Welcome everybody. I'd like to just start this out saying, you are not the typical
crowd who I speak to and I'm so happy about that, it's refreshing. And one more thing that I
would like to ask, just because it's personal curiosity and I'll preface it
by saying that I haven't been in law enforcement for three years okay. So I'm
no longer sworn. How many people in this room had ever had an inquiry from law
enforcement about their activities? A few. OK.Cool.
[Question from audience.]
Well I'm talking about your technical activities.
Your, your curiosity with electronic devices and computers specifically. Yeah
that's, that's what I'm talking about. There is this huge perception out there in the
world, that if you're at a hacker conference, you're going to be surrounded
by people who are doing this for nefarious purposes, right? Like that, that
you guys are out here trying to hack things and steal people's money and
information and sell that on the dark web and all of those things and... And
throughout my law enforcement career because I grew up as a total geek in
high school and learning file systems on my father's knee, it was always my
suspicion that that was just a load of BS. And that, that when you go to a hacker
conference like the vast majority of people are here just because they're
curious about how things work and they want to know more.
Great, so. That is actually the secret to my success in law enforcement. Is that
every time, and by the way I am among few in law enforcement that I have had the
honor to identify and arrest a couple of different DDoS suspects for major DDos
events and one for a major hacking event. That,
that actually went all the way to the US Supreme Court and, and came through okay.
So it made some case law in this area. But the secret to my success was talking,
right because, I'm not going to assume ahead of time that their goal was bad
unless it was obvious and then I'm gonna be kind of curious about what they did.
And how many people liked talking about doing something after they do it, right?
Like it's, it's pretty cool. We get to do some cool stuff. The other secret to my
success honestly, is that I have hidden in plain sight, my entire career. okay. I
have over 30 years In enforcement. Do I look like a cop? I didn't even really
look like a cop when I was a cop, and most of that is in Computer Crimes. And I
can walk into a forensics conference, or a security conference, or a hacker
conference and people just kind of ignore me. Or they pay the wrong type
attention to me and then they don't get very far because I was a cop for 30
years so... So it doesn't work out well. I will tell you when I walked into this conference, I
just sauntered up to the badge thing and was waiting in line for my really cool
badge. While I was waiting for that badge, two people cut right in front of me. The law
enforcement came out to me and I was like "follow the rules" So for 31 years I've
been in law enforcement. The last three I have been in the civilian world and I
will tell you so far I'm really preferring the civilian world. There's a
lot more freedom out there to follow my curiosity and a lot more resources to do
the sorts of things I want to be doing. But for 22 plus years, I've been doing
Computer Crimes in forensics and started my career back when law enforcement did
not know crap about anything. So really it was in the, and you could
argue that still the case in many jurisdictions and I won't be there
arguing that too much with you. But it was in the the mid to late nineties, back
when bulletin boards were a big thing and back in 1998 my dad gave me a one gigabyte hard
drive for Christmas and said that is the last hard drive you'll ever use. It's one of
the few things he wasn't wrong about. That has so much capacity you're never
gonna fill it up. And now we regularly leave behind ram that's you
know, 16 times that big. Great so, there's a problem there. So, I've done some pretty cool
hacking cases. Anybody here ever or be acquainted with the TV truck Jeep from
the 414 freaking club? Them, yeah? Is this someone you know? What's that? Okay I [Audience member].
