Latest / Parsing the Truth: One Byte at a Time / Digital Forensics Now Cross Over Event

Transcript

Digital Forensics Now Cross Over Event · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems for digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for a competitive quote.
1:29
Now on to our episode. Welcome to a detailed friendship
1:33
podcast and not only the DFN but also we're accompanied by the
1:38
amazing Stacey Eldridge Becky password from parsing the truth
1:41
one bite at a time. So they're so glad So first of
1:46
all, we're in ISS. You can see our ISS shirts.
1:48
So we're teaching well, the student that could be our
1:53
teacher. So all that knowledge there.
1:56
So no. So thank you for being with us.
1:59
So this is our first, I would say, official interview of.
2:02
We had one with Chris Pants prior.
2:04
But, well, that's just our. Official interview Interview
2:06
that was talking about. An artifact, Yeah.
2:09
I was like, this is a crossover event, you know, like they used
2:12
to do with Grey's Anatomy and private practice.
2:15
That's how old I am. Well, we are.
2:18
Shows you're talking. About.
2:20
Well, this is a treat because you're here also we got some
2:23
nice chairs here with the ISIS event as I was saying, and this
2:26
is the second week of the event and it's been great.
2:29
So we are being teaching obviously the for the folks that
2:32
watch the mobile advanced mobile device finances course Becky is
2:36
helping with. Cyber Cyber Incident Forensic
2:39
Response class. And that's one of the New York
2:41
classes, I believe, right? It's been going 10 years.
2:43
This is your 10 #10. Oh well, that's how much I know
2:47
about intuition response. I'm the one that doesn't know
2:51
anything and you're taking a class.
2:53
Yes, I am taking a plot Advanced Applied Database Forensics.
2:57
So now I'm really going to be dangerous, yes.
3:00
Damian is great. Yeah, it's amazing.
3:02
I think my head exploded about 14 times in the last two days.
3:06
I was just like, Oh my gosh. Well, mine just exploded just
3:09
listening to you, all the databases.
3:12
So, so yeah, so, so today, one thing we want to do since we
3:15
have you here and we kind of met here and again, it's give us a
3:18
better bill of background folks that listen to your podcast
3:21
know, I would assume we kind of a lot of crossover within
3:24
audiences. But for those that might listen
3:27
to us and not know about what your pocket is about, can you
3:30
give us a quick rundown of your background and what's the pocket
3:34
about? Yeah, so Becky and I are both
3:37
former FBI senior forensic examiners, used to be on the
3:41
computer analysis Response Team. We've since moved on.
3:44
We both teach at the university level.
3:46
We have our own businesses. And what we do with our podcast,
3:50
we say we're the true crime ish. Podcast.
3:53
Crime ish. Yeah.
3:54
Because, you know, we're not the typical true crime podcast.
3:57
We're focusing on the facts and the artifacts that today's
4:01
digital forensic examiners are finding or sometimes not finding
4:04
as we talk about all of that sort of stuff.
4:07
And that's the only part of like the cases and the trials that we
4:10
dive into. We don't go into anything else.
4:13
We have a very narrow focus. Yeah, that's that's different
4:17
from us. We're more like the whole kind
4:18
of what's in the news. Yeah, like forensic.
4:21
News. Yeah, film our Forte.
4:23
So yeah, we go backwards in time and you're current.
4:27
Both need it so, so I want to say, look, I'm happy to have you
4:30
because one of my first, not my first, but I think it taught me
4:34
a whole bunch of stuff when I was going up through the card
4:36
program that's. How we met.
4:38
Yeah. Briggs came to the A dex, the
4:42
Dex course I was teaching. Yeah, that's how we met.
4:45
Yeah. So that was the pleasure of of
4:47
of I think it was the first Dex class that we ever given in the
4:50
Bureau. Yes.
4:51
So, yeah, yeah. Sort of for that cohort and the
4:54
first class in that cohort. That's right, That's right.
4:57
So, and again, this, this community, if I mean, not only
5:00
in that state, but worldwide, it's really small group, I mean,
5:02
of detail experts at the type of work.
5:05
And it's it's great to have us all relationships and kind of
5:08
support each other as we grow in our careers.
5:11
So awesome to have you here. So question, you're blending
5:15
digital forensics with true crime, true crime discussions.
5:19
Why did you feel that that perspective was missing from the
5:22
true crime space? From the true or from the true
5:26
crime podcast that I've listened to, so many of them are just
5:29
people talking about whatever they think about this, that, and
5:32
the other. It's not like relying on the
5:35
facts or the evidence or like the case hasn't even started.
5:38
There's no motions and it's not even in trial yet.
5:40
And they have all of these opinions.
5:43
And when I went through training and when I stress to my students
5:46
and when I stress to my own work is to focus on the facts and the
5:50
evidence and present that without bias as much as
5:53
possible. And I just didn't, I think there
5:55
was a lot of that out there. And then I also think what a
5:58
better way to learn than to see what's happening in the
6:02
courtroom. Because it's one thing if you
6:04
understand the zeros and ones, but if you can't convey that
6:07
information to the jury, if they don't understand that, then you
6:12
know, what have you even done? So I think the courtroom is like
6:15
where the proof makes the pudding.
6:17
Right, totally. And I look at it as I've been
6:21
around for a long time and I see the amazing work of examiners,
6:28
like going back to first text. But also I remember you were the
6:33
first person on site at the Pulse Orlando.
6:37
And you're like, I don't know what to do.
6:39
But I have pitch phones here and, you know, just working in
6:44
that community and talking amongst each other.
6:47
But examiners are humble people and they're not.
6:52
They don't get recognized in investigations like they should
6:56
because they just sit back and do their work.
6:59
And I just feel like this is a way through our podcast with
7:02
true crime and investigations and court proceedings and
7:05
testimony that we can bring their humble work to light.
7:10
You know, we bring it out and we recognize what they have to do
7:14
to get to where they're at. Yeah, I had a meme for his, you
7:19
know, boxing ring and the fighters all bloody, you know,
7:21
and, and and it's there and next to is the the girl that has the
7:25
card numbers right for the rounds, right.
