Latest / Parsing the Truth: One Byte at a Time / Digital Crumbs: Finding the final crumb to find Ricky Saxton's Murderer

Transcript

Digital Crumbs: Finding the final crumb to find Ricky Saxton's Murderer · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these bad ass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One bite at a Time where digital evidence tells the story
0:57
that criminals don't want told. I'm Stacey Eldridge, and I am
1:01
joined by my Co host Becky Passmore, as always.
1:04
And today we're taking you to Yazoo County, Mississippi back
1:10
in November of 2013. It's a quiet town, and this
1:14
involves A beloved husband and grandfather and a crime that
1:18
shocked the entire community. That's right.
1:21
Welcome back everyone. 57 year old Ricky Wayne Saxton ran a
1:26
scrap metal business known and loved by everyone who came
1:30
through his yard. But one afternoon Ricky didn't
1:33
come home. His truck was found abandoned,
1:36
his body discovered later shot multiple times left in the
1:40
woods. For investigators, it was the
1:42
beginning of a digital trail that would lead to one of the
1:45
most pivotal pieces of evidence, a burner phone bought at a
1:48
convenience store and ADVR system that contained videos
1:53
that have been overwritten. But not really.
1:56
Only these clues would unravel the mystery and bring justice to
1:59
the Saxton family. So to help us understand how the
2:02
recovery of the data from the DVR computer system changed the
2:08
course of this investigation, we're joined today by Wayne
2:11
Mitchell, Retired Digital Forensic Examiner.
2:15
Wayne was was called in to assist Mississippi law
2:18
enforcement on this case and his work uncovering deleted data
2:22
helped identify the killer. Johnny Mac Brown.
2:26
Welcome, Wayne. We're glad to have you.
2:28
Thanks for having me, uh, making Stacy.
2:30
It's great to be here to talk about the case that really
2:33
showed the power of digital forensics and uncovering the
2:37
truth. Yeah, so Wayne, let's start by
2:39
letting our listeners get to know you a little first.
2:42
Tell us about your background and how long you've been doing
2:44
digital forensic investigations. My background is I started in
2:48
the United States Air Force as kind of a computer network guy
2:52
and transitioned into computer frantics when I joined the FBI
2:56
in 1997. It was a brand new job title,
3:00
brand new career path if you will never been really defined
3:04
before back in back in the days. I went through many, many hours
3:09
of training over the last 25 plus years.
3:13
I did with the FBI before I retired, maybe 1000 hours or
3:17
more worth of training and just really, really focused on
3:22
finding the evidence, digital evidence, whether it's on a
3:26
computer, a phone, whatever electronic things is out there.
3:29
Now, Wayne, you've clearly been in digital forensics a long
3:32
time. Could you share with us how the
3:34
FBI became involved in this investigation and what did the
3:39
initial and what did the initial evidence look like when you were
3:45
brought into this case? Sure thing.
3:46
Originally the evidence was sent off to Quantico.
3:50
I'm thinking that it was ADVR system.
3:51
Typically the local law enforcement will request
3:54
assistance for digital evidence and examination from the FBI.
3:58
Sometimes In this case, they reached out to my special agent
4:01
and said we've got this DVR system, we don't know what to do
4:04
with it and we think we have some some evidence on it to
4:08
showing who bought a burner phone that ties back to the
4:11
murder. So we need to get it examined,
4:14
get it analyzed and find out what evidence there is.
4:16
So my special agent sent it off to Quantico to have it analyzed
4:20
because that's not something that I would typically do.
4:22
And they gave it a shot, but it's determined it wasn't really
4:26
a DVR system. It's actually just a computer
4:28
system that ran a, not a surveillance system, but a
4:32
camera system, you know, that recorded what was going on in
4:36
the Fred's Dollar Store. And at that point they're like,
4:38
wait a minute, this, these videos are deleted.
4:40
I can't recover that. You need to send it back to a
4:43
Computer Analysis Response Team examiner.
4:45
Of course, that's me. So they bring it back to me.
4:48
Yeah. So we often hear about criminals
4:50
using these prepaid or burner phones to stay anonymous.
4:54
So can you explain how this type of device complicated the
4:58
investigation and what made it challenging from a forensic
5:01
standpoint? Sure.
