like it was yesterday.  I may not exactly remember how I came about to call him, except through a series of emails and questions that I wanted to ask him.  At the time, I was extremely proficient at working my way as an undercover officer in any criminal organization I targeted, in any number of states (and internationally).  But at the time, I was moving into the computer forensics world and was a green as a gooseberry in the middle June when it came to forensics.   That one phone call with Harlan set me on a new career path that I am truly grateful, especially since the undercover work was getting a bit hairy at times…I would say that my wife and kids really appreciated the career move.

Harlan was my mentor, at least with that phone call, and practically still is. 

Through the following years, I have had several mentors from the DF/IR field.  Most of which I never spoke or corresponded.   I read their writings, took their courses, or used their software.  I followed them as my mentors as if they were actually mentoring me (hint: they were, they just didn’t know it).

Getting to the point.

Your words are heavy.  Did I say that already? This must be important then.  I most likely follow your words to this day and your words have influenced me to be better, do better, and keep learning.  Especially if you have spoken to me personally, or emailed me, or DM’d me….  You just might be one of my mentors and not know it.

Since you just might be someone's mentor, here is some friendly advice.

Lend a helping hand. Encourage those who you have influence to do better than you did.  Show them the way to do things more efficiently and more effectively.  Our goal is to improve our lot, not to personally be the better than everyone else or constantly be the only 'winner' because we are the only ones who know how to do this job.  We are better because we help our peers and our juniors be better than we ever were or will be. You are the Yoda to today's Luke and Rey.

One of the things I do today is that which was done for me.  On that first call I had with Harlan Carvey, he gave me some advice.  Start a blog.  Find something no else is doing and research it.  Write a book.  And so I did, for myself at first.  But since then, I have helped ghostwrite DF/IR books for first timers, tech edit other books, and encouraged more than a few others to start Microsoft Word and get typing on their ideas for a great DF/IR book.  Some have not only taken me up on the challenge and published their book after me pushing them a little forward, but a few are also helping others in the same way.  Technically, I call this super cool.  One of my shelves of DF/IR books, I have a special section of books that I had a hand in being published.  I am most proud of those, even more so than the ones I have written because they are better than mine. That was my intention.

As an example of lending a hand, for book topics with those wanting to be published, I often get asked questions like, “What would you recommend to write about?” or “What do you think of this idea?”.  I always give my honest opinion based on (1) would I buy this book today or (2) would I have bought this book when I first started.  If neither fits me, my opinion is that maybe the idea works for others, but not for me. As for book ideas, I believe you can take any minute topic in the entire field of Digital Forensics / Incident Response and expand an entire encyclopedia on that one specific topic.  I’m not exaggerating. There is no need in the world to take an idea that has already been done and do over unless you can completely change everything that has already been done.  Why do that when you can be innovative, creative, and original?  Don’t reinvent the wheel.

There are too many ways in which you can be a mentor to positively affect someone in the field.  You can not only mentor the new folks, but believe it or not, you are probably mentoring your peers as well.  There is not a thing I cannot learn from every person, regardless of who it is.  If someone speaks, writes, or teaches, I can learn something regardless if it from a student or professor, user or developer, writer or reader.  This thinking should apply to you as well.

Your words are heavy.  You influence more than the people around you.  You influence everyone in the field.  You are a mentor, whether you accept the challenge or not, it is what it is.  I’m happy with that.

 

 

0
  1275 Hits
  0 Comments

Bitcoin Forensics | Investigating Cryptocurrency Crimes Online Course....it's coming...

You knew this was coming.  A course in cryptocurrency investigations.  There is no faster and comprehensive method to learn cryptocurrency investigations than to take a class in it and study a book about it.   As the book is being written, the course is being developed alongside the book as a companion to the book.  If you have not come across cryptocurrency in your investigations yet, I promise you that you will soon enough.  When it does show up, and you are not prepared, your case is not going to get the full attention needed if you are not already prepared.

