Latest / Parsing the Truth: One Byte at a Time / 25 Years of Turmoil in Digital Forensics

Transcript

25 Years of Turmoil in Digital Forensics · Parsing the Truth: One Byte at a Time

0:00
Hey everybody, thanks for tuning in for another episode of
0:03
Parsing the Truth One Bite at a Time.
0:05
This episode is a little different.
0:07
We recorded this live at the Oxygen Forensics conference, so
0:13
you will find in parts there is no video for a couple minutes
0:17
and the sound might get a little muffled.
0:20
We apologize for that, but we still think you're going to
0:23
think it's a great episode. And finally, we have to thank
0:27
Briggs for recording this for us and giving us our own personal
0:31
laugh track. Thanks everybody and please
0:33
enjoy. Join former FBI senior forensic
0:38
examiners Becky Passmore and Stacey Eldridge as they dig into
0:42
the world of digital forensics one bite at a time.
0:45
Now leading their own consulting firms and educating the next
0:48
generation of cyber sleuths, these badass babes of digital
0:51
forensics bring sharp insight, real world case experience, and
0:55
a dose of humor to the bits and bites that filled today's
0:57
investigations. From deep dives into business
1:00
e-mail compromise and ransomware attacks, Becky's specialty to
1:04
cracking the complexities of iPhone forensics, Stacy's
1:06
obsession, this podcast delivers insider knowledge for
1:09
professionals, students, and true crime techies alike.
1:13
If you've ever wondered what really happens when the digital
1:15
trail is all that's left, TuneIn and start parsing the truth.
1:27
Welcome to Parsing the Truth one terabyte at a time.
1:31
I am Stacey Eldridge and as always, I have my Co host Becky
1:34
Passmore with me for the live podcast at the Octogenic War in
1:39
the conference Legacy and Logic. Today you're going to be looking
1:44
back at 25 years of digital forensics, a journey from the
1:48
days of loppy, dis and flip phones to the era where a single
1:53
device can hold terabytes of secrets.
1:56
Digital forensics has transformed how we uncover the
1:59
truth. And today we celebrate the
2:01
evolution, the innovation and the cases that change.
2:05
Everything. Thanks, Stacy.
2:07
Today we're exploring the evolution of digital forensics,
2:11
the devices that defined an era, the artifacts have told the
2:16
stories, and the complexity that continues to challenge us all.
2:20
When we talk about the complexity explosion, we're
2:22
going all the way back to the 1990's, the point where digital
2:27
forensics truly began to accelerate into the massive,
2:30
data-driven world we know today. The complexity explosion in
2:35
digital forensics is a journey that some of us have experienced
2:38
first hand, one where our world of evidence has grown not just
2:43
in size, but in diversity, depth and difficulty.
2:48
So let's take a look back at the different digital evidence eras
2:52
it. Began in the 1990s, when our big
2:55
cases revolved around. 1.44. Megabytes of floppy disk, which
3:00
were considered cutting edge Sir Mix.
3:03
A lot had baby got back and digital forensics folks had baby
3:08
got bytes. Let's be honest, we like big
3:11
data and we cannot lie. Evidence recovery meant
3:14
repairing physical damage and navigating simple fat file
3:18
systems. Forensic examiners were pioneers
3:21
in interpreting bits, bytes, and strings of ones and zeros to
3:26
tell a story that no one else could see.
3:31
Forensic examiners were pioneers in interpreting bits, bytes,
3:35
strings, ones, serums, all that tell a story that no one else
3:40
could see. We didn't have advanced tools or
3:42
automated automated parsing. We had to build the methods,
3:46
understand the hex, and prove the digital traces mattered.
3:49
It was never about managing millions of files, it was about
3:53
finding that one deleted file that could change the direction
3:57
of the case. It was about understanding how
3:59
the metadata hidden within a document could lead to finding a
4:02
killer. These are the moments in digital
4:04
forensics that proved its worth in the pursuit of justice.
4:09
Becky, the 2000s are rolling in, the data's getting bigger, the
4:14
brides are heating up, and let's be honest, things are getting
4:17
hot in the air. We changed when we started
4:21
dealing with 40 gigabyte hard drives and a whole.
4:24
New kind of forensic pressure. Yep, that's the early thousands
4:28
again. Some of these weren't even born.
4:30
During. The error of the hard drive.
4:33
Suddenly digital evidence wasn't just a few files on a floppy
4:36
disk, it was entire systems overflowing inboxes and the
4:41
first wave of the mobile device data.
4:44
We pulled plugs on scene and then imaged.
