Latest / Parsing the Truth: One Byte at a Time / The Lauren Giddings Case

Transcript

The Lauren Giddings Case · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiners Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth one bite at a time. I'm Stacey Eldridge, your Co
0:56
host, and with me, as always, is my awesome Co host, Becky
1:00
Passmore. And we dive into digital
1:03
evidence in this podcast and we tell you how it helps break
1:06
cases wide open in today's and even yesterday's modern crimes.
1:11
Becky, what are we up to tonight?
1:14
Well, tonight we have a special guest with us and we are
1:17
extremely excited to welcome retired FBI agents, Digital
1:22
Forensic Examiner Dave Fryman. So thanks for being with us
1:26
tonight, Dave. We know you have a great digital
1:28
forensic story to tell us about. So we're going to get started.
1:33
Well, thank you very much. I, I, I really appreciate being
1:36
invited and, and again, having to follow all the people that
1:40
you've already interviewed is one of those things that I was
1:42
like, OK, great. So you know, but, but thank you
1:45
very much. I appreciate, humble, humbly
1:48
appreciate being invited for this.
1:52
You're going to do great. But First off, for our
1:54
listeners, can you briefly introduce yourself and tell us a
1:58
little bit about your professional background?
2:00
Yeah, so as it was stated, I'm a retired FBI agent of 22 years.
2:05
I'm currently working in the private sector and cybersecurity
2:09
and I actively teach undergrad and grad digital forensics and
2:14
cybersecurity courses as well. And finally, I have, you know,
2:18
over 23 years of experience in not only digital forensics, but
2:22
incident response, which is important because they are very
2:25
different and distinct in the approaches that they take.
2:29
Again, data is data, but it's the approach that they take, you
2:33
know, for it. Exactly.
2:35
And and finally, I'll I'll say this as well, just with my
2:39
experience. I've testified in over 30 trials
2:43
and has been entered as a subject matter expert on
2:46
numerous occasions. That's awesome.
2:48
So what is your role in digital forensics or investigations and
2:54
overall how long have you done in totality the investigations
2:59
and digital forensics? Yep.
3:01
So digital forensics. I, I've, I did for 16 years a
3:05
straight, I had a wide variety of expertise and not just, you
3:10
know, the operating systems themselves out there and go in
3:14
each one of those, but you know, really the core ones.
3:16
I have mobile forensics. I was an expert in that vehicle
3:19
forensics. I did a lot of early on
3:22
examinations and, and expertise. One of one of the big trials
3:26
that I I did initially in digital forensics was with AGPS
3:30
systems and tracking that for a murder.
3:34
We might have some stuff to ask you about in terms of vehicle
3:38
forensics from a different case that was pretty popular in the
3:42
news to get your perspective on that.
3:43
We won't do it today, but maybe we'll bring you back for that.
3:46
Sure. All right.
3:47
Absolutely. Yeah.
3:47
No, it's, it was definitely one of those up and coming new
3:52
perspectives and new areas and it's it's exploded even more.
3:55
I mean, just about every single vehicle has smart technology.
3:59
Yeah, with it, so vehicle, vehicle technology and, and the
4:03
information from it has been around for decades and a lot of
4:08
it was used for crash investigations and stuff like
4:10
that. But with the smart technology
4:13
transition, it's it's really explosive for cases and
4:17
otherwise, Yeah. Yeah.
4:19
Yeah. So before we start on this case
4:22
and your discussion of it and all the awesome things you did,
4:25
is there any limits about what you can say?
4:28
Right. Even now, I am very reserved in
4:31
what I discuss about cases. I kind of grew up with that.
4:34
I was in the military prior to law enforcement.
4:36
So really 32 years of government service and, you know, you don't
4:39
talk about missions, you don't talk about cases and things like
4:42
that. But, you know, a lot of it has
4:45
to do with, you know, respecting, of course, the
4:47
victims, the families, the friends of the victims and the
4:50
people that actually prosecuted it and, you know, did a lot of
4:54
the work and investigations. Because you don't want to
4:57
misstep or, or, or misstate something that was not
5:00
intentional, especially when a case has been, you know,
5:04
eradicated or, or completed, you know, so long ago.
5:07
You know, you don't want to sit there and say, well, I recall
5:10
this and, you know, it was some some other case or something
5:13
like that. You know, I always have
5:14
reservations about that. But speaking specifically to
5:17
this case and and Laura Lauren Giddings, you know, there there
5:20
was some things evidence that that was found that you know, is
5:23
a personal nature that I obviously would not discuss, you
5:27
know, publicly for that again, with respect to the individual,
5:31
the families and the friends and everything like, you know, in
5:34
line with that. Well, Dave, we are very excited
5:36
to hear about this case. So let's just dig in and you
5:40
start from the beginning and what you want to share with the
5:43
audience about this digital forensics case.
5:46
Yeah, so I mean, the very first time I I heard about this case
5:50
was I was sitting in the office as I usually do, working really
5:54
hard and that the evidence recovery team from, from the FBI
5:58
was actually on scene. It was a local case for the
6:01
county and, and, and the local Sheriff's Office there.
6:04
They were investigating. Obviously the murder and
6:06
evidence recovery was on scene. As they did their searches, they
6:11
came across, as with anything, especially nowadays, digital
6:15
evidence believe it or not. And so they had called up our
6:20
office to ask for assistance, which of course we definitely
6:26
don't mind doing. And so I was asked if I could
6:29
help and I said sure. I said you know, but it's 2 hour
6:33
drive, couldn't you have to go through Atlanta, which anybody
6:35
ever around here would know? Atlanta traffic is about 3 hours
6:39
really. Yeah.
