Forensic Focus

The investigation of child exploitation is a delicate balance between rescuing children, ensuring perpetrators are correctly identified, and safeguarding investigator mental health. This week on the Forensic Focus podcast, Christa and Si are with Cyacomb, talking digital forensics with: Jeffrey Bell, Customer Success Manager; Alan McConnell, Head of Customer Success; and Brandon Gardner, Program Manager.

As digital forensics decentralizes, shifting more responsibilities from lab to field personnel, tools that can manage the evidence from different user groups are ever more important. In this episode, Christa and Si talk with Andrew Lister, Managing Director at Detego Global, about interoperability between field and lab. They discuss Detego's significant post-pandemic growth, what it is about interoperable frontline and lab tools that other solutions miss, and the biggest challenges when adapting a military field tool to more regulated environments.

To read Andy's previous interview with us, visit https://www.forensicfocus.com/interviews/andy-lister-global-business-development-director-detego.

This week, Christa and Si talk with Cyacomb's Graham Little and Mike Burridge about the technology it takes to identify child sexual abuse and terrorist imagery, on both devices and the online world. The balance between public safety and privacy is discussed, along with challenges faced by both social media providers preventing imagery from being shared, and law enforcement investigating the perpetrators. Also described: technological challenges and what they mean for investigations and prosecutions, including the need for training and education of users; and new developments coming from Cyacomb.

In this episode, Detective Lee Bieber of the Plantation Florida Police Department and the FBI's Crimes Against Children and Human Trafficking Task Force in Miami talks with podcast host Christa Miller about his background, the trends he's noticed in criminal use of digital technology, and the artifacts that make up the elements of a statutory crime. Also discussed: putting digital artifacts together into a picture using various forensic tools, and the tool that helps him most in his investigations.

You can't put a price on bants! Friends and enemies welcome as this week Christa, Si, and Desi recap HTCIA and DFRWS. Deep dive into ticket prices and accessibility. Wonder whether there is innovation in the vendor space. Consider running their own virtual Forensic Focus conference in 2023. They briefly touch on neurodiversity, potential guests, and we all get treated to Si's long preamble and and slightly shorter outro.

Show Notes:

DFRWS APAC 2022 Program - https://dfrws.org/apac-2022-program/

BSides AUS - https://www.bsidesau.com.au/

BSides UK - https://www.securitybsides.org.uk/#

HTCIA - https://htcia.org/

Heather Mahalik's talk on verifying evidence

CYACOMB Prioritizing time sensitive investigations with Rapid Digital Triage - Alan McConnell

Hansken Forensics - https://www.hansken.nl/

Velociraptor - https://www.rapid7.com/products/velociraptor/

Sydney Declaration IAFS 2023 - https://iafs2023.com.au/sydney-declaration/

This week, Si and Christa talk with James Eichbaum, global training manager at MSAB, about:

• The technical and procedural challenges that students bring to class that inform R&D and, in turn, training.
• The importance of training to thorough, forensically sound examinations, as well as to educating managers and other stakeholders on why thoroughness is important.
• As well, the need and ability for examiners to be able to articulate their own processes in a rapidly changing field.
• Training for different levels of personnel, from frontline officers all the way up to the lab.
• How the COVID-19 pandemic affected training course design and delivery.
• Some of the new things to look out for in both products and training from MSAB.

Show Notes:

Our previous interview with James: https://www.forensicfocus.com/interviews/james-eichbaum-global-training-manager-msab/

Our interview with Matthew Sorell on mobile device forensics: https://www.forensicfocus.com/podcast/university-of-adelaides-dr-matthew-sorell-on-evidentiary-health-data-at-dfrws-apac-2022/

The FORMOBILE project: https://www.formobile-project.eu/

MSAB training: https://www.msab.com/training-overview/

In this episode, Desi and Si talk with Alex Tilley, who's part of the counter threat unit at Secureworks, as a followup to Alex's presentation on the history of financial cybercrime.

Show Notes:

The business club writeup from 00:18:25 https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group

Fast-flux and round robin DNS

Anti-money laundering legislation https://www.oaic.gov.au/privacy/other-legislation/anti-money-laundering#:~:text=The%20Anti%2DMoney%20Laundering%20and,sector%2C%20gambling%20sector%2C%20remittance%20(

Operation Tovar https://www.secureworks.com/blog/operation-tovar-dell-secureworks-contributes-to-efforts-targeting-gameover-zeus-and-cryptolocker

SMBiT Pro - Presenting Gold Coast end of October https://www.smbitpro.org/

ISACA - CBR Conference https://engage.isaca.org/canberrachapter/events/eventdescription?CalendarEventKey=29ea5d1c-5ee0-4bd7-b4ce-e591603ba8b3&CommunityKey=43346d1e-8e11-443a-bfa6-93582a92ad0f&Home=%2Fmelbournechapter%2Fevents%2Fcalendar

In this episode, Steve Slater, Head of Digital Forensics at Devon and Cornwall Police in the United Kingdom, gives Christa and Si an overview of implementation the new Rape and Serious Sexual Offence protocol:

• How digital forensics technology supplements a victim-centred, team approach
• Differences between victim and suspect acquisition processes
• What goes into balancing victim care with a forensically sound data collection
• How the protocol continues to adapt to the times: not just in terms of technology, but also in recruiting representative personnel and supporting their mental health
• Pandemic-era processes and procedures

Further reading: https://www.cps.gov.uk/cps/news/metropolitan-police-service-and-crown-prosecution-publish-review-r-v-allan https://ico.org.uk/

Following on their "unsupervised" discussion, this week Si and Desi focus on training and certification, including:

• Steps and missteps in commercial and government efforts to close the cyber skills gap through training and professional development
• The value of perspectives from different fields to digital forensics and incident response
• The shortcomings of certifications as measures of proficiency, and the need to teach a foundation of how to learn, not just pass certification exams
• Alternatives to certifications, such as chartered professionals, CTFs and coursework with practical elements
• The need for mentors to help develop professionals

CyberCX Academy announcement: https://news-events.cybercx.com.au/cybercx-academy-launched-to-help-solve-cyber-skills-crisis

Marketing fail: UK government criticised for 'crass' ad advising ballerina to retrain in IT: https://www.netimperative.com/2020/10/13/marketing-fail-uk-government-criticised-for-crass-ad-advising-ballerina-to-retrain-in-it/

Distant Traces and Their Use in Crime Scene Investigation: https://www.forensicfocus.com/webinars/distant-traces-and-their-use-in-crime-scene-investigation/

Australian Cyber Collaboration Centre: https://www.cybercollaboration.org.au/

dfrws.org

In this episode, Si and Christa talk with Martino Jerian, founder and CEO of Amped Software, about:

• Some of the misunderstandings around digital video and image evidence and how this can affect justice proceedings
• Technical challenges associated with evidentiary integrity and authenticity of data which is based on complex mathematics
• The need for better trained, qualified analysts in multiple dimensions of multimedia forensics, including file formats, processing, and metrology specialisms
• As well, the need for awareness-building among nontechnical stakeholders in policymaking