4:46
Every bit of the hard drive. Because that was best practice,
4:49
what used to take an hour now to a whole day, and sometimes even
4:54
longer. Imaging became a waiting game,
4:56
and patience was a new forensic skill.
4:59
We were transitioning from carving deleted BIOS to
5:02
reconstructing digital lives. The data told us who.
5:05
What? When?
5:06
And how long? Time stamps, logins, browser
5:10
history all began point painting a clearer picture of human
5:14
behavior behind the keyboard. But this era was also brought
5:17
with new obstacles. Earlier forms of encryption,
5:21
password protected files, and rapidly involving evolving
5:25
e-mail platforms. Forensic tools were essential,
5:27
but they were still young. Every update felt like a.
5:31
Leap. Forward the hard drive error
5:33
tested our endurance and our skill.
5:35
It was no longer about if the evidence was there, it was how
5:38
fast we could find it and if. We could breakthrough the
5:41
barriers to reach it. Becky, what era did you begin
5:45
in? Are we talking about our heiress
5:49
tour in digital branches? I started in 2004.
5:54
From Woppy diss to Probringe framework, I've been shaking it
5:58
off ever since. Stacy, which era did you?
6:02
Begin. Well, I started back in 2004 and
6:06
was certified by the end of 2005 in the FBI and right when Justin
6:10
Timberlake was bringing sexy back, I was bringing files back.
6:14
By you. That is how we met through the
6:19
training at the FBI. Like 20 tens.
6:22
Digital forensics had stepped into an entirely new frontier,
6:25
the era of social media, smartphones and the cloud.
6:30
Storage capacity surged from a few gigabytes to terabytes,
6:34
significantly increasing the complexity of our cases.
6:37
Evidence now lived everywhere, in hidden Facebook messages,
6:42
Gmail threads synced invisibly through the iCloud, fingered in
6:47
apps, app data that users knew never knew existed.
6:51
For the first time, the digital world was bigger than the
6:54
physical one. And to learn how to investigate,
6:57
and we had to learn how to investigate both.
6:59
The challenge shifted from finding data, deciding where to
7:02
start. Investigators now needed to
7:04
navigate a growing network of platforms, accounts and cloud
7:09
providers, all protected by privacy laws, Encryption, and
7:14
ever changing access procedures. Search warrants expanded their
7:18
scope from individual devices to encompass an entire digital
7:24
ecosystem. Ryan warrants were challenging.
7:27
Where did that data live physically?
7:29
Did the warrant cover the location of the evidence?
7:32
The house, the vehicle, the shed, the office, the cloud,
7:36
then the server? But with that can complexity,
7:39
every case meant thousands of files, dozens of devices, and
7:43
countless log entries. The 20 Tens taught us that
7:46
digital forensics wasn't about data.
7:49
It was about meaning, about connecting fragments to form
7:53
truth in a connected. World By the time we hit the
7:56
late twenty 10s digital evidence was everywhere.
8:00
Cloud, data, social media, mobile apps.
8:03
It was coming at us faster than ever before.
8:06
Honestly, Becky, I think by the end of the week most of us said
8:10
I can't feel my face and I just want to move into the weekend.
8:13
And here we are today, the 20 twenties, what we call the age
8:16
of data overload. We've entered the TB era, where
8:19
a single smartphone can hold more information than an entire
8:23
evidence lab once did. Our digital device, our digital
8:27
evidence, lives everywhere now, in the cloud, across Internet of
8:30
Things, inside vehicles, smartwatches, doorbell cameras
8:35
and encrypted apps. Let's not.
8:37
Forget our refrigerators everywhere.
8:39
Where encryption isn't an option anymore, it's the default.
8:42
Every investigation is enormously complex.
8:45
Massive data volumes, privacy hurdles, cross jurisdictional
8:49
warrants, even AI generated content blurring the line
8:53
between fact and fiction. This is where forensic steel
8:56
meets innovation. Frantics is no longer about
8:59
imaging a hard drive and waiting for results.
9:02
It's about making real time decisions in the middle of an
9:04
active investigation. Today, Digital Fundricks has
9:07
shifted from recovering what was once lost to understanding
9:10
what's happening right now. But here's the real shift.
9:14
Instead of trying to know everything about everything,
9:17
we've wanted to go deeper. We focus on understanding the
9:20
artifacts more, mastering the tools better, and delivering the
9:24
results faster. Our goal isn't just to process
9:28
data, it's to interpret it with purpose.
