Latest / Parsing the Truth: One Byte at a Time / Elsbeth Battles AI

Transcript

Elsbeth Battles AI · Parsing the Truth: One Byte at a Time

• 0:01
  Join former FBI Senior Forensic Examiners Becky Passmore and
• 0:05
  Stacey Eldridge as they dig into the world of digital forensics
• 0:08
  one bite at a time. Now leading their own consulting
• 0:11
  firms and educating the next generation of cyber sleuths,
• 0:14
  these badass babes of digital forensics bring sharp insight,
• 0:18
  real world case experience, and a dose of humor to the bits and
• 0:21
  bites that filled today's investigations.
• 0:23
  From deep dives into business e-mail compromise and ransomware
• 0:26
  attacks, Becky Specialty to cracking the complexities of
• 0:29
  iPhone forensics Stacy's obsession, this podcast delivers
• 0:33
  insider knowledge for professionals, students, and
• 0:36
  true crime techies alike. If you've ever wondered what
• 0:39
  really happens when the digital trail is all that's left, TuneIn
• 0:42
  and start parsing the truth. Welcome back to Parsing the
• 0:53
  Truth one bite at a time. I'm your Co host Stacey Eldridge
• 0:57
  and as always I'm joined by my lovely Co host Becky Passmore.
• 1:01
  Hello everyone. We are taking a little break
• 1:05
  from the dark and we're doing something a little different.
• 1:08
  We're going to talk about ATV show and how digital forensics
• 1:11
  could be used to help solve that case.
• 1:13
  What show are we going to talk about tonight, Becky?
• 1:16
  So tonight we're going to talk about Elsbeth Season 1 Episode 8
• 1:22
  titled Artificial Genius. Now Elsbeth is a spin off from
• 1:28
  The Good Wife, and Elsbeth is a quirky attorney who is embedded
• 1:35
  with the New York Police Department to make sure that
• 1:39
  they do everything right, but she always ends up solving the
• 1:43
  case while taking most of the NYPD along with her kicking and
• 1:50
  screaming. It's a cute little show.
• 1:52
  Let's summarize the episode. So Elsbeth goes to battle
• 1:56
  against AI and Quinn. Quinn is the CEO of a location
• 2:02
  based crime alert app. Quinn murders A journalist and
• 2:06
  uses her AI app to divert attention away from herself.
• 2:10
  Oh, AI, we got that AI going on. Yep.
• 2:14
  So Quinn, we know she's smart because she built this location
• 2:19
  crime alert app. She abuses her power as the CEO
• 2:24
  and basically has an employee and her data into the system
• 2:29
  that hasn't met their validation requirements.
• 2:32
  These are fake reports of Doggy Napper in the area of the House
• 2:37
  of the reporter she later murdered because he dug up some
• 2:41
  dirt on her and she didn't want that dirt getting out.
• 2:44
  So she's on scene the day after the murder sharing.
• 2:48
  She'd never been there before, but she was with.
• 2:52
  But she was friends with the reporter and he was writing an
• 2:56
  article about her. OK, so we're going to jump ahead
• 2:59
  to the murder. And Quinn set herself up with a
• 3:02
  seemingly rock solid alibi because she's presenting during
• 3:07
  a Zoom meeting. Coincidentally, she turned off
• 3:10
  her camera and had a voice recording going along with the
• 3:13
  slides during said presentation. She also left her phone at home
• 3:18
  before heading out. Now the reporter's down and then
• 3:23
  she goes to get his laptop because she wants to delete the
• 3:26
  dirt. Everything bad about her, she
• 3:28
  tries to get in, but alas, it's password protected.
• 3:32
  She simply takes the laptop. She simply takes the laptop down
• 3:37
  to his face and gets logged in because thankfully he had facial
• 3:40
  recognition enabled on his laptop.
• 3:44
  Now this episode is from 2025. Can you unlock facial
• 3:51
  recognition apps with closed eyes?
• 3:54
  Let's go way back to where it all began on consumer products.
• 3:58
  Apple first released facial recognition in November 2017 on
• 4:03
  the iPhone X. It used a true depth camera
• 4:07
  system, which used an infrared camera dot projector and a flood
• 4:14
  illuminator to create a 3D map of the user's face.
• 4:21
  Now, there's always been some aspect of aliveness detection
• 4:28
  step and that's why it tells you to look at the screen.
• 4:33
  OK, now it's really time to geek out on this.
• 4:38
  Two things. First, if you use another camera
• 4:42
  or a video camera, you can see the pulses and flashes of light
• 4:46
  coming from the iPhone from the infrared.
• 4:49
  And over 20 years ago I was doing this same methodology to
• 4:55
  troubleshoot remotes and things like that because sometimes
• 4:59
  getting those universal remotes program could be a pain.