was asking about one specifically because I still have some questions I'd
like to ask somebody who knew him. Some investigations just never end. That took
nine years of my life and if I ever meet someone, I'd like to have a
beer in a conversation. But that case, I've done a lot of DDoS cases. I've done
a lot of cases involving broken, smashed devices that were smashed on purpose
hoping to keep cops out of them. And had the opportunity to deal with some cases
where it felt like I was writing reports that belonged in comic books, rather than
in police files. Doctor Chaos and Riot Boy, wow. So, I've had supervisors read my
reports and go, what is this? Right? I don't understand three-quarters of the
words in here and then I knew I needed to go back and rewrite that report so
they can understand it. I'm a certified computer forensic examiner. I testified
as an expert on a number of a lot of occasions. North of
probably 200 at this point. In same federal courts and now in civil courts
as well. And I've had digital forensics cases go to both the Wisconsin Supreme
Court and the US Supreme Court. And both of those thankfully went in my view the
correct way. People can argue, but and they did. I'm also a certified SANS
instructor and a course co-author of FOR585, although I'm not currently teaching
because my personal business has just taken off to a point where I don't have
the time to dedicate to it right now. But maybe someday I'll go back and continue
to do that. And I did my master's degree in computer forensics at University
College Dublin. Earned that in 2011. It was a blended program, so some online and some
in country. One of the things my dad was very right about, is if there's something
you want to do and something you have to do and you can make those things come
together, it's a great way to live your life. So I wanted the good Ireland, they
had a master's program in forensic computing and cyber-crime. I knew that the
training programs that were available to law enforcement in my area weren't
cutting it for me anymore, so I went Ireland. And it's a great program if
anyone's looking for a good one. Um, so I'm going to start this talk with a picture, all
right. And it's not a new picture obviously. This is called Flammarion and
this is a depiction of the guy who first decided that the Earth probably wasn't
flat, it was round. And I like to think about technology in these terms, right.
Like we don't know what's possible until we pull that curtain aside and look
beyond it, at all of the things that are possible out there. And the vast majority
of the world sometimes goes on thinking that things aren't possible, even when
they're hearing that they are possible, right?
Security RD report. No thank you, OK, here's your rank somewhere. Great, like it's...
That could never happen to me. It's not a possibility and then they get nailed.
So my first degree was in graphic arts. I like to go back to graphic arts
because I think sometimes those pictures do more for us to describe the way we
look at the world versus the way the rest of the world sees the world. It is a
world of possibilities out there. And even in my field of digital forensics,
which is my preferred field, I'm getting pushed into incident response and
security and some other places that are less comfortable for me. But even in that
world, sometimes the way people see that world is so black-and-white that they
forget about the possibilities. And so when I say I'm happy to be in this room
talking to you, it's because people in this room or more likely to have already
looked beyond that curtain, at what's possible. And I would encourage you to
keep doing that. So... I want to talk about ground truth, right. Like those things
that we know are absolute in this world. The things that we were taught to
believe as truth. And I want to start out by saying after 30-plus years of law
enforcement, Oscar Wilde was right. The pure and simple truth is rarely pure and
never simple, right. There are always colors to the
grayscale. And there are always things that challenge our beliefs about what is
true the question is are we willing to go there and look at those things and
see where that possibility brings us or are we gonna get stuck in what some
wonderful destiny true and I'm afraid that for the vast majority of people we
get stuck with what people tell us it's true and we stop testing the limits I
don't know how I used to see this this is a game of giant Jenga played at the
Sands D Empire summit every year Jared and I play a game actually we play more
like 5 or 6 but this is a perfect again every piece is played all the way
to the top no pieces to go and you can see the foundation down there is strong
and true and at the top that goes towards tipping so again I saw this
great analogy greatly the further we go out towards the edges the less stable
things become and that is actually the area where I like to work in forensics
is wearing wearing the truth gets kind of fuzzy the stuff that we were taught
to be true has some exceptions and I like to explore those exceptions so what
am i doing I'm kind of hacking right like that that's what what you guys do
so I just want to talk about a few how many people have background in forensics
in this room a good number okay so for the rest of you this isn't gonna be
anything that's going to be like totally over your heads and for those of you in
forensics hopefully it won't be totally earth-shaking but it'll be enough to
have you peeked through those curtains a little bit we're going to talk about
