BFU Data, Forensic Tools, and the Future of Digital Investigations

WEBVTT
00:00:11.893 --> 00:00:14.936
Welcome to the Digital Forensics Now podcast.
00:00:14.936 --> 00:00:18.550
Today is Thursday, November 21st 2024.
00:00:18.550 --> 00:00:35.082
My name is Alexis Brignoni, aka Briggs, and I'm accompanied by my co-host, the one that puts the wild in wildlife, the tester supreme, the one now better known as HC Hollywood, the one and only Heather Charpentier.
00:00:35.082 --> 00:00:40.552
The music is Hired Up by Shane Ivers and can be found at silvermansoundcom.
00:00:52.159 --> 00:00:52.942
Yes, my outro was worse than last time.
00:00:52.942 --> 00:00:54.966
Yes, the what the hc, what hc, hollywood heather, oh my god.
00:00:54.985 --> 00:01:04.129
No, no, if people don't know why I'm saying that I'm gonna show you right now oh my gosh that she is now the star of all sorts of commercials.
00:01:04.730 --> 00:01:05.272
Oh, my God.
00:01:05.293 --> 00:01:06.134
Get out of here.
00:01:06.340 --> 00:01:08.066
What is wrong with you?
00:01:08.105 --> 00:01:11.929
No, look, look at that Computer Forensic Analyst for Excellence.
00:01:11.929 --> 00:01:13.885
She's on all the TV shows.
00:01:13.885 --> 00:01:16.588
Now I expect her to be like what's that show that's going to go?
00:01:16.588 --> 00:01:22.143
It's called it's like an investigative show.
00:01:22.483 --> 00:01:24.304
Oh my God, there's some people joining us.
00:01:24.683 --> 00:01:30.385
It's great that you joined us as we're looking at Heather doing her Hollywood debut on social media.
00:01:30.906 --> 00:01:33.287
It's a lovely shot you grabbed, thank you.
00:01:33.388 --> 00:01:34.227
It's fantastic.
00:01:34.227 --> 00:01:39.370
So if you all want to see her, go to the Minded Forensics social media and look for the video where she talks.
00:01:39.370 --> 00:01:48.474
It's a great mini documentary of New York State Police and some of the work they do, which is outstanding work, and obviously they show their header.
00:01:48.474 --> 00:01:50.436
Having a few words about the work that, she does.
00:01:50.775 --> 00:01:53.376
Oh my gosh, Holly and Jeremy say law and order.
00:01:54.018 --> 00:01:54.537
Law and order.
00:01:54.537 --> 00:01:55.498
Thank you, that's the show.
00:01:55.518 --> 00:01:55.677
Yeah.
00:01:56.460 --> 00:02:04.576
See, I knew that Tuntun would for people to give us the answer there, yeah, so surprise, surprise.
00:02:04.879 --> 00:02:05.703
Sneaky, sneaky, sneaky.
00:02:05.703 --> 00:02:07.188
I didn't know you were gonna do that.
00:02:08.723 --> 00:02:17.645
Um, thank you for picking such a fabulous shot I mean, you know, I, I can only do my best oh my gosh.
00:02:17.887 --> 00:02:19.169
So what have you been up to?
00:02:19.169 --> 00:02:21.294
We just did a podcast last week, but what's new?
00:02:22.102 --> 00:02:29.668
well, um, yeah, I've been doing a whole bunch of things, so, let me, talking about sharing pictures, I'm gonna share pictures too, but of myself.
00:02:29.668 --> 00:02:32.420
So let me, um, let me share it.
00:02:32.420 --> 00:02:40.155
So what I'm gonna show you is so, this, uh, this weekend, I was, uh, I spoke at sans defer con.
00:02:40.155 --> 00:02:49.876
You can see there, uh, folks that are not, they are listening, won't see it right, but you see stickers from SANS and D4Con, and what I did there was talk about the leaps.
00:02:49.876 --> 00:02:53.002
Right, I was accompanied by my beautiful family.
00:02:53.002 --> 00:02:56.034
It's a picture of us behind the Brightline train.
00:02:56.034 --> 00:03:00.127
So we took the train from Orlando to Miami so the boys could experience it.
00:03:00.127 --> 00:03:03.203
Their face looks like emojis.
00:03:03.203 --> 00:03:03.925
That's their face.
00:03:04.481 --> 00:03:05.205
I was going their faces.
00:03:05.205 --> 00:03:10.188
Wife and kids look just like you, yeah yeah, yeah.
00:03:10.209 --> 00:03:13.401
So their emoji faces are their real faces, so it's not a mask, that's their faces.
00:03:13.401 --> 00:03:19.581
So I kid you, I kid, I kid, right, so so you can see a little video there of me going on the train.
00:03:19.581 --> 00:03:27.092
Uh, let me tell you, central florida is pretty beautiful and on you know, as you're going by the train, you see the rivers and bridges and all the good stuff.
00:03:27.092 --> 00:03:29.586
I really enjoyed the Bright Line experience.
00:03:29.586 --> 00:03:30.548
I would definitely do it again.
00:03:30.848 --> 00:03:31.610
So it was nice.
00:03:32.680 --> 00:03:35.407
And then we had that night.
00:03:35.407 --> 00:03:37.906
We got there on Friday night so I had a dinner with some of the speakers.
00:03:37.906 --> 00:03:47.312
You see Brian Maloney there on the right, ian Whiffin and Christian on the bottom on the back part and so these people, all this brainpower in that table.
00:03:47.312 --> 00:03:48.153
It was pretty amazing.
00:03:48.153 --> 00:03:52.572
I was hoping that we could maybe see the future if we put our heads together, but that did not happen.
00:03:53.000 --> 00:03:53.884
You must have come close.
00:03:54.580 --> 00:04:00.465
Well, I mean, I was the one not putting enough output there Brainpower output so I blame myself.
00:04:00.465 --> 00:04:10.620
All right, and then I ate a salad because, because I gotta eat healthy for health reasons, but I'm not gonna bore you all with that, but where's the burger that you had after that salad?
00:04:11.161 --> 00:04:13.467
I already ate all the burgers I needed to eat in the past.
00:04:13.467 --> 00:04:15.133
I guess, all right.
00:04:15.133 --> 00:04:22.791
And then, uh, I started my day, um, and I started setting the family up and all that, uh, by listening to ian whiffen.
00:04:22.791 --> 00:04:24.586
Ian whiffen explain his art x?
00:04:24.586 --> 00:04:30.601
Uh tool and if you're not familiar with it we say it a lot of times but I'm going to say it again it's a must-have tool for your examinations.
00:04:30.601 --> 00:04:34.091
It's absolutely free, it's really I love it for the location.
00:04:34.091 --> 00:04:39.605
So he maps it and gives you different ways of showing the map locations for your exhibits.
00:04:39.605 --> 00:04:40.346
It's fantastic.
00:04:40.346 --> 00:04:49.036
So art x a r t e x, so ArtEx A-R-T-E-X, and at doubleblackwithak instead of ckcom, you can get it there.
00:04:49.036 --> 00:04:52.089
So just Google EM within ArtEx and you're going to find it All right, very cool.
00:04:52.300 --> 00:04:55.250
So, and the next thing is, it's me teaching.
00:04:55.250 --> 00:05:08.120
So I've been of a double mind in this trip because I gave my spiel about the leaps and I think I was asking Heather but not our Heather here.
00:05:08.120 --> 00:05:11.728
I was asking Heather Barnhart from SANS, which we all know and love.
00:05:11.728 --> 00:05:13.966
She thought I was overreaching.
00:05:13.966 --> 00:05:27.586
Overreaching because I tried to have the class do an artifact with me and you know, I think some people knew Python, some didn't, and it was kind of a bit of a situation where some folks were totally lost and some folks were like oh, this is great, it's easy, right.
00:05:29.180 --> 00:05:46.704
So I was a little bit about two miles about it, but then I came to a conclusion, right, and my conclusion is that I believe and a little bit of a soapbox here we've got to start moving as a community to I didn't close my door properly we need to move as a community to start acquiring these skills.
00:05:46.704 --> 00:05:56.692
Look, if the only thing you do is connect the device and press a button and hit print, you're going to be automated out of a job in a matter of years, maybe less.
00:05:56.692 --> 00:06:00.415
So we got to start thinking about if things are made using code.
00:06:00.415 --> 00:06:03.019
We need to understand code, or at least not be.
00:06:03.019 --> 00:06:09.588
I'm not going to make the next iPhone, but at least know enough to be able to determine what is relevant and how to parse it out.
00:06:09.728 --> 00:06:12.572
Okay, right you need to understand how these devices works at a more deeper level.
00:06:12.572 --> 00:06:17.009
So so I was of two minds, but you know what that's gonna be my spiel moving forward?
00:06:17.009 --> 00:06:23.004
Yeah, definitely, I like this picture because it shows it's random picture here.
00:06:23.004 --> 00:06:26.728
I was at the hotel and you know hotels, you know multi-level hotels.
00:06:26.728 --> 00:06:36.771
They usually have like a fire cabinet and there will be a hose there, right, but they took the hose out and just put a extinguisher and I'm like that's not like the same thing.
00:06:36.771 --> 00:06:37.435
That's not enough.
00:06:38.180 --> 00:06:41.302
You know a little thing, and it wasn't even a big extinguisher.
00:06:41.302 --> 00:06:48.329
It's like a little extinguisher, fire extinguisher instead of having like the actual hose that you could turn on the valve and douse the fire.
00:06:48.329 --> 00:06:53.807
So I know there's a lesson there, but I will leave it for later for this question.
00:06:54.199 --> 00:06:55.303
Thankfully there was no fire.
00:06:56.267 --> 00:07:00.339
Exactly, I'd rather have the fire hose than have the little fire extinguisher.
00:07:00.339 --> 00:07:07.343
So make sure you have fire hoses, intellectual fire hoses in your brain.
00:07:07.343 --> 00:07:08.024
Start developing those.
00:07:08.024 --> 00:07:08.266
All right.
00:07:08.266 --> 00:07:09.689
Brian maloney gave me a nice coin.
00:07:09.689 --> 00:07:12.336
Uh, he does the one drive.
00:07:12.336 --> 00:07:19.101
Uh, explorer, it's a forensic tool to deal with one drives and if you have investigations that require that you need to use that tool.
00:07:19.101 --> 00:07:19.882
It's also free.
00:07:19.882 --> 00:07:22.007
It's super well documented.
00:07:22.007 --> 00:07:23.973
He did a great, a great job at it.
00:07:23.973 --> 00:07:30.151
I couldn't stay for his spiel because I had to catch the train, but he gave me a nice coin and we discussed a little bit about his tool.
00:07:30.151 --> 00:07:30.500
So that was.
00:07:30.620 --> 00:07:37.887
I was pretty, pretty satisfying and actually I got to met him, met him in person, so I loved it very nice and then they gave me a little interview.
00:07:37.887 --> 00:07:40.182
They're asking me about what I was talking.
00:07:40.182 --> 00:07:42.968
There were my really bright uh yellow shoes, as you can see down.
00:07:43.548 --> 00:07:43.990
Oh, I didn't know.
00:07:43.990 --> 00:07:45.612
You got interviewed while you were down there.
00:07:47.324 --> 00:07:48.226
You know, I got interviewed.
00:07:48.226 --> 00:07:55.004
I'm famous and also everybody else was interviewed, so it wasn't anything special that it was me, just to make it clear.
00:07:55.004 --> 00:07:56.127
It was me and everybody else.
00:07:56.127 --> 00:07:58.987
So I spoke a little bit about the tool and all that.
00:07:58.987 --> 00:08:01.180
So that's fine and that's it.
00:08:02.141 --> 00:08:02.701
Very cool.
00:08:02.701 --> 00:08:08.627
I think we're going to have to do a demo of Ian's Art X on an upcoming podcast.
00:08:09.187 --> 00:08:12.151
Hey, that's not an idea, that's not reality.
00:08:12.151 --> 00:08:13.190
We're going to do that.
00:08:13.190 --> 00:08:14.012
Yeah, definitely.
00:08:14.411 --> 00:08:15.132
It's a great tool.
00:08:15.132 --> 00:08:15.774
I've used it.
00:08:15.774 --> 00:08:23.867
I don't use it as much as I should actually, but it's a great tool and, yeah, let's show it on the next one, I'll get something put together.
00:08:23.887 --> 00:08:25.673
No, we're definitely going to do that, and by doing that I mean you.
00:08:26.800 --> 00:08:28.045
Yeah, yeah, I'll put it together.
00:08:30.060 --> 00:08:31.848
Heather is so good at the whole testing thing, you know.
00:08:33.160 --> 00:08:34.225
I'm going to put this comment up.
00:08:34.225 --> 00:08:35.485
Everybody's going to get it later.
00:08:35.485 --> 00:08:40.066
Mr Terry Tibbs is in here and says Evening DFN podcast.
00:08:40.066 --> 00:08:40.628
Talk to me.
00:08:46.419 --> 00:08:48.203
And one of our topics later is going to pull that together.
00:08:48.203 --> 00:08:50.028
Oh okay, fantastic, fantastic, we're waiting for that.
00:08:50.028 --> 00:08:51.952
Yeah, a quick shout out to kevin is in the chat.