7:28
And the poor fighter that's the examiner and the tongue in cheek
7:32
people tongue in cheek. The girl with the cards is the
7:35
the agent or the investigator. So they're they're all pretty
7:38
and overall bloody. Got to the fight.
7:41
You're getting all the attention.
7:42
Correct. And we don't right now, but I
7:45
say tongue in cheek, right? And folks, if you follow my
7:47
social media, you see my means it because again, to your point,
7:50
if summers don't care for recognition, we care to bring
7:53
justice to the victims and or justice to those that be wrongly
7:56
accused, right? And, and we have different roles
7:59
to play and there's a lot of work in it.
8:01
But their reward is not recognition.
8:02
The reward is not even the money, because most of us work
8:05
in a government sector is the is the actual change in society
8:09
that we do. And I think I think most
8:10
examiners we can agree that's, that's, that's that's the
8:14
definitely that we have. I want to also comment real
8:16
quick. I really appreciate that you
8:17
deal with cases as example is something that we see a lot.
8:21
It's folks asking us, well, where can we get a case study
8:25
for something or an example of somebody testifying in in this
8:29
high situations. I'm like, you know, I got a
8:30
podcast for you that you got to listen about how the trial went,
8:34
all the details about it, interesting guests.
8:36
So you're feeling a really niche important niche in or like a gap
8:40
in knowledge that most of summer have in regards to how these
8:45
cases are presented at court? Yeah, and your podcast, I think
8:49
just discussing the court cases that that are past or present or
8:52
whatever will lead people to go watch the trials that are
8:56
televised too. So it really leads them into
8:58
getting into the courtroom and getting that experience,
9:01
watching the actual testimony. I don't think a lot of people
9:04
and a lot of people, but some people may not know how to find
9:06
that on their own. And I feel like you guys are
9:08
leading them. They're very, very good.
9:12
Yeah. So.
9:14
You both have discussed the argument that tools don't solve
9:17
cases, people do. We say that a lot.
9:20
As well, I think you have a common ground there and you say
9:23
that the the dangers of over relying on commercial forensic
9:26
tools. So where do you see examiners
9:28
going around most often when it comes to tool dependency?
9:32
Yeah, I'm, I would say that I had this discussion recently
9:39
when an AUSA that you know is wait, still waiting for their
9:44
evidence to be looked at, submitted, taken care of and
9:50
it's they just get a, I'm gonna call it pump and dump.
9:55
Yep, they just get a pump and dump, right.
9:58
They just dump button pushing report and they don't
10:03
understand. I I just call it dump.
10:06
I just. I call it the same that you do
10:08
and it's fine. But it is what it is because so
10:15
many people, there's so much work, right?
10:17
We look at anywhere from 18 to 36 months backlog for so many
10:23
agencies that all they can do is push out reports and all they
10:28
can do is say, well, the tool said or the tool said.
10:32
Can't tell you how many times we've listened to testimony
10:35
where they say the tool said and it's it's.
10:39
That's such a huge pet peeve. They say celebrate, said, Axioms
10:43
said. And if you are testifying, you
10:46
need to put it in your own words about what you figured out and
10:49
what you saw. You never once.
10:52
Like at the beginning you can probably mention all your tools,
10:55
but while you're talking about all the things and why it's
10:57
important, you don't never need to other utter another tool name
11:01
again. That's right.
11:02
That's right. And so just trying to, I mean,
11:05
really teach those examiners that it's not what the tool
11:08
says, it's what you interpret from the tool based on the
11:12
artifacts, because the tool can be wrong.
11:15
My goodness, all the time, absolutely, I'm a tool maker
11:20
because I've made the leaves and I got folks that the community
11:22
that work on that. And I've been actually actually
11:26
I have one of the folks saying, Hey, there is some delocation
11:30
points that you might need to you're missing, right.
11:32
So it's either it might be wrong or it doesn't show everything
11:36
right. So just saying, well, whatever
11:38
the tool shows me is what it is. Well, maybe it's not.
11:41
Maybe there's some points that still needs to hit right?
11:43
It's the tip of the iceberg, yeah.
11:44
And. What the tool parses.
11:47
It is. It is.
11:49
I mean, maybe we can say the tool led me to and then I dove
11:52
into those databases or dove into those files and found this
11:57
additional. Yeah, it's like we're not we're
11:59
we're saying in class that you know, you are the data forensics
12:02
tool, right? And it are the tool.
12:04
Yeah, my wife might think I'm a tool, but that's that's
12:07
different. They are sometimes I'm actually
12:10
the forensics tool and I said that made that OK.
12:13
I bet she's watching. It's like look at this tool.
12:14
Anyway I'm. Sure she is.
12:19
Yeah, no could. Agree with you more on that.
12:21
I think the more that we keep talking about it and keep
12:24
pushing it and keep teaching it, hopefully people will realize
12:26
that maybe the dump is enough on on one case it pleads out the
12:30
dump was enough I I got what I needed.
12:33
But you will have that case where you have to go further and
12:38
continue the. Main squareness on that I need
12:42
to put pause listening on this yeah, that's so it's.
12:45
Like hi, this podcast is great. Yeah, yeah, I love it.
12:47
We're live. Let me interrupt you.
12:49
All right. Right.
12:51
So, so in the cases that you discussed throughout, throughout
12:55
your different episodes, have you seen that be an issue of an
12:58
exam that comes in and says, well, you know, I just did what
13:02
the tool said, right? How would that play out kind of
13:04
in generally in some of those cases that you discuss in the
13:06
podcast? I mean, we just watched
13:09
Testimony recently where it talked about.
13:12
The. Celebrate tool said and the tool
13:17
stated and it's and we had that conversation about the fact that
13:22
they're just reading what the tool says.
13:24
They're not examining or articulating the artifacts
13:31
because incorrect. The tool being Celebrate,
13:35
Celebrate said, yeah, because it has an X here and it produced
13:41
this output. And I mean, that's what they're
13:44
reading. They're reading it as what it
13:47
is. Yeah.