• 5:02
  And so as swapping out the batteries and reprogramming, an
• 5:05
  easy way to check if the remote even worked was to see if the
• 5:09
  infrared was working. And actually shooting something
• 5:12
  out towards the TV was just to grab a video camera and and
• 5:16
  watch it and see what it does while you're pressing all the
• 5:18
  buttons. Now, secondly, when Samsung's
• 5:22
  Face ID first came out, there was an easy way to get around
• 5:25
  it. You could print out a picture of
• 5:29
  said owner, then cut eyes out of the picture that you've printed,
• 5:33
  and then hold the picture up to your face with the eyes and the
• 5:37
  eye holes. And then bingo, you're into the
• 5:39
  phone. Becky, did you ever try this?
• 5:44
  Well, I didn't try this, but we did have conversations and
• 5:47
  discussions about, well, if you know you're holding the phone
• 5:52
  and you just walk by and cross in front of the face of the
• 5:56
  individual to unlock the device, maybe they that would work.
• 6:00
  But. A drive by facial unlocking.
• 6:03
  A drive by facial unlocking, that was always, let's see if we
• 6:07
  can make this work. So, yeah, so the point of all
• 6:10
  that background information was to simply tell you she would not
• 6:13
  have been able to unlock that laptop with the dead guy's face.
• 6:18
  But it's a good thing she could in that show because it creates
• 6:22
  a trail of evidence for you to follow on that said laptop.
• 6:27
  She's on the reporter's laptop now, and luckily her expose is
• 6:32
  right there on the desktop. She quickly moves it to to the
• 6:36
  trash and I think she empties the trash because I think I hear
• 6:41
  a whooshing sound of the trash emptying in the background.
• 6:45
  Next she inserts her thumb drive into the laptop, drags her
• 6:49
  version of the expose right back onto the desktop.
• 6:54
  Then she removes the thumb drive and she's off and on her way.
• 6:58
  Let's talk about the artifacts that would be left behind with
• 7:03
  these actions. First is the log on time and
• 7:09
  method that she use. Obviously there is a thumb drive
• 7:12
  insertion as well, so that's going to leave multiple types of
• 7:17
  artifacts. We could see make, model, and
• 7:19
  serial number of that thumb drive if it's in a Windows
• 7:24
  machine. Shell bags will also help you
• 7:27
  find or see what folders were accessed on that external drive.
• 7:33
  You can also check the Finder state on a Mac.
• 7:36
  This is a nice artifact since Spotlight will index the copied
• 7:39
  file in the destination location, but even better are
• 7:44
  those unified logs on a Mac. Yes, these are some great
• 7:50
  artifacts that can be analyzed and are going to be present
• 7:52
  without the subject even opening the file.
• 7:56
  Even if it's simply a drag and drop situation, there will be
• 7:59
  some clues left behind. Now there's still more analysis
• 8:03
  to be done. You can check the modified and
• 8:06
  created times of the planted file.
• 8:08
  Remember, when you copy the new file onto the laptop, it will
• 8:12
  have a created date of the copied time.
• 8:15
  So when you copied it over, that will be the date and time for
• 8:18
  the created stamp, which means in this case the modified time
• 8:22
  will be older than the created time, which is another clue of
• 8:28
  files being moved. There's also going to be
• 8:31
  information within the metadata that is embedded within the file
• 8:35
  itself, and this is going to include information about the
• 8:40
  user who created the file, more possible file created times,
• 8:45
  they'll be editing times, and even the software used to create
• 8:48
  the file. And you could compare that
• 8:51
  embedded metadata to see if any of that information matches any
• 8:55
  of the specs for the victim's laptop.
• 8:58
  Yeah, it would be great if Quinn the murderer didn't take any
• 9:03
  extra steps to remove her metadata and then had her
• 9:07
  username embedded in the file along with some of the other
• 9:11
  information. So perhaps a different software
• 9:14
  not present on the laptop being used to create that file?
• 9:19
  And let's not forget keyword searching as this is probably
• 9:23
  how you're going to get your start in the case.
• 9:25
  Because in real life, we wouldn't know anything that
• 9:29
  happened on the laptop yet. We wouldn't know that she, you
• 9:32
  know, got logged in and did the thumb drive and all that stuff.
• 9:35
  That's what we're working to figure it out.
• 9:36
  So we're kind of doing this a little bit backwards, but we're
• 9:39
  still telling you about the artifacts.
• 9:41
  So now we're kind of going how you would have done this in real
• 9:44
  life. You're going to start keyword
• 9:46
  searching for the subject's name.
• 9:49
  And we know there is something going on here between the
• 9:51
  reporter and Quinn because she was there on site.
• 9:55
  She mentioned they were friends and he was writing an article,
• 9:58
  but she was also sure to say she'd never been there before
• 10:02
  either. So we're looking for any
• 10:07
  evidence that ties them together and any evidence that would
• 10:12
  indicate the reporter was having any problems with anyone.