5:03
So in this case burner phones not necessarily tied to one
5:07
individual person. So in this case, this subject
5:10
would went to Fred's Dollar Store, purchased prepaid phone,
5:14
we call them burner phones and activated it right then that's
5:18
what US in law enforcement back to Fred's Dollar Store because
5:21
the last phone call made to the victim was from this burner
5:25
phone. So getting a subscriber
5:27
information takes it back to where it was purchased, where it
5:31
was activated, and that's when they knew when it was activated,
5:35
where to key in on the surveillance system as well as
5:37
what location to go and determine if they could find any
5:40
evidence there. Now, Wayne, this is not your
5:42
first time talking about this case.
5:44
There was a whole episode on what is the name of the what was
5:48
the name of the show? I forget.
5:49
Caught in the net? Caught in the net?
5:52
Yes, that's right. I love the name.
5:53
I'm like stuff to watch. But I I watched the show.
5:57
Becky watched it twice. How many times have you watched
6:00
it? Well, I could only do it one
6:01
time. The episode is actually called
6:05
Digital Crumbs if anyone's looking for it.
6:08
It's caught in the net Digital Crumbs on investigation.
6:11
Discovery, I believe, and I was able to watch it on HBO.
6:15
So if you're looking for some ways, there's multiple ways to
6:18
watch it and it and they go through a lot more things
6:22
outside of the digital evidence. But one of the things they said
6:25
was they had Ricky's phone call logs, and they basically said on
6:30
the show that they went through and called every phone number
6:35
that was calling him that day. I was just curious if you heard
6:40
any chatter about that once you got involved in the case, if
6:44
there's any discussion in the office, You know, how we like to
6:48
talk about things and what any anyone said about that.
6:51
Because what they made it sound like at the show was that there
6:54
was just like the one person who didn't answer.
6:57
And this is the number that belonged to this burner.
7:00
And so that's how they kind of got backwards to this burner
7:03
being a lead. Yeah, exactly.
7:06
I mean, when they brought it to me, they really had no, no other
7:08
leads. This was this was it had caught
7:11
all the numbers. Everyone owned up.
7:13
Hey, yeah, I know, I know, Ricky.
7:15
But then like you said, this one, no one answered.
7:17
So that's very suspicious and that's that's what made him go
7:21
back in time, trying to track back where it came.
7:23
From I think I thought it was really interesting and I kind of
7:26
wondered if if that was true from what they sent on the show,
7:29
because, you know, sometimes the show doesn't get it 100% right
7:32
because. But I think that also speaks to
7:34
Ricky's involvement in the community, right?
7:36
Like everybody who was calling him was like, Oh yeah, I know
7:39
Ricky and I and I talked to him and it was about this, that and
7:41
the other or whatever. And, and it was fine.
7:43
And so because of his, you know, I don't know, status in the
7:47
community, it was like everybody but one person answered and
7:51
spoke. So then they got that one lead,
7:53
which eventually leads to backwards tracing the burner
7:57
phone, which leads to this DVR system.
8:00
And so that stumbles, you know, they've got the burner phone and
8:03
it was purchased from this local convenience store.
8:05
And you said it was called Fred's Dollar Store, right?
8:08
And so the investigators, it was what the County Sheriff and then
8:13
the Mississippi Bureau of Investigation.
8:16
So like the state, they went to this, I don't know if it was the
8:19
county or the state, but they went to the Fred's Dollar Store
8:23
to see if he had ADVR system that would give him some clues.
8:26
And luckily he did have one. I don't know if Fred still works
8:30
there, but we're going to say Fred's Dollar store had one
8:33
there. And so they tried to capture the
8:36
data from it at the time of the incident, but the videos didn't
8:39
end up being there or they couldn't get them off or what.
8:43
Do you know about that? What exactly happened there?
8:46
The story there is why they were reviewing the video.
8:49
They had the specific date in question, I think it was
8:53
November 13th, 2013, but they had the data, they just needed
8:57
to get it off in a forensic manner.
8:58
But maybe something happened, the clerk maybe clicked the
9:01
wrong button, and once it was shut down and dispatched to
9:06
Quantico, that's when they're like, wait a minute, these
9:09
videos #1 it's not a DVR system #2 they're deleted.
9:13
So you need to send this to somebody who can recover the
9:16
deleted files. So you're saying that when the
9:19
computer DVR system, it actually went to Quantico, but they
9:23
didn't come to you first because they contacted someone that they
9:27
were probably more familiar with from law enforcement
9:30
perspectives. Special agents communicate with
9:32
law enforcement personnel. And so that connection was there
9:37
and they that was the decision where the special agent went
9:41
ahead and sent it to Quantico. Then Quantico said we don't need
9:44
to do this. It's a computer system.