13:48
I wish, I mean, for obvious reason, we can't do that, but I
13:51
wish we have like a view of the jury to see how they react to
13:54
different testimony and from from any sides.
13:56
And I'm not like to your point, we're trying to be, you know,
13:58
unbiased and then be factual, but see what the reaction is.
14:02
Because I can assure you that if you go with that weak sauce that
14:06
you would be like looking at you like all sorts of ways.
14:09
Well, I don't think you sound like an expert.
14:10
You're it might come off as like defensive.
14:14
Well, someone don't say it. You know, like, is that the tone
14:18
that they're hearing? Defendant, they can't render an
14:21
opinion, they can't make it sound important or significant
14:24
because they're like, well, you know, Becky said.
14:29
And I say it's deflection, right?
14:31
It's putting blame on something else.
14:33
So if my testimony is wrong, it has to be because this is what
14:36
the tool. Yeah.
14:38
And there's nothing I believe worse than not taking
14:41
responsibility for whatever it is, either be a good or bad,
14:43
right. If you made a mistake or you
14:46
don't have a typo in your report, then the computer, the
14:50
spell check, No, no, you, you are the one doing the report.
14:53
So own it, Own it and actually helps a lot with how you come
14:58
across as a person that's believable, that's trustworthy,
15:01
right? Yeah, definitely.
15:03
So let's roll back to your podcast and specifically the
15:07
interviews that you've done. So you interviewed the Defense
15:09
Digital, the Defense's digital forensic expert for the Casey
15:12
Anthony trial. He revealed untold stories about
15:16
the role behind the scenes. What was the most eye opening
15:19
thing that you learned from the conversation?
15:22
Well, one that there was a defense expert.
15:24
Yeah, this. Is true.
15:26
They never got called to the stand.
15:28
Yeah, they just got us a secret, right?
15:30
The secret? And he was in a safe house
15:32
during the trial because he was afraid people would find out the
15:36
whole team was. So he was in a safe house, did
15:39
it for free. Oh, wow.
15:41
Because he felt like, you know, she was not representative and
15:45
she was going to need somebody to, you know, even the case out.
15:50
I would say I also found out that how attorneys are strategic
15:55
that the process the state prosecution called the same
16:00
expert, I mean the defense, I'm sorry, the defense called the
16:02
same experts that the prosecution did.
16:05
So they were their witnesses. So they called him up there and
16:09
got them to speak to reports that they never even created.
16:14
And it was just mind boggling because that was so many years
16:17
ago that I couldn't believe that all that information came out
16:22
through someone else. You know, we're we prepare the
16:27
best that we can with who we're I'm called by the prosecution or
16:32
defense and then to be called by this opposing counsel.
16:39
I'm up there and now. Get evidence in, you've got
16:42
evidence in. It wasn't just like
16:44
contradicting what they said earlier.
16:45
They introduce evidence and through the state's witnesses.
16:49
That's interesting that as the defense.
16:51
Well, but that makes the point that I mean we, we tend to focus
16:55
on on the prosecution side usually.
16:57
Well, I'm a witness for the prosecution, right?
17:00
No, you're a witness of truth, right?
17:04
And we need to, I think as a pastor, we teach folks me to
17:07
convey that to them to like, you're not a defense, like you
17:10
don't have a, like a, like a horse to run in that race,
17:15
right? No, you, you are, you're here to
17:17
answer any questions. And folks, it happens.
17:21
We try to break that bad habit when you're talking to the
17:23
prosecution, you're all attentive.
17:25
And when and when did they first ask you a question?
17:27
You're like, what, what do you want, right or vice versa,
17:29
right? But that minds needs to go away,
17:32
right. And I think to your point, we
17:33
are there to speak the truth no matter who has the question.
17:37
I would treat the prosecution and the defenses as likely.
17:40
I think some other countries, the experts, not even a witness
17:43
to any parties services the court and the services the the
17:49
court and they're there to provide expert witness to the
17:52
court, not as part of any other of any size, not an adversarial
17:57
like that. So in different court systems,
17:59
different ways of being, but the concept of thing applies in that
18:03
sense that we're there to speak to truth no matter who's asking
18:06
the questions or what points trying to be made.
18:07
Truth is true no matter what. That's right.
18:09
It's really easy to have that demeanor, though, when they're
18:11
coming at you. No, Yeah, But yeah, that's why
18:16
you try not to look at the attorney.
18:17
You just look. Right jury and just me and traps
18:20
beyond try to. Mix it up when beyond become or
18:24
try to get him to smile. Yes.
18:27
And, and I will say a personal opinion, of course, is how
18:30
important it is for, for folks that like this gentleman say,
18:35
well, I think this person deserves a defense.
18:37
And I'm going to just put some of my time to do that.
18:39
And that's fine. I I believe that.
18:42
So I believe that my understanding constitution is
18:44
that people have a right for a defense.
18:46
And yeah, that's some, that's stigma that sometimes some
18:49
examiners have for folks that do work outside of prosecution,
18:52
prosecution, prosecutorial work. That's something I don't really,
18:55
I don't agree. And I think such as kind of like
18:57
an old school way of thinking that should die, right?
19:00
Everybody deserves a defense. Checks and balances.
19:03
It keeps us all accountable on both sides.
19:05
Anonyx in both directions. Yep.
19:07
So I think the other interesting thing that Larry Daniel knew
19:11
going into it is he knew the discrepancy in the parsing with
19:15
the morgue database that led to the 84 times versus the one time
19:19
for the core form because it hits.
19:21
He knew that. And so that was part of their
19:23
strategy baked into it going into, right.
19:26
So it wasn't like the lawyer, Jose Baez, wasn't it?
19:31
He was not surprised when any of that stuff came out in the
19:33
testimony and he was trying to get that to come out sooner
19:36
rather than later. Yeah.