9:31
We focus on outcomes, on expectations, on clarity, not
9:34
just the totality of the data. We've also recognized that no
9:37
one can do this alone. The best examiners aren't
9:41
isolated, they're connected. We collaborate, build networks
9:45
of experts, share strategies that build bridge that gap
9:48
between technical findings and legal storytelling.
9:51
We're going to communicate better with attorneys to help
9:54
them articulate what the data. Really means in.
9:58
Court turning, technical complexity, city.
10:00
Any 2 compelling truth. The 20 twenties have redefined
10:04
our profession. We're no longer exist examiners.
10:07
We're the technics of the scientists.
10:09
We're analysts for report writers, educators, and truth
10:13
finders operating in a world that never stops creating data.
10:18
So as the data has evolved, so have we.
10:20
From floppy disk to terabytes in the cloud, every leap in
10:23
technology reshape how we investigate, analyze, and
10:27
uncover the truth. But.
10:28
Behind that evolution are the stories, the cases that tested
10:32
us, changed us, and proved just how powerful digital evidence
10:37
can be. Stacy, some of these.
10:44
Cases didn't just make headlines, they had up stancing
10:47
the night away in the lab, facing evidence through drives,
10:51
phones and lobs until the truth came out.
10:54
Let's talk about a few of those cases that truly changed the
10:58
game. Absolutely.
10:59
So in my opinion, one of the first big cases that helped us
11:03
prove the power of digital forensics and how fast
11:06
discovered by forensic examiners could be used to solve Major
11:10
Crimes was the case of the BTK killer.
11:13
The BTK killer had murdered people across Kansas for 17
11:17
years and then nothing. He re emerged 14 years later
11:21
taunting police. And during those exchanges, he
11:25
posed a question. Can I send you a floppy gist?
11:28
Can you track it? Be honest.
11:30
So the detectives asked their forensic examiner, Randy Stone.
11:34
Randy said there could be data on there that might be subtract
11:37
him. So the detectives, oh BT killer
11:40
No, go ahead and send us that floppy disk.
11:43
Randy prepped for the floppy by conducting tests to ensure that
11:46
X raying it wouldn't damage anything on it.
11:49
They were fearful that explosives might be contained in
11:52
it based on some of the. Things the BTK killer was.
11:55
Saying and X raying it would prove no problem, wouldn't alter
11:59
it in any way, and finally that purple floppy disk arrived.
12:03
They rushed to the lab. The metadata of the RTF files
12:07
present on that purple floppy disks contain clues and those
12:11
clues would eventually lead to the killer.
12:14
The metadata contain clues such as the name of a church Christ
12:18
Lutheran, the name of a town Park City, a name to the last
12:23
edited by field Dennis Rader It wasn't a confession.
12:26
Dear police, I started killing people in 1974 and here are all
12:30
my victims love Dennis Rader. No, nothing like that.
12:33
It wasn't so obvious. It was the recovery of the
12:36
metadata that would provide leads that that could be
12:39
investigated and put together to discover who done it.
12:43
And this metadata hold with solid investigation work finally
12:47
led to a suspect confessing 3-4 years after the first murder.
12:53
Dennis Rader finally admitted he was a BTK killer.
12:58
How about the in the first infamous case involving digital
13:02
forensics that went to trial? Let's talk about the Casey
13:05
Anthony trial. This is one of the first trials
13:08
that really exploded with social media, 24/7 news cycles and it
13:13
was hot across the globe. And there was certainly lots of
13:16
digital evidence in this case. 3 different digital forensic
13:20
examiners testified multiple times and there was even a
13:23
defense expert who stayed behind the scene, never entering the
13:27
courtroom. But instead, instead, from the
13:29
State House in Orlando, Larry Daniel helped the defense call
13:32
into question the chloroform searches presented by the state.
13:36
Now, for years, fingers have been pointing and saying they
13:40
simply should have validated their results.
13:42
And this case was used to teach people the consequences of not
13:46
validating the results with two different tools.
13:49
But what happens when two different tools don't agree?
13:53
What happens when four different tools don't agree, such as what
13:57
happened in this very case where Net Analysis and Case Cash Back
14:02
and FTK all produced different results on that morgue database?
14:08
They were all different. What then?
14:10
So the strategy can be to try not to introduce those results
14:14
into court because you couldn't validate them.
14:17
But what happens if they do get introduced?
14:19
Remember, we're there to answer the questions, not ask them.
14:24
The prosecution wasn't supposed to ask John Bradley about the 84
14:28
times that chloroform site was visited, but they did.
14:31
Now, this opened up an entirely new line of questioning in the
14:35
courtroom. And after thoroughly reviewing
14:37
this case, Becky and I believe that the attorneys strategy,
14:41
especially surrounding the chloroform site visit counts,
14:45
did a disservice to John Crowder.