9:46
Send it back to Wayne or send it back to Mississippi and it gets
9:49
to Wayne. So what happens next, Wayne?
9:52
Well, it came into my lab and I'm looking at it.
9:54
I study the history of what's going on and, and start digging
9:58
into it and I see the actual application is just a
10:01
surveillance software. So using the existing software
10:05
with existing standard files, I was able to play some of the
10:09
videos. So I'm watching some of the
10:10
videos. And then what we do is as far as
10:12
recovering the files is, is taking a known data set,
10:15
determining how it's how it's written, the hex, if you will,
10:19
behind the scenes and trying to get a pattern, in this case, a
10:22
header, the beginning and the end of a file, a header and a
10:25
footer. So deciding that and figuring
10:27
that out, I could see a pattern. I'm like, wait a minute, we
10:30
might be able to actually carve data from this computer hard
10:34
drive and get these deleted ones back.
10:37
So that's what I said upon to do is to craft a specialized
10:41
carving to pull out that data. OK, Wayne.
10:44
So I'm going to kind of break some of this down for some of
10:48
our listeners who maybe aren't into digital forensics as we are
10:52
and get all nitty gritty. So, you know, you mentioned that
10:55
your car, you mentioned hex and that's kind of like the
10:59
gobbledygook that is, is underneath everything that tells
11:03
the computers what to do. But you mentioned you're looking
11:06
for like the beginning and the ends of the file.
11:08
And so I'm, I'm wondering, it was not like a regular standard
11:12
video format. Is that why you had to do that?
11:15
Yes. It was not a traditional video
11:17
format, which was good because it gave me an actual structure
11:21
that and it recorded in smaller chunks.
11:24
So if you know, you know how it is when you record a video, it
11:27
it actually overwrites and encompasses multiple locations,
11:31
multiple clusters. So recovering videos
11:35
traditionally and what we do is hard rare.
11:37
So to build this custom Carver, if you will, to then target
11:42
these specific headers and pull out this, the amount of data was
11:47
pretty, pretty phenomenal that it actually worked.
11:49
And I was shocked the next morning when I came in and it's
11:52
all the amount of data that it did would cover.
11:54
You're like, holy cow, look at all these files because
11:57
basically what Wayne did, he's like computer look for this
12:01
pattern and if you see this pattern, chunk it out for me so
12:04
I can look at it later. And then it found a bunch of
12:06
stuff, chunked it out for him, and then he had a bunch of
12:09
videos to go through. Do you have any idea?
12:12
Like how many individuals videos do you remember?
12:15
Like was it say it was 16,000? Oh my goodness.
12:19
See thousand videos to go to. So like, many of us have been
12:23
there when the Pandora's box of evidence has been opened up,
12:27
right? So what was that feeling like?
12:29
And then what did you do next? Just elation, you know, I'm
12:32
like, OK, number one, it worked. Right.
12:34
Then then I'm like, how am I going to look at all these
12:37
files? Because you know how it is with
12:38
videos, you it's real time, so you have to play it and watch it
12:41
in real time. You can't really Fast forward or
12:43
you miss something. Right, right.
12:45
So the first thing I did was try to figure out the line where I
12:49
can cross where they would play or not play.
12:52
So based on the size of the videos that were recovered,
12:55
because they're all coming in different sizes, I had
12:58
determined that only 12,000 of them would play.
13:01
So you cut it way down. Way down.
13:03
It's like 4th of it gone within an hour.
13:05
You know, I'm like, yes, I can do this, but then I'm like, OK,
13:10
let me pick the biggest one and play it.
13:12
So I play it and it's several minutes long.
13:14
So the process of playing it though, again, pulling some
13:17
statistics out here, it takes about 30 seconds for me to open
13:22
the player, pull in the file, play the thing and then it
13:26
closed. And once it closes, I have to do
13:28
it again. So 12,000 times, a minimum of 30
13:31
seconds. I'm thinking 8 weeks of work
13:33
here. And, and they needed, they need
13:36
the lead now. So that's when I reached out to
13:39
the state CID folks and said, hey, I think Lori was Lori
13:42
Travis was the lead detective at the time.