imaging because we were told some SuperDuper straightforward rules about
imaging about how when we do a full physical image of a hard drive we go
from the first bit to the last bit and we did every bit in between and that is
a good image if we have it my hash Mac I'm gonna tell you why that's not true
and why we shouldn't believe it in wine it's been common knowledge since 2012 we
just chosen to just kind of cover our eyes and ignore it and I'm not talking
about firmware which I was so glad to see these badges and to see that you
guys are dumping firmware I actually added a couple of slides into this
presentation right out there in the hallway about case that came in this
morning because it has to do with with firmware and hardware and I want to talk
about hardware okay because in forensics we sort of ignore
these things we sort of ignore firmware and hardware we assume that they're
doing what they're supposed to do according to the manufacturer and that
there's nothing sneaky going on there behind the scenes
that we're not able to see same with hardware and then I'm gonna talk about
what we do about it once we discover that the earth isn't flat in forensics
right that there are some exceptions to rules that we need to take into account
like if for 15 years I've been writing police reports swearing in front of a
judge that I'm telling the truth the whole truth and nothing but the truth
and then I find out that I'm not getting every bit of a hard drive the next time
I testified what do I say right like I I swear that I'm gonna tell the truth well
really that's not the truth the truth is a little different from the fact that
we're just getting first to last these are the slides I added does anybody know
what this is just off the top of your head it's not point a sail skimmer
right so this was placed over a point-of-sale device in order to capture
some credit-card information we turned that sucker over we've seen
the back of the keypad we start to see kind of a mess it's hard to see from
there so I'll make it bigger for you that's where the brains live anybody
especially people who made these badge is happy about the work that was done
here it's kind of a hack job right minutes in the police in the least happy
sense of the word again a little bit hard to see with the lights up but I'm
told that's the way to do the video here so we'll let it go but what we see
circled in the middle is a little I think 8 megabyte CMOS chip that's where
the data gets stored before it goes out of this device via bluetooth so we get a
call Monday this week from another forensics company and they say hey we
have called no less than 10 elapsed I've sent out the information about this chip
I sent up pictures of this chip and everybody says no sorry I'm eating chip
ups but we don't do that and I looked at that I'm like it's just a CMOS chip like
why don't you do that like it's that's probably the simplest scenario ok so
when you guys are working on half the bag challenge right and you
look at the little chip on the back you'll see that it's nearly identical
it's not the same naked model but you will be dumping the firmware out of that
chip so those ten forensics companies that
said no to this job that's super simple you guys if you can accomplish this will
at least be able to do part of that work and taking that chip off because it's
been secured by hot glue is not going to be a super challenge and there are
readers for CMOS chips right so this is not a hard job so when I said yeah it
shouldn't be too bad a challenge he's like what do you mean he's like
everybody else said no and I'm like about there's not much data on it it's a
simple chip we have readers we have all of the information we need about how the
thing is laid out on this this shouldn't be a challenge at all and it shouldn't
even be expensive he's like well if you get data out of this one you can have
all of our typical like okay data so bonus right bonus so this is a lesson in
why when somebody else looks at something and they go that's a homemade
piece of I don't know and they probably weren't looking to see which one of
those chips held the data or which one of those might be a challenge because
there's nothing about that that's complex it's just not made by Samsung or
by LG or by somebody else right and so so you guys would be like oh yeah I mean
that's not a big deal let's go for it so that's why I wanted to put this in here
so that you can see that in the real world outside of conferences this sort
of work is out there to be done and there are a lot of companies that are
turning it down because they see it as - as a carrot to do so that's the stuff
that makes my work fun now in law enforcement I probably would have had to
send that chip up right because because there aren't too many labs that will do
it but I do know of another one that will Secret Service has allowed
so imaging as examples go in this ground truth area and things that are playing
hiding in plain sight this imaging is kind of an oldie but goodie
Todd Shipley in 2012 he's an old forensics guy wrote the white paper
talking about our our imaging verbage and what everybody was taught by a
national white crime Center and by the FBI part team and by every other
training organization out there and said hey we can't keep doing this because
it's wrong I said yeah you're getting a bit for bit image of the user
addressable areas of the drive but there are all sorts of other pieces of
information you're not getting we gotta stop saying this and by the way people
if they're smart could be hiding data in those places that we're not getting so