14:48
This was further compounded by the fact that the Orange County
14:51
Sheriff Office explicitly advised the attorneys to avoid
14:56
that specific line of questioning.
14:58
And in this completely unusual case, where lots of unusual
15:02
things happen constantly, they had John Radley read in data
15:06
from a report that he didn't generate.
15:08
While he was on the. Stand now.
15:11
The Orange County Sheriff's Office.
15:12
Did state we're not going to use this data, We don't want to use
15:15
this data, but that doesn't mean you're off the hook.
15:18
The defense gets what you generated as a digital forensic
15:21
examiner along with your reports, so they know what you
15:25
know. So you better be prepared to
15:27
answer those questions. So after all the time we spent
15:30
on the Casey Anthony case, do you think there are new lessons
15:33
learned for examiners? Yeah, I think you can find 2 new
15:36
lessons learned out of this case.
15:38
So from the Casey Anthony trial, we can learn first that lawyers
15:42
are responsible for asking the questions and getting the
15:46
evidence in. I think it's super easy to
15:48
forget their role in all of this because we can prep with them
15:52
and have discussions with them about everything we think about
15:55
the digital evidence and what we think is important and what we
15:58
want to say when we're on the stand.
16:00
But ultimately the attorneys are there to present evidence and
16:04
arguments to support their clients position.
16:07
Secondly, avoiding unreliable data simply isn't the answer.
16:12
You should be prepared to answer questions about it because even
16:16
if your lawyer isn't going to ask you questions, I think about
16:19
it the other. Side just might.
16:21
That's right. But what about a case that isn't
16:23
so old? You know, good to say.
16:24
Taylor way that thin. Yeah.
16:26
Casey Anthony way back. There are cases involving
16:29
digital forensics still making the news today.
16:33
Anybody heard of a little trial involving Karen Reed?
16:36
The 1st. Child or the second child?
16:39
Well, I mean, both, both of these trials were feisty because
16:44
the defense or the prosecution, their digital forensic experts
16:48
had completely differing opinions about a little artifact
16:52
from the browser state DB and also what a little red FS mean.
16:56
These opinions were so different that one expert's conclusion
17:01
enabled the defense to not only say Karen Reed did not do it, it
17:06
enabled them to use this artifact to imply that others
17:10
were responsible for the death of John O'Keefe during the first
17:13
trial and throughout the trial. Lots of digital evidence
17:17
centering around the iPhone. But of course we had vehicle
17:20
forensics. There was video footage and even
17:22
time stamps all being called into question.
17:25
But who knew a little red X in a tool had lead to such differing
17:30
opinions? So what's the difference between
17:33
a record being marked as recovered versus a record being
17:36
marked as deleted in your? Tool.
17:38
Do you know? Second, how do you validate if
17:41
someone is deleting that record on purpose or if instead this is
17:46
simply how the iOS and the database are interacting
17:50
together? Let's jump into some lessons
17:52
learned now. First, I think the first lesson
17:54
learned from Karen Reed's trial is let us see how a little Red X
17:59
should remind us the importance of knowing how your tools work.
18:04
So not only does this show the pitfalls of over reliance on
18:08
automated tools, perhaps it demonstrates the importance of
18:13
intending vendor training so you know how your pools actually
18:16
work. Now we can jump into House Long
18:21
to die in the cold. It was a Google search found on
18:25
Jennifer McCabe's phone. This Google search for House
18:28
Long to die in the cold is what turned the Karen Reed case into
18:32
a true crime phenomenon. The defense claimed that this
18:35
claim was made hours before Don O'Keefe was found dying in the
18:39
snow, and this suggested that someone knew he was there and
18:43
didn't save him. Now it was Richard Grieve's
18:46
affidavit, the defense expert, who said that this search
18:50
occurred at 2:27 AM and this kicked off a whole chain of
18:55
events where it would resulted in additional forensic examiners
19:00
being called in, calls to celebrate hours and hours of
19:03
additional testing and validation, and even Jennifer
19:07
McCabe being harassed for months and months by the public.
19:11
This search for House Long to die in the cold was found in the
19:14
browser state DB. It was not found in the history
19:18
DB. These are two different
19:20
databases. That serve.
19:21
Two different purposes. The browser state DB, the ogler
19:25
simplify, is basically tracking your tabs and their status.
19:29
It is not tracking all of your browser history.