13:45
I said, Lori, I need help. You know, I got 12,000 + 8 weeks
13:49
of work. Send me some people and I'll put
13:51
put you in a chair to show you how to do this process that I've
13:54
developed. Now and then you can see my eyes
13:58
and determine if we see something on November 3rd, 2013.
14:01
And when you were watching the video files, were you in the
14:05
forensic software or I guess, well, maybe the better question
14:10
is when you had the other investigators come in from the
14:13
other agencies to help review all these videos, were they in
14:16
the forensic software or did you export all these videos media
14:20
Windows Media Player or or something like that?
14:23
Sure. So you're, you're naming a lot
14:24
of the most common video players out there.
14:26
No, you couldn't play with those that would have been nicer and
14:30
they couldn't view it in the the forensic tool either.
14:32
So yeah, I've exported the 12,000 files out and had to use
14:38
the software player to then play each video.
14:41
So what I did was I set up four or five different stations.
14:44
I think it was just 4 because I could kind of sit in the middle
14:47
and direct the traffic, you know, of, of who's was seeing
14:50
what and how to do it. And gave them a tutorial on how
14:53
to open the application, find the file, make sure you, you
14:58
know, play the file, watch the whole thing through.
15:00
And the beauty of it is this is another rarity.
15:03
The video itself had a timestamp inside the video.
15:06
In the bottom. So you didn't have to worry
15:09
about metadata about the properties to say when was the
15:12
video recorded or not. They pulled it up, looked at it
15:14
and they could see when when the video was recorded.
15:18
So then process of triage kicks in like OK, if you see a
15:22
different day, just throw it out, move on, throw it out, move
15:25
on. Because they're also short, so
15:27
they can just pull it up and be like, oh, this isn't even the
15:29
right day next. Yes, exactly.
15:32
Some of the shorter ones were like milliseconds.
15:34
Like it pops up on the screen and goes away.
15:37
So you have to play it, play it, play it before to come up and
15:40
you could see this timestamp, and one of the ones I was able
15:43
to pause on long enough to get a snippet to send to the news
15:47
agency was only probably half a second long.
15:50
Oh wow. It took me about 15 tries to
15:53
with the space bar and the mouse to play, pause, play, pause,
15:56
play, pause and finally it's on the screen that like nobody
15:58
move. So I took a snippet of that one
16:01
and it showed the the subject behind the phone.
16:04
Well, that's the thing with carving out these files.
16:07
I mean, you have a pattern. It doesn't mean that it's always
16:10
carving things out precisely or properly.
16:14
And there's lots of stuff. If everything was deleted, how
16:16
long you know, all the stuff with the turning it on and off,
16:19
I mean, stuff just happens. So you're gonna get stuff like
16:21
that. That's not unusual at all to
16:23
have not great stuff to go through.
16:25
Exactly. A lot of false positive, a lot
16:27
of junk to go through, but this was really good.
16:29
The tool I used was a FTK Forensic toolkit and allows you
16:33
to build that custom Carver where you can put in those
16:36
headers the hexadecimal characters at the beginning,
16:38
tell it how big to capture and go to town.
16:41
That's great. I always say it has to be a
16:43
great feeling that knowing the system went to Quantico on not
16:47
under your guidance, not under your direction goes to Quantico
16:51
Virginia who is amazing, does amazing work back there.
16:54
We all know that they they didn't try to or they said, hey,
16:59
this isn't ADVR system, send it back to Mississippi.
17:02
Not that they sat down and tried to recover anything.
17:05
You just said, OK, let me take a look at it.
17:07
You took the time to discover these hex patterns.
17:11
You set up this carving technique and you kicked off a
17:16
search to recover those headers and those all video segments,
17:20
which then ultimately identifies the suspect.
17:23
If you hadn't taken the time to do this, what do you do you
17:26
think would have happened to this case?
17:27
I'm not sure it would have ever been solved, at least to the
17:31
point of getting a lead of an interested person.
17:35
Person of interest. Yeah, yeah.
17:37
Which usually then they go cold. Exactly.
17:40
Yeah, I do say that one of the nice things about the FBI was
17:45
like having equipment and computers and software, even in
17:49
the field offices, even in the small ones, was not an issue.
17:52
So, you know, I don't know how much of a struggle in reality it
17:54
was for you to get those four computers, other than getting
17:57
them set up and, you know, all the videos and stuff there.
