Chris Doman, Co-Founder of Cado Security, joins the Forensic Focus podcast to discuss cloud forensics and incident response. Cado Security provides cloud-based software for collecting and analyzing forensic evidence in cloud environments.

Chris discusses the challenges of cloud forensics, such as the constantly changing nature of cloud environments and the need to standardize and normalize data from different sources.

Cado Security is working on partnerships with cloud and EDR vendors, as well as IR providers, and is planning to release new features related to SaaS and email compromise investigations.

00:00 – Introducing Chris Doman from Cado Security

03:00 – Starting and growing Cado Security

05:45 – Cado Community

06:30 – Cloud forensics tools

10:40 – Collecting, processing and presenting data

12:00 – Advantages of cloud to cloud

13:50 – Audit logs

16:00 – Automation

20:30 – Training and investigation support

28:00 – Release cycle and managing updates

30:30 – Roadmap

40:30 – Chain of custody

43:00 – Encryption and storage

43:30 – Cado Security at events

Alan Platt, Professional Services Consultant at MSAB, discusses his experience as a former UK police officer working in digital forensics. He talks about the different levels of digital forensics capabilities within police forces and how MSAB products like XAMN and XEC Director are used by frontline officers versus lab analysts.

The discussion covers how MSAB partners with law enforcement to develop custom workflows for mobile device acquisitions that facilitate ISO compliance. Alan explains MSAB's managed service offering, where approved MSAB staff can remotely access a customer's XEC Director server to assist with software updates and troubleshooting. He emphasizes the strict data segregation policies enforced by customers to prevent MSAB from accessing any sensitive case data.

Looking ahead, Alan mentions MSAB's new CEO and hints at some exciting developments coming down the pipeline. He spotlights recent enhancements to XEC Director's speed and database functionality for managing large estates of networked Kiosks. Alan also plugs the new XEC Director training he created to help users fully leverage the platform's capabilities.

00:00 – Introduction to Alan Platt

07:00 – Training

12:00 – Workflows

17:20 – Ensuring a secure environment

19:45 – Customer training

20:35 – Helping customers comply with ISO accreditation

25:00 – Validation and verification

27:30 – ISO standards

30:00 – MSAB’s pipeline plans

32:40 – XEC Director

43:45 – Privacy of user data

Nick Harvey, a former Detective Inspector in the Metropolitan Police, discusses his transition from law enforcement to his current role as a Customer Success Manager at Cellebrite. He describes his experience in tackling county lines, a form of organized crime in the UK where drug dealers set up operations in smaller towns and cities to expand their business. He also discusses the role of mobile phones in criminal investigations and how data-driven approaches can expedite the justice process.

Nick goes on to highlight the challenges of explaining digital evidence to judges and juries and the potential impact of artificial intelligence in forensic investigations. He also emphasizes the importance of communication between digital forensics units and investigators and the need for tools that can handle large data sets and provide actionable insights.

Nick shares his thoughts on the impact of regulations on forensic processes and the need for a balance between oversight and efficiency. He concludes by advising investigators to be open to new approaches and to focus on the objectives of their investigations.

00:00 – Introduction to Nick Harvey, Customer Success Manager at Cellebrite

02:40 – Data driven approach to tackling county lines crimes

07:50 – Changing landscape of mobile forensics

11:45 – Operation Venetic and EncroChat crime

15:20 – Ensuring admissibility of evidence

19:50 – Machine learning in crimes and crime detection

24:00 – Machine learning in Cellebrite’s tools

27:10 – Working at Cellebrite

31:30 – Managing large volumes of data

34:40 – Training tool users and empowering investigators to get the most from data

36:00 – Regulations and compliance frameworks

39:55 – Advice for digital investigators

Subscribe to the Forensic Focus Podcast: https://www.forensicfocus.com/podcast/

Keith Lockhart, Vice President of Training at Oxygen Forensics, discusses the evolution of training in the digital forensics industry. He highlights the shift towards online training and the use of technology to deliver courses remotely. He also mentions the importance of gathering feedback from customers and adapting training programs to meet their needs.