6:42
But it's I had to drive through Atlanta, get to Macon, wait
6:45
around obviously to sign all the evidence and in inventory and,
6:48
you know, on scene to make sure I've got everything and then go
6:51
back to the office. And so that's another two hours.
6:54
So I said I told the ASAC at the time who got in the call and I
6:57
said, I said probably would save about two hours of processing
7:01
time if somebody drove it to me. And again, I'm not saying, hey,
7:05
drive to the FBI, you know, Pat, our cell.
7:08
It was merely just saying, hey, I'm going to save you guys some
7:12
time. A couple hours went by and it
7:16
was about 6:00 PM and I was like, are they bringing it up or
7:19
what? And the ASAC goes, oh, I forgot
7:21
to tell you. They, they decided to go with
7:22
GBI. Now that's another thing I want
7:24
to state is that nothing that I'm going to talk about in any
7:28
way taints GBI and their work. Every agency is different.
7:33
And, you know, the locals state, you know, even other federal
7:37
agencies may not have funding, equipment, training, you know,
7:43
time and expertise with other individuals that have been
7:46
there, if that makes sense. So I'm not taking any way away
7:49
from them in what I will discuss, but at times I was
7:53
brought in to help out and so their work with what they had
7:57
done was impeccable and they did a really great job.
8:00
So I just want to add that as well again just in case we have.
8:03
GBI and when we're talking about GBI, we're talking about Georgia
8:08
Bureau of Investigation. Yeah, thanks.
8:10
Yeah, of course, we throw around all these acronyms all the time
8:13
and, and, and you're right. Thank you for calling me out on
8:15
that because, yeah, the Georgia Bureau of Investigation, yeah,
8:19
I've worked with them on numerous cases.
8:21
This was not the first and it wasn't the last.
8:24
And they are really good bunch of people.
8:28
Again, it's just simply, you know, either funding or training
8:31
or equipment and and, you know, the expertise in certain areas
8:35
that maybe we've run across before, you know, and things
8:38
like that. So sure.
8:40
Yeah. Well, especially way back when,
8:41
because what year was this again?
8:43
2011 so they like let's see I started in forensics and 2004
8:51
for digital friends actually. 2003 at the end of 2003 I
8:55
started doing some on site training and things like that or
8:59
or you know, hands on apprenticeship if you will.
9:02
And then New Jersey got a RCFL at the time.
9:07
And so I started with the New Jersey RCFL and and the FBI in
9:11
that big conglomerate program there.
9:15
And so that training and then got transferred down to Georgia
9:20
anyway. So yeah, so this is, I mean,
9:23
just still an inkling, you know, we're in infancy really of the
9:28
major explosion of all of the digital media.
9:31
I mean, 2007, the iPhone came out.
9:34
So we're four years from that, from the release of that even.
9:40
So do you finally get the evidence and to your office or
9:43
do you end up going to Macon? So, so no, there, there's a
9:47
little back story to that. So I said no problem, we had our
9:50
own cases. As usual.
9:52
Like I said, we're willing to help.
9:53
I got plenty of work to do. Exactly.
9:56
Like I'm willing to help. And then they say we got it, no
9:59
problem. You know, I'm not going to sit
10:01
there and argue. I don't have time to argue even,
10:03
you know, And so I was OK with that.
10:05
About a month later, I get a call from one of the persons
10:10
that was with the evidence recovery team that was the
10:12
liaison for the Macon office with GBI in this case, the FBI
10:18
agent there. And she had said, hey, look, we
10:23
the investigation has come across A blog post that there
10:27
was some significant blogs and stuff talking about the murder
10:31
itself. So they had subpoenaed the blog
10:34
site and some individuals I think had provided the details
10:39
saying that they thought this was the subject that they
10:42
eventually arrested, that this was his moniker and so they had
10:45
subpoenaed it. Well, when they got it back, the
10:48
date and time was in epic time, which is really a a series of
10:53
numbers in seconds from January 1st, 1970, depending on which
10:57
epic time that you use. But that one in particular and
11:00
then the IP 4 version 4 was hashed, so they didn't know what
11:05
the IP came back from. So they were trying to determine
11:07
those two things. They like it.
11:10
It says it's an IP address, but it's this weird number.
11:13
It's a hash, right? Right.
11:14
So this hash is a mathematical algorithm that, you know, can
11:17
run against anything. It can run against a document, a
11:20
period, a, you know, word, even an IP address.
11:24
So that's how they were storing them in their blog site, you
11:27
know, on their servers. That's interesting.
11:30
And so that, so, so I, I could do and, and everybody in this
11:35
room and just about, well, everybody you've talked to, I'm
11:38
sure could do the epic time like in their sleep, you know, at
11:42
least with the calculation and all that stuff, it's very easy,
11:46
right? And now the MD 5 hash was a
11:48
little bit more challenging in the sense that again, we're
11:51
talking about 2011. And so I had a way that I could
11:56
manually go 0.0.0.0 and get the hash of that and then 0.0.0.1,
12:05
you know, OK, but we're talking over 4 billion calculations.
12:10
Right. Just throw that into AI today
12:13
and maybe it'd be right. Yeah, exactly.
12:16
I could have it in 10 minutes. Now, now and and.
12:19
But in truth be told, the the usable public IPS are about 3
12:27
1/2 billion, but we're still, OK, so I took off a billion,
12:30
we're still talking 3 1/2 billion.
12:32
So talking about, and this will be one of my points that I'll
12:36
bring up at the end as as what significance of the case.
12:39
But collaboration, you know, the FBI had embedded computer
12:45
scientists in the cybersecurity, you know, squads.
12:49
So I went over there and we had a good relationship and I and I
12:51
talked to, I said, look, I can do this manually.
12:53
He goes, yeah, yeah. I said, could you loop this?