19:32
However, the history DD tracks your Internet browsing in Safari
19:37
on your iPhone. This brings us to the second
19:39
lesson learned that browser state DD artifact for the search
19:43
for house, long to die and hold demonstrates that no artifact
19:48
lives in isolation. You need to validate your
19:51
conclusion by looking at related artifacts, and in this case, it
19:54
was important to take a look at that Internet history as well.
19:58
In addition to doing that, I think it would have been crucial
20:00
to review the events that were occurring immediately before and
20:05
after that search allegedly took place at 2:27 AM.
20:10
You have to build the whole. Picture So since there was so
20:14
much disagreement over that House Long to die in the cold
20:18
artifact, was it included in the second trial?
20:21
It is worth noting that that digital forensic examiner for
20:23
the defense that was used in the first trial did not come back to
20:27
the second trial, nor did they use that house lawn to die in a
20:31
cold defense strategy. So, any more lessons?
20:34
Learned in the Karen Reed trial. You bet there are.
20:37
Let's pick up with the third lesson.
20:40
The Karen Reed trial shows us just how complex iPhone exams
20:44
are and the importance of testing and validating what
20:47
you're seeing when you're stating that something happened.
20:50
The two witnesses for the state, Jessica Hyde and Ian Whitman,
20:54
both conducted tests on iPhones to be able to confirm the
20:58
significance and the meaning of the data that they were talking
21:01
about. During the first trial in the
21:03
courtroom, they spent time discussing what they're testing
21:06
was, what they did, and what it meant in terms for that house
21:10
long to die in the cold surge and what it meant for the
21:14
browser state DB versus the history DB.
21:17
Now during the the second trial, Ian Witham went on to spend more
21:21
time talking about additional testing he had conducted and
21:24
that was related to the Apple Health data.
21:27
But I'm going to come back to Apple Health data in a minute.
21:30
Let's focus on why we should test and validate.
21:33
Remember, the tools are just that, tools.
21:36
They help us get the job done. It's our responsibility to check
21:40
that they are interpreting the data correctly.
21:42
I also find it so odd that in an industry full of people who are
21:46
typically so suspicious of everyone and everything, but
21:51
when it comes to our vendor tools, we tend to put a lot of
21:53
blind trust in them. I'm not saying the tools are
21:55
garbage. Absolutely not.
21:57
We have to use them to get through the mass amounts of data
22:00
we are facing today. We're no longer examining every
22:03
bit on every device that we get. But when it comes to altering
22:07
someone's life forever and the ripples that come with it, we
22:10
have to take a moment and test and validate the assertions that
22:14
we are making. And there is so much data on the
22:17
iPhones and when you're relying on that data that goes beyond
22:21
simple artifacts such as pictures and text and you're
22:24
starting to dig deep into the data denses.
22:26
And now we're even starting to get into the unified logs, all
22:29
of that data and the new information they can provide.
22:32
We can't blindly rely on the column names to accurately
22:37
document the data contained within them.
22:39
For the remaining if you've ever looked at column name in a
22:42
database, in an Apple database, you will see that the names are
22:46
just crazy. Why do so many of them start
22:48
with ZDDDI? Have no idea, and it makes no
22:53
sense. But one of the things that
22:55
shockingly happens with Apple is native release.
22:58
New IS versions all the time. And those new versions and green
23:03
changes, and sometimes those Apple engineers just shove the
23:07
new data into old columns. Now testing is going to bring
23:11
truth to the many assumptions we've held for years.
23:14
So now I want to loop back to that Apple Health data.
23:17
Have you ever heard people saying for years that when it
23:19
comes to Apple health floors, they can be other either up or
23:24
down? Well, they can't.
23:26
They're just up. Now we have to remember that
23:29
this data is related to health tracking, health apps and
23:32
fitness apps and trackers. They don't care that you're
23:35
going downstairs. They care that you're going
23:37
upstairs for health purposes. That's what you're going to
23:40
track. And I'm not saying that it's up
23:42
because this is based on my assumption that they care about
23:44
up for exercise and fitness. I'm basing this on the fact that
23:47
there is actually an additional database related to Apple Health
23:51
data and it's seldom talked about or this database shows.
23:55
The sets. So please stop saying that the
23:58
floors climb can be either up or down.
24:00
It's simply up. I'm going to talk about some of
24:03
the databases and the names may slightly vary depending on your
24:06
iOS. I'm talking about a case I work
24:08
so if you would look at the cash encrypted c.tv you will see
24:13
floors ascended and descended. But then if you go back to the
24:19
dot S2 like, you'll notice that it's not like doing math with
24:23
it. It's not adding the floors up
24:25
and then subtracting the floors down and then giving you a sum
24:28
total. It's not doing that.