back in 2012 I paid attention and I was like whoo I I need to change what I'm
doing here because I don't want to miss things and I don't want to be saying
things on the stand that aren't truth right like I want to be doing the best I
can do so the myth here is that when we create that drive image we're making a
full bid for the image and in reality we're only getting a bit for the image
of the user addressable areas of that device but we have these lovely tools
that allow us to take that image and get a hash and match the hash afterwards
after after that validation or verification process and and we have
planned people who are willing to say oh I got everything we're good move forward
write the report it's it's easy and simple it's easy and simple until you
start realizing that there are all sorts of places in this drive the service
system area reserved areas servo information post protected area firmware
all of these places on the drive that you know the disk itself or within the
flash memory that can be altered by the user and could have information that's
really important to a case so some of this stuff our write blockers even
picked up on right so in this case we have
a picture of a write blocker that I used in a case where a long-term employee he
works for the company for 13 years turned into his computer after he left
he worked remotely and they were like he wiped the hard drive well he didn't wipe
it well maybe she you know reinstalled Windows really waited it was a different
hard drive into that computer that had only been powered up six times right so
he gave them back an intact computer it just not the right hard drive so it had
only been powered up five times when I got it but interestingly the write
blocker sees this serial number we were to search that bit for bit image of that
hard drive or that serial number we should be able to find it right should
be there it's not because it's not stored in the user a celeriac stored
outside the user accessible area so sometimes forensic examiners see this
stuff and they go okay well that's what it says the harddrive serial number is I
want to verify that I'm gonna search my image for it oops I can't find it and
they go I don't know maybe it's encoded somehow and then they call up Ultra doc
or Tablo or whoever and they say where'd that come from I can't find it on the
drive in and then ultra black or tableau tableau sends them off to Tasha please
article and they go oh you know I just pulled the curtain back and there's this
whole new world hunter so that's out there and it's it's certainly an area
that doesn't probably get enough attention in terms of what can be
written to that area and what can be done to manipulate the drive during
during the use of that hard drive so so that's the number one example I want to
use for you the things that are hidden in plain sight for us firmware myth
firmware doesn't really matter as long as it works and the reality is from
where really freaking matters like it matters all the time yes we want it to
be the stock firmware but some of the most neat DX points right now are for
our exploits right so so firmware can be used to turn on your computer even when
it's turned off and to access it at the lowest levels and it used to be
available only to nation states but now it's available to all of us if we just
go to WikiLeaks and download the information and the tools so so it
becomes problematic right because those those schools are now out there so one
example I like to use when I'm talking to tops is that you know your so you
think about computer users in a certain way farmers are having their own
firmware in their tractors okay so if farmers are hacking their firmware in
order to avoid John Deere's man you know mandated service times at once a year
then we ought to be aware of the fact that anybody with the right knowledge
and tools can hack their own firmware so it's something we have to pay attention
to firmware is everywhere I have this a great pointer that I like to use when X
as an example unfortunately Murphy's Law says the best
review is not fully charged so so this is this this is a pointer that does some
firmware tricks so I can point it at my screen or I can point it at that screen
and it will show pointers either place without a piece of a laser and it's
interacting with with that device little Bluetooth magic or a little Wi-Fi magic
in between and you have you have a really cool toy but USB keyboards
webcams sound cards graphic cards one major place this comes up data recovery
data recovery company gillware started as a native
company 1516 years ago one of the most common things that comes in is people
who turn over to us they're 64 128 gigabyte USB devices that they bought
off of ebay or amazon for 14 bucks right and they go I got this huge USB I put 64
gigabytes of pictures on this and there's nothing left what happened well
when you take it apart it's actually an 8 gigabyte chip right so you can't put
64 gigabytes in an 8 byte chip but I think gigabyte check but you can change
the firmware on that 8 gigabyte chip to make it show the user that gets a bigger
USB Drive so that you can make more money so this is one very common way
that this happens it can also be used by bad guys and I've had the great
opportunity to see it being used in cases where reporters are being spied on
and where bad guys are using altered USB firmware in order to create spy devices
so so watch those USB keys they're still under imaging but GPS devices traffic
signals routers printers vehicles everything's got firmware in it and we