Oxygen Forensics is focused on providing a range of training options, including on-demand content and hands-on training with shipped devices. Additionally, Keith discusses the company's new technologies, Oxygen Corporate Explorer (OCE) and Oxygen Analytic Center (OAC), which offer collaborative review and data collection capabilities. 

00:00 - Keith Lockhart’s career 

06:45 – Educational background

09:15 – Technical knowledge and software development

14:55 – Transitioning to a training role

20:05 – Sharing knowledge and presenting evidence in court

24:15 – Products and training from Oxygen Forensics

34:00 – Receiving customer feedback

35:30 – Online versus in-person conferences and training

38:10 – Providing training and tools in different languages

41:00 – Oxygen Forensic Certifications

44:10 – Oxygen Forensics’ focus for 2024

Si interviews Monica Harris from Cellebrite about new products and developments in the field of digital forensics. They talk about the importance of staying connected to the community and understanding their needs.

Cellebrite has recently launched several new products, including Endpoint Mobile Now, a SaaS solution for the patent pending remote collection of targeted data on iOS and Android devices. Another new product is Mobile Ultra, a mobile forensics solution that provides access to mobile data on a wide range of iOS and Android devices.

Cellebrite aims to develop technology that meets the needs of their customers and provides solutions for the challenges they face in digital forensics.

00:00 – Introduction to Monica Harris and Cellebrite

03:20 – New Cellebrite products and upgrades

05:40 – Cellebrite Endpoint Mobile Now

12:00 – Storage, privacy and ownership of acquired data

13:30 – Bandwidth requirements

15:00 – Targeting specific data

18:45 – Cellebrite Mobile Ultra

22:15 – Cloud collection platforms

26:10 – Collecting data from the cloud

27:05 – Screen share and capture capabilities

29:15 – What’s coming up for Cellebrite?

32:10 – AI and machine learning

36:40 – Final thoughts and invitation to get in touch

Si and Desi interview Rich Frawley from ADF Solutions. They discuss the use of screenshots and screen recording in mobile device investigations. Screenshots and screen recordings can be used to capture evidence that may not be available through logical acquisitions, allowing investigators to add valuable information to their cases.

Rich also discusses the limitations of screenshots and screen recording, such as the inability to capture certain types of data or the risk of alerting the other party in a chat conversation. He emphasizes the importance of investigators knowing their cases and making informed decisions about the best methods to gather evidence.

Rich also highlights the speed and efficiency of ADF Solutions' tools, which focus on triage and intelligence gathering rather than cracking devices. He mentions the company's training programs and the ability to generate reports and share data with other tools. The conversation touches on the future of mobile forensics, including wearables and emerging technologies like smart glasses.

Si Biles interviews Sophie Powell, Professor Sarah Morris, and Rob Black about the Cyber 9/12 Strategy Challenge. The challenge is an opportunity for students to experience a simulated cyber crisis and provide advice to senior government decision-makers.

The guests discuss the value of the competition in developing multidisciplinary skills and the importance of diversity and inclusion in the cybersecurity field. They encourage students to participate and emphasize the benefits of networking and learning from industry professionals.

The guests also highlight the need for more outreach and support for women in cybersecurity at all levels of education, and the work of CyberWomen Groups C.I.C..

Show Notes:

Event Recap: The CyberWomen Conference 2023 - https://www.forensicfocus.com/event-info/event-recap-the-cyberwomen-conference-2023/

Si and Desi are joined by Brittany and Ailsa from digital forensics software company ADF Solutions. They discuss how ADF is addressing key challenges for digital forensics practitioners, including handling the massive volumes of data from mobile devices and the cloud.

The guests outline ADF's focus on developing their software as an easy-to-use onsite triage tool that can help quickly identify pertinent evidence. Key features include advanced handling of video files, AI-assisted classification of images, and new screen recording capabilities for mobile devices that allow suspects to safely share relevant data.