00:08:51.952 --> 00:08:53.722
Adam is in the chat.
00:08:53.722 --> 00:09:00.761
Um my sister holly is in there hey, there we go yeah but she's the one with the cultural reference a lot of order.
00:09:00.782 --> 00:09:05.408
Thank you, holly yes, so what?
00:09:05.508 --> 00:09:05.788
what?
00:09:05.788 --> 00:09:11.634
So now that I spoke for half an hour about what I did, I want to know what, what you did.
00:09:11.634 --> 00:09:12.375
So what's going on?
00:09:13.279 --> 00:09:22.490
So I went on vacation since not last podcast, but the podcast before, and I have some pictures from my vacation.
00:09:22.490 --> 00:09:38.519
So my sister turned 25 again on October 23rd, yeah, so we did a little birthday trip and I think you've mentioned it probably 15, 20 times how much of an animal lover I am on the podcast.
00:09:38.519 --> 00:09:42.211
Well, my sister is so much more of an animal lover than I am.
00:09:42.211 --> 00:09:47.511
So we chose to go to Tanganyika Wildlife Park in Kansas.
00:09:50.303 --> 00:09:52.571
I would have never guessed that by that name that it was in Kansas.
00:09:52.820 --> 00:09:54.707
You know, I think it was in Africa, or something you know.
00:09:55.320 --> 00:09:57.369
So she loves penguins.
00:09:57.369 --> 00:10:03.951
So I Googled where can you swim with the penguins and this is the only place in the United States that comes up as a place that you can swim with the penguins.
00:10:03.951 --> 00:10:09.808
In is the only place in the united states that comes up as a place that you can swim with the penguins in kansas, yeah, in kansas.
00:10:09.808 --> 00:10:10.451
So we went to kansas.
00:10:10.451 --> 00:10:11.942
It's very, it's very flat there.
00:10:11.942 --> 00:10:14.287
It's very flat, yeah.
00:10:14.287 --> 00:10:16.130
Um.
00:10:16.130 --> 00:10:19.197
So we went and we saw all of the animals.
00:10:19.278 --> 00:10:25.109
We did a three-day all-inclusive at this park where you get to feed with the animals and interact with the animals.
00:10:25.109 --> 00:10:35.177
Um, so these are the lorikeets we were feeding and there actually was a lorikeet named um noodle that if he sat on your shoulder, if you asked him to dance, he would dance.
00:10:35.177 --> 00:10:36.422
He would like bob his head up and down.
00:10:36.422 --> 00:10:37.123
It was really cute.
00:10:37.123 --> 00:10:41.773
Um, we saw the capybaras, which are adorable.
00:10:41.773 --> 00:10:42.500
These are babies.
00:10:42.500 --> 00:10:43.923
They actually get really big.
00:10:43.923 --> 00:10:46.126
Um, but these were little babies we got to feed.
00:10:46.126 --> 00:10:46.788
Feed them.
00:10:46.788 --> 00:10:47.789
Like how big?
00:10:47.789 --> 00:10:49.953
Like I think a couple hundred pounds.
00:10:49.953 --> 00:10:53.726
They're big, it, big oh geez yeah and these are just little guys.
00:10:54.509 --> 00:10:56.131
Um, so it was so much fun.
00:10:56.131 --> 00:11:01.145
Those, I think the capybaras, were one of like close to my favorite animal at the zoo.
00:11:01.145 --> 00:11:12.910
Um, yeah, they're awesome, kevin, we got to go hang out with the owl monkey and the cavies in this picture and then we got to swim with the penguins.
00:11:12.910 --> 00:11:18.135
So they gave you a wetsuit and you actually get in with the penguins and they have little cat toys.
00:11:18.135 --> 00:11:20.221
The penguins like to swim after the cat toys.
00:11:20.221 --> 00:11:28.143
So just some pictures of us swimming with the penguins, got to feed the giraffes and had the little giraffe interaction.
00:11:28.143 --> 00:11:34.024
Oh, holly said up to 100 pounds, so I said a couple or 150 pounds for the capybaras.
00:11:34.725 --> 00:11:36.991
So like a decent, decent amount of weight.
00:11:36.991 --> 00:11:38.095
Yeah, a big animal.
00:11:39.217 --> 00:11:42.445
We interacted with the otters and the sloths and actually the sloths.
00:11:42.445 --> 00:11:51.831
What they do with them is the sloths will hold a paintbrush, so I have the pictures here and the zookeeper holds the little canvas up and the sloth paints you a picture.
00:11:54.000 --> 00:11:55.948
But he's not telling you that picture took three hours.
00:11:56.311 --> 00:11:57.966
Yeah, oh yeah, pretty much.
00:11:57.966 --> 00:12:02.602
Yeah, it was not a fast process, but I didn't care because I liked being in there with the sloths.
00:12:02.602 --> 00:12:09.751
And then this animal right here, the Okapi, is the weirdest looking thing I've ever seen.
00:12:09.751 --> 00:12:12.394
I'd never heard of it until I went to Tanganyika.
00:12:12.394 --> 00:12:13.395
It is.
00:12:13.395 --> 00:12:18.484
It just looks like a mix of a whole bunch of different animals.
00:12:18.484 --> 00:12:23.025
You can see like its butt is a zebra and its face looks more like a horse and deer combination.
00:12:23.025 --> 00:12:34.288
So it was a really cool animal and the monkeys and the rhinos we got to feed the rhinos and hang out with the rhinos and the pygmy hippo was the most adorable thing ever.
00:12:34.568 --> 00:12:35.289
um, they have.
00:12:35.289 --> 00:12:37.903
That's not the one like deng the mudeng is that?
00:12:37.903 --> 00:12:39.024
Yes, it's just like him.
00:12:39.186 --> 00:12:39.667
Oh, it's not.
00:12:39.667 --> 00:12:42.173
No, this one's name is locky, but it's just like.
00:12:42.173 --> 00:12:45.850
Just like mudeng um, and they painted pictures too.
00:12:45.850 --> 00:12:51.735
So it was a non-toxic paint they put on the nose and it comes over for treats and paints on your canvas.
00:12:52.758 --> 00:12:53.240
Oh, look at that.
00:12:53.980 --> 00:12:57.530
And then my very favorite animal at the entire place was the lemur.
00:12:57.530 --> 00:13:02.312
You got to go in with them and they sat on your lap and you got to feed them out of your hands.
00:13:04.083 --> 00:13:05.235
I bet people made the whole.
00:13:05.235 --> 00:13:08.708
I got to move and move a joke, right yeah, yeah, of course.
00:13:09.631 --> 00:13:13.864
And then we got this nice selfie with a lemur there on the one of the last days.
00:13:13.965 --> 00:13:17.541
So it was, it was he's sticking his tongue out for the folks that can't see it.
00:13:17.620 --> 00:13:24.644
So I guess, he's like it's just sticking the tongue out it was awesome, um, one of the best trips I've ever been on.
00:13:24.644 --> 00:13:36.500
We usually go horseback riding for her birthday every year, um, but this was like a once in a lifetime type of uh trip to wildlife park in kansas of all places I heard that I heard they're looking for some missing capybara.
00:13:36.520 --> 00:13:39.489
So oh yeah, it's a pure coincidence that they got.
00:13:39.489 --> 00:13:43.245
They weren't missing after you went there they're both at my sister's house.
00:13:43.284 --> 00:13:51.947
She would be the one to steal them don't tell anybody, don't tell the police so the time off was well spent.
00:13:51.947 --> 00:13:56.293
Uh, it was a great vacation well, that's, that's awesome.
00:13:56.333 --> 00:13:59.562
Thank you for sharing all your your pictures yeah adorkable.
00:13:59.562 --> 00:14:03.563
They're great um adorkable adorable.
00:14:05.845 --> 00:14:10.307
So now that we have vacations out of the way, hop into some forensics.
00:14:10.908 --> 00:14:11.388
Let's do it.
00:14:11.388 --> 00:14:11.947
Let's do it.
00:14:12.048 --> 00:14:12.467
All right.
00:14:12.467 --> 00:14:15.029
So last week we had Chris Vance on.
00:14:15.029 --> 00:14:20.613
We talked about the iOS devices that were rebooting due to inactivity.
00:14:20.613 --> 00:14:26.296
Just wanted to quickly throw up another resource to learn a little more about that.
00:14:26.296 --> 00:14:30.538
There's a blog called Reverse Engineering iOS 18 Inactivity.
00:14:30.538 --> 00:14:34.041
It is similar to Chris's blog.
00:14:34.041 --> 00:14:45.216
It has some detail, talks about where you can find those artifacts that show whether the device was rebooted and a whole bunch of other stuff about the iOS 18 too.
00:14:46.059 --> 00:14:59.106
Yeah, and something I like about the article is that it actually goes into the detail of how the author went and had to reverse engineer the processes, right, because one thing is looking at logs and what the logs show and another one is trying to look at.
00:14:59.106 --> 00:15:18.182
For example, if you want to understand some undocumented feature on whatever software, the first thing he did was he took the IPA, whatever the executable is, and you look for strings and hopefully the developers left some strings there that you can read like notes to give you an idea of what's going on.
00:15:18.182 --> 00:15:20.087
A lot of these variable names.
00:15:20.087 --> 00:15:22.663
There are things you can actually read like that makes sense.
00:15:22.663 --> 00:15:24.609
So he put together some of those.
00:15:24.609 --> 00:15:25.511
Do some testing.
00:15:25.511 --> 00:15:26.041
He had to.
00:15:26.562 --> 00:15:37.133
Some of the hiccups with it is how do you get into the software when the encryption keys are removed by Apple, right?
00:15:37.133 --> 00:15:49.812
So he went around all this rigmarole to be able to get to that data and give a detailed sense of what's going within the device and when it was added and how is it executed within the device.
00:15:49.812 --> 00:16:05.830
So I recommend everybody to read that and get familiar with it, and if this is something you find attractive, then definitely reverse engineering is for you and I believe we need more of that within the mobile forensics sphere, beyond just intrusion, intrusion detection, intrusion response.
00:16:05.830 --> 00:16:08.485
In the DF field we definitely need more reverse engineers.
00:16:10.283 --> 00:16:11.044
So, good example there.
00:16:14.131 --> 00:16:18.029
Okay, so FTK image or BitLocker.
00:16:18.029 --> 00:16:19.947
We had it for a minute.
00:16:19.947 --> 00:16:21.585
I'm going to show it.
00:16:22.701 --> 00:16:23.605
Look, look, look.
00:16:23.605 --> 00:16:26.229
The thing is the for background here.
00:16:26.229 --> 00:16:33.860
Uh, extero, which are the makers of ftk and ftk imager uh, really, ftk imager is everybody's toolbox.
00:16:33.860 --> 00:16:36.330
It's one of the most well-renowned tools.
00:16:36.330 --> 00:16:43.668
They came out with a release ftk 7.3 point something and it had bitlocker support and it was up for a day or so.
00:16:43.668 --> 00:16:49.208
So a whole bunch of us well, not me, but somebody else downloaded it and it's like oh, this is great, let's test it out.
00:16:49.208 --> 00:16:51.889
And a few people made blog posts and then it disappeared.
00:16:51.889 --> 00:16:54.143
You couldn't download it.
00:16:54.143 --> 00:16:56.510
So I started complaining Not complaining, that's not true.
00:16:56.879 --> 00:17:00.029
I started pointing out the fact that it disappeared.
00:17:00.029 --> 00:17:03.706
I'm like what happened to it was was there an issue with the software that we should know about?
00:17:03.706 --> 00:17:05.309
Was it not working properly?
00:17:05.309 --> 00:17:06.551
It just took it out, but not tell us.
00:17:06.551 --> 00:17:08.864
But eventually, is that the explanation was?
00:17:08.864 --> 00:17:16.667
And harsh peel that, I think, is the main product manager for ftk tooling within extero explained that the reason is that it was uh, it was.
00:17:16.667 --> 00:17:18.961
They were not supposed to release it yet, right?
00:17:18.961 --> 00:17:21.666
Yeah, um, so there was about an accident.
00:17:21.666 --> 00:17:27.645
So they released version 7.0, I guess, or 0.1, and not this version which is ahead.
00:17:27.645 --> 00:17:28.930
But guess what?
00:17:28.930 --> 00:17:31.810
It's already out, so we're going to use it and we're going to show it.
00:17:33.580 --> 00:17:35.428
So let me take that off the screen.
00:17:35.428 --> 00:17:42.609
All right, so I just have a BitLockered thumb drive and I am going to add it.
00:17:42.609 --> 00:17:43.772
Oh, hold on.
00:17:43.772 --> 00:17:45.346
Oh, I have to have it out.
00:17:45.346 --> 00:17:48.324
Sorry, I'm gonna add the physical drive.
00:17:48.324 --> 00:17:56.664
I have it plugged into my laptop and it is this, and just hit finish.
00:17:56.664 --> 00:17:59.981
When I add it it pops up, and here let me zoom in on that.
00:18:00.344 --> 00:18:01.007
Yes, yes please.
00:18:01.460 --> 00:18:05.268
Pops up a screen asking for your BitLocker encryption credentials.