18:01
But at least you had the four computers available so you could
18:03
have several people looking at the stuff at the same time.
18:07
How long do you think it was before you guys finally found
18:12
the video that you were looking for?
18:13
Was it hours? Was it days?
18:15
Weeks. Surprisingly, it was only a
18:16
couple hours for that first one to be found.
18:19
Yeah. That's a couple of hours.
18:21
Couple hours. We we spoke of the show and you
18:25
mentioned, I think the lead detective, it was a female, you
18:28
thought maybe her name was, was Laura on the show, she said.
18:32
And then we found it. We've got our money shot.
18:35
And I was like, I don't think that means what you think that
18:38
means. No, she's sweet though.
18:42
Yeah. Yeah.
18:43
In fact, what didn't I see on the show where she was actually
18:47
supposed to be promoted or moved to another department?
18:51
And if she had, if you guys had not worked together to get this
18:57
all taken care of, that it was going to it, it ended up into
19:01
someone else's hands, didn't it? Her husband's hands, actually.
19:04
OK. Yeah, she did get promoted and
19:06
her husband Travis took over the case.
19:08
OK. So, and I think, you know, cases
19:10
like this, it's involving multiple agencies, local law
19:14
enforcement, the state, the FBI. What was the collaboration like
19:18
and how did your role and digital forensics sort of work
19:22
to bridge those gaps and you know, the process and the
19:26
investigation? It's just really good
19:28
collaboration really between the three agencies, just, you know,
19:32
working really, really good together and knowing that
19:35
there's a victim family out there that needed answers.
19:39
And that's why I did the show. That's why I'm doing this.
19:41
I mean, I believe in in sharing the truth and helping to kind of
19:45
ease some of that pain. And this was, and I don't say
19:47
this a lot, but this, this was a God thing to see everything that
19:53
happened to bring that system to me and to me, everything I've
19:57
talked about the remarkableness of videos being recovered,
20:00
that's not normal. Videos having a time stamp,
20:03
that's not normal. Finding two different clips
20:06
showing the person asking where the phone is and the person
20:08
buying the phone. That's I mean, it's just the
20:11
timing of everything had to be perfect.
20:13
It's just I'll give it him all the glory because he he put it
20:17
all in the right places at the right time.
20:19
Yeah, and, and the show actually goes in to the very deep faith
20:25
of the South, right? And they talk about the family.
20:28
They knew that there was nothing there and they were praying and
20:32
they were putting faith in God to lead the investigators or
20:37
lead the people to the right locations.
20:39
And I'll say this, back in 2013, I would say there's not a lot of
20:46
examiners in the FBI that if that computer would have ended
20:49
up on their desk, that they would have been able to do go
20:53
through the same process, right? Like we've all done some
20:57
remarkable things. We've all done some amazing
21:00
recovery. But to, to look at that system
21:03
and go, I, I need to find the right pattern to collect these
21:08
video segments to lead to the identification of this suspect.
21:12
I don't know that that would have happened in every field
21:15
office. Yeah, I mean, the, the tenacity
21:17
to do what we do borders on it's scary.
21:22
And had I not had success early in my career, I wouldn't have,
21:25
you know, maybe had that same tenacity, the same persistence.
21:28
I mean, you work a case where you find 3 little letters in an
21:32
entire hard drive, SDQ, the Santo Domingo airport, where we
21:36
find 4 kids that were kidnapped. That was 1 little lead.
21:39
You know, that points to where these kids are.
21:42
So you keep looking, you get down into the hacks, you get
21:45
down into the weeds and you just don't stop because it matters to
21:49
somebody. And that's that's what drives us
21:51
so. It's definitely what drives us.
21:53
Yeah, And I think it's, you know, you're speaking to your
21:55
experience based on another case and, you know, you news 3 little
21:59
letters could help you solve this.
22:00
And you're like, well what what 3 little letters or 4 letters
22:04
can I find in here that will help me figure out how to get
22:06
all of these videos back? And I think you bring up an
22:09
excellent point in your procedure of what you did.
22:11
You had some known videos on there from this recording system
22:14
and so you looked at the known stuff and then you're like, how
22:18
can I work backwards and and find the stuff that's been
22:20
deleted? Can I get any scraps back?
22:23
That's amazing and. I mean.
22:25
It goes back to your triaging, right?