can mess with all of that firmware and make things do things other than they
were designed to do here's the next picture I love to show looks like a
hacker doesn't it your traditional happens
this is Trenton he works for me he's not hacker he's actually a great coder but
what he's doing right there is decrypting however many virtual machines
are there from trauma from a ransomware case the problem is that we start
looking for you know very computer savvy people and we should be looking for this
guy really the guy who figures out that they can change that firmware in their
tractor or better yet the kid who from the age of tiny decides hey those limits
they're not mine somebody else's limits and I'm just
gonna keep pushing beyond them and figure out how to make this thing do
what I want it to do so if we're not looking for those people or add those
people and there's whole roomful of those people here I'm pretty sure then
we're missing out on a lot why does it matter it can be easily exploited it's
not designed for security it's small it's fast to write we see meltdown
inspector and we're firmware in firmware exploits the Intel from wherever ulnar
ability is is is out there and in use is is actually a screenshot from a case I
pulled that out of unallocated space the Intel Active management technology
screenshot and so so really if you got that Intel chip and someone has can
remotely get into your computer even if it's been turned off and in this case
they could also turn the power off on you this person's computer was doing all
sorts of crazy stuff that and they didn't know why and unfortunately they
were in a in a in a very large big name company and that company was kind of
owned at the firmware level so it was kind of an ugly mess I mean like
operating system firmware really has easily update market mechanisms but you
can go out usually and find on Russian or Chinese sites the software that you
need to interact with all sorts of different firmware we can use it to help
us access devices that otherwise can't be accessed and in the mobile forensics
field anybody playing with mobile devices at all firmware can really help
us get into devices that are acting right or that are under otherwise
inaccessible through through security mechanisms so
it's definitely something to be to be looking at hardware the myth is the
hardware doesn't really matter so long as it works I don't know too many
forensics courses that ever talk about hardware and firmware how they interact
together and how they in fact what we see later on in reality hardware really
matters and it doesn't necessarily even matter whether it works or not if you're
able to get that hardware to work then then you're gonna be a better shape so
sometimes we just need to go there to get around the problem the the picture
here on your left is a Qualcomm chip on the phone this is the first chip off
chip back on case on never aware of so go where we said hey we could take chips
off read them directly if we get in cryptid data back we know that there's
several chips involved in that encryption what if we put that chip back
on another phone and replaced chips - could we get around some of that and the
answer is yes you can not going to work with every phone but there are several
phones that we've had this process work for so it's pretty cool next one is an
old SD card thing was broken off but in in ways that we just so get around them
so I just did some spiderwire soldering it got the the diagrams to get the right
connections and then did a physical read of the data from that card reconstructed
it and got the data back on it and the third one is a donor column next to an
evidence phone this is from a Chicago homicide case Chicago PD homicide case
where a body was burned in a barrel along with his phone and the person
obviously wasn't identifiable the phone to look like a hockey puck but we got
probably 98% of the data back out of that
including the guys last pictures and his last communications and they were able
to identify the guy and solve their homicide hardware mattered in that case
right like and many labs would just look at that and go not a chance
I'll go through some more pictures of that case in a little bit repairs and
replacement and reconfiguration can solve some problems that other methods
can't you can go act these things all you want with a write blocker and read
and read and greed but but sometimes we have to go beyond that to get data out
of devices board spots chip swaps head swaps for hard drives or board swap
phones can get us to dated it is otherwise coated inaccessible
alternative input methods so you see the iPad there that was a password-protected
I've had at one point but somebody left accessibility options on and we were
able to insert a keyboard and do some do some hacking in order to get into that
particular device and then I'm making that one a little bit bigger this is an
iPhone board we've sprayed it with some well in this case we actually used the
the free spray right but you could use your candid or upside down that way but
this was a foam that was stuck in a book loop and iPhone stuck in a blue glue it
would come up it would overheat and it would shut down if you spray it with
cold air as it's coming up and frost everything it becomes obvious which
chips are the problem right and then you swap out those components this phone
will work beautifully and it will move all the way okay so most people would
say that phone is a hockey puck I'm on to the next phone that would be a
mistake because you will miss your evidence great example so this is the