19:38
Well, yeah. I mean, I'm not going to speak
19:40
to the details of the case, obviously, but it's interesting
19:43
in general sense, either prosecution or defense have a
19:46
strategy, They have the steps to the strategy and they execute
19:50
it. And that's our thing.
19:51
And if you're thinking I'll be smarter than a lawyer, don't try
19:54
it. Yeah, just speak truth, right?
19:56
And that's it. No matter what your role is in a
19:59
case. And and forget about the rest.
20:03
So Speaking of the cases that you've talked about recently,
20:06
there's been some chatter around the fact of what whether or not
20:10
it is acceptable to discuss ongoing active or closed cases
20:16
and it specifically addresses active in closed cases.
20:19
So you've been interviewing witnesses in these types of
20:22
cases. How do you decide when it's the
20:25
right time to conduct an interview?
20:26
And honestly, I'll add a little to that.
20:29
Do you or are you open to actually discussing active cases
20:33
and? Yeah, we're, we're not going to
20:38
talk about any cases that are like active in going or like
20:41
currently in trial or haven't gone to trial.
20:44
But if something has had a verdict rendered, but it's under
20:49
appeal, we are open to discussing that.
20:52
But obviously we're going to keep it along to whatever's been
20:54
said in the court of law. So whatever's part of the public
20:58
record. And if we do get a witness to
21:00
come on, you know, we would expect their interview to stay
21:04
in line with that. We wouldn't try to like draw
21:06
anything out and corner them and make them say something that
21:09
hadn't been sent said yet. Yeah, we've, we've invited
21:13
people to come on the podcast and they have respectfully
21:18
declined because they are the cases are either under appeal or
21:25
they just don't feel comfortable being on the podcast.
21:28
They just, but they, they either respectfully decline or they
21:32
have a conversation with us. And so we, we just want to keep
21:36
it like that. We don't want to involve any
21:38
active cases that would allow a juror to that a potential juror
21:45
to hear on a podcast and then their bias, right?
21:48
All of a sudden we have mixed that up.
21:52
So we we just choose cases that we can research, that are open,
21:58
that information is open on the Internet or whatever and.
22:03
Yeah. And I mean, obviously Karen
22:04
Rainbow was a big one because there was a lot of heated debate
22:07
on that digital evidence. So, you know, we look for like 2
22:10
things. One, was it just an interesting
22:12
case for whatever reason, or is there a lot to be learned from
22:16
this case? Yeah, I feel like there was like
22:19
an ongoing public podcast from the Carried Reed trial right on
22:23
Twitter the entire time. I mean, it was just on fire with
22:26
comments and people discussing the evidence and people
22:29
discussing the witnesses the entire time.
22:32
I think, I think it's really admirable that you don't do
22:35
podcasts with people in active, active cases for sure.
22:39
Yeah, because otherwise those podcasts, they're already, you
22:45
know, rendering a a verdict in their podcast about what
22:50
happened, right? They're not, they're, you know,
22:52
they're not listening to everything.
22:53
So yeah, we don't, we don't want to bring up anything active.
22:58
Without trial specifically, there were people recording
23:01
about the evidence and tweeting about the evidence or whatever
23:04
it's called. No, I don't.
23:05
Even know if it's called tweeting?
23:06
Anyone but. Texting, whatever not.
23:10
Asking about. It but I feel like it's.
23:12
Same thing you said. If any of the jurors were able
23:15
to go on and read that, and I know they're not supposed to,
23:18
but you never know what they're gonna be exposed to.
23:20
I feel like that's really gonna into decisions in a trial, yeah.
23:26
Absolutely. And I like that you keep
23:28
yourself to your own wheelhouse, right?
23:31
Yeah. You talk about forensics, which
23:32
is the things that you know, right?
23:34
And what you see a lot of people.
23:35
And that's something that we shouldn't make that mistake or
23:37
trying to opine on things that we're not have expertise on.
23:40
Because I could let Leos astray, I would think.
23:43
Somebody was like, oh, you should do this recently.
23:44
To me, they're like, oh, do this case because it's got some great
23:47
Geo fencing in it. I'm like, I am not touching
23:49
that. No way.
23:53
Let me talk about some cell towers.
23:55
Yeah, I'm not an expert in cell towers.
23:56
I'm on expert on folks that's. Definitely something we're never
23:59
discussing. On.
24:00
Podcast cell towers. That is not my thing.
24:02
My Co host over here passed the cast, the cast discussion to me
24:06
on the on Karen retrial and I was like, I'm not Karen Retrial,
24:10
but when we were preparing the murder on murder, yeah, she
24:13
passed the cast. I was like, yeah, we're just
24:15
gonna just kind of. Bring it up to like they were
24:18
there. No cast guys, they're fantastic.
24:22
And for folks I don't know, CAST is a group that does work with
24:26
specific cell tower triangulation, figure out where
24:30
the device might have been a particular point based on the
24:32
cell tower locations and the communication of the devices,
24:34
which again, really interesting stuff, but that's not my
24:37
expertise, so I'm going to stay away from that.
24:39
Yeah. SO question.
24:41
Which? Was your favorite which?
24:43
Which trial was your favorite to discuss on the podcast and why?
24:48
I'm throwing a a oddball out too 'cause I didn't even tell you I
24:51
was going to pass. A second.
24:53
No, I'm sorry, totally unfair. It's.
24:55
OK. It's OK.
24:56
I mean, we had some great ones just interviewing.
25:00
I I can go back and Dave Fryman and Mark Johnson and Wayne
25:04
Mitchell and Randy Stone, who's the chair for the Cypher class.
25:09
Like we did the BTK Killer investigation and and then we
25:17
got it wrong. Because the some of the there's
25:21
like published books from special agents that were on the
25:23
case. That were wrong.
25:25
Or about the digital evidence. There was information out there
25:28
that was wrong. And so we did that podcast and
25:31
then Randy reached out to us and he was like, and this might not
25:35
have been right and this might not have been right.
25:37
And we're like, oh, let's do them, you know, myth versus
25:41
fact. Yeah.