12:56
Because I had the idea, like you talked about other other people
12:59
having ideas and I had the idea. I just wasn't sure.
13:02
And I hadn't done coding in a little while and and such.
13:05
So he said yeah, so he ran. Brilliant, brilliant.
13:09
Overnight brought it back to me and said OK here here, here they
13:12
are and there was 14 unique IPS out of 3 / 300 posts.
13:17
OK, But I'm playing devil's advocate and here's another
13:20
point that I would bring up to any forensic investigator and
13:24
things like that is don't just settle on what you get, validate
13:28
it right? I said, all right, look and you
13:32
guys have been around as long as I have as far as digital
13:35
forensics. So you know about the MD5
13:37
collisions and the whole, you know, defense of well there this
13:41
hash may match something out and you're like, OK, it's only been
13:44
tested in the lab. They've proven it, but it was
13:47
only lab. I've never seen it in the wild.
13:48
I still haven't seen it. But really MD fives are going
13:51
away. I think probably with more and
13:53
more technology out there and the amount of data, it's likely
13:56
it could happen, but I haven't seen it myself.
13:59
But I said because he ran it and when it would hit, it would just
14:03
take that one out of the equation and say, OK, we found
14:06
this and move on and it would run the rest of the numbers.
14:08
I said, well, wait a minute, have you run, you know, the 4
14:12
billion possibilities against this hash just in case it comes
14:16
doesn't come across somewhere else, you know, like twice.
14:19
And he goes, no, I said, OK, can you do it again?
14:21
Just to get I'm again, I know the defense was would ask that
14:24
potentially and sure enough they did because those are the types
14:27
of things that were popular back then.
14:30
You know, it's those it's those little things that they try to
14:32
twist you with. And I'm not blaming them.
14:34
I mean, it's a good question, right?
14:36
And if you don't have that, well, I didn't test it.
14:39
OK, there's doubt, right. So anyway, so I did that and
14:43
still 14, still good and nine of them came back to Atlanta, Macon
14:50
and Mercer College area. The other five were anomalies.
14:54
They that one was from overseas, a couple of from the Northeast
14:57
and you know, one I think was out towards the West.
15:00
And the significance about that, the reason why it was important
15:04
and which I learned later is that the the prosecutors had as
15:09
part of their reasoning to keep the subject locked up at the
15:13
time. Part of it, it wasn't an entire,
15:15
but part of it was that he had posted this specific thing about
15:20
the murder. They believed it was him.
15:21
Well, they had arrested him. And this post was after that.
15:25
So it was a lot of the discussion for that.
15:27
And they didn't realize that it was OK.
15:29
I mean, at the end of the day, the judge said now he's still
15:31
staying in, you know, whatever, because it was other
15:33
circumstances around it, you know, but that was another,
15:36
another important matter. So my point is, is that I did it
15:40
like a 30 page report, 14 IPS. But it's like how I found it,
15:45
what's epic time? What are the locations and the
15:49
radiuses and what is the dates and times and, and you know, all
15:52
of that report and I gave it over to the to the case agent
15:55
again, that was the liaison. And I said, OK, don't have the
15:59
DA or anybody else come back to us.
16:01
This is the type of, you know, report that they would get.
16:04
You know, if I was doing all the evidence and you know, anybody,
16:07
you know, like I said around our class time, if you will, or, or
16:10
our time that we got trained would all do like these huge
16:14
reports because it was, it was the significance of not the
16:18
fluff. More is not the best, more is
16:21
the accurate or, or what is the significance of it, you know, is
16:24
really what it came down to. So that's where we ended up with
16:28
for that. And then I didn't hear anything
16:30
for about 2 1/2 years after. Well, I take that back after I
16:35
gave the report, they said, hey, look, we got all this evidence.
16:38
Would you come by GBI have a conversation with us and say,
16:42
you know, like like kind of have a plan to, you know, look at it,
16:46
what's important, maybe what's not and how we can tie things.
16:49
I said, sure. You know, like I said.
16:51
So, so I went over to GBI and we had a conversation.
16:53
It was a great conversation. They had a couple of, they had a
16:56
couple piece of evidence. One of them was a gaming system
16:59
that was from the subject and of course I did a white paper for
17:03
the Bureau on gaming systems in particular, and so I gave them
17:06
advice on how to approach that. The significance of that was
17:10
when they process that it happened to be the, the moniker
17:14
for that gaming system happened to be the same moniker as their
17:18
posting. So they had validity of the from
17:21
the blog site. Yeah, to the blog site.
17:24
So they had validity of people calling in and saying, hey, this
17:27
is that person. We know it's that person or
17:29
whatever. And at least they had that
17:30
connection with that as well. And then it kind of went dark
17:34
for 2 1/2 years. I wouldn't.
17:36
They're not busy. I just hadn't heard from them in
17:38
about two. Hours and work on that case,
17:40
Yeah. So let me ask you more questions
17:41
about the IP addresses. So did you find out, did one of
17:44
those come back to him, his address or somewhere that he is?
17:49
Yeah, so, so they were all part of Mercer College, their complex
17:55
they were in they were using Comcast and it I I think it was
17:58
Comcast one of them that that comes back to Atlanta, that's
18:01
Atlanta based own. And and so all of those tied
18:04
into that again, I handed over that they would have to subpoena
18:08
to get, you know, the records as to where it went from there.
18:10
Fast forward, when I testified, because they wanted to throw the
18:14
evidence out of my work for pretrial testifying, the judge
18:19
kept it in. But again, it was that amount of
18:22
work, that amount of detail. And that's the other thing, you
18:25
know, sometimes we think, Oh my goodness, if I put too much in
18:28
there, you know, whatever. But you know what, you put a lot
18:30
in there, you're going to remember things or I don't
18:33
remember. Let me recall.