"Bitcoin" has been in the news more and more lately.  You probably have already heard of Bitcoin, but may not actually own any, nor understand how it works.  The intention of both the book and course is to give you the 'need to know' information of what it is and also the 'must know' information of how to investigate cryptocurrency.  Cryptocurrency is much more than just Bitcoin.  Way way much more.  The entire blockchain universe has begun to change the way data and records (and currency!) are being created and maintained.   In your lifetime, there will not be an investigation where some aspect of the blockchain and cryptocurrency is not a part, whether it be a tangent to your case or instrumental to it.  Criminal and civil investigations both.  Crimes from petty theft to murder.  You will see aspects of the blockchain in most everything.

Bitcoin Forensics | Investigating Cryptocurrency Crimes

But don't worry.  This book, the first book to be conceived and to be published on this subject, is covering all of it.  And if you want to see demonstrations, follow along with exercises, and actually trace transactions online in real-time, this course that will compliment the book is for you.

You may be able to tell that I am really excited about this book and course.  I am actually excited about the changes to investigations as we know it today due to the blockchain.  You cannot ignore the future in your cases and how this technology is changing everything.  Money laundering is a whole new world with cryptocurrency.  From small time street dealers to international drug trafficking organizations, the time is not only coming near, but is already here.  If you have read any of my previous investigative books, you know that I cover not only the things you can only do with search warrants, but also the things that you can do without any court order.  This applies to both civil and criminal cases, as many times you can get exactly what you need in a timely fashion when you know exactly where to look and what to look for, when it is publicly available.  That is the intention of both this book and course.  Deep dive into the operating system to find the crypto artifacts and hop online to trace the transactions from their origin to destinations. 

 

0
  1845 Hits
  0 Comments

Thinking of Writing a #DF/IR Book? Here’s a tip that may or may not work out for you.

I am very open on my opinions about writing books, specifically DF/IR books.  I encourage anyone who is thinking about writing a DF/IR book to write away and start right away!  The longer you wait, the more likely someone else will write the book you wanted to write.

Over the years, I have been asked questions about writing and I posted a fairly detailed blog post with my opinions.  Take into account that I am no JK Rowling, nor do I have dozens of books in print, and like anyone, my opinions are my own.

So, what is the writing tip that may or may not work out for you?

The tip is to decide whether you want to tell the world about the book you started or keep the project to yourself.  Here is my experience on this, with an example for both.

2010, Experience #1: 

Some years ago, I wrote two ‘papers’ on virtual machines and forensics.  I decided to write a book on virtualization forensics and mapped out a table of contents, and started the first chapter.  Before I sent out a proposal to publishers, I came across a post on www.forensicfocus.com by Diane Barrett in which she posted that she was writing a book on the same topic that I was (Virtualization and Forensics).   Totally coincidental and an obvious case of independent-invention (we both had the same idea, independently).  So…what did I do? 

I chose to not write “my” book.  Why write what someone else already publicly announced? That's be like making a Wonder Woman movie after hearing that someone else is already making a Wonder Woman movie.

2017, Experience #2:

My fourth and current book is titled Bitcoin Forensics: Investigating Cryptocurrency Crimes.  I did my due diligence in researching to see if any other book existed (it did not) and if anyone else was working on the same topic (no one that I could find online).  To make sure I wasn’t writing something that someone else was writing, I blogged it, tweeted it, and posted to online forums.  I even reached out to anyone who would be interested in contributing to the book and am fortunate to have some fantastic volunteer contributors, along with a super co-author.  So, what happened?

Well…one of the volunteer contributors who agreed to help with the book quit, then without a peep, proposed the same book to a publisher, got a book contract, and the book immediately went to pre-sale on Amazon.  Interesting enough, he wasn’t planning to write the book in the first place until after volunteering to help with this book.

Huh?

That’s right.  It happened.….at least he changed the title from "Bitcoin Forensics: Investigating Cryptocurrency Crimes" to "Cryptocurrency Forensics"....   