25:43
And so we brought. Him on.
25:44
And he was able to clear up those myths versus facts.
25:49
And so it just helped us to realize, yeah, we should do our
25:54
research a little more, talk to people that work the
25:57
investigation. And so that one was fantastic.
26:00
Yeah, I think because he came back to us, we're like, you know
26:02
what, We should try to interview people.
26:04
See. Let's see who will come on the
26:06
podcast. And talk about their cases.
26:08
Yeah. And help everybody learn.
26:09
Yeah. Well, I love how that
26:11
illustrates how volatile truth is.
26:14
And these are friends. We think volatile memory turn
26:16
the computer off goes away, right.
26:18
But that's a reflection of reality, right?
26:21
Even though everybody saw that trial and everything, as time
26:23
goes by and people start relating the thing, the actual
26:27
facts kind of get diluted, right.
26:30
And again, folks, I use that now have now go back and say, OK,
26:34
let's see what was the truth of the matter and how what can we
26:36
learn from it Today is super important, right?
26:38
So that's, that's pretty awesome.
26:40
Yeah. I was saying, I still, I think I
26:43
kind of, I mean, I've learned a ton from doing the Karen Reed
26:46
case, but I think Casey Anthony is still my favorite because it
26:50
was like you thought you knew how it all went down.
26:54
But then once we dug into the testimony more and then once we
26:58
got John Bradley on and then worked out what happened and how
27:01
it happened. I mean, that was it was so
27:04
interesting to finally learn how it all went down and what the
27:08
attorneys did, their major role and how the digital evidence
27:11
shook out in that case. Their strategies, I mean
27:13
learning from other examiners who have testified about the
27:18
strategies of the attorneys and how they put them on the stand
27:23
and use them for specific artifacts to be spoke about.
27:29
And so just just learning that through interviewing has been
27:33
really interesting to us. Yeah, you are also the tool of
27:36
for the lawyer. That's a lawyer's tool.
27:39
And they might make you look like a tool sometimes.
27:43
Well. And I think that's why, like
27:45
people would come on the podcast because there's so many things
27:48
you never got to say on the stand.
27:51
And so especially if the verdict is rendered, there's no appeals.
27:54
You can be like, this is everything that never got
27:57
introduced, or I want to set the record straight.
27:59
The media misinterpret stuff all the time.
28:02
Yes, they do. If you've been in the courtroom
28:04
and then you go read the newspaper, you're like, are we
28:06
sitting in the same courtroom, you know?
28:09
So let me ask you this, I think we touched upon it, but I would
28:14
like to ask you directly again, there's been some talk, folks
28:17
say, well, maybe examiners that examiners or test witness have
28:20
been in a case shouldn't be out there talking about the case
28:24
after it goes, after it's finished or whatever it is
28:26
either because there might be some confidentiality that's
28:30
being broken ethically speaking or not.
28:33
What are your thoughts on that? Because that's some of some
28:35
chatter they've been listening lately about it.
28:37
Yeah, well, it depends what you sign, Merstock.
28:40
And then like on my cases, I talked to the attorneys, I'm
28:43
like, what can I say? And they're like, well, anything
28:47
you said in court is, is fine to say.
28:50
And then, you know, keep in mind you go outside of that.
28:52
It's your butt on the line, right?
28:55
Yeah, you own your own. Your own then.
28:57
I think, I think we have to understand as digital forensic
29:00
examiners, we're still ethically and professionally responsible
29:03
for what we say and how much we say.
29:06
And so I think that's why we see so many humble forensic
29:12
examiners not speaking on behalf of all their hard work.
29:16
And so, but then you see other people maybe overspeaking on
29:22
maybe a part of a piece to the investigation and then it gets
29:28
taken out of context or it gets reconstrued on how it was
29:34
represented. And so I think being able to one
29:39
stay in our lane and be professionally and ethically
29:42
responsible with our communication on a case is
29:45
important. Yeah, yeah.
29:47
We've seen many folks maybe going beyond what they should
29:52
have said and then really getting in trouble about it.
29:54
At the same time. I my thought was because of this
29:57
with Heather during the day as we're preparing for the for the
30:00
question, the interview is that this balancing of well, there's
30:05
things that happened, right and that we might not be able to
30:08
disclose. But the same time cases are in
30:11
court and court is public. Anybody can go and sit at a
30:15
courtroom, any courtroom in any case.
30:17
I mean, there's certain little exceptions, but for the most
30:19
part it's public. It's recorded and it's recorded.
30:22
Yeah, it. Can download transcripts
30:23
sometimes and exhibits sometimes for free or sometimes a small
30:27
fee. So I mean you can get access to
30:29
that data. And the the jurors are told you
30:32
can now speak about this. You can go do interviews, You
30:35
can, you can tell your family that what happened with the with
30:39
the case throughout. So I mean, I, I just feel like
30:43
it is public record when a verdict is rendered.
30:45
And obviously if things weren't shared during during the court
30:49
proceedings that that you may have access to, that's off
30:51
limits. But I mean.
30:54
I mean, freedom of speech doesn't go away because you were
30:56
in a in a court, in a courtroom, right.
30:58
But again, I guess it's exercising that judgement,
31:01
proper judgement regards balancing my freedom of speech,
31:03
the fight that the information is public record versus the
31:06
point that you just making in regards to maybe going beyond
31:10
and and and then at that point and.
31:12
Boasting, right? Yeah.
31:13
There's humble and there's humbleness, right?
31:16
And then there's boasting. Yeah.
31:18
And exaggerating, Yeah. And, you know, basically
31:23
inflicting like more information than you really knew or had so.
31:29
But yeah. Or even, like, phone numbers,
31:33
Like, sometimes they're in the exhibits in the courtroom and
31:37
sometimes they're shown on the TV screen and sometimes they're
31:40
not. So if you're going to, like,
31:42
show old exhibits, yeah. Do you need to redact those
31:47
phone numbers? Hopefully all those people have
31:49
probably changed their phone numbers by now anyways.