00:18:05.268 --> 00:18:10.372
We can do a recovery key or we can do the password to the BitLockered USB.
00:18:11.201 --> 00:18:12.310
Or the boot key file too.
00:18:12.900 --> 00:18:13.944
Yes, or the boot key file?
00:18:13.944 --> 00:18:17.653
Yes, I have, let's see if I still.
00:18:17.653 --> 00:18:21.744
Yeah, so I have the recovery key to this because I BitLockered it.
00:18:21.744 --> 00:18:30.935
Because I BitLockered it and as soon as I put it in, we have access to the files on the USB drive.
00:18:38.423 --> 00:18:43.759
So you can see here my top secret documents folder we now have access to and something that's pretty cool about the tooling.
00:18:43.759 --> 00:18:49.671
So this is a traditional scenario where you have this drive, you're going to write block and it's bitlocker, you have the key, let's look what's inside of it.
00:18:49.671 --> 00:18:55.792
So my case, my testing case, was I took and I image the bitlocker uh drive.
00:18:55.792 --> 00:18:57.842
I imaged it as an e01 straight up.
00:18:57.842 --> 00:19:01.730
So I have now the encrypted e01 with bitlocker and again same thing.
00:19:01.730 --> 00:19:24.945
I put it there, I went in a little bit and again that screen popped up and I was able to get in which, which is pretty neat because, yeah, as long as you have the key, you can do the e01 straight up and then later on, uh, do the whole, uh decryption of it, also with the tool, and after that you can make ad1s, as always and for those are not familiar, those are logical extractions from from the image that you're working out of.
00:19:24.986 --> 00:19:37.204
So you can take, say, a film file, some folders, build an extraction, a logical extraction, and pull that out, or do the traditional things you would do with FTK Imager and if you're digital forensics, you have to know this tool.
00:19:37.204 --> 00:19:38.890
This is just one of those things that you did.
00:19:38.890 --> 00:19:41.086
One of the first tools they give you when you're walking through the door.
00:19:41.627 --> 00:19:47.545
Yeah, oh, definitely the first tool you use in college too, right, oh, absolutely.
00:19:47.644 --> 00:19:49.229
It's like it's all reliable.
00:19:49.229 --> 00:19:50.391
I call it in one of my old my.
00:19:50.391 --> 00:19:54.326
Now the thing is that the question is are they gonna I mean, why?
00:19:54.326 --> 00:19:54.909
Why?
00:19:54.909 --> 00:19:55.810
Take it back right?
00:19:55.810 --> 00:19:58.684
Is it because they're gonna charge for it or you're gonna know?
00:19:58.684 --> 00:20:00.028
Well, I hope not.
00:20:00.028 --> 00:20:04.145
I hope they can release it as is, as I did, free with that functionality.
00:20:04.145 --> 00:20:08.989
But who knows, do other tools do this Absolutely?
00:20:08.989 --> 00:20:14.468
But it's a benefit, because we're so used to using this tool I've been using it for over 15 years or whatever it is.
00:20:14.468 --> 00:20:24.086
So just adding this capability makes the tool so much useful and it broadens the user base because we know how to use it, we teach it and now it has more capability.
00:20:29.900 --> 00:20:31.345
So I hope they release it for free again in the not too distant future.
00:20:31.345 --> 00:20:32.248
So please, xterra, don't make us wait too much.
00:20:32.248 --> 00:20:32.809
Yeah, and super easy to use.
00:20:32.809 --> 00:20:34.476
So I mean we definitely want access to this.
00:20:35.940 --> 00:20:42.829
So if you don't have access to it, I'm sorry and don't ask me for it, because I am not an Xterra tool distributor and I don't want to get in trouble.
00:20:42.829 --> 00:20:46.915
I just got a copy for me and for testing and that's it.
00:20:46.915 --> 00:20:48.185
So if you didn't get it, sorry.
00:20:48.779 --> 00:20:49.845
Yeah, I know.
00:20:50.461 --> 00:20:51.324
Don't come asking me for it.
00:20:51.945 --> 00:20:52.528
He's not lying.
00:20:52.528 --> 00:20:53.761
He won't even give me a copy.
00:20:53.761 --> 00:20:54.884
I had to get it elsewhere.
00:20:54.884 --> 00:20:55.546
No, I'm just kidding.
00:20:55.546 --> 00:21:00.205
Yeah, yeah, yeah, I didn't give him the copy period.
00:21:01.641 --> 00:21:02.202
That's my story.
00:21:02.202 --> 00:21:03.326
I'm sticking to it yeah.
00:21:04.328 --> 00:21:05.131
Oh, ryan Benson.
00:21:05.131 --> 00:21:06.325
Ryan Benson is in the chat.
00:21:06.325 --> 00:21:09.470
I got a shout out to Ryan.
00:21:09.470 --> 00:21:12.781
Ryan does great tools, like in hindsight.
00:21:12.781 --> 00:21:18.259
He does Unfurl Unfurl just recently Good thing I saw his name Unfurl just updated.
00:21:18.259 --> 00:21:25.259
So now it recognizes blue sky timestamps and more different data and better parsing for some protobufs and other things.
00:21:25.921 --> 00:21:35.047
If you're not familiar with unfurl, what that does is it takes the url from a, from a website, from a cloud service, a chatting application.
00:21:35.047 --> 00:21:39.781
You take that url, you put it on furl and it breaks down the url in its component parts.
00:21:39.781 --> 00:21:44.373
You see the domain and those component parts might have timestamps in.
00:21:44.373 --> 00:21:50.286
It, might have protobuf or something else other data types within the URL base64, which is traditionally a URL thing.
00:21:50.286 --> 00:22:04.153
It will explode that for you and show you all the component parts and it's a great tool If you carved out some URLs and you want to know when the URL, the activity, happened.
00:22:04.153 --> 00:22:11.102
Some of these URLs have timestamps of a search that was done within that URL and just put it on referral and it tells you what the timestamp is.
00:22:11.102 --> 00:22:12.807
So great, great tool.
00:22:12.807 --> 00:22:13.588
Same with hindsight.
00:22:13.588 --> 00:22:14.672
You're doing browser forensics.
00:22:14.672 --> 00:22:15.863
Check it out Also.
00:22:15.863 --> 00:22:18.528
Quick shout out to Brett Shavers in the chat.
00:22:18.528 --> 00:22:19.952
What is he saying, heather?
00:22:20.799 --> 00:22:24.672
FTK Imager is the pair of pliers in the DFIR toolbox.
00:22:24.672 --> 00:22:25.434
Definitely.
00:22:25.454 --> 00:22:28.063
FTK Imager is the pair of pliers in the DFIR toolbox Absolutely Of all the tools.
00:22:28.063 --> 00:22:29.268
Pliers is a good analogy.
00:22:29.268 --> 00:22:31.405
I like that.
00:22:31.880 --> 00:22:33.086
Yeah, that's really good.
00:22:33.086 --> 00:22:41.753
So there's another release of a tool, the Samsung Secure Health Data Parser.
00:22:41.753 --> 00:22:47.009
It was released, or created and released by um.
00:22:47.009 --> 00:22:49.441
Oh, where did I put that?
00:22:49.441 --> 00:22:53.130
I'm trying to remember the, trying to remember the blog name.
00:22:53.130 --> 00:22:53.672
I have it down.
00:22:53.672 --> 00:22:55.564
Oh, breakpoint, breakpoint forensics.
00:22:55.564 --> 00:23:03.682
Um, what this does is it will, um, it'll parse out your Samsung health data, right.
00:23:03.682 --> 00:23:06.692
So the features of the tool are step count parsing.
00:23:06.692 --> 00:23:11.009
It does exercise sessions, it does live data decompression.
00:23:11.009 --> 00:23:13.247
It creates comprehensive reports.
00:23:13.247 --> 00:23:16.209
The GUI is super easy to use.
00:23:16.209 --> 00:23:18.749
I'm going to just throw that up on the screen here.
00:23:18.749 --> 00:23:25.511
So this is what the GUI looks like for the Samsung Health Database Parser.
00:23:26.361 --> 00:23:33.909
What you do need, though, is this database, by default, is encrypted, so you have to get a decrypted copy of the database.
00:23:33.909 --> 00:23:36.047
The database is securehealthdatadb.
00:23:36.047 --> 00:23:50.086
Tools like Celebrite actually automatically were decrypting the Samsung Health Database, automatically were decrypting the Samsung health database.
00:23:50.086 --> 00:24:07.404
I tried to extract my Samsung device to have some test data for the podcast tonight so I could show you how this tool actually works, but I think, because of that key store issue, where the key store is not being pulled from Android devices, I'm not getting the decryption keys necessary to generate that decrypted version of the health parser.
00:24:07.986 --> 00:24:14.855
I do have some like older versions, but it's work stuff so I wasn't able to bring it on and show everybody how this tool works.
00:24:14.855 --> 00:24:19.263
So if you have that decrypted version of the database, try it out.
00:24:19.263 --> 00:24:21.125
It looks super easy to use.
00:24:21.125 --> 00:24:24.130
You're just going to choose that database, pick your output folder.
00:24:24.130 --> 00:24:35.451
It'll create a report in CSV or in HTML and there's also a blog about it which I have up on the screen.
00:24:35.451 --> 00:24:42.113
And then the Breakpoint Forensics GitHub page is where you can go to download the tool.
00:24:43.201 --> 00:24:50.788
Yeah, go to the repository and get it, and I think one of the big takeaways of this type of discussion, it's not only the tool which we need, and that's great.
00:24:51.501 --> 00:24:55.528
And also, it's not only the fact that we need the vendors that deal with extractions.
00:24:55.528 --> 00:25:01.663
That's the part that we as a community are kind of forced to outsource to them to get support for those encryption keys or decryption keys.
00:25:01.663 --> 00:25:07.491
A good teaching point is that when you think about Android, android is not just Android right.
00:25:07.491 --> 00:25:17.752
You got Android Samsung, you got Android LG, you got Android Moto, you got Android Google ones right, and all of them will, for example, deal with health data.
00:25:17.752 --> 00:25:45.433
But each vendor might decide to do their own implementation, which means if you're doing Android forensics, if you know about a health database in a google pixel, you gotta think about is my tool showing me the implementation from moto or motorola or from lg or for whatever other vendors out there, right, if they're android 14, 15, whatever it is compliant, they will have it, but they might not be located where you expect it in traditional Vanilla from Google Android.
00:25:45.539 --> 00:25:54.126
So, again, the big takeaway is make sure that, as you're working with different Android types, that you're looking for those implementations.
00:25:54.126 --> 00:26:02.229
Your tools will not parse all of those and I'm telling you because this happened in my cases time and time again where, oh, there's no health data.
00:26:02.229 --> 00:26:05.125
I bet it might be there, it's just in Motorola.
00:26:05.125 --> 00:26:12.568
It might be somewhere else, or it might have a little bit of changes in how the data is decoded and their meaning.
00:26:12.568 --> 00:26:14.842
I'm trying to think of an example.
00:26:14.842 --> 00:26:23.445
Look for the one in Samsung Ruben Ruben Ruben is another example, by the way.
00:26:23.720 --> 00:26:25.063
You're right, that's not the one I the other one.
00:26:25.083 --> 00:26:25.804
Ruben is another example, by the way.
00:26:25.804 --> 00:26:26.484
Yeah, you're right, you're right.
00:26:26.484 --> 00:26:28.449
Yeah, that's not the one I was thinking of, but that's a good example too.
00:26:28.449 --> 00:26:29.891
Right, you have to decode that as well.
00:26:29.891 --> 00:26:30.992
There's one for activities.
00:26:30.992 --> 00:26:32.635
It's not user stats, it's the other one.
00:26:32.635 --> 00:26:42.372
I just forgot the name right now.
00:26:42.372 --> 00:26:47.528
In Samsung it's a number and in Google it's a different number, even though they track the same activity.
00:26:47.528 --> 00:26:49.386
So that's part of that research that you have to do.
00:26:49.386 --> 00:26:55.651
So, anyways, I'm going too long on this, but again, I want to emphasize those differences.
00:26:56.380 --> 00:27:00.707
Specifically, though, ruben is a good example of what I think the issue is here.
00:27:00.707 --> 00:27:09.951
I can't decrypt the Ruben database right now because there's issues with the pulling the key store from the devices, so I think that's probably just what happened here.
00:27:09.951 --> 00:27:13.265
I I did find an older database and and used it.
00:27:13.645 --> 00:27:17.353
It works beautifully so, yeah, no, we, we need to.
00:27:17.353 --> 00:27:26.123
We need to work with vendors and again, I I believe that us as examiners, the analysis is on us and the extraction is going to be on vendors, and I don't think we should outsers.
00:27:26.123 --> 00:27:29.236
The analysis is on us and the extraction is going to be on vendors, and I don't think we should outsource also the analysis to the vendors.
00:27:29.236 --> 00:27:32.529
But that's a discussion that we can have later.
00:27:33.059 --> 00:27:35.848
You're just generating topics for the future podcast.
00:27:35.848 --> 00:27:36.190
Thank you.
00:27:36.190 --> 00:27:42.549
I wanted to point out a blog article.
00:27:42.549 --> 00:27:48.292
So the name of the blog is Mobile Forensic Data Structures, which data structures are super important.