The hosts and guests also explore ADF's ongoing research into areas like facial recognition, handling new device types like games consoles and smart watches, and identifying deepfake media.

00:00 – Introduction to Ailsa and Brittany

03:00 – The challenge of vast amounts of data

05:50 – Recovering data from Chromebooks

08:50 – Triaging using ADF tools

12:30 – Benefits of using ADF Solutions’ tools

15:50 – Limitations in types of apps

17:20 – Keeping up with technological advancements

19:15 – ADF customer base

21:00 - Artificial intelligence in classifying images

30:00 – ADF Solutions’ triaging kit

37:00 – Training with ADF

40:00 – Target user

44:50 – Roadmap of future devices to examine

51:30 – Main focus for ADF Solutions going forwards

Show Notes:

AI-generated CSAM article on Sky News - https://news.sky.com/story/thousands-of-ai-generated-child-abuse-images-being-shared-online-research-finds-12991727

Si and Desi interview Emi Polito from Amped about how to become an Amped FIVE Certified Examiner (AFCE). They discuss the exam requirements and format, as well as Amped’s future plans. Emi explains that the certification is aimed at demonstrating competency with the Amped FIVE video analysis software after completing training. The exam consists of multiple choice questions on theory and practical exercises using the software. Emi talks about the online exam format and process for passing or failing.

Emi also discusses the broader challenges many organizations face with validation and accreditation. He emphasizes Amped's commitment to developing tools that facilitate that process. The hosts reflect on the confusing accreditation landscape and Amped’s passion for improving training and certification in forensics. This episode provides an overview of Amped's new certification and perspective on challenges in the field of video forensics.

Show Notes:

Introducing The AFCE Certification (Amped FIVE Certified Examiner) - https://www.forensicfocus.com/news/introducing-the-afce-certification-amped-five-certified-examiner/

Video Evidence Principles With Amped Software - https://www.forensicfocus.com/podcast/video-evidence-principles-with-amped-software/

Digital Image Authenticity And Integrity With Amped Authenticate - https://www.forensicfocus.com/podcast/digital-image-authenticity-and-integrity-with-amped-authenticate/

File Analysis And DVR Conversion Training From Amped Software - https://www.forensicfocus.com/reviews/file-analysis-and-dvr-conversion-training-from-amped-software/

Amped FIVE Speed Estimation 2d Filter And Training From Amped Software - https://www.forensicfocus.com/reviews/amped-five-speed-estimation-2d-filter-and-training-from-amped-software/

Amped Software’s Martino Jerian on Key Challenges and Opportunities for Video Evidence - https://www.forensicfocus.com/podcast/amped-softwares-martino-jerian-on-key-challenges-and-opportunities-for-video-evidence/

LEVA 2023 Training Symposium - https://www.leva.org/

Forensic Collision Investigation & Reconstruction Ltd - https://www.fcir.co.uk/

Amped FIVE Certified Examiner - https://ampedsoftware.com/afce-certification

Introducing the Amped FIVE Certification Program - https://blog.ampedsoftware.com/2023/10/04/introducing-the-amped-five-certification-program

Amped Software YouTube - https://www.youtube.com/ampedsoftware

How to Use the Validation Tool in Amped FIVE - https://blog.ampedsoftware.com/2023/03/29/how-to-use-the-validation-tool-in-amped-five

Si and Desi talk to Gavin Prue and Selim Kang about their non-traditional paths into cybersecurity careers. They share their diverse educational backgrounds, from vocational college courses to returning to school later in life, and the hands-on training that helped prepare them for incident response roles.

Gavin and Selim provide advice for aspiring cybersecurity professionals on the importance of networking, asking questions, having a positive attitude, and being willing to put in extra time learning new skills. They discuss the value of university degrees versus certifications, the pros and cons of accredited cybersecurity programs, and the need for continued education in this rapidly evolving field. Whether starting from scratch or changing careers, their stories demonstrate that resilience and motivation can overcome lack of formal qualifications.