31:51
If you were in the Karen Reed trial, you did, yeah.
31:53
You know. Stuff like that, but like also
31:55
sensitivity to OK in the courtroom you had to show these
31:59
horrible pictures, but do you now need to go around right,
32:02
showing that victim's picture on all of your presentations?
32:06
Probably. What value is it going to add
32:08
especially as like a forensic examiner, we're here to learn
32:11
about the facts and the artifacts.
32:13
How can we find that evidence? I don't need to know what that
32:15
picture. Look, tell me how you found it.
32:18
Let's talk about bits and bytes and offsets and.
32:21
And the significance of it. And why it mattered.
32:24
Yeah, exactly. I think too like, so if we took
32:28
that off the table, we took speaking about cases when
32:30
they're done in court off the table, how are we going to learn
32:33
from them? Like we the case studies when we
32:35
go to these conferences and case studies are put on or we're just
32:38
teaching a subject and I'm like, I had a case and this is what
32:42
happened and this is how it relates to that data structure
32:45
or that type of data that was found in the instruction.
32:48
It's used as a learning tool in the industry too and.
32:50
Really feel like we. Would be limiting ourselves if
32:52
we didn't share court cases that happened.
32:56
Yeah, I hope so. So I was just saying, I hope
32:58
somebody, you know, is like listening to her podcast and
33:00
they're, you know, and then they're working a case and
33:02
they're like, you know what? I don't remember exactly what
33:05
was said, but I remember like it was often misinterpreted or
33:09
difficult to parse out or something like that.
33:12
And then hopefully they will go and dig a little deeper instead
33:15
of taking something at face value because they remembered
33:18
hearing something. I remember that was a pain
33:21
point. Well, and you're reviewing some
33:23
of those. These are forensic points also
33:25
in models, good behavior for examiners say look, this was
33:28
effective, it was presented in this way and there's the reason.
33:31
And then folks like ourselves can go back.
33:33
And I haven't been in a trial that exposure level, but if you
33:37
learn from it, right, you should be able to function at cases
33:40
that are not as how can I say although that's such a
33:43
microscope, right? Yeah, that's right.
33:45
So. Right.
33:46
And then going back to it's our responsibility as forensic
33:49
examiners to educate the prosecution or the defense on
33:54
the artifacts so that they don't misinterpret them when they're
33:57
asking us questions on the stand because we're, as I had been
34:02
told by an AUSA once when I went to testify, he says don't be
34:06
nervous. Yeah, OK, OK.
34:10
He says don't be nervous or don't be nervous.
34:13
Which one? Which?
34:13
One is it Chelsea nervous? Or don't no be nervous.
34:18
And he said, because you know the most about this case, and I
34:22
need you to go in there and tell a story to the people that don't
34:25
know it, the judge, the jurors. These people don't know what you
34:29
know. So be a storyteller, right?
34:31
So, you know, a lot of people like the technical side of it,
34:35
but it is truly an education side of it, too.
34:37
Yeah. Definitely is definitely all
34:41
right. So mobile device forensics is
34:43
evolving rapidly with encryption and cloud data.
34:45
What do you see as the biggest technical frontier or challenge
34:49
facing examiners right now? Let me take that one.
34:53
Me, me, my love of of iOS, well, because I do civil work, I
34:57
probably see something a little different than you guys, which
35:01
is like E discovery companies have come into the mobile
35:05
forensic space, but they don't understand the differences
35:10
between the extraction types. They don't understand what files
35:13
come with what and so they're getting the wrong extraction,
35:18
they're not getting the evidence that is needed and they're like
35:21
ruining their own clients cases. Yeah.
35:24
And it's just detrimental all the way around.
35:27
And I had one case where it was kind of not great for both sides
35:33
and they just don't know what what they're doing.
35:35
So that's kind of a different thing that you guys might be
35:39
seeing. That's why I love that question
35:41
because my visibility into kind of the outside, I always apply
35:45
outside of the strictly law enforcement, it's so limited.
35:47
And I think a lot of the audience might come from more
35:50
your previous background in our current situation and and that's
35:54
something to also consider and learn from.
35:56
Yeah, right. How that knowledge gets now
35:58
transmitted across to other parts of the just forensic
36:01
practitioner space, right. Yeah.
36:02
Right. And then also the old timer disc
36:06
analysis says a lot of it lives in the cloud.
36:09
Yeah, so. If.
36:10
If you're only looking at the disk, if you're only looking at
36:13
the, you know, that forensic image, you're, you're missing
36:18
the connection with the cloud. And so being able to explain
36:23
that in communication to let's, let's go ahead and preserve the
36:29
cloud data and and get that pulled back as quickly as
36:32
possible too and. Even outside of ourselves, I set
36:37
ourselves as the forensic examiner groups, the cohorts,
36:40
groups around the world leading the clients.
36:43
On your end, I would still understand that.
36:45
But even to this day, telling investigators, hey, I know you
36:49
spend a lot of time doing the search warrant, doing these
36:51
things. You have to do one more thing
36:53
and there's one more paper I need to put in to make sure you
36:55
preserve it. And then you search warranted or
36:57
whatever it is. And, and we have to do that even
37:01
though it's not, it shouldn't be my position to be reminding the
37:03
investigator, but I do it all the time and, and we have to do
37:07
it. And again, educating them,
37:08
right, because they don't know where the digital evidence
37:10
lives, right? We know when and if we aren't
37:13
doing our due diligence to remind them to go get that dude,
37:16
that digital evidence. It.
37:18
Could you know it's not due diligence?
37:22
Now they're, they're being again, no details on cases, but
37:25
many cases where being able to have the problem with customer
37:28
device to reach out to the cloud actually was able to find that
37:31
missing piece or smoking gun to actually be able to solve that
37:35
case successfully. So, so important.
37:37
I think your your point in the civil where you know the
37:41
education on the types of extractions that that's in, in
37:45
law enforcement. I've been trying to educate
37:47
prosecutors when they get their final product right, and this is
37:52
everything on the phone. It's everything the investigator
37:55
told me. It's everything on the phone and
37:56
it's a logical extraction from a from an iPhone 15.