22:27
You're like, OK, I can get rid of, I can get rid of 1/4 of
22:31
this, but then I need some help. And so, you know, you start to
22:36
put that in perspective as a forensic examiner.
22:38
Right, right. And I mean, there's no, there's
22:41
no going past being in the seat and eyes on the screen.
22:46
You just have to gut it out and, you know, comb through the data.
22:50
There's some shortcuts or some automation that you can use with
22:53
tools and and so forth. The training, you know, we've
22:55
got when, when you get down to it, you have to have butts in
22:59
the seat. That's what I like to say.
23:01
You know, that's what the four people were doing.
23:02
That's what I had done before they got there.
23:04
And that's what I would have done for eight weeks had I
23:07
didn't have those guys. Well, and this talks about, you
23:09
know, what is everybody's role, because I think in the FBI we
23:13
have what was known as the case Agent Investigative Review
23:16
system. It was called CARE.
23:18
And that is where we could or we could have the agents review
23:20
their cases. And that was basically set up as
23:23
a way to get through the backlog because many offices had
23:26
backlogs, some offices had really big bad backlogs.
23:30
And there are some big cases where they're like, the evidence
23:33
was still just sitting there waiting to be examined.
23:36
And so heads got together. Well, what are we going to do
23:38
get through this and we got through care.
23:40
And then it also kind of relates to this whole conversation on
23:44
push button forensics. Well, we'll just go like image
23:46
it, run it through the tool, go next, XXX next.
23:50
And then people can just look at stuff.
23:52
And I mean, that's great for like word documents and reading
23:56
emails and looking at pictures. But what you had to do, Wayne
24:00
takes a person who knows computers, knows the forensics,
24:04
knows the hex and how to like look at something that's there
24:08
and use that to find something that doesn't seem to be there
24:11
anymore. That's why we have hundreds.
24:14
You 1000 like 1000 hours of training to figure out how how
24:17
to do this to to work the hard cases and get a lead and find
24:21
the stuff. Yeah, I mean, I think there's
24:24
there's a place for both of them, right?
24:26
Absolutely. And they both complement each
24:29
other. But you got to have that
24:31
training. You got to have that
24:32
specialization to and that mindset.
24:34
Like in the Matrix where you, you know, I can, all I see is a
24:37
blonde Rinette. You can, you can see it.
24:39
It's a pattern. You see it, you get used to it.
24:41
But yeah. It's taking that data and where
24:45
it was hex and numbers and characters and converting it
24:49
into readable format. Like I I tell my students and
24:53
Stacy, I'm sure you do 2 all the time.
24:55
It's like these are ones and zeros and the computer reads it
24:59
this way, and we have to read it this way, and sometimes we have
25:02
to make that conversion or that carving process work so we can
25:07
see how we read it as a human for sure.
25:10
For sure. Fun, yeah.
25:13
So, like Wayne, looking back, what does this case teach us
25:18
about the evolution of digital forensics, especially the
25:22
importance of that persistence when an examiner is told there's
25:26
nothing left to find? The evolution, that's a, that's
25:30
a tough question. I mean, we've, we've all seen it
25:32
expand, we've seen the size of data grow larger, but
25:37
statistically speaking, I think the tools have kept up as far as
25:40
netting us the same amount of time.
25:42
For example, I'm I'm in a closet in my first office, I've got a
25:45
386 computer and I'm running old school DOS command to pull out
25:49
the data a. Little Norton Disk Editor.
25:53
Even before that, but I did use that, yeah, I mean, but it it
25:57
might you kick off a running process and it takes overnight
26:00
to go through it, but it's not a TB of data.
26:03
There's no way that would even finish in our lifetime for a TB
26:06
of data. But a 40 Meg hard drive, it
26:08
does. Same thing happens now and you
26:10
kick off a very good program, FTK X Waze, whatever, and you
26:16
come back the next day and it's 2 terabytes of data and it's
26:19
cranked through it overnight. And so as far as that aspect,
26:22
evolution is just pretty, it's kept in in line, right.
26:27
As far as the examiner, I think it's similar.
26:30
The training, there were no formal education back when I
26:34
started. Now you're, you're teaching it
26:37
and at the collegiate level and I think that's keeping, keeping
26:40
pace. You know, I think other
26:43
evolution is you've got more people doing it now, whereas
26:45
back then we didn't. So the preponderance of digital
26:49
evidence, cell phone in everybody's hands, that's where
26:51
it's going is more personal devices are being used daily and
26:56
they've got evidence on them and they're going to need to be
26:58
analyzed. So more of the software is
27:00
gearing towards that as well as the training and it should
27:03
because that's where everything is at.