00:27:48.292 --> 00:27:53.209
I'm going to tell you why here in a second Extracting and Analyzing Data with Free Tools.
00:27:53.209 --> 00:28:07.335
So it's a blog written by Cesar Caseta from Hexordia, and he outlines how to extract and analyze data structures using SQLite Browser, pl editor pro and notepad plus plus, which are all free tools.
00:28:07.335 --> 00:28:11.290
He takes the one of the cache DB files.
00:28:11.290 --> 00:28:21.483
So there's a whole bunch of different cache DB files in the in extractions and they commonly have different types of data structures stored within the cells as blob data.
00:28:21.483 --> 00:28:35.403
In Caesar's example, there's BP list and base 64 stored inside of the SQLite database and he shows you, walks you through how to open the data, how to export it and view it with the free tools.
00:28:35.403 --> 00:28:37.828
Why is it important?
00:28:37.828 --> 00:28:40.441
I mean, the tools do it for you, right?
00:28:40.441 --> 00:28:42.210
So why do we need to know how to do that?
00:28:42.210 --> 00:28:45.323
Do the tools always do it for you?
00:28:46.816 --> 00:28:52.058
Not always going to work, yeah, and what is a data type you know.
00:28:52.058 --> 00:28:53.500
You said that your tool doesn't recognize.
00:28:53.500 --> 00:28:56.244
You have to pull it out and use another tool to be able to look at it, right?
00:28:56.625 --> 00:28:58.567
Exactly, exactly.
00:29:00.049 --> 00:29:01.960
Although I will say I will say something real quick.
00:29:01.960 --> 00:29:06.136
That's why this part, this information that Cesar is giving out, is super important.
00:29:06.136 --> 00:29:07.919
It, this information that Cesar is giving out, is super important.
00:29:07.919 --> 00:29:09.340
It gives you a way to do some of that.
00:29:09.340 --> 00:29:21.974
But I want to push everybody to take it to the next level, because if your cache file has 10,000 rows, are you going to be pulling all those one by one and then opening it with a viewer, one by one?
00:29:21.974 --> 00:29:23.801
You're going to be there for a week, right?
00:29:23.801 --> 00:29:34.686
Or you can code a few lines to do a query on the database, pull out the thing, it automatically identifies what it is and then it shows it to you in a nice report, right.
00:29:34.686 --> 00:29:40.105
Again, I'm kind of also self-serving, because that's something you could do with the leaps.
00:29:41.076 --> 00:29:43.964
Yeah, you know how to code a little bit right and they use the leaps to show it to you.
00:29:43.964 --> 00:29:49.925
But this knowledge is important for you to know what's the deal, what's inside of it.
00:29:49.925 --> 00:29:58.785
We need to get to it, and then the next step, I believe, for the community, is to start automating some of the stuff and sharing that knowledge among the rest of members of the community.
00:29:59.467 --> 00:30:17.309
Right, and so definitely being able to code and look at all of the cells in the SQLite database, all the tables, all the rows, is important, but if you just need to go in and validate or verify the results of one, the skills that you can learn just by reading this blog can be super helpful.
00:30:18.817 --> 00:30:19.601
Oh, absolutely.
00:30:19.601 --> 00:30:21.340
And again, you might not need to do 10,000.
00:30:21.340 --> 00:30:26.398
Maybe you do, but still, even if you don't know how to code, at least know that you can get to the data and look at it.
00:30:26.398 --> 00:30:28.221
It's better than not, right.
00:30:28.340 --> 00:30:30.163
Oh yeah definitely.
00:30:30.282 --> 00:30:38.111
I mean there's 100% absolute great value on all this, and then we can take that and automate it as another goal we can set for ourselves.
00:30:41.446 --> 00:30:45.336
Right With this data structures.
00:30:45.336 --> 00:30:47.021
There's other courses to take or there are courses to take too.
00:30:47.021 --> 00:31:10.944
So if CESAR works at Hexordia, there's a data structures course at Hexordia, and if anybody's interested in learning more about the different data structures, it's an excellent course and I believe it's got a discount right now, through December 2nd, I think for Black Friday, so definitely maybe take advantage of that discount and then you could always come down to Orlando also for the big IASIS event in April and May.
00:31:10.944 --> 00:31:16.583
The instructors who are teaching the advanced mobile class are super awesome.
00:31:16.583 --> 00:31:25.106
Yes, people listening can't see Alex like dancing around and pointing to himself and pointing to me.
00:31:25.106 --> 00:31:33.000
But yeah, we teach that class at IASIS and there are still seats available for week one, so check it out.
00:31:34.096 --> 00:31:36.242
And everybody that's hitting me on LinkedIn and social media.
00:31:36.242 --> 00:31:38.842
I said don't worry, we will have answers for all your questions.
00:31:38.842 --> 00:31:49.545
Heather will be in charge of it of answering the questions, so I know that she's waiting for those with bated breath to actually answer all your questions.
00:31:49.654 --> 00:31:52.384
Yeah, I accidentally saw your comment too.
00:31:52.384 --> 00:31:57.722
I forget who your comment even was to, but it was like oh, Heather will be there, She'll answer all of the questions for you.
00:31:57.722 --> 00:32:01.022
I expect to have some help with that.
00:32:02.395 --> 00:32:04.443
I'll make sure the rest of the team does.
00:32:04.443 --> 00:32:11.164
I'm just there to pet the electronic detection dogs.
00:32:12.935 --> 00:32:14.762
We're going to have a couple in class this year too.
00:32:14.762 --> 00:32:21.384
So if you don't want to come learn about data structures with us and you want to just come pet the dogs, no, you have to learn about the data structures too.
00:32:22.576 --> 00:32:24.002
And pet the dogs in the process.
00:32:24.394 --> 00:32:25.520
Yeah, the dogs will be there.
00:32:25.520 --> 00:32:27.040
I hear we're going to at least have two.
00:32:28.915 --> 00:32:32.144
Let me, before we move to the next topic, let me just highlight a few other comments in the chat.
00:32:32.346 --> 00:32:32.506
Sure.
00:32:33.817 --> 00:32:41.305
Yeah, the folks were talking about how hard it is to get some of that Tableau software to update some of that firmware.
00:32:41.305 --> 00:32:45.665
They're saying that, well, we just run the firmware to 2010.
00:32:45.665 --> 00:32:48.681
We never update it, and actually that's so true.
00:32:48.681 --> 00:32:52.162
You can ask some people when was the last time you updated your write blockers?
00:32:52.162 --> 00:32:54.420
And people are like you can update your write blockers?
00:32:54.420 --> 00:32:58.082
Yes, you can, and please do it as soon as you can.
00:32:58.082 --> 00:33:00.903
Yes, make sure you update that type of stuff.
00:33:00.903 --> 00:33:13.539
And Damien which again a shout out to Damien he also teaches with Spider Forensics, so he gives that class also during IASIS, but within Spider Forensics and on data structures and SQLite.
00:33:13.539 --> 00:33:21.527
He's talking about how he had a lot of work to do with a SQLite database but with a few lines of code he was able to automate the process and get to those results.
00:33:21.527 --> 00:33:23.681
So a lot of value in learning those skills.
00:33:24.403 --> 00:33:36.136
Definitely skills, definitely so.
00:33:36.136 --> 00:33:40.665
Um, an article that actually alexis shared with me uh called game plans a template for robust digital evidence strategy and development.
00:33:40.665 --> 00:33:43.200
Um, we thought it was a good read and that we would share with everybody.
00:33:43.200 --> 00:33:52.688
So, um, it kind of addresses the need to have digital evidence strategies to uh effectively identify, collect, examine and evaluate digital devices and data.
00:33:52.688 --> 00:33:58.747
It lays out nine fundamental components of the game plan.
00:33:58.747 --> 00:34:05.241
So let me share that screenshot with everybody so you can see the Nine components.
00:34:09.476 --> 00:34:12.594
One day I'm going to be able to do this quickly, sharing the screenshots.
00:34:12.594 --> 00:34:16.326
I swear I'm going to come up with some kind of quicker way.
00:34:16.326 --> 00:34:18.260
There we go.
00:34:18.260 --> 00:34:32.400
So for game plans, it's grounds for investigation, authorization, method of investigation, evaluation of the meaning of any findings, proportionality, logic agreement, logic agreement, necessity and scrutiny.
00:34:32.400 --> 00:34:36.369
So that lays out the steps of the game plan.
00:34:36.369 --> 00:34:44.096
Having a game plan in place will support investigators and their teams and ensure that important elements are not overlooked or missed.
00:34:44.096 --> 00:34:56.217
It may take time to implement and plan out, but it's necessary to make sure that tasks are carried out properly in not only digital forensics, but I think this kind of applies everywhere.
00:34:56.217 --> 00:35:00.248
I can think of ways it could apply in your own personal life to have a game plan.
00:35:00.248 --> 00:35:02.719
So what do you?
00:35:03.721 --> 00:35:07.449
think I like the format Again, each letter of the word game plans.
00:35:07.449 --> 00:35:09.954
I like the format Again, each letter of the word game plans.
00:35:09.954 --> 00:35:12.998
It speaks to an aspect of what we need to do.
00:35:13.038 --> 00:35:24.431
When I read it, as I was reading it, I'm like this is good stuff, but it's a lot right, it's a little bit a lot of work to do to develop them, and at the end of the article the author also says, yes, it's a little bit burdensome.
00:35:24.431 --> 00:35:33.909
So the author also agrees with me on that, but there's value in trying to detail the investigative work based on this pattern or these steps.
00:35:33.909 --> 00:35:37.503
Will folks sit down and do this at that detail?
00:35:37.503 --> 00:35:56.547
Maybe not, but I do believe that discussing each of these we're not going to do it here today, we'll discuss a few but discussing these and then have them as part of your process, it's essential, right, even if you don't use this methodology to the T right At that level, right, can I highlight a few?
00:35:56.547 --> 00:35:56.987
Heather?
00:35:57.208 --> 00:35:57.969
Yeah, absolutely.
00:35:59.739 --> 00:36:02.512
So one that I found interesting is by proportionality.
00:36:02.512 --> 00:36:04.197
I'm like, what does even proportionality mean?
00:36:04.197 --> 00:36:09.938
And the article speaks about how the technique that you're using is proportional to the need, right?
00:36:09.938 --> 00:36:19.956
For example and this is an example that I came up with I thought about if some of the evidence involves victims, right, we need to be proportional to that.
00:36:19.956 --> 00:36:25.474
Is it necessary to disclose the victims or move this data related to victims around?
00:36:25.474 --> 00:36:26.498
Is that necessary?
00:36:26.498 --> 00:36:28.605
Is it what we need?
00:36:28.605 --> 00:36:30.101
Is it proportional to the need of the case?
00:36:30.101 --> 00:36:34.001
Well, it might not, so we don't need to do that.
00:36:34.001 --> 00:36:42.094
We have to make sure that the evidence that we're acquiring is proportional to the need of the case and not go beyond that.
00:36:42.094 --> 00:36:44.443
Right, it's logical to do that, right?
00:36:44.443 --> 00:36:46.981
I like also the one about logic.
00:36:46.981 --> 00:36:55.083
You have one for logic, right, and to me, this is something that I've seen in many places Is it logical to look for X or Y?
00:36:56.034 --> 00:37:01.184
Sometimes we want to look for X or Y because we have a hunch, because we think, and it becomes a fishing expedition.
00:37:01.184 --> 00:37:08.822
And no, there's a constraint of why we do things and why we do it, and I don't care if it's on consent.
00:37:08.822 --> 00:37:13.123
This is my perspective, again, like always, and we're going to say this, we say it every show.
00:37:13.123 --> 00:37:21.467
We speak as our own personal opinions and our opinions do not reflect all employers or their policies in any kind.
00:37:21.467 --> 00:37:23.101
We speak for ourselves and only for ourselves.
00:37:23.101 --> 00:37:25.903
So I don't care if you have a device on consent.
00:37:25.903 --> 00:37:27.480
Well, I have consent to look at everything.
00:37:27.480 --> 00:37:28.563
Well, should you?
00:37:32.043 --> 00:37:33.449
Is it logical to do these things right?
00:37:33.449 --> 00:37:36.869
Is it logical, let's say, to look at something that's going to take six months to be able to analyze?
00:37:36.869 --> 00:37:39.380
Maybe not.
00:37:39.380 --> 00:37:42.224
Maybe the case has to be done in three months, in two months.
00:37:42.224 --> 00:37:49.744
So wasting resources on something that's going to take six months or more might not be logical, right?
00:37:50.936 --> 00:37:54.467
Maybe you're looking for a crime and you found evidence of a different crime.
00:37:54.467 --> 00:37:57.063
Is it logical to go down that path?
00:37:57.063 --> 00:38:01.094
Maybe, maybe not, because maybe the crime, the sentencing, might be concurrent.
00:38:01.094 --> 00:38:05.521
So do we really need to spend time delving into this different crime?
00:38:05.521 --> 00:38:10.269
That's not going to add to the possible sentencing or rehabilitation of the suspect.
00:38:10.269 --> 00:38:12.262
That doesn't mean we're not going to use it.