38:01
So it's it's. Everywhere, it's everywhere.
38:04
And a couple people in my office, we've been actually
38:07
going around and talking to our prosecutors to try and try and
38:10
get that point across. I wish there was a way for us to
38:12
like public service, announce it to everybody involved in the
38:16
digital forensics. Right.
38:18
Well, they just need. The tool vendors need to change.
38:21
The default should be full file system extraction, and you can
38:24
only ever get an advanced logical if a full file system
38:27
extraction isn't available, right?
38:29
Right. So we're just like, block it
38:31
out, block. It it's not even enough.
38:32
Just like I'm sure they're rolling over swearing up, right?
38:37
Now it won't be unlocked until it fails first, yeah.
38:40
I love it because that impacts a lot of other things because then
38:43
they're trying to say we'll just.
38:45
Collect. These 10 emails and these four
38:50
as text messages and you know, and then you're like, then I
38:54
don't have any of the other data that I will undoubtedly need
38:58
later. Show the full picture.
39:00
Exactly. And then on the civil side, you
39:03
have problems with the client. Like everybody, nobody wants to
39:06
give up their devices, right, right.
39:08
Well, if you want the best chance at your case, you're you
39:12
know, you're going to need to hand it over and it's going to
39:14
take some time and I don't need to know how long.
39:18
And then just like you have the problems with, you know, logical
39:21
versus advanced logical versus full file system.
39:23
I struggle on the defense to get something besides the Celebrate
39:27
reader report, and we got the I approach my attorneys with what
39:33
to tell the prosecutor and they're like, no, that's good
39:37
enough, you have everything. And I was like, I assure you, I
39:39
absolutely do not have everything.
39:42
That's a conversation in you and I had just, you know, about six
39:45
months ago and I was like, I, I, I need to get more data and all
39:52
I have is a celebrate reader and we had a big conversation about
39:56
make them give you that. Image.
39:58
And I did. And I feel really comfortable in
40:02
saying that discovery obligations, I don't understand
40:06
discovery obligations on the civil side, I don't understand
40:09
them. So I'm not going to go there.
40:10
It's whatever the lawyers negotiate here that's discovery.
40:14
Yeah, I'm not familiar with that, but I always as part of
40:18
I've been trained. I keep all my work on my my
40:21
evidence and that's that's, that's provided like it has to
40:25
be that way. I am more than happy to receive
40:27
examiners come into my office and some evidence cannot be
40:31
provided for them to take home right, right.
40:32
But they can they provide them the space, the resources?
40:36
I want to make sure. I also have the horror stories
40:38
all about that I want to see. That and, and it's, it's to me,
40:45
it's such a shock that, that there will be some pushback on
40:48
that on, on, on either side, right.
40:50
So again, that's something that hopefully as time goes by and,
40:54
and that's my opinion, if the examiner community skill level
41:00
gets up, goes upwards in a general sense, I'm going to say
41:03
that there's a question about that that's coming up.
41:07
The I believe that the it's not formalized.
41:10
We've got folks that have no degrees in the interferences
41:12
like me, because I didn't exist. So we have a lot of training
41:15
certifications. Yeah, literally that was not a
41:19
thing that did not exist. But now you require folks to
41:22
come in with a degree. So there's a lot of variance on
41:26
how much, how trained are we, Right.
41:28
So maybe as we all kind of achieve this kind of uniform
41:31
level of competency, then we can push forward for folks to be
41:35
able to kind of do things in a more efficient, better, more
41:39
transparent way, I would like to believe.
41:41
You think we're going to achieve that level?
41:47
I mean, I guess, I guess if we don't, they will force us.
41:51
So you got. Yeah, you got feels that you're
41:53
a doctor, right? You gotta pass the bar.
41:56
I know the bar sell lawyers, but still lawyers is the same.
41:58
Is the same thing to have the bar.
41:59
The doctors have whatever doctors have.
42:01
And maybe it's not a bar. Maybe.
42:02
I don't know, maybe it's a kitchen.
42:04
And yeah, exactly. A medical board.
42:06
You have the medical board. Thank you for saving me there.
42:10
Yeah, Thank you for letting me wonder about.
42:14
And it's, you know, it's kind of mandated, right?
42:16
There's no uniform standard. I know Brett Shavers talks a
42:20
lot, a lot about this. And you know, Brett Shaver is
42:22
you need to go Google. Yeah, it does a lot about it.
42:24
So either us as a community and as an industry start putting
42:28
those requirements out or external entities will impose it
42:31
upon us. And then who knows?
42:32
How is that going to work? Yeah, I think eventually it will
42:34
be imposed upon us, hopefully not in a bad way.
42:37
That's right. That's right.
42:40
OK, so where do you see the field of digital forensics in 10
42:43
years, especially given the rise of AI generated content and
42:47
encryption? And let me just say, we couldn't
42:49
have a podcast without mentioning AI.
42:51
I really apologize. But the good thing is that
42:55
Becky's really diving deep in all those issues, so I'm so glad
42:58
that she's gonna. She's ready for this.
43:00
Oh yeah, OK, I know she is. So for those that don't know, I
43:05
am a PhD student too. So soon to be Doctor Becky.
43:08
Yeah, I don't know one of them. We have to finish first.
43:12
But so I, I, I, I live in the community, right?
43:16
So I pay attention to what's being said and what's being
43:20
done. And so I have started my
43:25
dissertation thesis and started my research and I have chosen to
43:32
focus on the area of the admissibility of evidence that
43:39
is AI. How is that affecting that
43:43
admissibility of evidence through our Daubert and our
43:46
seven O 2 evidence, especially since that amendment in 2023.
43:49
And so I have started a my research paper to, you know,
43:55
define that those boundaries of what should be accepted and what
44:00
should not be accepted. And the mere fact that AI can't
44:04
testify. So it still takes a human to sit
44:09
on that stand and tell what AI told you.