So, this is a tip for future writers that could be more like a warning if it doesn’t work.   If you plan on writing a DF/IR book, you’ll have to decide to either keep it a secret or tell the world.  Keep it a secret and maybe no one else is writing the same thing.  That’s a big chance to take because I can tell you, everyone is thinking about the same book to write that you are.  Not the best thing to have two closely identical books come out at the same time to the same (fairly small) audience.  

Or, you can publicly announce your book and probably someone else won’t intentionally take your idea and write it.  However, worst case, someone could offer to to help with your book, then run off and sneak in a book contract with another publisher...good grief.

I prefer telling everyone.  Why hide what you are working on?  Why hide the research you discovered?  I believe in sharing to help push us all forward, even if just an inch forward.  This is the way I have seen others do it and actually what I prefer.  I would regret having written an entire book, or even half a book, only to find that someone else was writing the same thing, which could have been avoided by simply announcing my intentions.  Then again, this happens....

And yes, I am still writing this book.  The team of contributors, tech editor, and co-author is simply awesome.

1
  1464 Hits
  0 Comments

DF/IR Case Studies

I've made three case studies so far and will have a fourth up this week.  From the feedback I've asked in a short survey about the case study series, here are the results:

  • The case studies are beneficial, useful, and job relevant.
  • The presentation format works (weekly to bi-weekly case studies).
  • Length is appropriate (between 30 minutes to 1 hour).
  • Printed certificates of completion are important to 90% of the respondents. 

With that, I'll keep going and adding one or two cases a week, more if I find relevant cases to recent news.  Personally, I have always benefited from case studies.  I get reminders of how investigations are done, tips on how to do them better, and sometimes learn things that I should never do in cases that go sideways.  I can tell you that after being assigned to over 100 criminal cases a year for 10 years, you can never learn enough to improve.  Some things you can learn may be small but have a huge impact on your case. 

In Case Studies #3, the case was solved in 6 months.  This was an international investigation spanning several countries and multiple states in the USA, with anonymity services used by the suspect.  I know that the investigators involved in the case used everything at their disposal to figure it out and all it took was a few little things to crack it open.  This is what case studies is all about.

I mentioned at the start of the Case Study series that I would have a short-run promo occasionally to entice more DFIRrs to start a habit of reviewing cases and continually be in some sort of training.  This time, the promo includes the Placing the Suspect Behind the Keyboard Course.  The Placing the Suspect Behind the Keyboard Course is 13-hours of the tactics, methods, and procedures to do the things that are being done in cyber cases today, in both the criminal investigation world and the private security world.  I'm giving it FREE with the Case Study series, but I'm limiting registrations to only 100 or Friday Nov 17, whichever comes first.

If you didn't need another reason for these courses, keep in mind that you should be doing case studies anyway, but when you do them by yourself, the only documentation you will have is that which you jot down on a piece of paper.  I'm keeping track of the hours you spend when you complete the each course and case study, and you can print it out for your records.  Take advantage of professional development when you can get it because you should constantly be improving your skills by doing something everyday: reading, courses, coding, practicing, teaching, something/anything. 

Register here to get the promo price of $75 for both the Case Studies Series and Placing the Suspect Behind the Keyboard course (promo code "cs-psbk"):

http://courses.dfironlinetraining.com/series/case-study-series-and-placing-the-suspect-behind-the-keyboard-training-bundle?pc=cs-psbk 

 

1
  816 Hits
  0 Comments

The last thing we want in DF/IR is the first thing we need in DF/IR (aka: regulations...)

    As teenagers, we never liked rules growing up. Curfews. Chores. Homework.  But we know now that the rules were good for us.   It seems like nothing has changed for those of us in the DF/IR field.  We don’t particularly want to be regulated simply because, like when we were teenagers, we know what is best for us. 

    The DF/IR field, as it stands today, is practically the Wild Wild West.  We have few regulations outside of obtaining a business license. In some states, we might need a PI license, but that is about the most regulated we get today.  It’s freewheeling at the moment without any government intervention. What a great time to be in DF/IR!