18:34
And it's right there, you know, like your thought process or why
18:38
you did what you did. So again, that's another reason
18:43
why you know more is better sometimes, but not verbose, not
18:48
like just fluff. It's gotta be, It's gotta be.
18:51
Mean something? Yes, factual.
18:54
You present the facts and then you explain the facts, and
18:57
sometimes it takes a lot of pages to do that.
19:00
Yeah, for sure. Yeah.
19:02
So at that point, like I said, I didn't hear anything for 2 1/2
19:06
years and then they wanted me to testify with a pretrial to throw
19:10
that out. And of course it was it was kept
19:12
in. So that was.
19:14
So I didn't hear from them until, you know, like in the
19:16
fall of 2013 or the very beginning like January, because
19:21
I know that they were having some difficulties with, you
19:24
know, the lab, you know, and some of the other evidence not
19:28
not having problems with it was just delays, you know, things
19:31
like that. So the the trial was potentially
19:33
going to be delayed again, but this was early in 2014 that they
19:38
were trying to throw out some more evidence and so they
19:40
finally set a trial date for April of that year.
19:44
So of 2014 is the next thing that they wanted to do so?
19:56
So Monday, 3 weeks before the trial, the DA.
20:03
Just a few weeks before the trial.
20:05
Becky and I are smiling because we know what's coming.
20:08
You're lucky you got three weeks, but do tell what happens.
20:12
It's funny because you're right, I only had three weeks ahead of
20:16
time because I first of all asked for it.
20:19
I am, I'm very much of A preparer and it's not to
20:24
practice my, you know, testimony or rehearse it, but it's just to
20:29
make sure that we got the facts down.
20:30
And just in general, what questions?
20:33
I mean, you guys can send me questions about what you're
20:35
going to ask, but guess what? It goes off to somewhere else or
20:38
you might ask something else that I wasn't expecting, but
20:41
guess what? It's in line with what we're
20:43
talking about so that that's not the issue and that's not what
20:46
I'm talking about. It's just getting these facts
20:48
and kind of going back through this, you know, remembering it
20:51
was 2011, you know, and the trial was 2014 and things like
20:55
that. That's that's a long time ago.
20:57
Yeah. But so three weeks before the
20:59
trial on a Monday, I went, I was asked to go to the DA's office
21:03
to do trial prep and I was like OK, sure.
21:06
Or that's when he said he was available.
21:08
So I said, OK, sure, cuz the week after I was going to train
21:13
some people, you know, in forensics and stuff on whatever
21:16
I was asked to do or whatever technique I had learned to, to
21:19
teach, you know, for the Bureau. And so I was going to be gone
21:25
the week after. So that's why it was 3 weeks
21:27
before. So anyway, so on that Monday I,
21:30
I drove again, I think I explained this before, it's like
21:33
2 hours with no traffic. And again, it's Atlanta, so
21:36
there's always traffic. So I drove about two hours to
21:41
get to the meeting and he calls me in and he goes, all right,
21:46
we're going to ask you the same things that we asked you in the
21:49
pretrial testimony. And I'm like, you may need for
21:53
two just to tell. And I have a transcript of my
21:56
testimony, right. You know, I said I could have
21:58
looked over the not that the questions would be exactly the
22:01
same as I said, but at least it's it's really what I did
22:04
anyways. Yeah.
22:05
And it's that line of questioning, right?
22:08
So I looked at him and I and and again, we had a very friendly
22:11
nature and, you know, it's we're professional and stuff.
22:13
And I did ask him that in that way.
22:16
I was like, you call me down here and then and I said, OK, is
22:18
there something else on your mind?
22:19
There seems to be something else on your mind.
22:21
He had that look again. I guess that's where the
22:24
investigator comes out of me and the FBI, you know, but.
22:28
Spread his face. Yeah, I did.
22:30
And he goes, yeah. So we're gathering all the
22:36
evidence up and you know there's some at the county because it's
22:39
it's with the county. So some of the evidence is at
22:41
the county, some of it's obviously with GBI, the digital
22:45
forensics and stuff like our digital media.
22:47
And then there's stuff at the FBI, whether it's the blood
22:51
testing and, you know, all that kind of stuff that all the other
22:54
physical evidence that they were looking at that the FBI is
22:58
really good at. Yep.
23:00
Looking at or helping out with so, he said.
23:02
We were going through the inventory and we came across a
23:04
camera and we realized nobody had looked at yet.
23:07
I said OK. There it is.
23:10
Yeah, so he goes. He goes.
23:11
So Friday GBI came by and picked it up and they, they imaged it,
23:17
you know, they took an image of the camera and stuff that the
23:19
memory in there. And there's like 10 video, what
23:24
appears to be what appears to be 10 videos on the, the last
23:28
evening that Lauren was known to have sent an e-mail.
23:32
So I think that was on the 25th of June 2011.
23:35
So that evening she sent an e-mail out or whatever and that
23:38
was the last anybody heard from her, or at least a message that
23:42
purportedly came from her, right?
23:43
I mean, known at that time it wasn't known, but anyways, that
23:46
was the last that anybody heard from her was the evening of the
23:49
25th. So there's videos from the 25th
23:52
and early in the morning on the 26th.
23:55
I'm like, OK, so what's the problem?
23:57
He goes, they were all deleted and they can't recover the
24:00
videos Where they they've recovered these videos or
24:03
whatever, you know, these files, but they can't get them to play.
24:06
I was like, OK, he goes, would you get, would you mind looking
24:09
at them? I said, OK, sure.
24:11
I said, but again, keep in mind, they, they need to make a
24:15
working copyright because they're the leads.
24:18
I, I never, I don't care about the glory about anything or
24:22
stepping in or whatever. You know, it's really about
24:25
getting to the truth, you know, again.
