Welcome to this month’s round-up of recent posts to the Forensic Focus forums.

Which forensic Linux distro would you use to analyse a Macbook Pro? Add your thoughts on the forum.

Forum members discuss how much of an advantage it is to speak multiple languages as a digital forensic investigator.

A student from the University of South Wales is looking for responses to a survey about digital forensic methodologies.

Is this an example of carved email or text data, or something else? Share your thoughts on the forum.

Can you help dj_chiro with this Windows network connection analysis question?

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (231 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Eric, tell us a bit about your background and how you became an investigator.

I was a police officer with the Phoenix Police Department in Arizona for 24 years. 15 years of that was working with crimes against children. But even before that, when I started off on the Vice squad, I knew I wanted to be an investigator. Going to Vice was a stepping stone for me – a way to learn how to go undercover, how to handle cases, how to­ take on a case load.

How did you get involved with CSA investigations?

In 2001, our police department got a charter with the Internet Crimes Against Children taskforce (ICAC), which is one of 61 federal taskforces in the United States. I tested to go there – mostly because of the technology. I did the job from 2001 to 2005. By then I needed a break.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (424 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Reviewed by John (Zeke) Thackray, Churchill Fellow, FSS Dip.

The objective of this article is to share an independent review and actual hands-on, in the field experience when gathering evidence using the Logicube Forensic Falcon®- NEO.

The most important phase of any digital investigation is the initial preservation and verification of potential evidence. If this is not achieved in a safe and reliable manner any future analysis may be jeopardized and considered inadmissible.

This review is designed to assist organizations or individuals to streamline that process when considering the use of the Logicube Forensic Falcon®- NEO without the influence of the manufacturer or other third-party competitors. Initially the testing conducted was performed in a controlled laboratory QA process. After proven concepts and manufacturer claims were validated, an extensive evaluation in a live environment with real evidence was made.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (417 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

by Richard Press, NIST

Aerial drones might someday deliver online purchases to your home. But in some prisons, drone delivery is already a thing. Drones have been spotted flying drugs, cell phones and other contraband over prison walls, and in several cases, drug traffickers have used drones to ferry narcotics across the border.

If those drones are captured, investigators will try to extract data from them that might point to a suspect. But there are many types of drones, each with its own quirks, and that can make data extraction tricky. It would help if investigators could instantly conjure another drone of the same type to practice on first, and while that may not be possible, they can now do the next best thing: download a “forensic image” of that type of drone.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (519 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Controversy has been raging around ISO 17025 ever since the standard was adopted for digital forensics back in October 2017. Although many people who work in the industry agree that standardisation is advisable and probably necessary if we are to keep moving forward, there have been many criticisms of ISO 17025 and its effectiveness when it comes to digital forensics.

The baseline of the problem seems to be that ISO 17025 was not specifically designed for digital forensics; instead, it takes the standards of ‘wet’ or traditional forensics and applies them to computing devices. This has a number of issues, not least the fact that technological advances are constantly happening; in a field where most large apps are being updated a couple of times per month as a minimum, it becomes very difficult to properly standardise tools and methodologies.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (647 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

The latest version of our flagship software, Oxygen Forensic® Detective is now live and available for download by customers with current licenses.

In addition to added support for dozens of application updates, version 10.4 offers several major new features to enable investigators to extract and examine more data than ever before.

• Posted by: OxygenForensics
• Topic: News
• Score: 0 / 5
• (2270 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

MediaClone new product release: A portable powerful multi ports Forensic Imager and a Complete Forensic Field Investigation unit, running Linux/Win open OS in a dual boot, that supports many different kinds of digital storage devices includes the latest of NVMe SSD.

The unit has two built-in NVMe ports which enable the user to image from one Suspect NVMe SSD to one Evidence NVMe SSD at a high-speed of 93.7GB/min. The unit is supplied with two PCIE U.2 external cables plus two external NVMe to M.2 adapters with mounting and locking brackets. The external PCIE U.2 cables provide a flexible solution to cover both NVMe M.2 and 2.5” U.2 SSD form factors.

In addition, the unit has two built-in SATA ports, one e-SATA port (4 via the supplied TB Expansion Box), eight USB3.0 ports and a high-speed Thunderbolt 3.0 port with 40Gb/s bandwidth.

The SuperImager application allows the user to image drives across ports and interfaces, for example, image an NVMe SSD to a SATA drive or image an NVMe SSD to a USB flash drive, and so on.

• Posted by: ekohavi
• Topic: News
• Score: 0 / 5
• (1594 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

by Eric Oldenburg, Griffeye

We recently met up with Eric Oldenburg, Griffeye’s new Law Enforcement Liasion in North America, and heard about his new role. Here, he explains how reducing mental stress for investigators is a driving force for him, one that led him to work for Griffeye, and why the mental health of investigators is a subject that we must talk more about.

In 2001 I started working with child sexual abuse crimes at the Internet Crimes Against Children Taskforce (ICAC). Looking back, I can’t think of any other work that is more fulfilling, but before taking the job I had no idea how mentally difficult it would be. At that time, I don’t believe anyone had a great understanding of the trauma that it causes investigators and examiners to see it. But when you break it down, and you really think about it, you are watching children being abused, which is a terrible and unnatural thing. So as a result, it comes with a lot of problems.

Read More

• Posted by: Griffeye
• Topic: News
• Score: 0 / 5
• (886 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Want to learn more about Logicube's next-generation forensic imaging solution? Ultra fast imaging speeds of over 50GB/min, simultaneous imaging from 4 sources to 8 destinations, image from PCIe to PCIe, 2 X 10GbE network connections -designed to streamline the evidence collection process. Check out the Falcon-NEO overview video here!

• Posted by: lmd07
• Topic: News
• Score: 0 / 5
• (2281 reads)

• comments?
• Printer Friendly Page
• Send to a Friend

Brian, you're Director of Training at Oxygen Forensics. Tell us about your role; what does a typical day in your life look like?

As Director of Training my goal is to not only develop content to help Oxygen Forensics customers implement our products in their investigations, but also build a knowledge base for them to be successful investigators in the long term as new technologies and techniques hit the market.

This involves researching the latest trends and technologies, maintaining our live and online certification trainings, presenting webinars on investigative techniques, and scheduling classes around the world to ensure our users worldwide have access to development opportunities.

Read More

• Posted by: scar
• Topic: News
• Score: 0 / 5
• (1430 reads)

• comments?
• Printer Friendly Page
• Send to a Friend