  •  Licensing requirements? Nope.
  • Training requirements? Nope.
  • Education requirements? Nope.
  • Certification requirements? Nope.
  • Experience requirements? Nope.
  • Testing requirements? Nope.
  • Annual update requirements? Nope.

    To state the point quickly, I foresee this Wild Wild West coming to a screeching halt, where we will all be (willfully) blindsided, and potentially have our careers and businesses put on hiatus until we comply with mandated regulations that will take months, if not years for each of us to comply.  I expect that some currently working in DF/IR may not be able to comply!

    Let me get to the solution before getting into the issues.  Simply copy and modify what is being done in other professions to fit the DF/IR profession, and give our ideas to the respective government regulatory agencies to implement.  In this manner, everyone can keep doing what they are doing, begin to comply with the regulations, be grandfathered in where appropriate, and have reasonable standards created by those who know best (that’s you by the way).  Pick a profession, any profession, and get started.  The medical field, accounting field, anything.  Even hair stylists are regulated with training and education standards.  Pick several and meld them together to fit DF/IR.

Brett’s Opinion on a few things

Certifications

I usually get on a soap box and rant against certifications, but I’ll make it shorter this time.  I’m not against certifications, and I believe that having a sheet of paper of classroom training completion is worthwhile.   Having that sheet of paper shows:

  •  I attended ‘x’ number of hours on "x" date and time
  • I was exposed to ‘x’ topics in those hours
  • I was taught by ‘x’ (person or organization)
  • I passed an exam (if one was given)

 

Licensing

    Licensing is inconvenient to maintain, just ask any doctor if you are curious.  But, licensing is important to prevent unqualified people from practicing a service that can have serious consequences.   We certainly trust our doctors, but part of that trust is based on a license from the state, which is based on a successful internship, which is based on the degree granted by a university, which is based on the successful passages of a specific curriculum, and so forth. 

    In the DF/IR world, all we need to do is attend a 3-day FTK class and buy a dongle.  No, all we need is just buy the dongle.  Wait a sec, actually forget the dongle, we can just download some free forensic software and get started…

    We need licensing, and a standardized process to meet those licensing requirements.  Whatever that may end up becoming is currently up to the DFIR community, but will eventually be mandated by someone else if we sit idly by.  If you are reading this and doing DF/IR work, I would imagine that grandfather clauses will be inserted in every requirement, otherwise, the entire DF/IR field will grind to a halt.  Most of those working today in the DF/IR field can probably teach DF/IR at a post-graduate level, yet not personally hold a post-graduate degree (or any degree in any IT related field)

    I can foresee licensing based on a healthcare provider licensing model.  Each different job (doctor, nurse, etc…) has its basic foundational requirements.  Additional specializations have additional requirements (heart surgeon, registered nurse, etc…).  So that,

  • DF/IR Licensed Professional (much like a family doctor in general practice)
  • DF Licensed Specialist (operating system specialization, device type specialization, etc…)
  • IR Licensed Specialist (penetration specialization, intrusion specialization, etc…)
  • And so forth.

    Imagine looking for an employee and you can instantly see what they should know based on a standardized licensing model.  Today, you may be trying to weed out the IR applicants for a DF job you have, and that is not as easy to do when you have to go line-by-line to sort it out what the applicant’s skills are.  When looking at other professions, I usually point to one example of becoming a hair stylist.  I'm not knocking hair stylists, but the majority of us getting hair cuts don't even know the licensing requirements involved.  In Washington State, it's a lot of requirements to just cut hair...

 

    Think about what it takes to cut hair the next time you argue against any licensing requirements for DF/IR work...because we don't have anything that compares.  Another benefit of licensing is getting rid of the bad apples.  An example of how this is done in the police world (at least in WA state), is the Peace Officer Certification.   If the Peace Officer Certification is revoked, then that police officer will not be able to work anywhere in the state.  The world of lawyers is similar in they can be disbarred from practicing law.  How nice would it be to de-certify a DF/IR person who falsified evidence or doesn’t meet any minimum standards?  Everyone would benefit.