24:28
So I said, yeah, sure. So I drove by GBI on my way back
24:31
because they were on the way back and grabbed a working copy
24:36
of the videos, went back to my office.
24:39
Another colleague that I work with again happened to be in the
24:42
office collaboration conversation.
24:45
I said, hey, look, I got these videos and they want me to find
24:48
out something that can recover me.
24:49
Goes, Oh yeah. So we're both looking and, and
24:51
again, I don't know who found what, but we both looked and and
24:55
searched and we found a couple of things.
24:56
And there was a demo version of 1 of a file recovery.
25:01
And so I said, yeah, let me try that.
25:02
So I tried it and it recovered like the first eight to 10
25:06
seconds of each of each of these videos.
25:09
So anyways, so I have this 88 to 10 seconds.
25:13
I was like, OK, so I call headquarters again.
25:16
This is where money comes in and equipment and things like that.
25:19
And I said, hey, you know, because you know as well as I
25:22
do, you know, testing and validation and, you know, all
25:25
that stuff. We had to go through a process.
25:26
We couldn't just buy our own equipment as much as or, you
25:30
know, even software or whatever, as much as I thought that we
25:33
could or should or whatever. But anyway, so I called up
25:36
headquarters. They were like, Yep, absolutely.
25:38
They got on it the next morning. I got a license copy, got all of
25:43
them recovered. The assistant DAS happened to be
25:46
in our office in evidence downstairs collecting all the
25:49
evidence. And I called him up and I said,
25:51
hey, do you guys mind coming up here?
25:52
Because I really wasn't sure 100%.
25:55
And just to be forthright, I never went to the crime scene.
25:59
I didn't collect the evidence there.
26:01
So I wasn't familiar with anything and I wasn't, I
26:03
purposely don't really watch the news or I don't even really have
26:06
DD stuff like that. So I, I just don't pay attention
26:09
to that kind of stuff more so because I don't want to be
26:12
tainted by what's being talked about, what's not, and you know,
26:17
all that stuff. But so I wasn't sure what I was
26:19
looking at. And the first probably, you
26:22
know, 8 to 10 seconds or whatever is a blur on each one
26:27
of the videos pronounced like that's interesting.
26:29
And, and then all of a sudden it shows inside an apartment, what
26:36
it looks like to be apartment or whatever.
26:38
Anyways, so it looks like it's shining in there.
26:40
You see a, a, a couch set up with ATV and a, and a foyer with
26:44
a table where you put your keys. You know, there's a, a purse on
26:49
the back of a, you know, a table behind the, the couch, whatever
26:53
they call those, my wife would probably know as fancy as it is,
26:56
you know, I just know it's the table to put stuff, you know,
26:59
more junk on, you know, but anyways, but a purse was there
27:04
and things like that. So I called him up and said, and
27:06
so they came up two of them and they were like, my goodness, Oh
27:10
my goodness, I cannot believe this.
27:12
I was like, what? They go, that is Lauren's
27:15
apartment. She was on the 2nd floor and
27:18
that window is on the court side of the, the complex.
27:23
And I said, oh, OK, She and one of the AD as was like that purse
27:27
is her purse. And that was sitting exactly
27:30
where it was when they did the search and everything up.
27:32
Nothing, everything that you see there is exactly how it was when
27:36
they went into search. So I was like, OK.
27:40
And so a couple of significant things came out of that.
27:43
Obviously it was a huge break in the case because one of the
27:47
early parts of the investigation, a lot of people
27:50
in the complex and everything like that.
27:52
Well, all of them were interviewed and things like
27:54
that, which again, I didn't know I, I didn't have that stuff.
27:57
But they were telling me that somebody in the complex was
27:59
walking in the courtyard and it was late at night and they were,
28:02
they saw the subject there and they really, oh, what are you
28:05
doing? He goes, oh, I'm just hanging
28:06
out. He had a, a pool skimmer in his,
28:11
in his hand, like, and that's what he had the camera too.
28:14
Now the individual is dark and stuff, didn't see the camera on
28:16
there or he could have taken it off in between shots or whatever
28:19
just to hang out. But he had the camera on the
28:22
pool skimmer and was lifting it up to the second floor to see in
28:26
the wind. Oh, from outside of her
28:30
apartment, the victim's apartment.
28:32
The subject was outside Hammer on the pool.
28:35
Skinner. Skinner.
28:36
No, cuz I didn't have. Did they have selfie sticks back
28:39
then? But he needed a long.
28:40
No, he didn't have. They didn't have selfie sticks
28:42
back then. Remember, there was.
28:44
A stick to get some height. Yeah, yeah, he just needed to
28:47
get it up to the second floor cuz it's two-story, you know,
28:51
and that was, there was no porch or, you know, whatever landing
28:55
or anything like that. It was just a window side, you
28:57
know, So, yeah. So that was the first
28:59
significant thing. And the ADA pointed out
29:02
something else that, you know, at first glance I didn't catch
29:05
because again, I, I wasn't on the scene or I didn't know much
29:08
about it. But when they went into the
29:10
apartment, they noticed there is AI don't know if you guys have
29:14
ever seen that sort of triangle shaped.
29:17
I don't know if you've seen triangle shaped like door
29:21
stopper. It, it's long on the base.
29:23
And then it has a, a, a kind of a rod that fits underneath the
29:27
door handle, right. So that if somebody's trying to
29:30
open it up, they can't, it's jam, you know, it's a door jam,
29:34
if you will. Yeah, Yeah.
29:35
But it's for the inside, right? And so obviously their friends
29:40
had gotten into the apartment, you know, went in to check on
29:42
her and you know, and that's when they call the cops because
29:44
it was, you know, they she went there and stuff.