• 10:17
  So obviously we are looking for the articles since we know what
• 10:23
  the reporter was writing one, but we're also looking for
• 10:26
  emails or any evidence of interaction between the two of
• 10:30
  them. The keyword search results would
• 10:34
  lead us to the real expose file that was written by the
• 10:37
  reporter, but remember it's now missing from the desktop.
• 10:42
  Will we find that file as an intact recover deleted file or
• 10:46
  will we have to data carve and recover maybe only part of the
• 10:50
  file? We do know that what we we would
• 10:53
  be able to find evidence of lots of interactions with that real
• 10:57
  file, the original file. And we're talking about links to
• 11:00
  the file, recent items, jump lists, web cache, shell bags,
• 11:07
  all of these great artifacts that will help you find evidence
• 11:10
  of a now deleted file. And you should also look closely
• 11:16
  at those same artifacts to discover that this new fake
• 11:21
  expose file that was planted is not showing up anywhere in terms
• 11:25
  of user interaction. And that would be unusual
• 11:29
  because if you're working with a file constantly, you would have
• 11:33
  expected to see evidence of interaction with that file.
• 11:39
  Yeah, that's true. So at this point your Spidey
• 11:42
  sense should be tingling and perhaps there are lots of links
• 11:47
  to real expose files, but it's definitely no longer active.
• 11:52
  And maybe it wasn't even recovered, but now you have
• 11:56
  another file about Quinn, but there's no interaction with it.
• 12:00
  It's not enough to simply say these files are present on the
• 12:05
  device, It's how did they get there, what is their history?
• 12:10
  Build that history, interaction and connections between those
• 12:14
  files. Now, if you got to the computer
• 12:17
  fast enough, you could likely recover that deleted file even
• 12:22
  though the trash was empty. Everything does tend to
• 12:25
  disappear really fast on a Mac, but again, if you're fast, you
• 12:28
  might just get it now. Regardless, you really want to
• 12:31
  dig into the significance of what's there and what's not.
• 12:36
  You'd also want to make sure to tie it all in with the timeline
• 12:40
  as well. Do they have a solid time on the
• 12:42
  death? If so, why?
• 12:44
  Was there interaction with the laptop after death?
• 12:47
  Right. So maybe they don't know the
• 12:50
  time of death yet, but let's not ignore that corroborating
• 12:57
  evidence coming from other sources.
• 13:00
  Excuse me, like Ring doorbells and security cameras.
• 13:04
  Did any of those things catch someone entering and leaving the
• 13:09
  location? But for example, in this case,
• 13:13
  let's say camera footage indicates Quinn was there, and
• 13:17
  then you're able to determine that during that time the
• 13:22
  favorable file was added to the laptop.
• 13:25
  And that's just more fuel for the fire.
• 13:27
  Based on what you find on the laptop, you could then get a
• 13:30
  search warrant to search her home and business for that thumb
• 13:33
  drive too. So now when Elsbeth is on the
• 13:37
  scene, she asks the cop if Quinn could easily replace the article
• 13:45
  with one of her choosing by unlocking the laptop even though
• 13:51
  he was dead, and the cop answers yes, since it's not very heavy
• 13:56
  and the body was close. But we've discussed why this was
• 14:01
  a little whoopsie in the show. Right, right.
• 14:06
  There is a liveness detection that must be meant.
• 14:08
  It's looking for your face with your eyes open that are alive.
• 14:12
  We don't think it would work if you died with your eyes open.
• 14:16
  Have we missed anything else in this case in terms of artifacts,
• 14:20
  things we should be thinking about in terms of the laptop and
• 14:25
  who was there and who, motivations, things like that?
• 14:29
  No, I think we've, we've, we've, we've kept it, you know, in our
• 14:34
  line of methodologies, processes, understanding of
• 14:39
  putting a case together and identifying evidence.
• 14:43
  OK, great. Well, as we wrap up, I do have a
• 14:46
  favor to ask everyone that's listening.
• 14:48
  If you are loving this podcast, and we hope you are, could you
• 14:52
  please leave us a rating on your favorite podcast app?
• 14:56
  It would really help us get the word out and we'd really
• 14:58
  appreciate it if you took the time to do that for us.
• 15:01
  Yeah, absolutely. So thanks again for listening to
• 15:04
  parsing with parsing the truth when by the time.
• 15:07
  Until next time, stay safe, stay sharp, and as always, keep
• 15:12
  parsing the truth one bite at a time.
• 15:18
  If you enjoyed this episode, make sure to follow us to get
• 15:22
  notified the next time a new episode drops.
• 15:25
  If you can do Morehead on over to parsingthetruth.com and
• 15:29
  donate by clicking on the donate button.
• 15:32
  Parsing the Truth is a nonprofit organization and we are raising
• 15:35
  money to send a new digital forensic examiner to I Asus
• 15:39
  training next year in Orlando. Thanks.