example that pulled me out of law enforcement and into the private sector
so for probably the last ten years of my career I had a lot of different people's
hey Cindy come work for us like there's the amount of money wouldn't he said the
minute law enforcement there's all sorts of stuff to be done out here
well then I went for a tour of Gilmer's data recovery lab to talk to them to
consult with them about starting a forensics business I wasn't going to be
involved in it I was just consulting with them and walked through their data
recovery lab and a guy named Greg introduced he was working on an SD card
that a wedding photographer had accidentally reformatted after coming
back from Hawaii and shooting a high-dollar celebrity wedding she was in
trouble rage so so she sent this SD card in and
you reformat it any time we read this with Windows what is it going to tell us
it's an empty card it's all zeroes I can apply my write blockers and I can take
the physical image of that drive first bit too last bit all I want and it is
always going to show me all zeroes okay in law enforcement if that had come to
me USB Drive SD card I put it on a write blocker I preview it and it's all zeros
I'm on to the next piece of evidence and I've worked Child Exploitation doses for
17 years okay so a lot of pieces of evidence so I watched Greg that day I
happen to get lucky recovered 300 plus images from an SD card that would read
all zeros what kind of magic is that Christmas big wait like I'm supposed to
be an expert and you just did that and I always thought the data recovery people
were just sort of forensics light right it's not anything yes we have these
perceptions that we come into this business with right that that data
recovery people are just getting people's data back it's just you know
what did they do we don't get that back what's yeah so but this was some sort of
magic or I just like what wait like how did you do that and how can I be
involved in doing that so then I started to read more and learn more
about flash memory and Greg gave me and I knew some of this like I had heard
academically a lot of this stuff but until I saw it in action I didn't
realize you know how fooled I was about about what was visible versus what was
it so we have the file system level our software based it was just kind of reach
there and understanding through windows through Linux through whatever you're
looking at it through an operating system all you're going to get is that
level on these flash memory devices USB devices thumb drives or flash memory or
even the Flex hard drive they have this flash translation layer that just
basically sits there and says here's what I want to show you and you're not
seeing anything else okay and I like to think of that as the wizard from The
Wizard of Oz do not look behind this curtain right because everything back
here is stuff you no longer need to know about I've been told to reformat this
drive so all you can see is eros but underneath that lays both NAND flash
memory and that ROM and if you can directly read that chip rather than
reading it through an SD card has data on it until garbage collection and we're
leveling happened which is less common with SD cards and USB devices than it is
with more modern hard drives but here we are above that we see the logical level
and we can get a physical image of the logical level okay so that's the part
that was screwing with my head because I thought I'm getting a physical image of
this my tools tell me that my processors tell me that my experience tells me that
I've done this a hundred times but all I'm getting is anything that the Wizard
of Oz tells me I can see if we're able to go down below the five translation
layer then we can see the rest of it by the way this looks
by person so there isn't a thing underneath there that makes any sense
whatsoever two people were talking about it it's so if I erase it the stuff at
the top is gone the stuff behind the Wizards curtain though it is still there
and the worst thing people can do is start messing with that device and
trying to get it back through a file system read great like the worst thing
they can do is apply power to that and start working on it
because you're not going to get to it that way you have to take the chip off
do a directory and then put that million piece puzzle back together again so
there's two avenues of extraction we can either do a normal device interface so
you say that I am MCS do all of the different interfaces we have or we can
do a directory to the flash memory of one or more chips so in this case we're
seeing a more modern SSD where we have removed all of the chips from that
device we will do directories on each and every one of those chips and then we
will put together that five billion piece jigsaw puzzle well it's hard it's
not easy and it takes a long time but if you look underneath there with these
tools they have tools that help you to figure out the patterns and to visualize
them and it reminds me of my graphic arts days I go back and I kept oh that's
pretty it must be right and half the time it's right so so if you can get the
right tools to do this work there is data there and you can bring it back but
there's significant puzzles of building involved in it so why don't we just do
it all the time wrecking like chip off everything and I was there for a minute
it took I said slow down sitting that's okay we can't do this all the time
because a lot of times those flash and chips the NAND flash chips have industry