00:38:12.262 --> 00:38:28.255
Maybe the plan is, the logical thing is to take that conduct, not charge it, but use it later as sentencing, as conduct, as a pattern of conduct, which also the law provides, at least in the United States, for some enhancement of penalty based on pattern of conduct, right?
00:38:28.275 --> 00:38:45.864
So again this, this article, made me think of all the different aspects of our work and how can we constrain it or expand it in a way that and that's really important on the scrutiny part at the end, in a way that's justifiable and that S at the end, the scrutiny is so important.
00:38:45.864 --> 00:38:50.626
We need to consider scrutiny, not because the defense is going to come after us and then we get mad at them.
00:38:50.626 --> 00:38:51.387
No, no, no.
00:38:51.387 --> 00:38:53.501
The first level of scrutiny is yourself.
00:38:53.501 --> 00:38:55.106
Is your property as an examiner right?
00:38:55.106 --> 00:38:59.766
Am I expanding or limiting my search in a way that's justifiable?
00:38:59.766 --> 00:39:03.364
When I look at that phone live, do I really need to do that?
00:39:03.364 --> 00:39:05.775
Do I really need to go around the screen and click it around?
00:39:05.775 --> 00:39:07.657
Can I justify that or can I not?
00:39:07.657 --> 00:39:13.922
So those for me, is it necessary and the scrutiny really, really important within this aspect?
00:39:13.922 --> 00:39:17.925
So please go to the link we're going to be in the show notes and check the article out.
00:39:17.925 --> 00:39:21.246
I think it's a great read and really gave me a lot to think about.
00:39:22.106 --> 00:39:22.708
Yeah, definitely.
00:39:22.708 --> 00:39:43.617
I was applying it more to like the lab setting because I work in a lab and I think it definitely overall, if you have a structured approach and you have a game plan, it can improve your investigative process, ensure that you have a thorough analysis and then help to maintain the highest standards in the lab.
00:39:43.617 --> 00:39:50.268
I also think the game plan could kind of like just follow along the same lines as your SOPs.
00:39:50.268 --> 00:39:52.860
If you have good SOPs, you have a good game plan.
00:39:52.860 --> 00:40:01.072
If you have no SOPs or no guidelines in your office at all, there is no game plan and I just can see how that could lead to chaos.
00:40:01.072 --> 00:40:08.489
So I really liked this read on the game plans and it made me think of the lab setting mostly and having a good set of SOPs.
00:40:09.317 --> 00:40:10.442
And I want to say something real quick.
00:40:10.442 --> 00:40:14.704
Will SOPs or game plans cover every single circumstance you're going to find in your career?
00:40:14.704 --> 00:40:15.567
The answer is no.
00:40:15.567 --> 00:40:19.923
There will come some time when they might not apply exactly.
00:40:19.923 --> 00:40:21.126
But guess what?
00:40:21.255 --> 00:40:29.188
You need to know your SOPs, you need to have your game plans, because the only way you can go, move beyond them when needed, is by having a thorough understanding of them.
00:40:29.188 --> 00:40:30.338
Right, it's like in martial arts.
00:40:30.338 --> 00:40:41.860
Right, when you get your black belt and you're a high level practitioner, that's when you start you can actually go out of that system and apply it in ways that you wouldn't do before because you didn't have that knowledge.
00:40:41.860 --> 00:40:54.188
I guess that's a lot of words to say that you need to know your SOPs, you need to have your game plans, you need to know your sops, you need to have your game plans, you need to know your procedures and then, if something changes, based on those, you'll be able to justify whatever changes are needed.
00:40:54.188 --> 00:41:04.204
And and evolution moving forward, because technology evolves, right, and then you can take that sop, take that knowledge and then evolve that sop, that game plan, uh, with it, you, you know, yeah.
00:41:05.706 --> 00:41:06.708
Definitely worth the read.
00:41:09.574 --> 00:41:10.936
Absolutely.
00:41:10.956 --> 00:41:11.297
Absolutely so.
00:41:11.297 --> 00:41:21.231
Another article this is actually a paper, a paper put out by Major Cities Chief Association Digital Evidence Working Group.
00:41:21.231 --> 00:41:30.014
So this paper explores the increasing importance and challenges of managing digital evidence in modern law enforcement.
00:41:30.014 --> 00:41:45.532
It highlights how digital evidence plays a role in solving cases, often surpassing traditional forms like DNA evidence, they say, with six out of 10 professionals identifying it as their most critical investigative tool.
00:41:45.532 --> 00:41:53.043
So digital forensics I mean digital devices are in every type of case and this report talks about that.
00:41:53.043 --> 00:41:58.867
It talks about the role that digital devices have in modern day law enforcement.
00:41:58.867 --> 00:42:03.206
It was put up on LinkedIn by Robert Pike.
00:42:03.206 --> 00:42:09.445
If you don't know Robert Pike, he works in North Carolina Great guy, and I think he contributed to this paper.
00:42:09.445 --> 00:42:15.788
But it's a whole bunch of examiners that contributed to this paper and another great read.
00:42:17.996 --> 00:42:23.498
It has a lot of reference materials because it's more high level, so they don't go into.
00:42:23.498 --> 00:42:24.903
This is how you extract a phone.
00:42:24.903 --> 00:42:27.023
These are the things you're going to find on a computer.
00:42:27.023 --> 00:42:27.710
It's more about.
00:42:27.710 --> 00:42:28.309
These are the things you need to consider.
00:42:28.309 --> 00:42:28.869
These are the things you're going to find on a computer.
00:42:28.869 --> 00:42:28.969
It's more about.
00:42:28.969 --> 00:42:29.389
This is the things you need to consider.
00:42:29.389 --> 00:42:46.507
These are the standards, and then links to those and a lot of high level policy guides, which I think is going to be extremely useful for managers and you know kind of folks that might be a couple levels removed from the actual evidence, at least to start educating them on some of those aspects.
00:42:46.507 --> 00:42:47.840
So we also really could read.
00:42:48.635 --> 00:42:52.106
Yeah, it touches on AI in digital forensics too.
00:42:52.106 --> 00:42:53.782
I know that's a hot topic with everybody.
00:42:53.782 --> 00:42:58.074
We have talked about it numerous times and I see articles for it everywhere.
00:42:58.074 --> 00:43:07.773
But they talk about the potential for enhancing digital investigations, but they also address the ethical considerations and potential biases in AI.
00:43:08.115 --> 00:43:30.266
So another resource to um learn about about ai and digital forensics yeah, let's not, let's not, let's not get into ai right now no, I don't want to talk about that tonight I'm gonna lose it again, which which, by the way, I'm gonna be talking at a small interview for the deferred days of christmas, or deferrmas.
00:43:30.266 --> 00:43:37.628
Okay, uh, yeah, for uh, um, for the uh, the company that makes atrio atrio, I forgot his name right now.
00:43:37.628 --> 00:43:44.173
Um, arcpoint, arcpoint for asics, yeah, and there'll be a lot of talk about validation and ai.
00:43:44.173 --> 00:43:45.195
So you want to hear me run.
00:43:45.215 --> 00:43:54.038
Be be aware, be ready for that'm going to have to tune in for that one, definitely All right.
00:43:54.038 --> 00:43:55.902
So this one got me going.
00:43:55.902 --> 00:44:05.923
This week I saw a post by Carl Lawrence of MSAB about the importance of BFU partial file system extractions.
00:44:05.923 --> 00:44:11.481
His post I'm just going to read his post to you, so he wrote this really shocked me.
00:44:11.481 --> 00:44:12.824
But should it have?
00:44:12.824 --> 00:44:24.186
I recently heard that some organizations are shelving BFU devices so before first unlock devices, they're labeling them as too difficult or not worth it.
00:44:24.186 --> 00:44:26.974
He says this blew my mind.
00:44:26.974 --> 00:44:34.505
He wanted to hear from the deeper community about what they think on bfu extractions and should they be attempted.
00:44:34.505 --> 00:44:35.867
Why wouldn't you attempt them?
00:44:35.867 --> 00:44:39.139
Um, why wouldn't you attempt them?
00:44:39.139 --> 00:44:43.807
So yeah, go ahead yeah, I was gonna.
00:44:43.989 --> 00:44:45.436
It's for folks that are not familiar with that.
00:44:45.436 --> 00:44:52.068
Uh, bfu is a phone that is turned on and nobody has put the code in yet, right?
00:44:52.068 --> 00:44:57.708
No, pin code has not been accessed, which means the amount of data that's accessible to you is pretty limited.
00:44:57.708 --> 00:45:01.760
If somebody calls you, for example, you might get the phone call, but the screen's not going to tell you who.
00:45:01.760 --> 00:45:06.262
It is right, because that information is still safeguarded within the phone.
00:45:06.262 --> 00:45:22.844
Now, if you put your PIN code in once and then the phone locks again either because you locked it or a timer when you get that phone call again it will show you on the screen hey, so-and-so is calling you right, because now that data is accessible because the phone was unlocked at least once.
00:45:22.844 --> 00:45:24.862
So that's called AFU.
00:45:24.862 --> 00:45:30.025
So being able to get an extraction in AFU state is better.
00:45:30.025 --> 00:45:33.041
You get more BFU, you get less.
00:45:33.041 --> 00:45:38.925
And then I guess the article speaks of people assuming that since it's less than AFU, therefore it's useless.
00:45:38.925 --> 00:45:40.329
That's the question, right?
00:45:40.329 --> 00:45:42.222
Is it useless or not?
00:45:43.235 --> 00:45:44.961
So I hear that from people all the time.
00:45:44.961 --> 00:45:47.260
It's just a BFU, it's just system information.
00:45:47.260 --> 00:45:48.242
I'm not going to look at it.
00:45:48.242 --> 00:45:50.161
Why would you not look at it?
00:45:50.161 --> 00:45:52.432
Or why would you skip the extraction?
00:45:52.432 --> 00:46:08.784
Even so, for mobile devices that come in and there's no support for brute force, no support for a full file system and they're in that BFU state, you can get the BFU extraction, which is limited data and mostly system artifacts.
00:46:08.784 --> 00:46:10.980
When I say mostly, it's definitely just mostly.
00:46:10.980 --> 00:46:13.545
There are user artifacts in there.
00:46:13.545 --> 00:46:22.596
So some of the user artifacts that I've seen in a BFU, I've seen KTX files in the form of system generated snapshots.
00:46:22.596 --> 00:46:30.949
So what the snapshot is is the user has an application up on their screen and it was sent to the background for some reason.
00:46:30.949 --> 00:46:39.150
The user maybe just closed the window and the system takes a snapshot of what that app looked like at that time that it was sent to the background.
00:46:39.150 --> 00:46:47.771
If your device user has text messages up there, you potentially have a snapshot of the text messages.
00:46:47.771 --> 00:46:51.481
Is that going to be available in every extraction, every BFU extraction?
00:46:51.481 --> 00:46:54.027
I don't know, but I've seen it in them before.
00:46:54.027 --> 00:46:58.061
You have access to the Apple ID.
00:46:58.061 --> 00:47:00.987
You have access to the cloud information.
00:47:00.987 --> 00:47:03.800
When was the last time the device was synced to the cloud?
00:47:03.800 --> 00:47:05.264
So potentially you have the date that it was synced to the cloud.
00:47:05.264 --> 00:47:17.195
So potentially you have the date that it was synced to the cloud yesterday and then you have the Apple ID that you can send off to Apple with legal process to gather the data that's stored in the cloud.
00:47:19.378 --> 00:47:22.443
I've seen some location artifacts in the BFUs.
00:47:22.443 --> 00:47:28.471
They were specifically on images that had EXIF data.
00:47:28.471 --> 00:47:34.447
So there's an area of the phone called file provider storage artifacts.
00:47:34.447 --> 00:47:40.014
They can include user images that have the EXIF data, including the location.
00:47:40.014 --> 00:47:48.614
One of my test data BFU extractions Kevin that I work with and I were down in New York City creating all this test data.
00:47:48.614 --> 00:48:02.179
We were taking pictures all over New York City, came back, extracted the device, the BFU, and there were the pictures we were taking in the city in that file provider storage, which relates to synchronization across devices.
00:48:02.179 --> 00:48:12.219
But I had the locations and it was right where we were when we took the pictures the locations and it was right where we were when we took the pictures.
00:48:12.280 --> 00:48:14.623
Other things you can find in a BFU log entries, wi-fi connections and Snapchat.
00:48:14.623 --> 00:48:16.807
There is a ton of Snapchat.
00:48:16.807 --> 00:48:18.597
If your device user is using Snapchat.
00:48:18.597 --> 00:48:23.648
You're potentially going to have their messages in the Snapchat Arroyo database.
00:48:23.648 --> 00:48:28.556
All of their messages come out in a BFU partial file system extraction.
00:48:28.556 --> 00:48:30.777
I don't want to miss that.
00:48:30.777 --> 00:48:37.619
What if Snapchat is the platform that they were using to plan the crime or commit the crime?
00:48:37.619 --> 00:48:40.059
We have all of that.
00:48:40.059 --> 00:48:42.007
I'm going to.
00:48:42.007 --> 00:48:43.155
You're going to read.
00:48:43.639 --> 00:48:43.760
Yeah.