27:05
The only other thing that I was thinking is because of that
27:09
personal device, the type of data and the way that data is
27:12
stored, that's not really addressed as well as I think it
27:15
could be in training and technology tools, for example,
27:19
SQLite databases. That's huge, you know that being
27:22
Mobile Examiner. So that's kind of where tools
27:26
need to get to and it's it would be helpful if they got to it
27:31
faster so that the examiner doesn't have to to use manpower
27:35
to do it. But did that answer your
27:37
question? Yeah, no, that was great.
27:40
Well, and to sort of wrap everything up, you know, I think
27:42
it was a deeply emotional case. The whole community got involved
27:47
because even on the television show, they talk about, you know,
27:50
many people from the community going out and conducting the
27:53
search before his body was found.
27:56
And they talk about how they were talking with the cell phone
27:59
company on, on maybe where he was at.
28:01
So they could kind of send people to the area.
28:03
But there were people basically driving and searching like all
28:06
over the Backcountry of a Missy of Mississippi to to find Ricky.
28:10
And so it was so emotional for the family and really everyone
28:15
involved in the entire community.
28:17
How did it feel for you to know that your work, this forensic
28:21
recovery that you did, brought closure to a grieving family?
28:25
I mean, obviously proud, but I try to keep that in check
28:28
because I, like I said from the beginning, I feel it was all a
28:31
God thing that, that this family needed closure and they got it
28:35
through all the different steps that that led up to it.
28:40
And I'm glad I, we were able to, to find who did it.
28:43
And, and now they're serving time.
28:47
So that's reward. Yeah, for sure.
28:50
So you've spent a career in digital forensics, literally a
28:53
long career in digital forensics and you know, from early hard
28:57
drive analysis, mobile forensic extractions, video data
29:00
recovery. How have you seen the role of a
29:04
forensic examiner develop over time and what advice would you
29:08
give? There's a lot of our listener
29:10
are new to this field and they really want to hear from
29:15
professionals that are have been in the field.
29:17
So what would you tell those listeners out there that are new
29:22
to this field and I want to know more?
29:25
Sure. Definitely get the training.
29:27
We know that whether it's through a collegiate college or
29:31
through tech school, whatever, you get the training, but then
29:33
find someone to shadow because you pick up an awful lot from a
29:37
mentor. We know that through the CFC
29:39
process, it's a year long process.
29:42
You have a mentor that helps you through those those challenges,
29:45
those tasks. Same thing applies in real life.
29:47
Get out there and find somebody that you can bounce ideas off of
29:50
and say, how do you do this? Why do you do this?
29:52
You know, give me your your expectations and things like
29:55
that. So.
29:57
For sure. Yeah, that's.
29:58
My key advice there. Yeah, yeah.
30:00
Great tips. I think the murder of Ricky
30:03
Saxton was tragic, but it highlighted something
30:06
extraordinary. The precision and persistence of
30:09
digital forensics can speak for the victims who can no longer
30:13
speak. And it reminds us that no matter
30:15
how how defeated something might seem, traces do remain, and it's
30:20
the examiner's job to find them, interpret them, and make sure
30:23
they stand up in court. Wayne, thanks for your decades
30:26
of service and sharing your history and experience with us
30:30
tonight on this episode. It's my pleasure.
30:32
Thank you for having me. And then you guys are rocking
30:34
it, so keep on. So if you'd like to learn more
30:37
about this case or digital forensics in action, check out
30:40
the show on Caught in the Net. Digital Crumbs is the name of
30:43
the episode. And don't forget to follow and
30:45
subscribe wherever you listen to podcasts.
30:47
Until next time, stay safe, stay sharp, and keep parsing the
30:51
truth one bite at a time. If you enjoyed this episode,
30:55
make sure to follow us to get notified the next time a new
30:59
episode drops. If you can do more, head on over
31:03
to parsingthetruth.com and donate by clicking on the donate
31:07
button. Parsing the Truth is a nonprofit
31:09
organization and we are raising money to send a new digital
31:12
Forensic Examiner to IASYS training next year in Orlando.
31:17
Thanks. Yeah, yeah, yeah, yeah.
31:23
Yeah, yeah, yeah, yeah, yeah.