29:47
But that's The thing is, is that night, it's not on the door.
29:50
It's not the door jam is not in place.
29:52
So I think two things the subject was looking to see if
29:55
she was asleep yet or not. And secondly, or any movement.
29:59
And secondly, was trying to determine if the door jam was
30:02
there because this individual, I guess, volunteered to be sort of
30:10
a secondary maintenance person around there.
30:12
So if somebody's light bulbs went out or anything.
30:15
And he had a key to all the apartments to help do that.
30:20
So I think he's been, well, I don't think I know he's been in
30:24
her place before. And that that I'll tell you
30:27
about that here in a minute with some additional stuff that I
30:29
found. But so he knew about the door
30:31
jam and I think he was seeing if it was in place.
30:34
Yeah. So wow.
30:39
So the next part of that was like both of them, both of the
30:45
ADA stopped and looked at me and said, OK, can you please look
30:51
through all the digital evidence and see if we've missed
30:53
anything. And I said happy to help out,
30:57
but I will not be driving anything the the analyst from
31:02
GBI. Make them look like they missed
31:06
something and if they did miss something then try to make them
31:10
look bad again. Another significant thing about
31:13
us and our training, especially back then, is that we just never
31:17
duplicated right. Duplicate exams, right?
31:22
Yeah, right. Don't want to have two subject
31:26
matter experts going against each other in a court so.
31:31
And you know, the main part of the main reason behind that is
31:34
really because the defense can try to pit one against the other
31:38
or at least put doubt. And look, I'll just put it out
31:41
there. If Stacey's asked to look for a,
31:43
she's going to look for a. And if the case progresses and
31:47
all of a sudden we're looking at B&C and Becky's asked to look at
31:52
it, even though Stacy wasn't asked to look for anything other
31:55
than a right, especially if it's a, a search warrant that that
32:00
limits her, you know, view or whatever.
32:02
Yep. It could try to make Stacey look
32:05
bad to say, oh, you didn't find it.
32:07
Why? Why didn't you or, or Becky?
32:09
Why didn't you find a or what? You know, because you weren't
32:11
looking for a, you were looking for B&C because the case is
32:14
progressed or whatever. So that's another reason it it
32:17
has nothing to do with the individual, but Yep, again.
32:22
Yeah. You know, that's exactly what
32:23
they did in the Karen Reed trial to some extent with Jessica Hyde
32:27
and Ian Wiffin. Well, why didn't you look at
32:29
this? Why are you only looking at
32:31
this? You know?
32:32
Yeah, they're going to be like, oh, your window of what you're
32:35
supposed to look for was too tight.
32:36
If you'd looked elsewhere, then you would have found something
32:39
else. Yeah.
32:40
So it's just the defense strategy.
32:42
Yeah. Right.
32:43
But then if you again, as your expertise go look, I've been
32:47
down this road a lot and I know what and where to find certain
32:51
evidence based upon a crime. I still can't do that or
32:53
shouldn't. And and again, the defense would
32:55
say, oh, you went too wide. If they're saying you went too
32:58
narrow, it's it's, it's yeah, yeah, a little little, you know,
33:02
back and forth. So.
33:03
So again, to avoid that, I said, hey, come to our office.
33:06
I got a wide space. Come on in.
33:09
They sat right next to me. They brought a big hard drive
33:11
with all the evidence, threw it in some reviewing commercial
33:15
software that we had, again, money, equipment, processing
33:19
speed or whatever. I wasn't looking at finding
33:22
every little nugget or doing a keyword search.
33:25
I didn't care about that, you know so much.
33:27
What I wanted to do was to find specifically, especially based
33:30
upon the search warrant parameters, but look for things
33:33
that related specifically to the, the murder and what
33:38
evidence we knew and, and where we were at at that point.
33:41
So there's a couple of things. First of all, there was Ausb Dr.
33:45
that was found in in the subjects residence, the
33:48
apartment that he had, that Lauren had claimed that she had
33:53
lost her, she had misplaced or lost her Ausb Dr. that she had.
33:57
Hers was found in the subject's apartment.
34:00
Now he tried to claim, oh, you know, I found it outside.
34:02
Didn't know who's it was or anything like that.
34:04
Again, looking at the metadata, that thumb drive was plugged in,
34:09
so he knew because it had her stuff on there.
34:12
So he can't say that he didn't know.
34:13
Even if he didn't know up until the point that he found it, he
34:17
could have gotten it back to her at any time.
34:18
That's the first thing. Second thing is, is that I found
34:22
a hidden folder that contained a lot of specifics to Lauren and
34:28
to some personal things. Again, that, you know, we talked
34:31
about at the beginning that I wouldn't discuss, but there was
34:33
some personal things that that were there, that was hers that,
34:37
you know, just showed his mindset, I think in his attempt
34:41
to connect with her. And so that was a second thing
34:45
that was found, a hidden folder with all that.
34:47
So that was another piece of evidence.
34:49
The third thing was we, well, I say we again, sitting next to
34:54
the GBI analyst, I found another folder that was hidden as well
34:58
that had all of the similarities to Lauren.
35:03
And this individual later was found to live in the complex as
35:07
well. My goodness.
35:08
It's my expert opinion that again, based upon the modus of
35:12
things and and how it went, that that could very well have been
35:17
another victim had this individual not been caught so.
35:22
Yeah, wow. Yeah, so putting all that
35:24
together, the camera video, all the things that were found on on
35:28
the computer now, now let me let me go back to one thing.
35:32
So GBI did attempt to do certain searches and get a mindset of
35:38
the individual and found a lot of explicit sexual content words
35:44
and, you know, things like that or, or, you know, whatever
35:46
search terms in in the browser history and and all that kind of
35:50
stuff that that lent to that credibility as well.