24:29
All it's doing is reporting all of the floors ascended together.
24:33
So it's just up now. How did I know?
24:37
Because I tested it and I asked other examiners what they saw.
24:41
Now, why did I test it? Because in a case I had, it made
24:44
a huge difference if the floors were going up or down.
24:48
But testing and validating could be really tricky, especially
24:52
with when you're getting an old case.
24:54
Getting that to the right iOS and on the right phone can be
24:59
downright impossible. And getting the right devices
25:02
can also be expensive and it can be time consuming.
25:05
And therefore, four, it can be extensive for your client to pay
25:08
for as well. Now let's move on to a fourth
25:11
lesson. During the trial, we also got to
25:13
watch an expert get raked over the coals for listing a degree
25:17
they hadn't earned yet on their CD.
25:19
And I think this is a subtle reminder.
25:21
Lawyers will attach you with whatever they can, whenever they
25:25
can to make you look bad on the stand.
25:29
Now finally, it's really easy for us to sit up here and tell
25:33
you what we think after we've had the ability to go back and
25:36
watch both of the care and read trials twice and then replay
25:40
certain parts of it over and over again and then having the
25:42
luxury of conferring with our notes.
25:44
But how would have this done all done down if you or I have been
25:49
on the stand, if we have been an expert And what questions would
25:53
the lawyers have asked us when we were in the hot seat?
25:55
Who knows? But we have the ability to go
25:58
back and watch these trials, any of these trials, and this is a
26:02
huge learning experience for all of us, and it's free.
26:06
Becky, let's. Crank up the nostalgia back when
26:09
Nirvana ruled the airwaves and the forensics smelled less like
26:12
Teen Spirit and more like First Circuits.
26:15
Let's walk through some of the devices that started it all.
26:19
Yeah, let's do that floppy disk. The tooth over there?
26:23
Yep, so do. You want to see?
26:28
These you have a. Few floppy disks here, so with
26:33
the 8 inch, the 5.25 inch, the 3 1/2 inch.
26:37
The floppy disk family marked the beginning of portable data
26:41
storage. The 8 inch was introduced in
26:43
1971 held a near 80 kilobytes of data, mostly used 5.
26:50
The smallest 5.25 inch version was 1976 to the 1990s that
26:57
increased the capacity to a whole 1.2 megabytes.
27:01
The company. Use this for playing organs.
27:03
Now I. Hope, England.
27:06
Out of the century. Becoming the standard for early
27:09
PCs by the mid 1980's, the 3 1/2 inch floppy arrived sturdier,
27:15
protected by a hard classic shell and capable of storing up
27:18
to 1.44 megabytes. But which one is the real floppy
27:24
disk here? Which one?
27:26
Which one? Red or yellow?
27:27
The one's real. Red depends how you define
27:29
floppy. The red one is an actual floppy
27:31
dish, this one's just so the 3 1/2 has.
27:34
No longer floppy. Good gist software installation,
27:38
document transfers, or what we call sneakernet and saving
27:43
critical system data long before flash drives or the cloud even
27:47
existed. The popping still lives on your
27:51
computers today as the save icon.
27:53
A digital fossil from computing's early days now.
27:58
Hard drives were certainly around way back when, but they
28:00
were small. They weren't small in size in
28:03
terms of this one, but they were small inside of around 80
28:08
megabytes, yes, megabytes. Now in the 90s, Windows 95 had
28:14
users demanding more storage and then so we had one and 2
28:18
gigabyte hard drives that were. Becoming more.
28:21
Commonplace and by the end of the 90s, ten gigabytes was
28:24
pretty standard. But then in the 2000s, we were
28:27
there for the 40 gigabyte hard drive.
28:29
And I remember in the lab constantly energy 40 gigabyte
28:33
hard drive after 40 gigahertz, 40 gigabyte hard drive.
28:36
And then came the bigger ones. We were starting to get the 80
28:39
gigabytes and then we jumped to 1:20 and then we jumped to 2:50.
28:43
And then 500 gigabytes was pretty standard for quite a
28:46
while. But today it's pretty common to
28:48
see one terabyte solid-state drive and even the cheapest of
28:53
laptops and external hard drives at anybody's house could average
28:57
10 terabytes. But did you know that Toshiba
29:00
plans to release a 40? Terabyte hard drive.
29:03
In. 2027. Bigger data it's coming and over
29:07
time, I mean this hard drive I hear I think it was 40 gigabytes
29:11
and the laptop it was it had all the pins for the IDE drives as
29:16
well. But this one and this was I
29:19
think I got this one in 2006, this little thumb drive was 4
29:23
gigabytes and we were like that's amazing.