00:48:43.760 --> 00:48:59.989
So to add to that, so different than folks in the chat telling us that testifying the case and the BFU helped convict the suspect of 10 counts, because later it says five years but later he corrects oh sorry, it's 10 counts because there was a ton of data in that BFU.
00:48:59.989 --> 00:49:10.014
So not only the stuff that Heather is telling you, the BFU has been used successfully, you know, to prosecute and complete investigations.
00:49:10.014 --> 00:49:19.947
Jeremy is telling us that he has gotten, like confirming what you're saying, heather, that there are Snapchat conversations on the BFU and people should not sleep on those.
00:49:19.947 --> 00:49:22.161
Look and let me mini rant right, go ahead.
00:49:22.161 --> 00:49:24.403
Let me mini rant right, go ahead.
00:49:24.463 --> 00:49:36.757
Even if you think that that phone has nothing on it, on that BFU, and you have the authority and you have a crime to solve, you still need to do it, even if, just because you have a thing called what Due diligence?
00:49:36.757 --> 00:49:46.862
You need to do your due diligence and that's a word that I believe we're not using enough, a concept we're not stressing to folks coming to the field enough Due diligence.
00:49:46.862 --> 00:49:59.364
It means that you do the work the best you can, how you can have your game plan, do all of that, but because it's expected of you to do a complete investigation, right, you cannot dismiss.
00:49:59.364 --> 00:50:01.471
It's like an example that's not forensics, right?
00:50:01.471 --> 00:50:11.960
You got a suspect and you got to interview the suspect and you're like, well, they know I'm coming, I'm not going to ask for their phone or they will never talk to me, because they know I'm coming.
00:50:11.960 --> 00:50:13.483
What?
00:50:13.483 --> 00:50:14.065
You're not going to go.
00:50:14.065 --> 00:50:17.992
You still have to go and you ask, hey, can we do this?
00:50:17.992 --> 00:50:19.961
And they might say yes, and a lot of times they do.
00:50:20.041 --> 00:50:42.275
Right, you have to do your due diligence and it really irks me that folks are looking for all sorts of excuses to not do their due diligence, and managers need to make sure, from my perspective, that themselves and their reports are exercising due diligence in their investigations and their casework.
00:50:42.275 --> 00:50:45.510
If you're not doing that, then what are you there for, mr Manager?
00:50:45.510 --> 00:50:50.923
Just to keep a spreadsheet of how much the tools cost and which ones are we going to cut because we don't have funding?
00:50:50.923 --> 00:50:53.148
That's, I mean, anybody can do that.
00:50:53.148 --> 00:50:58.431
But exercising due diligence Are we doing the cases and following up as we should?
00:50:58.431 --> 00:51:03.367
And that means sometimes doing a BFU and guess what you might get good stuff out of it.
00:51:05.173 --> 00:51:05.956
Definitely.
00:51:05.956 --> 00:51:08.766
I'm going to share a couple pictures that Carl had up too.
00:51:08.766 --> 00:51:18.264
There's all your BFU devices on shelves waiting for extraction, waiting for support right, because we're waiting for support to brute force the device and get a full file system.
00:51:18.264 --> 00:51:32.849
But these shelves and shelves and shelves of devices that are here in this screenshot all have the capability of performing a BFU partial file system extraction and potentially gathering that data that we're talking about.
00:51:33.583 --> 00:51:45.507
I want to believe that picture is AI because, if folks are listening, it's like shelves and shelves full to the brim of phones and I'm like I hope this is not real, because if these phones are for real and nobody has looked at them, I'll lose my mind.
00:51:45.507 --> 00:51:49.617
It's like an insane amount of, and I'm like I hope this is not real, because these phones are for real.
00:51:49.617 --> 00:51:50.219
Nobody has looked at them.
00:51:50.219 --> 00:51:50.579
I'll lose my mind.
00:51:50.579 --> 00:51:54.489
It's like an insane amount of phones like all on top of each other, which I would say it's not properly categorized.
00:51:54.489 --> 00:51:55.351
But let's be real here.
00:51:55.351 --> 00:51:59.666
A lot of our labs kind of look like this Put a sticker on it and just put it there.
00:51:59.666 --> 00:52:00.568
You know yeah.
00:52:00.588 --> 00:52:01.831
Oh geez Due diligence.
00:52:06.960 --> 00:52:07.722
Also how you handle your evidence.
00:52:07.722 --> 00:52:08.163
Please, due diligence.
00:52:08.163 --> 00:52:11.028
Yeah, so I I want to actually talk about a couple more artifacts that I found.
00:52:11.028 --> 00:52:16.867
Um, so there was an iphone 14 that I had looked at in the past I was running like ios 16, so we're a little past that.
00:52:16.867 --> 00:52:18.231
Is this artifact still there?
00:52:18.231 --> 00:52:25.371
I don't know, it might not be anymore, but uh, there were calls and chats, regular phone calls and chats, regular phone calls and native text messages.
00:52:25.371 --> 00:52:35.349
In the BFU, the call database is call history dot store store data and the SMS database is the SMS dot DB.
00:52:35.349 --> 00:52:50.067
Well, there was a copy of the call history dot store data with an underscore temp and same with the SMS, an underscore temp, and inside of those temp files were two phone calls and three text messages.
00:52:50.067 --> 00:52:55.045
My guess is they were probably the last three messages or the last two phone calls on the device.
00:52:55.045 --> 00:52:59.605
I didn't have anything to compare to that, but there's potential to get that data.
00:52:59.605 --> 00:53:02.639
But you're never going to know unless you open it up and take a look.
00:53:03.621 --> 00:53:09.487
Exactly, exactly and, as a quick note, it's been confirmed that that picture was actually AI Oof.
00:53:09.487 --> 00:53:11.387
What a relief.
00:53:11.387 --> 00:53:12.668
I was going to lose it.
00:53:13.210 --> 00:53:14.931
You feel better, huh yeah.
00:53:14.951 --> 00:53:17.733
Kevin's saying that there's no way that's been properly inventoried.
00:53:18.614 --> 00:53:18.914
No.
00:53:19.516 --> 00:53:20.856
Yeah, so okay, it's AI Oof.
00:53:20.856 --> 00:53:27.023
Okay, there was no game plan for those phones.
00:53:27.023 --> 00:53:28.184
None at all, absolutely no.
00:53:28.184 --> 00:53:29.226
No SOPs there.
00:53:29.226 --> 00:53:30.429
So which?
00:53:30.429 --> 00:53:33.152
Again, let's not get into AI, it's just a scary definition.
00:53:33.152 --> 00:53:34.034
Yeah, let's skip that.
00:53:34.134 --> 00:53:34.675
Let's skip that.
00:53:34.675 --> 00:53:36.146
I have one more meme to show.
00:53:36.146 --> 00:53:45.322
So this was the meme that was up with Carl's post and I have no idea, so I had to be schooled today, before the show, on who this is in the screenshot.
00:53:45.322 --> 00:53:46.925
It's Terry Tibbs.
00:53:46.925 --> 00:53:52.353
So if anybody is in the chat right now on YouTube you might see Mr Terry Tibbs as a user.
00:53:52.353 --> 00:54:05.728
I'm going to guess that's Carl in there, but it's Terry Tibbs from a UK TV show called Phone Jacker, so I'm hoping that anybody from the UK may recognize what I'm talking about.
00:54:05.728 --> 00:54:11.614
But I had no idea who it was until I said Carl, help me, what's a phone jacker?
00:54:11.634 --> 00:54:13.376
They just run and take the phone from you.
00:54:13.376 --> 00:54:14.556
They jack it away yeah.
00:54:18.099 --> 00:54:19.643
So he explained it as I'm going to butcher this.
00:54:19.643 --> 00:54:23.409
By the way, he explained it as Terry Tibbs would make it would be a personality on prank phone calls.
00:54:23.409 --> 00:54:29.304
Oh, okay, so they call you to prank you on the phone, I guess, so I've never seen it.
00:54:29.304 --> 00:54:44.427
I may have to see if I can find a version online and check this out but one of the what's up one of the catchphrases of terry tibbs is talk to me oh, there you go yeah that's me, with every agent that walks through the door.
00:54:44.809 --> 00:54:47.041
Can you please tell me what this case is about?
00:54:47.041 --> 00:54:48.365
Let's just don't drop the stuff here.
00:54:48.365 --> 00:54:49.248
Please talk to me.
00:54:49.248 --> 00:54:55.592
Yeah, my uk uk cultural references are lacking, sadly, but I will look into it mine were too.
00:54:55.612 --> 00:55:01.891
So I I cheated and I I phoned a friend, uh, before the show, yeah, and I probably just butchered half of what I was saying.
00:55:01.891 --> 00:55:13.302
But uh, carl was telling me that he and he and adam firman, who we love from MSAB2, were joking about this show recently and that's how the meme made it to his post about BFU's.
00:55:14.045 --> 00:55:14.427
Talk to me.
00:55:14.427 --> 00:55:16.784
Talk to me that's the new catchphrase for the month.
00:55:16.784 --> 00:55:17.226
Talk to me.
00:55:17.786 --> 00:55:19.572
I'm adding it back up, trying to take it down.
00:55:19.572 --> 00:55:22.663
Okay, last thing on the BFU's.
00:55:22.663 --> 00:55:24.766
So I do have one case example.
00:55:24.766 --> 00:55:27.090
Oh, he says I got it spot on with the Terry Tibbs.
00:55:27.090 --> 00:55:28.594
Good, I didn't screw it up too much.
00:55:30.440 --> 00:55:31.204
Well, there was a wink there.
00:55:31.324 --> 00:55:32.371
So I don't know.
00:55:32.371 --> 00:55:41.168
I'll get rid of the wink side.
00:55:41.168 --> 00:55:41.610
I'm sorry.
00:55:41.610 --> 00:55:46.416
A home invasion case, uh, that involved a BFU extraction.
00:55:46.416 --> 00:55:54.701
Um, the guy dropped his phone, uh, the person who was at the house didn't, didn't know who it was that invaded the home.
00:55:54.701 --> 00:56:06.012
And the guy dropped his phone, uh got the partial file system, the BFU, and in it were enough details to just prove whose phone it was and who broke into the home and assaulted a woman.
00:56:06.012 --> 00:56:09.106
He got like 25 years in prison.
00:56:09.106 --> 00:56:09.487
I think.
00:56:09.487 --> 00:56:14.742
Um, if I had just said let's not do the BFU, there's nothing in it anyway, it's not worth it.
00:56:14.742 --> 00:56:17.911
You may not have ever even identified who the suspect was.
00:56:17.911 --> 00:56:20.121
So do not skip your BFU.
00:56:21.061 --> 00:56:23.324
Oh I mean wow, I got that.
00:56:23.324 --> 00:56:24.065
That's so amazing.
00:56:24.065 --> 00:56:25.806
I got nothing to add, it's just amazing.
00:56:26.367 --> 00:56:34.114
It was the Snapchat data right, because I mean I had the username and the Snapchat data and the iCloud, the Apple account Saved the day.
00:56:34.876 --> 00:56:35.556
Oh, that's good stuff.
00:56:38.132 --> 00:56:38.273
Love.
00:56:38.273 --> 00:56:40.844
It All right, we can move on from that, I swear.
00:56:41.648 --> 00:56:50.949
No, I mean no, it was an important discussion yeah, that one, I truly believe that one drives me nuts, so let's move on to a happier note here.
00:56:50.949 --> 00:56:52.291
So samari gives back.
00:56:52.291 --> 00:56:58.809
Um, I don't know if anybody saw this on linkedin but or any other social media, but samari has.
00:56:58.809 --> 00:57:14.202
Samari gives back 2024, where you can submit a nomination for a law enforcement agency with limited resources, a high caseload and a focus on serious crimes.
00:57:14.202 --> 00:57:16.007
The nominations need to be submitted by November 29th.
00:57:16.007 --> 00:57:17.172
The submissions are limited to 500 words.
00:57:17.172 --> 00:57:27.302
A community of law enforcement examiners will review all nominations and select the top five agencies, and then the top five agencies will be notified, asked for permission to participate.
00:57:27.302 --> 00:57:33.563
Once they're approved, they'll be featured online for public voting from december 12th to december 18th.
00:57:33.563 --> 00:57:46.132
Um, and let me show you what they have the potential of winning if it's, if it's summary, I'm expecting a legit box.
00:57:46.532 --> 00:57:47.054
There it is.
00:57:47.295 --> 00:57:47.514
Boom.
00:57:47.514 --> 00:57:51.168
So they will be giving.
00:57:51.168 --> 00:57:55.824
The title of the picture is the green Tolino, green Beast.
00:57:55.824 --> 00:58:05.307
So it is a Tolino and all of the specs can be found on their website at the Sumori Gives Back 2024 link that I have up on the screen.
00:58:06.121 --> 00:58:12.170
I will call it the green mean mystery machine, that's how I would name it, you know like green mean mystery machine, love it.
00:58:12.981 --> 00:58:14.365
Yeah, it's a pretty nice looking machine.
00:58:14.365 --> 00:58:15.208
I have a Tolino.
00:58:15.208 --> 00:58:16.563
I loved my Tolino.
00:58:16.563 --> 00:58:17.746
I need another Tolino.