35:53
But that is pretty much where at least their point was of the
35:57
mindset of this individual until we found that other stuff, if
36:00
that makes sense. Yeah.
36:02
Yeah. So we got the camera that all
36:05
those videos of the night of the last message into the next
36:09
morning were found the other evidence on the computers. 2
36:14
hidden folders. Yeah, and the hidden folders and
36:17
and such and then all of that was so that was on a Wednesday.
36:20
So again, Monday I get the thumb drive.
36:22
Tuesday I recover the videos and the AD as come down.
36:25
They want me to. So I sit all day on Wednesday,
36:28
GBI Thursday, they go back to the DA set down everything that
36:34
they have now that's new and, and just, you know, whatever.
36:37
And Friday they call the defense.
36:39
Now that Sunday I was flying out, go to to my training and
36:44
and and teach. And that Monday the defense
36:48
speak before they were to go to trial.
36:51
They entered a plea. They were going, they were going
36:55
to trial. As a matter of fact, you know,
36:57
even the defense attorney says, you know, they, they didn't have
36:59
much. I mean, there was, it's kind of
37:01
circumstantial, right? You got a thumb drive, you know,
37:04
I mean, you can find that anywhere.
37:05
I mean, even if he plugged it in, maybe he just didn't have a
37:07
chance to get it to her, you know, in passing or whatever,
37:11
because she worked, he was at school, whatever reasons, you
37:13
know, there, there could be a lot of circumstantial or, or, or
37:17
explanations, if you will, that could kind of put certain things
37:22
to rest. But having certain articles of
37:25
her clothing and stuff like that, that's a little bit more,
37:28
you know, right. Yes.
37:30
Well, you know. He found a pile of her clothes
37:33
with the thumb drive in it on the floor in the in the.
37:37
Laundry room and it was in the pocket.
37:40
Yeah, and it was washed, but the thumb drive still works.
37:43
I'm just saying. Right.
37:45
Yeah. But you know, I mean, that's
37:48
there all sorts of stories can be laid out there in court to
37:52
explain things. And so that's like why you're
37:55
writing good solid reports to really explain all of the facts
37:59
out there of of what that means, because that's going to help
38:01
stop counter anything that may not be based in fact.
38:07
Right. And that is a critical and key
38:10
term facts, right? Like, like I said, we're not
38:14
into writing narratives right When I said.
38:16
The hardest thing is, and, and Dave, you tell us if you
38:19
experience stuff with your students, but I have a lot of
38:22
students who write their written reports for their digital
38:24
forensics cases and it is written like the next Great
38:28
American fiction novel. And I'm like, no, no, no, no,
38:32
no, no. Facts.
38:33
US needs some facts. That's right.
38:35
That's right. And, and, and like I said, it
38:37
can be long or, or, or articulate.
38:43
When I say narrative, I don't mean like, like you said, kind
38:46
of telling the tale of two cities, you know, narrative.
38:48
We're, we're talking about the evidence.
38:51
And if there's a lot of information in there, because
38:53
you're covering it or, you know, down the road, you want to
38:56
remember this, you know, three or four years later, we're
38:58
testifying. I mean that the statute of
39:00
limitations runs out in five years for a lot of crimes, you
39:04
know, so and 10 years for, you know, a lot of bank.
39:07
When the bank fails, what happened in, you know, under
39:10
Bush, the first Bush, President Bush, they they increase the
39:14
statute of limitations for the mortgage fraud, you know, for
39:16
the bank failures to 10 years for those just because it was so
39:20
much volume of cases and and the amount of loss, you know, that
39:24
kind of thing. So that went on.
39:26
So it just depends though. But narratives don't mean
39:29
writing fiction or just filling in another page because, you
39:33
know, you don't want to sit there and go, wow, this is a
39:34
great report, man. This, this is a, this is a good
39:37
B report. You know, it's like, no, no.
39:40
It's. You know you're you're subject
39:42
matter expert analysis, you know right?
39:47
Exactly. So Dave, this case was actually
39:51
presented on Dateline, right? Yeah.
39:55
So that the thing, you know, a lot of cases that that I've been
40:00
a, a part of have, you know, done these, you know, date lines
40:04
or, or other other shows and things like that.
40:06
People go on to podcasts and talk about them and what not
40:09
well. No, no, years later and stuff,
40:11
but I'm talking like right in the moment and and things like
40:13
this, this seem like and and, and, and I will tell you guys
40:17
again, you know, from the time that she, you know, was was
40:21
found murdered or at least part of her body and things and, and
40:23
known when the last thing and you know, her last day and stuff
40:28
from that time. It almost seemed like it was so
40:31
quick, like a year. And then dateline came out and
40:34
they were like, oh, OK, we're doing this thing.
40:36
And they had asked and of course the Bureau has to give approval.
40:39
And by the time they do it, you know, and I don't mind, I, I
40:41
didn't care whether or not. But I will say this, the DA had
40:46
at the beginning of that show, they made a very direct comment
40:50
that the, that the FBI recovered videos that, you know, that were
40:53
instrumental. And then at the very end, the,
40:55
the DA was saying, Hey, if they didn't have that, you know, we,
40:57
we wouldn't have had something to go with.
40:59
I mean, a more so than than the evidence that they had, it
41:03
wasn't strong. But I will say this, it just
41:05
seemed very quick when they did it.
41:07
But they did it because he entered A plea.
41:10
And I was under the impression when he entered the plea that
41:13
because they took the death penalty off that he couldn't
41:16
appeal, which I guess you know, again, not being on the legal
41:20
side, I didn't know that. He does have a right to
41:22
obviously appeal and he has been trying and the first one was
41:26
thrown out or or denied or something like that.