29:25
It's 4 gigabytes and it's and it's so small and this thumb
29:31
drive I here have here now is 120 gigabytes on this little
29:34
one. I think this teeny tiny one here
29:37
is also 120 gigabytes. So we've really compacted down
29:42
on how much data we can fit on something so small.
29:46
And then as sizes increase but the devices decrease, sometimes
29:50
it became harder find some of these things when we are going
29:53
out on our first warrants to find stuff.
29:56
But let's jump. Back into the.
29:57
History of the hard drives and solid-state drives themselves.
30:01
I think it's interesting to go for some of the physical
30:03
connections as they've evolved over time.
30:05
They actually first started out with SCSI interfaces.
30:09
I wasn't dealing with a lot of SCSI in the FBI in terms of hard
30:13
drives, but I was using SCSI to send all of my images to tape.
30:18
And we had, as we mentioned, the IDE drives.
30:20
And we had to struggle with making sure that the jumper cap
30:24
was on the correct pin. And we had to make sure we have
30:27
the right configuration where we putting it into master slave or
30:32
cable select. And we had to make sure we got
30:34
it right before we did. Let me tell you, don't even ask
30:38
chat GOTP to like diagram out something like this for you,
30:41
especially on the bigger hard drives and label what was what
30:44
because it Simply put it even after being given the picture of
30:48
what it shows like. So now the SATA drives hang
30:52
along in the 2000s and they gave us a lot more speed.
30:55
So we're excited about that. But of course, we can't forget
30:59
about the solid-state drives that came around around 2010 and
31:03
we were spending a pretty penny so we could get a 64 gig
31:06
solid-state drive into our exam machine.
31:08
So it could be the 10th drive. Now, Becky, what about some
31:12
other drives that weren't computers but still had Disney
31:15
Elevens? On them we have the iPod 1st
31:18
generation released in October 2001 and it would redefine that
31:23
portable music with its promise of 1000 songs in your pocket.
31:28
It transformed the way people interacted with music.
31:31
Sleep Simple and shockingly powerful.
31:34
At its time, there was 5 gigs of the hard drive that could store
31:39
1000 songs. It had 10 hours of playback and
31:43
the original iPod sparked a total shift because music became
31:47
personal, portable, and perfectly, perfectly organized.
31:50
It paved the way for that iTunes store and eventually the iPhone.
31:55
The very first iPod could only be used on Maps.
32:01
But Microsoft, as always, comes out a few years later with the
32:05
competitor. So here we have the Microsoft
32:09
Zoom introduced in 2006. My Zoom still works, still has
32:13
my music on it. I will say I like it better than
32:16
the iPod. Why?
32:18
Because my headset, the port was in the top and not in the
32:22
bottom, so I could like set it down while I was exercising and
32:25
stuff like that. But anyway, so the Zoom,
32:28
Microsoft's answer to the iPod, it offered wireless sharing
32:32
before AirDrop existed. You had customizable backgrounds
32:36
and you could have a Zoom Pass that would give you unlimited
32:39
music. But despite the innovative
32:42
ideas, it never gained traction because that five years later,
32:46
I've already had mass dominance with the iPod.
32:50
Now, it did have some social sharing where you could do
32:54
wireless song swaps and then you could share a song with your
32:57
friend and then they could play it three times in three days.
33:01
Then you had. Your original iPad 20,000, I
33:04
mean 2010, Apple's first iPad introduced the post PC error.
33:09
It was sleek, touch driven and blurred the lines between a
33:13
laptop and phone. Steve Jobs introduced it from
33:16
couch saying it was better than a laptop, better than a
33:19
smartphone. We also have the iPad 2 that was
33:23
noticeably thinner, offering better performance and
33:28
usability. Next up came the iPod Mini.
33:32
So the IT was still just black and white, but it was much
33:35
smaller. It was tiny and cool and it
33:38
finally made digital music feel personal.
33:41
And it's new click will became iconic.
33:44
Now this was discontinued after just 18 months.
33:48
It was replaced by the iPod Nano and that is the beginning of
33:53
Fashion meets. So the iPod Nano 2005 to 2017
33:59
now evolved across 7 generations from candy bar design to
34:04
touchscreen music companion. It symbolized portability and
34:09
professional and personalization and a little known fact.
34:12
About this is the 6th. Generation of Banano was so
34:16
small people wore it as a watch with third party wrist straps so
34:22
I wonder if that's how they came up with this iWatch.
34:25
Next up we have the Nokia phone early 2000.