standard interfaces and they're not so easy to read or the data layout is
proprietary or you have a tentacle ship after chip by making model up firmware
and you look underneath them the patterns are
all totally different great like they haven't used a standard layout on the
memory underneath encryption is another problem if that drive is encrypted then
the data underneath is also encrypted by and the other issue here is that when
we're dealing with these larger drives that have we're leveling and garbage
collection that happens on a really regular basis and Trend commands and all
of that stuff that gets rid of a lot of the data that we would be after anyway
pretty automatically and pretty quickly so the the more modern devices the
larger devices there's actually less chance of recovery from those although
we do find in spare area and over provisioned area on these devices that
we're getting back lots of little files and lots of versions or little files so
it's still not a possibility seems straightforward but it's not really the
truth here is not simple and oh yeah it can be physically destructive to the
original device like once you take those tips off depending on the device putting
them back on is not necessarily going to be a successful thing or if it is it may
not last for a long time so when I tell you we're doing chip off chip bonds for
phones we are we're doing them on a fairly regular basis now and having some
success with that but we're not handing that back to the customer and saying hey
here's your LG phone go ahead and use it right because that's a temporary fix for
us to get that data out and then to move forward so let's talk about that oxide
case just a little bit because I think this is a great example 90% of law
enforcement lab we've got a phone in in this condition would consider that phone
to be toast okay and they would not have gone any further the phone itself was
melted to the point where getting the micro sd card out was pretty difficult
and then once the SD card came out does it look like it's in good condition so
anybody heard any rumors about how flash memory is heat sensitive okay so all of
these issues should be a problem by the way don't we
that last thing flash memory in my experience is so tolerant to all sorts
of abuse like you can throw it under salt water you can you can bury it for a
couple years you can burn it like this and we're still able to do some pretty
amazing things to get data back it's a pain in the butt and this one by the way
the whole lab would stomp like burning plastic so this this was not a pleasant
case to work on so that if you ever have a battery that looks like that it's time
to get that battery out of your building okay that's that's my safety advice or
put it into an arson can and wait for it to explode because it's going to at some
point so that's Mike's hands my kids are one of our best chip off guys he did two
puffs work in Afghanistan and he's really fabulous at it and has the
studies hands of anybody I know Mike did the chip off on this basically took the
chip off of the donor board and we replaced it on to the other board and
we're able to pull the data out so that's the chip as it came off of the
board you can see the nice clean spot it came out of great he'll clean that up
make it pretty might have to reball it might have to
resolder it depends on the job but then we can get that data out so so we were
able to get back like most of the data all of the name came off of that flash
memory chip and we were able to recreate it we got like a 90% read on the SD card
so we didn't get everything and there was a little bit of corruption there but
but what we got back helped to solve that case so what do we do about all
this right because a lot of what I'm talking about is those areas where we go
now is that's just forensics or is this like science fiction right because this
is this where science meets fiction and we're doing stuff that didn't used to be
considered to be possible and the thing is the longer you're around
and I've been around for 30 plus years in law enforcement and in 25 now or
something and doing forensic the longer you are around the more you keep hearing
oh that stuff that used to be impossible we're not doing like all the time right
it's and and the thing is we moved forward but often times we don't stop to
say hey that's no longer true so stop writing it in your reports and
stop swearing to it every time on the sand and this seems like a simple advice
though but I will tell you as someone who's testified a number of times the
first time I write a report and then testifying that notice isn't a complete
image of the hard drive this is an image of the user addressable areas of hard
drive there was a very smart defense attorney on the other side that said hey
Cindy you and I've done a lot of cases
together and I've heard you testify lots of times
why is this different than that other one up like why did you use to get all
the data up and now you're not is there something different about this partner
okay and then then you had that moment where you go grab and you go no no I was
wrong all those other times then I testify afraid like I was wrong
and that's a really hard thing to say and the problem is you had to follow it
up and say I was wrong but not in a way that substantially changes that case
right like I just learned that not only can I get all of that these are
international stuff but there's other stuff out there that I could get to if I
need to dig that deep and so what to do about it is we can't be so afraid of
those moments where we go how do I explain this that we just take the easy