41:28
And he's still trying to appeal certain things with maybe the
41:32
defense that he had or other aspects of it.
41:34
But yeah, still the facts laid out.
41:36
Yep. And do you do you recall the
41:39
name of the episode so we can let our listeners know to look
41:42
for it? Stranger watching.
41:46
I think I'd have to look it up. You guys can look.
41:50
I'll we can put it in the show notes so.
41:52
If you yeah put it in the show notes.
41:53
I forgot it's a stranger watching or something.
41:56
And it's the What was the victim's name?
41:59
Lauren Giddings. Giddings OK, yeah, that's a
42:03
that, that'd be really good. I know that a lot of our
42:07
listeners are true crime enthusiasts that are very
42:11
interested and so, you know, pointing them to the direction
42:14
of the more details about the case and then knowing because of
42:20
your efforts, because of your due diligence and intelligence
42:26
and you know, expertise being able to recover those videos,
42:31
you know, make them move forward with that case.
42:33
Well, like I said, first of all, Line did an excellent job on the
42:39
the case and how it progressed of the collection of evidence
42:43
and things like that, the interviews.
42:44
So you get a lot of that side. But I think more importantly,
42:49
this program itself is, is this podcast is really delving into
42:54
the digital forensic side that a lot of lot of people don't get
42:59
unless you guys or people like you, you know, get that story
43:02
out there to be able to tell. And, and I will say this as well
43:06
or reiterate the point. Yeah.
43:07
I mean, I found a lot of stuff it's based on expertise and
43:11
things like that, but it was a collaborative effort.
43:13
I mean, you know, even knowing certain limitations that, you
43:16
know, one may have, because again, we can't be experts in
43:19
everything, but we can certainly find people that that are
43:23
experts. And, and that's the other thing
43:26
is, is one of the important aspects of collaboration is it
43:32
can't always be 1 sided. You know, you can't keep going
43:36
to the well because eventually the well will dry.
43:38
You got to share your knowledge and your expertise and, you
43:42
know, provide something to others that are seeking, you
43:46
know, your help, not always the other way around.
43:49
So make sure when you are collaborating and things like
43:51
that, that it's, it's a team effort that it goes both ways,
43:56
if that makes sense. Yeah, absolutely.
43:58
Yeah. Especially sharing your
44:01
knowledge, even if if you guys aren't asking, you know, if, if
44:05
there's some breakthrough on stuff and I see it all the time,
44:08
you see blog posts and things like that.
44:10
A lot of great people in forensics, they, they create a
44:13
tool that parses something and they may only use it once for
44:16
one case. But guess what, there's probably
44:18
100 or 1000 cases out there for that same exact thing and they
44:23
post it as open source or whatever.
44:26
Again, test it, make sure it works, but it helps in a lot of
44:30
ways and you can tweak it. Or you could take that idea and
44:34
use it for something else, for another similar type case.
44:38
But it gives you that jump start there.
44:40
You know, you, you don't always want to start at 0, right?
44:43
You always want to move forward and keep moving forward, if that
44:46
makes sense. Yeah, absolutely.
44:49
So last question, I guess at the end of all of this, can you tell
44:53
us why you think that this case was particularly significant in
44:57
terms of digital forensics or in terms of things people can learn
45:01
from all the work that was done in this case on the digital
45:05
evidence? Yeah, the, I mean, the biggest
45:07
take away, as I said, was a collaboration, never giving up.
45:11
And there's, there's always something else to find.
45:14
I mean, yeah. Yeah, what is the saying?
45:18
You you never stop working a case, you just walk away at some
45:22
point got. To walk away and that is so you
45:25
have to walk away or I mean, you could be mired in it.
45:29
And if I, if I may go back to one thing that I said at the
45:32
very beginning, you know, I do incident response now and, and I
45:35
say it's very different because you know, with digital
45:37
forensics, you're getting what they say, the whole enchilada,
45:40
you know that the whole, you know, like you got the, the
45:43
whole computer and you're imaging everything and you're
45:45
looking through every single byte, you know, an incident
45:47
response, you're getting log files.
45:49
The log files are the same when you gather them as they were on
45:53
the host, but it's just a snapshot of of what's going on
45:57
because that's all you care about, right, An infection or
46:00
otherwise you're going through that.
46:02
So you kind of have to have that mentality of finally going, OK,
46:05
we found the root cause. We're going to move on, you
46:09
know, was root cause lateral movement and data exfiltration.
46:12
That's pretty much the focus on any most incident response.
46:16
And so digital forensics, you kind of have to have those three
46:20
points like, OK, when I get to this, this and this, maybe when
46:23
I run out of coffee or something, I'm done with the
46:24
case. I don't know, you know.
46:26
That's right. That's awesome.
46:28
Well, Dave, thank you so much for sharing your knowledge, your
46:31
expertise, all the details about this case.
46:34
I know our listeners like to hear about cases and
46:37
investigations, so very much appreciate your time and sharing
46:42
the story. I like I said, I really
46:45
appreciate being asked. I'm I'm amongst a lot of great
46:50
people before me and I know there'll be a lot of great
46:53
people that you guys interview hopefully continue, you know,
46:57
after. Yeah, well, thank you so much.
47:00
Until next time, stay safe, stay sharp, and as always, keep
47:04
parsing the truth one bite at a time.
47:08
If you enjoyed this episode, make sure to follow us to get
47:11
notified the next time a new episode drops.
47:14
If you can do more, head on over to parsingthetruth.com and
47:18
donate by clicking on the donate button.
47:21
Parsing the Truth is a nonprofit organization and we are raising
47:24
money to send a new digital Forensic Examiner to IASYS
47:28
training next year in Orlando. Thanks.
47:35
Yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, yeah.