00:58:17.746 --> 00:58:21.489
I'm not going to win it, but maybe I can talk the boss into buying me another Tolino.
00:58:21.489 --> 00:58:31.923
Yeah, how about you talk to boss also send me one.
00:58:31.923 --> 00:58:32.746
Yeah, maybe you know we'll share the love.
00:58:32.766 --> 00:58:33.449
We can give them out for christmas.
00:58:33.449 --> 00:58:33.952
Holidays are coming soon.
00:58:33.952 --> 00:58:34.635
Anybody else in the chat want one?
00:58:34.655 --> 00:58:35.559
I'll work on it yeah, you're not gonna get it.
00:58:35.559 --> 00:58:35.920
But no, you're not.
00:58:35.920 --> 00:58:42.039
But uh, if you know an agency that's deserving of that, so murray gives back nomination.
00:58:42.039 --> 00:58:45.990
Uh, write up the essay and definitely nominate them.
00:58:47.541 --> 00:58:50.186
Yeah, those are pretty powerful boxes and folks that are not familiar.
00:58:50.186 --> 00:58:57.288
Mori is a company that provides computing resources computers, laptops For due time, forensic purposes.
00:58:57.288 --> 00:59:05.039
They have write blockers built in, proper video cards for cracking passwords and encryption.
00:59:05.039 --> 00:59:08.206
So pretty good equipment and good on them.
00:59:08.206 --> 00:59:18.612
For you know it's advertisement and that's fine, but this is the type of advertisement that I like, because it recognizes the good work people do and then enables them to do even more good work, right.
00:59:20.121 --> 00:59:21.706
So what's new with the leaps?
00:59:24.742 --> 00:59:25.864
So we got a lot of stuff going on.
00:59:25.864 --> 00:59:27.730
So the first thing, actually, I'm going to go first and I'll let you go after me.
00:59:27.730 --> 00:59:28.351
Sure, what's new with the leaps?
00:59:28.351 --> 00:59:29.034
So we got a lot of stuff going on.
00:59:29.034 --> 00:59:31.539
So the first thing, actually, I'm going to go first and I'll let you go after me, sure.
00:59:31.539 --> 00:59:43.831
So last episode I was trying to show the changes within the reporting structure that we're building and again, I always give a quick explanation what the leaps are.
00:59:44.360 --> 00:59:46.929
These are Lux events and properties or PList Parsers.
00:59:46.929 --> 00:59:52.260
It's a Python-based framework that I developed and then the community has embraced and developed further.
00:59:52.260 --> 01:00:12.670
That allows folks in an open source, totally free, python-based way to look at extraction from iOS, android's returns from providers, vehicle extractions, all sorts of data types, and it creates a nice HTML report and some other reporting features in KMLs or SQLite databases for your cases.
01:00:12.670 --> 01:00:22.592
And we try to specialize in the tool being quick Tools is more than one, obviously, being quick and we try to parse things that nobody else does as quickly as we can.
01:00:22.592 --> 01:00:29.065
For example, which is something that Heather is going to talk about, a lot of us have been opening accounts in Blue Sky.
01:00:29.065 --> 01:00:37.059
Blue Sky and that's like a Twitter-like application, like competition with Twitter and threads, and it's great stuff.
01:00:37.059 --> 01:00:45.054
So Heather made some test data for Android and I made a parser for it within the Leap.
01:00:45.054 --> 01:00:51.528
So if you have a case where they're chatting within Blue Sky, the only tool that will do it as of now is ALEAP.
01:00:51.730 --> 01:01:04.989
Right, good folks, I think Adam hopefully he can do that he's trying to get us some iOS test data to then build one, or at least get us the data, and then I'll use it to build something for iOS, for ILEAP.
01:01:04.989 --> 01:01:06.525
So we're working on that.
01:01:06.525 --> 01:01:07.824
So that's what the platform does.
01:01:07.824 --> 01:01:10.907
That's the purpose, and folks have embraced it, which I'm pretty grateful for.
01:01:10.907 --> 01:01:15.965
And I got a good group of developers Kevin is in the chat, one of them and I always mention their names.
01:01:15.965 --> 01:01:17.266
I'll mention them again in a second.
01:01:17.266 --> 01:01:19.867
Now that explanation.
01:01:19.867 --> 01:01:28.364
So what happened with the Leaps leaves recently?
01:01:28.364 --> 01:01:29.971
Well, we're moving to a new viewer called lava and somebody's saying blue ski.
01:01:29.971 --> 01:01:30.271
I hate you all.
01:01:30.271 --> 01:01:30.994
It's your, it's your, it's your fault.
01:01:30.994 --> 01:01:32.079
Heather first calling like blue ski, like a bruski.
01:01:32.079 --> 01:01:33.443
No, it's blue sky.
01:01:33.663 --> 01:01:41.768
Okay, I will always oppose it dfir, dan and I are gonna have bruskies while we chat with people on blue ski later oh my god, I'm cringing.
01:01:41.867 --> 01:01:45.706
I'm cringing for you so hard on the inside.
01:01:45.706 --> 01:01:47.610
I'm crying in my insides about it.
01:01:48.231 --> 01:01:48.413
I know.
01:01:48.413 --> 01:01:49.543
That's why I keep saying it.
01:01:50.586 --> 01:01:53.586
Yeah, I know, folks, she's not on the show.
01:01:53.586 --> 01:01:57.362
She texts me the blue ski when she texts with me just to annoy me.
01:01:57.362 --> 01:01:59.730
All right, when she's messaging me for stuff, anyways.
01:01:59.730 --> 01:02:13.688
So what we've done is we're trying to build a viewer, a newer viewer, so that it allows you to look at more data in a more efficient way and have more parsing not parsing, I'm sorry sorting capabilities and that good stuff.
01:02:13.688 --> 01:02:20.934
So I'm going to show you now how the directory has changed and it's actually way cleaner.
01:02:20.934 --> 01:02:55.735
Now I want to give a shout out to the team, like I said I would, as I'm representing the data James Haben, johan Policek, kevin Pagano the one that's right here next to me, heather although she's slacking a little bit, I am, I know you need to catch up on some things, as you know anyways, I digress and Bruno Constanzo, a great, great friend as well, that he does a lot of library parsing work.
01:02:57.641 --> 01:02:58.324
Oh and John.
01:02:58.344 --> 01:02:58.585
Hyla.
01:02:58.585 --> 01:02:59.945
I cannot forget about John.
01:02:59.945 --> 01:03:04.688
He's the king of the refactoring, so I love you all guys.
01:03:04.688 --> 01:03:08.585
So I'm actually going to have'm actually have some challenge going to be sending you shortly, all right.
01:03:08.585 --> 01:03:09.670
So what do we see here?
01:03:09.670 --> 01:03:12.820
So this is the folder structure is way better now.
01:03:12.820 --> 01:03:19.206
Before you would have all the reports were html and we're like kind of thrown in the in the root directory, which is kind of ugly.
01:03:19.206 --> 01:03:24.563
Now you hit index and it will open your report, html report, and then all the other little reports.
01:03:24.563 --> 01:03:30.389
I say say other little, but all the other reports about it are gonna be in the HTML directory.
01:03:30.389 --> 01:03:34.086
So it's way cleaner and the timeline is still there.
01:03:34.219 --> 01:03:40.889
It's a SQLite database of all things that have timestamps in your parsing and that's a underused capability.
01:03:40.889 --> 01:03:41.603
People don't know about it.
01:03:41.603 --> 01:03:50.621
Take dbBrowser for SQLite, open it up and then you can look at all the artifacts, kind of lined up by timestamp, and see the relationships between them, right, so it's really useful.
01:03:50.621 --> 01:03:54.873
There's the tsvs, so tab separated values.
01:03:54.873 --> 01:03:58.905
You can import it into your kind of spreadsheet program if you need to.
01:03:58.905 --> 01:04:02.637
Now the big thing I want to show is these two structures.
01:04:02.637 --> 01:04:25.583
One is a database, sqlite database, called lava artifacts, another one called lavadatajson the viewer that we're hoping to release soonish because it's still working on it will take that JSON and then be able to reference the database, and all the information that's in the HTMLs is now in this database, and this is really useful because now it allows us to use Lava as an electron application to look at the data and is now on this database.
01:04:25.583 --> 01:04:30.264
And this is really useful because now it allows us to use Lava as an electron application to look at the data and not choke on it.
01:04:30.264 --> 01:04:32.125
If it's too much data, htmls won't work.
01:04:32.125 --> 01:04:42.601
So I want to show folks let me take this off the screen I want to show folks how it looks and again, I'm really excited about it, so that's why I'm talking about it at length.
01:04:42.601 --> 01:04:48.407
So thank you for humoring me folks, the folks that are still here or are still here that were with us.
01:04:49.128 --> 01:04:54.351
So let me open my DB browser for SQLite and I want to show you folks how it looks.
01:04:54.351 --> 01:04:58.615
I'm opening it now, and now I'm going to share the actual program.
01:04:58.615 --> 01:04:59.436
It's a little bit too big.
01:04:59.436 --> 01:05:02.467
There we go, so let me share it.
01:05:02.467 --> 01:05:11.405
Share screen and, as you will see here, this is the right one.
01:05:11.425 --> 01:05:13.675
Yes, you'll see here of the artifacts that we have been able to refactor to make it compatible.
01:05:13.675 --> 01:05:16.463
We have a whole bunch here we got each artifact is a table.
01:05:16.463 --> 01:05:29.909
You got the biomes, we got burner artifacts, we got notification artifacts, telegram, website, website visits, all sorts of things and we're refactoring this code.
01:05:29.909 --> 01:05:52.748
That means that we're updating it to be compatible with this and you can see here all the data within the different databases, or I'd say, tables in the database, and this allows us also, with the viewer, to be able to sort not sort the time zone, change the time zone on the fly, so you can move it to any time zone that you need and it will deal with those.
01:05:54.780 --> 01:06:02.628
I'm showing this because in the future, if you have data, as long as it's in this type of format, you could use Lava to view other sorts of data.
01:06:02.628 --> 01:06:04.927
So it's designed for our stuff.
01:06:04.927 --> 01:06:11.242
But if you understand a little bit of sqlite, how this is ordered, you can create your own sqlite databases and use lava to view them.
01:06:11.242 --> 01:06:17.264
So it will be another way of looking at different sorts of data if there are sqlite databases in this type of structure.
01:06:17.264 --> 01:06:19.393
Um, but that's a discussion for another day.
01:06:19.393 --> 01:06:21.621
So I'm excited, uh, for it.
01:06:21.621 --> 01:06:23.445
Uh, the whole team is excited about it.
01:06:23.445 --> 01:06:34.983
It'll be like a monumental change in how we deal with the leaps and it will enable folks to be able to look at all sorts of data, independent of how much data there is.
01:06:34.983 --> 01:06:43.907
I guess we're going to be getting closer to more like a corporate type of solution, but still being open source and available to the community.
01:06:44.768 --> 01:06:46.670
So we're excited, very cool, very cool.
01:06:46.670 --> 01:06:48.755
It's going to be awesome, definitely.
01:06:48.755 --> 01:06:57.179
I know I've had iOS cases where I just have so many artifacts and if you load them all onto the page, the page just crashes.
01:06:57.179 --> 01:06:59.748
So the fact that this is going to fix that is awesome.
01:06:59.748 --> 01:07:01.867
I think a lot of people will agree that use the leaps, oh yeah, and it's way faster.
01:07:01.867 --> 01:07:03.201
Look at this stuff that.
01:07:03.221 --> 01:07:05.168
Use the leaps, oh yeah, and it's way faster to look at the stuff.
01:07:05.168 --> 01:07:05.829
Oh, quick, quick thing.
01:07:06.480 --> 01:07:07.846
I was just going to put that up, yeah.
01:07:07.980 --> 01:07:09.565
Holly's saying that it's blue sky.
01:07:09.565 --> 01:07:11.121
Okay, Sorry, rather so.
01:07:11.121 --> 01:07:13.889
Your sister is the obviously the better one of the sisters.
01:07:14.681 --> 01:07:20.005
So I'm just going to say that she's just not joining Dan and I for brewskis anymore.
01:07:26.519 --> 01:07:28.204
So no, she Us too.
01:07:28.204 --> 01:07:32.413
We're going to go and actually look at the blue sky, you know, Okay, you guys have fun.
01:07:32.413 --> 01:07:38.447
Oh, and Rebecca showed up, so hey, don't worry, Rebecca, if you're late, you can watch the first half later in the recording.
01:07:38.467 --> 01:07:53.235
So with the Leaps since we're talking about blue sky, blue ski we did some test data and Alex wrote some parsers for the blue sky data, so let me share my screen here oh, and you're sharing the screen, johannes, in the chat again.
01:07:53.255 --> 01:07:54.661
You always stay late for the show.
01:07:54.661 --> 01:07:55.485
We love you, man.
01:07:55.485 --> 01:08:02.067
He's saying that it's more, it's able to manage more than 1 million records and that's all that's a lot right.
01:08:02.067 --> 01:08:10.103
There's no html reporting that will allow you to do that so he's doing some of that testing and some of that implementation and it's pretty awesome, so we're super excited about it.
01:08:10.103 --> 01:08:11.889
Sorry, go ahead.