44:12
It's no different from what the tool told me, what AI told me,
44:16
right? And so I have started that and I
44:20
will be looking for participants to help me with the research,
44:24
right? Because I will have data sets
44:28
that will be designed to use human only.
44:31
So our judgement and then AI assisted what different models
44:40
produce the results and then AI only?
44:44
How can AI only be the judgement of this data?
44:49
It really can. So, so that's my that's my
44:53
research. And it'll be for the next year
44:56
and a half, so. I want to read it now.
44:59
What are the answers tell me? Put it into chat.
45:06
There'll be answers and there are the the answers.
45:09
Yeah, it's, it's very interesting.
45:10
I have there's a big gap like people have done study on
45:15
triage, you know, I know, you know, there's in 2014, there was
45:19
a study on the fact that the data was overwhelming in backlog
45:23
and all that stuff. And that's no different today,
45:26
right, right. But we also have to be mindful
45:29
of the fact that you are you're dealing with evidence and you're
45:32
going to that's going to have to make it into the court of law.
45:35
And if you're only using AI and you're letting AI interpret it
45:39
only then. So yeah, I'm, I'm excited about
45:44
sharing that with you guys. Yeah, it's Frontier.
45:47
Investigation or research, because there is, I haven't
45:51
heard of any work really being done at a academic level on any
45:56
of this that is extremely necessary.
45:58
There's a lot of things that's been going on but I'm really
46:00
arguing. Super looking forward to it.
46:02
You may not be able to answer this.
46:03
Because you're. Doing the research now, but are
46:06
you, will you be implementing any of like the digital forensic
46:09
tools in or just testing the models behind the digital
46:12
forensic tools? So testing the models.
46:15
Yep, but also testing some tools that are incorporating those
46:18
models and also putting together the questions to say how did you
46:24
study it? Because if you use a model, you
46:27
use a model, right? And you use a model.
46:29
Do they all interpret the same? Thing right, right.
46:32
And so so just trying to develop those qualitative quantitative
46:37
questions and then do the testing through human AI and AI.
46:42
That's so cool. I can't wait.
46:46
Like I cannot go go go go. Get it, get it, get.
46:48
Go on. Yeah.
46:53
I mean. Because I mean, folks that
46:56
listen to me talk, I go a lot about my experience and
46:58
intuitions and that's great to opine, but that's all it is,
47:01
right? Hard research.
47:03
That's where it's actually at. And, and I talk a lot, but I'm
47:08
more than happy to say I'm wrong and the research shows something
47:11
else then that's what the research shows and and we all
47:13
know that. We do, triage, we do.
47:17
Triage data, Oh yeah, definitely pieces where you need some, you
47:23
need something right now to move a case forward.
47:26
Like we get it, you can do triage data, but is AI the
47:32
answer for triaging that data? Or do we have sufficient tools
47:37
to triage the data to get the results?
47:39
Or do we have a combination right?
47:41
What is the end result there? Yeah, I'm super interested on
47:45
the whole your Daubert. Analysis yeah, me too.
47:47
So I'm super interested and especially since there's.
47:51
Daubert and there's Mona tires where it also is it part of
47:57
research where being used very. Similar to like Daubert.
48:01
And then the seven O 2 evidence that had an amendment IN22O how
48:06
that impacts. All those things, yeah, they.
48:09
Missed. It in court.
48:14
I'm super excited. You need to get working.
48:17
A year and a half is too long. We're going to start the podcast
48:19
now so you can. Go to work, I start.
48:22
Something when I finish, so it'll be until.
48:23
Next. Yeah, yeah, a year and a half
48:26
is. When I finish, so it'll.
48:27
Be in the next 8 months. Very cool, Very cool.
48:32
Yeah, I'm really excited. Well, again.
48:36
We cannot thank you enough for being here and talking to us.
48:40
No, we appreciate you guys having us.
48:42
Great and. So on the bus sit.
48:43
Down I'm glad we're all in the. Same place at the same time.
48:46
To make it happen, Definitely. So please again if you're not.
48:49
Familiar with the podcast? Go follow them, Listen to them.
48:54
Go comment on the social media after we do some of the editing.
48:58
I'm gonna put that on the notes. Yeah.
49:01
And by me, I mean Heather depends.
49:02
No link will be in the note. Yeah.
49:05
Because she helps me. Because I I'm.
49:07
I'm I'm an idiot in some things. So we have those things for you.
49:10
So call the podcast and if you're at I Asus, come see us.
49:14
We have stickers. Oh yeah, yeah, let's just.
49:17
Do it. She gave me some already.
49:23
Right, cool. Any parting words?
49:26
Becky. Thank you so much you guys, this
49:28
podcast. Is amazing and we like to listen
49:30
to it and learn. I'd love to hear all about the
49:33
the tools are not the answer. Definitely can.
49:38
Do what new thing that needs to. Like give a whirl and we
49:42
appreciate you guys bringing that.
49:43
To to the to the. Podcast and to the.
49:47
Community and thanks for having us.
49:49
Thank you so much. Same right back.
49:50
To you love the podcast. It's awesome.
49:53
Well, with all this love here. And I'll share it to you.
49:56
Thank you for the folks. I apologize that I couldn't read
49:59
some of the message as we usually do because the
50:01
computer's all the way out there and we all the way over here.
50:04
So, so now you'll see me in the show, like get into it.
50:07
But we will read those comments again.
50:10
You know, our audience knows you can reach us at our LinkedIn and
50:15
our all social media pages. And as always, thank you for
50:19
watching. Take care and have a good night.
50:22
Thank you. Bye.
50:28
Ending any second now, If you enjoyed this episode, make sure.
50:34
To follow us to get notified the next time a new episode drops.
50:39
If you can do more, head on over to parsingthetruth.com and
50:43
donate by clicking on the donate button.
50:46
Parsing the Truth is a nonprofit organization and we are raising
50:49
money to send a new digital forensic examiner to I Asus
50:52
training next year in Orlando. Thanks.