 <on soapbox>

    I want to rant a bit on certifications, only because I am asked about ‘which certs should I get’ all the time.  I am not anti-certification, but I have strong feelings about some of the certifications and about how certifications are looked at by students, employers, courts, and vendors.

     I believe certifications are important to more easily show in court that you at least completed training in a certain subject especially if you are using DF/IR skills in (1) helping put someone in or keep out of jail, or (2) helping someone keep or lose their job.  It doesn’t mean you know what you are doing, just that you had training in the subject.  Otherwise, it looks like you were winging it.  **exceptions exist, I know, but bear with me as speaking generally**.

    Here are some of issues I have personally seen in courses offering certifications:

  • ·         Students sleeping in class
  • ·         Students showing up late and leaving early due to “work”
  • ·         2-hour lunches on some rarer occasions
  • ·         20-minute breaks on many occasions
  • ·         Course over by lunchtime on the last day
  • ·         Everyone passes the test with multiple attempts
  • ·         Everyone getting a certificate even if they failed the test or didn’t attend the entire course

     Here are some of the issues I have personally seen about certification perceptions:

  • ·         Only “x” certified DF/IR employees know how to use “x” software
  • ·         You must have “x” certification to apply for this job
  • ·         If you self-studied and mastered “x”, you aren’t as good as an “x” certified applicant
  • ·         The “x” certification is better than the “y” certification
  • ·         The “x” certification is more expensive because it is the best certification

    I have seen certification-junkies, where almost like an obsessive collector, the more acronyms they collect, the better they feel.  What about the Challenge Coins!  Gotta have them!  Vendors have got to love these types.  It's like the Pokemon or Furby craze.  Employers are also at a loss because the only certifications they care about are the ones that are most hyped by a vendor that gives out the most cherished acryomn. 

    As for me, if I were ever a hiring manager again, rather than look at an applicant and see that box for “x” certification exists, I’d rather make sure that the certification was (1) relevant to the job, and (2) the applicant knows the material that the certificate says.  Otherwise, I look at certs as simply a document showing the number of hours that a person completed for professional development. No more. No less.

    Speaking of number of hours in courses, I am a stickler on actual numbers.  Every statement that I have ever made of the number of classroom hours I have completed, I have cut the documented number down by at least 25%.  On paper, I may have a certain number of hours in print, but in depositions, testimony, resumes, CVs, and informal conversations, I state the lower number.  Why? Because I see classroom hours as not including the breaks or the early-outs on Friday morning.   Or when the instructor has to cut the class short to make a flight.

    I have taken courses where a 40-hour course turns out to be 60 (like SWAT training….), but I have never seen that happen in the DF/IR training world.  If you don’t believe that a 40-hour course classroom time is closer to 30 hours, crank up Excel and put in the number to your last course.  Be honest in the numbers and you will be surprised.  And be sure to put in the extra-long breaks, the days that the class started late and ended early.  And the days that the class stalled because of this-reason or that-reason.  Add the time you stepped out for a phone call (if you ever did such a terrible thing!).

 

 

     The next time you testify and are asked about your classroom (formal) hours of training, think about the actual numbers before you answer.   Lunch time is not typically going to be considered DF/IR learning time.

 <off soapbox>

    I see the future where the road to working DF/IR will be as easy to figure out as it is today if you want to be a doctor or lawyer or house builder.  Follow the path to licensing and you will be good to go.  Salaries will be much higher, the profession will advance faster than ever, and employers/clients will have an easier time of finding exactly who they need.

    The requirements and qualifications? That’s up to us to figure out, and figure out fast.  Otherwise, I can also see government making the requirements so burdensome that it will push out those who are competent and prevent those with great potential from coming in.  That is totally opposite of what we want to happen.

0
  1474 Hits
  0 Comments