01:08:12.110 --> 01:08:12.690
No, you're fine.
01:08:12.690 --> 01:08:28.398
So we now have let me click over here and zoom in we have parsers for Blue Sky Actors, blue Sky Feedpost, blue Sky Messages, blue Sky Posts and Blue Sky Searches for blue sky actors, blue sky feed post, blue sky messages, blue sky posts and blue sky searches.
01:08:28.398 --> 01:08:42.054
So just to take a look at that, the actors are your contacts, um, or people that were messaged with correct not are not necessarily contacts so it's.
01:08:42.073 --> 01:08:42.194
So.
01:08:42.194 --> 01:08:44.100
People ask me why actors, not users?
01:08:44.100 --> 01:08:49.140
Well, the word that blue skies uses within the data structure is literally the word actors.
01:08:49.140 --> 01:08:53.431
So I try when I do artifacts to keep it as close to what the verbiage they use.
01:08:53.431 --> 01:08:57.210
So actors is anybody and everybody is an actor.
01:08:57.210 --> 01:08:58.905
Somebody put a post as an actor.
01:08:58.905 --> 01:09:03.506
You put a post or responded you're an actor, everybody is an actor.
01:09:03.506 --> 01:09:09.645
And it's not necessarily your contacts, because I can have actors there that are not my friends.
01:09:09.645 --> 01:09:15.506
They're just a post that came by and that post have that actor quote, unquote actor information.
01:09:15.565 --> 01:09:19.092
So, since the data and I oh how much time we have.
01:09:19.092 --> 01:09:29.363
Oh, we've been running short on time, so I'm not going to the details, you're sure.
01:09:29.363 --> 01:09:33.199
Yeah, it's from an http cache type of structure, which makes me think I have I need to test more this more, but it makes me think that the app mostly works as a browser.
01:09:33.199 --> 01:09:44.320
It's an app, it's really a browser, so it's pulling stuff in, putting it there and as you're moving around the app, different things will be coming in and being shown to you on the interface, kind of kind of like a browser.
01:09:44.320 --> 01:09:51.274
So I'm able to capture this data from this kind of HTTP cache functionality and it's mostly JSON.
01:09:51.274 --> 01:09:58.744
So I try to just be as accurate as I can while trying to give you something that you can actually interpret right.
01:09:58.744 --> 01:10:00.926
These JSON files where this is coming from.
01:10:00.926 --> 01:10:02.449
There's more data in them.
01:10:03.239 --> 01:10:09.408
I didn't find it to be horribly relevant, so I did not show that and let me tell you this is not something weird that I do.
01:10:09.408 --> 01:10:10.511
Oh, look at you hiding stuff from me.
01:10:10.511 --> 01:10:13.234
Let me tell you, your tool vendors do that all the time.
01:10:13.234 --> 01:10:18.686
Yeah, if your tool vendors were to show every single row or every single table, you will not be able to do things right.
01:10:18.686 --> 01:10:19.720
So that speaks.
01:10:19.720 --> 01:10:24.564
Another side note your tools will point you to where things might be.
01:10:24.564 --> 01:10:32.912
If the smoking gun is the list of actors in my blue sky list, I will still go and look at those files by hand.
01:10:32.912 --> 01:10:41.088
I say by hand, quote, unquote right, I will look at them with myself and make sure that whatever data points I didn't put in, make sure they're not relevant to my case.
01:10:41.088 --> 01:10:42.399
Or if they are, then make sure to include them right.
01:10:42.399 --> 01:10:46.043
So that's what an actor is, and folks always think about that way.
01:10:46.043 --> 01:10:46.905
The tool will not.
01:10:46.905 --> 01:10:52.305
Even if we show you something, that does not mean showing you everything I have to say.
01:10:52.485 --> 01:10:55.731
I have an example of one of these chat applications.
01:10:55.731 --> 01:11:06.132
I forgot right now which one it was, but there was an entry in the database that tells you if the user was an administrator of that group or not, and the tools didn't show you that.
01:11:06.132 --> 01:11:14.804
The tools show you who the person was, what was said and all that and the media attached to that conversation or that particular entry in the chat, but it wouldn't tell you this detail.
01:11:14.804 --> 01:11:15.525
That's part of the database.
01:11:15.525 --> 01:11:16.408
Well, guess what?
01:11:16.408 --> 01:11:17.951
Some jurisdiction?
01:11:17.951 --> 01:11:30.746
There are statutes that explicitly put penalties on folks that are running illicit websites or illicit group chats for, let's say, the trading of contraband.
01:11:30.746 --> 01:11:39.323
Well, that charge, those folks wouldn't be penalized as they should for being the leaders of the organization if I didn't look at the database to figure out.
01:11:39.323 --> 01:11:43.210
Hey, look the database, tell me who's the administrators are or who the main user is right.
01:11:43.210 --> 01:11:51.292
So always, folks, always take your data, your smoking gun data, look at the source directly with your own eyes and make sure that you're not missing anything.
01:11:51.292 --> 01:11:54.863
Oof, sorry for the rant.
01:11:54.903 --> 01:11:55.524
No, you're fine.
01:11:55.524 --> 01:11:59.913
So we have the Blue Sky feed posts here that you can see.
01:11:59.913 --> 01:12:01.702
My test here.
01:12:01.702 --> 01:12:02.724
Let me zoom in a little.
01:12:02.724 --> 01:12:13.630
My test data is Amy Farrah Fowler, so you can see the display name, amy Farrah Fowler, and she posted checking out this awesome new app.
01:12:13.630 --> 01:12:14.725
It's her only post.
01:12:14.725 --> 01:12:22.493
If anybody saw Amy Farrah Fowler stalking their Blue Sky page recently, I was just trying to get test data.
01:12:23.400 --> 01:12:25.148
Yeah, and you might see a few entries repeated.
01:12:25.148 --> 01:12:26.645
And again, that's a decision that I made.
01:12:26.645 --> 01:12:32.269
Some of these files, different files, these caches, will have the same data in a few of them.
01:12:32.269 --> 01:12:38.029
So I decided as of now to just show them all, but at some point I might deduplicate them.
01:12:38.029 --> 01:12:48.011
But that's some of the decisions that you make as a developer and you will make us an examiner, right, how much of this data might be useful.
01:12:48.011 --> 01:12:50.952
Maybe the context indicates that this thing being there three times means something and we just don't know yet.
01:12:50.952 --> 01:12:52.524
It might mean there was access more than once.
01:12:52.524 --> 01:12:53.268
What does it mean?
01:12:53.268 --> 01:12:57.126
So we have to take that into account when we see data and try to figure out.
01:12:57.126 --> 01:12:58.029
What does it mean?
01:12:59.622 --> 01:13:00.632
So we have the messages.
01:13:00.632 --> 01:13:09.189
Alexis became friends with Amy Farrah Fowler and had a little conversation, and then posts.
01:13:09.189 --> 01:13:15.527
This was Amy Farrah Fowler's only one post here and then the searches.
01:13:15.527 --> 01:13:20.728
So she searched for best memes Howard Wolowitz, leonard Hofstadter, penny Hofstadter and Sheldon Cooper.
01:13:20.728 --> 01:13:28.447
So that is all stored within the Blue Sky Blue Ski data and now you have a tool that supports it.
01:13:28.447 --> 01:13:29.871
Yeah, I know.
01:13:30.161 --> 01:13:31.085
And it's good stuff.
01:13:31.085 --> 01:13:36.453
Johan is saying that he actually staying early, so it's so so late.
01:13:36.474 --> 01:13:38.804
That's already the next day, so he's already like.
01:13:39.246 --> 01:13:39.587
I'm up.
01:13:39.587 --> 01:13:40.529
I'm staying up, whatever.
01:13:40.859 --> 01:13:41.765
I just want to watch the show.
01:13:42.199 --> 01:13:43.662
No, I'm just teasing you, johohan.
01:13:43.662 --> 01:13:44.965
Thank you for all you do man um.
01:13:44.965 --> 01:13:46.167
I hope we can meet in.
01:13:46.608 --> 01:13:53.264
We can meet in person sooner rather than later yeah, I'm coming too, if we're going to visit him actually you're going.
01:13:53.283 --> 01:14:03.847
I'll be in your luggage so tons of great new updates to the leaps, but we are now at everybody's favorite part, the meme of the week.
01:14:03.847 --> 01:14:06.552
That's yeah, let me share it.
01:14:06.552 --> 01:14:11.064
How could we not?
01:14:11.064 --> 01:14:23.005
So this week was the mike tyson fight, um, and the two women that fought were definitely the better fight, in my opinion.
01:14:23.005 --> 01:14:33.768
So we we have the digital forensic examiner who is all beat up, and then one of the announcer girls I don't even know what the title is, I guess, the ones that carry the little round.
01:14:35.106 --> 01:14:36.460
Yeah, as the case agent.
01:14:36.460 --> 01:14:42.832
So the case agent is looking all happy and the digital forensic examiner has just been beaten, beaten, beaten.
01:14:44.743 --> 01:14:49.807
Well, and the little note I had at the post was when they asked you for updates, right.
01:14:50.088 --> 01:14:54.466
Yeah, hey, investigative team give us an update and everybody's like here's the examiner.
01:14:54.506 --> 01:15:02.288
Go ahead and you're like oh my gosh, this has been a hard week and the case agent is all fresh, looking good you know I mean that's not always the case.
01:15:02.288 --> 01:15:05.364
I know case agents that work really hard and we both work in teams.
01:15:05.444 --> 01:15:11.414
It's just a bit of a teasing to the agents because I believe that my work is the most important work in the world.
01:15:11.414 --> 01:15:13.146
But you know they believe the same thing.
01:15:13.146 --> 01:15:14.905
I'll be honest with you.
01:15:14.905 --> 01:15:23.332
I did not watch the fight because I thought it was going to be like a wrestling not real wrestling, but like WWE.
01:15:23.552 --> 01:15:23.993
Staged.
01:15:24.373 --> 01:15:25.194
A staged thing.
01:15:25.194 --> 01:15:29.088
And I'm like wwf staged a stage thing and I'm like this is staged.
01:15:29.109 --> 01:15:34.689
This is ridiculous and, based on what I've been, told I think it was staged, I think the tyson one was, but these women really like, went oh, no, no, no yeah they were.
01:15:34.810 --> 01:15:36.555
That was a good one no, no, no, no, no.
01:15:36.555 --> 01:15:46.529
This, this girl is beat up like for real yeah, oh yeah yeah, no, no, the, the, the cars, before the main thing they, they were pretty legit, right, but yeah, but the main one.
01:15:46.529 --> 01:15:49.323
Come on, that's all preordained acting stuff.
01:15:49.425 --> 01:15:50.546
I fell asleep.
01:15:50.546 --> 01:15:51.229
That's my opinion.
01:15:51.229 --> 01:15:56.207
Definitely, but we had to use it as the meme of the week since it's so fresh.
01:15:57.530 --> 01:16:00.649
Yeah, I thought for me it was funny.
01:16:00.649 --> 01:16:03.306
Hopefully other people appreciated the humor in it.
01:16:03.748 --> 01:16:04.470
Yeah, I did.
01:16:04.470 --> 01:16:05.502
That's why I picked it.
01:16:05.502 --> 01:16:06.184
Awesome it yeah.
01:16:06.203 --> 01:16:06.645
I did.
01:16:06.645 --> 01:16:07.887
That's why I picked it Awesome, awesome yeah.
01:16:08.469 --> 01:16:08.990
Well, that's it.
01:16:08.990 --> 01:16:09.792
That's all we got.
01:16:10.960 --> 01:16:13.649
Well, thank you everybody.
01:16:13.649 --> 01:16:15.466
Just a quick couple of notes from the chat.
01:16:15.720 --> 01:16:37.884
You know, sometimes those agents bring us donuts, so I guess that's not a bad thing, or sometimes they don't, and then you know sometimes you got a comment here that you complete the report, submit it and then you can add more artifacts related to the case, because an examination is never done and honestly it's never done, it's only done when you answer the questions.
01:16:37.884 --> 01:16:39.929
But it could go on forever on the device.
01:16:39.929 --> 01:16:45.274
All right, Talking about going on forever, which is apparently what I always do.
01:16:45.274 --> 01:16:48.106
Heather, Heather, do you have anything else for the Goody Order?
01:16:48.627 --> 01:16:49.449
I have nothing else.
01:16:49.449 --> 01:16:50.212
Thank you so much.
01:16:50.880 --> 01:16:51.261
Thank you.
01:16:51.261 --> 01:16:53.609
All the folks watching, we appreciate it.
01:16:53.609 --> 01:16:54.050
We love you.
01:16:54.050 --> 01:17:04.185
Hit us up in Blue Sky, hit us up in LinkedIn or our accounts in those platforms and others and let us know what you think, let us know what you want us to speak about.
01:17:04.185 --> 01:17:07.296
If you do something cool, also, let us know what you think, let us know what you want us to speak about.
01:17:07.296 --> 01:17:08.506
If you do something cool, also, let us know and we'll try to highlight it here and everywhere else.
01:17:08.506 --> 01:17:11.208
So good night Heather, good night everybody.
01:17:11.300 --> 01:17:51.793
And thank you Good night, bye everybody, thank you Bye.