route and say I'm not gonna explain it I'm just gonna keep doing it the way
I've always done it and hope nobody else notices because it's too hard right it's
not we just have to educate people as we go and we have to keep learning and
reaching and growing and when our understanding changes we have to be
humble enough to say I didn't know or I don't know or
I was wrong and that actually gets harder the more experience and expertise
you have under your belt the long run around the more I know I don't know
crack right like that's that's a really what it comes down to which makes me a
good forensics person because I'm always questioning the stuff that I assume to
be true which is after all what science is about right so so that's that's a
really the message I have for you about those things that are hiding in plain
sight it's all around us like it's not just in this conference room the stuff
that we believe to be true in forensics is our understanding of forensics at
this point in time and like I've shown you a few examples here but there are
many others of how that is just going to expand and grow as time moves forward
and technology changes and so any questions I have with me I don't know
they're my new key cartoon room this was a shirt that is from anonymous in
Amsterdam I was at math conference in Amsterdam and a guy walked up to
meetings like Cindy I want you to have this I'm like oh okay
thanks I have a shirt and I said you know I can't wear this at work right my
boss would get sick but he said I'm giving this to you to let you know that
some of us in Anonymous and he said this in a really nice Amsterdam accent
appreciate the fact that you're keeping our streets clean right he's like
because our goal when if we set out was to make things right and there's so many
people who are out like ddossing you know SeaWorld and children's hospitals
and I want you to know that we appreciate the people who are policing
our streets too so I brought this shirt to give away though so if anybody is a
European large and has an interest by the way your Kmart is smaller than a
US large just for those of you who don't know and try to figure out how to give
this shirt away but I think what I'm going to do is give it to Mike and then
halfway with who's not in the room anymore because apparently you know he
can't be bothered
I'll get to Mike and and some challenge in the next couple of days will include
this shirt as well ok so that's your bonus flash memory because if I do a
direct read of men's memory and Crowell does it or some other company does it
that direct read of Nan memory if we were to hash it after the rebuild they
may rebuild it slightly different than I do and it's not going to be the same
like if we hit it the same that would be amazing
so if it can be an issue and we just have to be prepared to say you know sort
of like Ram is never the same cell phones are going to be rarely the same
if you if you image them twice those things that are actively changing are a
little bit different so the chain of custody is usually of that physical
device but it can be of the data too and so it can get a little messy because
they can have one exhibit number four for our dump and a different one for
another dome that people can spend hours arguing which one's right even though
above the flash translation layer the data is all exactly the same so you know
that billion taste soft and the puzzle that we're putting back together if we
rebuild some things differently underneath it's not necessarily going to
show above so so yeah it can be an issue than this one that we we still are
working through I think honestly that's part of the reason is collecting Ram
stores like it doesn't say hi say this is the correct image of brand because
the next one I take will be different so if we have a court order that allows us
to try to break that encryption or to come up with a hardware or firmware
way around we may be able to get past it it's it really depends on the makeup
model of phone though and the technology involved this is really prevalent to buy
phones right now great link if you are affiliated with law enforcement you may
have the ability to get a great kini extraction which is going to have more
data in it even for a password-protected phone which they could break the
passwords on then you can from any civilian available tool and so it's not
an equal world out there in a lot of different ways
and whether we can get around encryption on a particular phone really depends on
the make and model of phone the version of the operating system on that phone
and potentially other things as well chipsets can make a difference Acushla
so every every phone is its own individual problem we have time for one
more question have I ever been told to stop my investigation man you know when
I retired did you get me just ask the whole audience did anybody know her Jeep
me try if you did I'd like to have a conversation with you
yeah no I have never been told to stop an investigation usually what happens is
that so many other investigations come in after it that it dies a natural death
so you know it's it's like you're a chef at a 12 burner stove and everything's
burning over at once that thing that requires your attention the least is
most likely to slide from your attention so I've never been ordered to stop but I
usually follow the rules and I'm very nice great I got I'm very nice to the
people I talk to whether their hope that guy or a good guy and and I try to
follow rules and get permission sometimes okay thanks
you