34:29
This is a classic. Nokia dominated the pre
34:32
smartphone era with models like the 3310.
34:36
It was known for its indestructibility, long battery
34:39
life and snake. Now it did work on the 2G GSM
34:44
network. It had a monochrome display.
34:46
So that means you know monochrome either black and
34:48
white or black and green depending on your version.
34:51
But anyway, battery in. The state could last for. 10
34:55
days, could you imagine not having to charge your phone
34:58
every single night? And you also had physical
35:02
buttons and you could just touch these buttons.
35:06
But if you wanted to text, you had to go through the numbers.
35:09
So if you wanted to see, you had to hit one free time.
35:12
But some people could text like monsters on this.
35:15
They were machine. It was amazing.
35:17
Also, the Nokia 3310 could survive drops and possibly a
35:22
mild apocalypse. Then you get this Motorola Razor
35:27
which was launched. In 2004.
35:28
It wasn't just a phone, it was a status symbol.
35:31
The razor brought style to the mobile.
35:33
World. For the first time, a phone was
35:37
more about fashion and and less about function.
35:41
But it has a. Camera, it had five megabytes,
35:46
megabytes internal. It had Bluetooth, a mini USB and
35:51
you could talk on it for seven hours.
35:53
And it came in different colors. It was the fashion.
35:56
Motorola sold over. 130 million units, making it the best
36:03
selling phones ever. The Razor paved the way for the
36:06
modern smartphone design, and it showed that people didn't just
36:09
want technology, they wanted technology.
36:13
We also. Have an original iPhone.
36:15
The first generation. Was out in 2007 not too bad but
36:21
when Steve Jobs announced the iPhone he said it's an iPod, a
36:24
phone and an Internet communicator.
36:27
It's all in one Honey changed tech forever.
36:30
Early iPhones introducts introduced the multi touch
36:33
interface and it was the beginning of the apple and the
36:37
app ecosystem. Fun fact the original iPhone
36:41
didn't have copy and paste. It didn't have video recording
36:44
or picture messaging. So these devices.
36:47
Weren't just part of our digital lives, they were the first
36:50
digital evidence items that taught us how to recover,
36:53
extract and preserve data. Each one challenged us to learn
36:58
new tools, adapt new techniques, and build the foundations of
37:02
modern digital forensics. So what began as curiosity about
37:06
how it works became the science of how to find the truth inside
37:11
the data. These early devices paved the
37:14
way for today's advanced methods of acquisition, analysis, and
37:18
preservation, reminding us that every byte has a story and every
37:23
artifact has a legacy. From floppy disks to forensics
37:27
in the cloud, our field has transformed from recovering
37:30
single deleted files to to analyzing entire digital
37:34
ecosystems E Jira has brought new devices, new challenges, and
37:39
new lessons. But one thing has never changed.
37:42
Our mission to uncover the truth one terabyte at a time.
37:45
Today, 1 byte at a time when we started.
37:48
The stories we shared today remind us that Digital Cranks
37:52
isn't just about data. It's about people, decisions,
37:56
and accountability. Every artifact tells also
37:58
storing, and every examiner has a responsibility to make sure
38:01
that story is accurate, tested and validated.
38:05
We've. Seen how metadata can touch a
38:07
killer, how validation can make or break a trial, and how
38:11
testing reveals the truth behind the tools we trust.
38:14
The devices have evolved, the data has exploded, and the
38:18
states have never been higher. But through.
38:20
It all our purpose. Has remained clear to interpret
38:23
the data with integrity, communicate it with clarity and
38:27
it's always seek the truth. Because in the end, it's not
38:30
just about technology, it's about trust.
38:34
The evidence may look in the digital world that the impact,
38:37
but the impact lives in the real 1.
38:42
And that's why we do what we do. This has been parsing the truth
38:46
one bite at a time. Thanks for joining us live at
38:48
Oxygen Forensics Conference where legacy and meets logic.
38:52
The future of digital forensics continues to unfold.
38:55
And we've survived the 1st 25 years and we will survive the
38:59
next 25 years. Until next time, stay safe, stay
39:03
sharp, and as always, keep parsing the truth one bite at a
39:06
time. It's if you enjoyed this
39:23
episode, make sure to follow us to get notified the next time a
39:27
new episode drops. If you can do more, head on over
39:31
to parsingthetruth.com and donate by clicking on the donate
39:35
button. Parsing the Truth is a nonprofit
39:37
organization and we are raising money to send a new digital
39:40
forensic examiner to IASYS training next year in Orlando.
39:45
Thanks. Yeah, yeah, yeah, yeah, yeah,
39:53
yeah, yeah.