Computer Forensics Archive

Computer forensics expert testifies

Posted March 27, 2013 By National Cyber Security
Computer Forensis

STEUBENVILLE – Thursday afternoon testimony in the trial of two Steubenville High School athletes who have been charged with rape in connection with a August incident revealed that sexually explicit texts concerning the incident were sent and received on or around Aug. 12.

Testimony in the second day of the trial of Trent Mays, 17, of Bloomingdale and Ma’Lik Richmond, 16, of Steubenville showed that text messages and photos, along with e-mails, were sent from the alleged 16-year-old victim through her mother’s cell phone to phones reportedly belonging to the defendants, witnesses and other individuals. She was reportedly trying to get answers about what happened that night and determine the location of her own cell phone.

The prosecution painted a portrait of a victim who was not aware of her surroundings or anything that happened after she had reportedly vomited in the middle of a street at the second location she was reportedly taken to.

Also, testimony indicated that the victim, who lives in Weirton, through a text message, asked one of the defendants why she was drugged, and the defendant replied that she was not. The testimony was offered by JoAnn Gibb, a computer forensics specialist with the Ohio Bureau of Criminal Identification and Investigation. Her testimony was expected to last for up to three hours.

Defense attorneys offered several objections around the admissibility of text messages and other testimony from Gibb. Some objections were sustained by visiting Judge Thomas Lipps, who is hearing the case, but most were overruled with the judge’s understanding that others will later testify about receiving those text messages.

During the course of the early testimony at the Jefferson County Justice Center, text messages from Mays to others suggested Mays did not have intercourse with the alleged victim, but he did admit in one text that he did have some physical contact of a sexual nature with her.

Other texts seemed to also implicate Richmond in the incident.

The defense had not had an opportunity to cross-examine Gibbs, who was called as a prosecution witness.

If convicted, Mays and Richmond could be held in a juvenile jail until they turn 21.

Source: http://www.reviewonline.com/page/content.detail/id/565607/Computer-forensics-expert-testifies.html?nav=5008

High Tech Crime Solutions

Suburban computer forensics team sifts through scams

Posted March 27, 2013 By National Cyber Security
Computer Forensis

When a young employee of iRobot left the company known for the Roomba self-traveling vacuum, a competing product soon hit the market. After a period of surveillance, the company filed a lawsuit against the former employee for taking trade secrets.

Also making robots for the military, the company requires high security and hired Daniel Bellich, a former FBI agent who protected Pope John Paul II and headed major heroin busts, and Keith Chval, a former head of the High-Tech Crimes Unit at the Illinois Attorney General’s office. They co-founded Claredon Hills-based Protek International, which specializes in computer forensics and investigations.

Chval and Bellich do high-tech computer investigations to search for data, and when necessary, combine that with some old-fashioned, low-tech Dumpster diving to retrieve records. In the iRobot case, they later enlisted the U.S. marshals office to escort them to search the homes of the suspect as well as his parents and girlfriend.

“We found the girlfriend’s laptop had just finished wiping out some data,” Chval said. “And during the course of all this, he got a $250 million Department of Defense contract. But it was later voided.”

Investigating computer-related cases started about eight years ago in a very non-tech way. Chval met Bellich were both were club officers volunteering at Lions Club events in 2003. They went into business together in 2005.

The iRobot case was just one of their key investigations involving the loss of computer files or intellectual property. Another involved the Heartland Institute and global warming wars. A memo with confidential information went out by email to someone who should not have received it. The men were hired to track the electronic trail.

“Our business has steadily been increasing,” Chval said.

Chval thrives on solving cyber crimes and handles many cases on behalf of companies and individuals. They often use the investigation to help quietly stop the activity or refer the case to law enforcement for prosecution.

Despite many warnings that computer users receive at work and at home through their Internet service, phishing and other scams prevail. Stolen information is another top crime.

“The trend now is how frequently corporations get information stolen,” Chval said.

An individual leaves and takes a client list, supplier information or trade secrets of products and uses it to benefit their new company, Chval said.

Companies and individuals need to assess how valuable their information is and what they can do to protect it or duplicate it for emergency use, or what equipment or software they need to ensure its safety, Chval said.

“It’s all about awareness and education,” he said.

If it’s your data, or your employer’s, you need to know the risks involved with that information being compromised or stolen, he said.

“You must take it seriously and let them (the scammers) know you’ll be watching closely,” he said.
Surfing

Swedish watch company Mutewatch will launch its one-of-a-kind touch screen watch at Brookstone in Woodfield Mall in Schaumburg in April. The company said when the watch first launched in 2011, one of its first customers was Apple co-founder Steve Wozniak.

• Show Your Way Rewards members with Hoffman Estates-based Sears can now get a behind-the-scenes look at the creation of the upcoming apparel and accessory collections from entertainers Adam Levine and Nicki Minaj at www.shopyourway.com/adam and www.shopyourway.com/nicki . In addition to messages, photos and videos there will also be shopping advice, insider tips and entertainment and lifestyle news.

• As part of its ongoing 4G LTE rollout, AT&T, which has its Midwest headquarters in Hoffman Estates, has activated a new mobile Internet cell site in Hoffman Estates to expand coverage for area residents and businesses.

Source: http://www.dailyherald.com/article/20130315/business/703159783/?interstitial=1

Hi Tech Crime Solutions

computer crime lab

For the first time, a new camera was allowed inside the Boulder County Computer Forensics Lab where 7NEWS was granted exclusive access.

“Pretty much every case that happens any more involves some level of digital evidence,” said  Longmont Police Detective Bryan Franke.

Franke is one of three computer forensic analysts working as a team at the Boulder County lab.

“We’re looking at computers, cellphones, portable devices, GPS, storage devices, external hard drives, flash drives, disks, DVDs (and) CDs,” said Franke.

More than 300 devices are in line to be analyzed at the lab. All of the devices need to be documented, preserved, examined and have their data extracted.

“It’s not like TV where it’s done in an hour. It’s typically days and days and days. It could go months,” Franke said of their sophisticated cyber investigations.

The computer crimes lab works cases for Boulder County law enforcement agencies and police departments nationwide.

“We’re constantly taking in devices that need examination for different cases,” said Franke.

The growing case load is divided between Franke, Longmont Police Detective Sara Pierce and Boulder County Sheriff’s Detective Jeremy Shavin.

“We need additional people in here,” said Franke.

Until there is more assistance, the team works on a case-by-case basis. The queue of cases to be handled first is determined in part by what cases will be going to trial first.

“More like 75 percent of my cases are helped as a direct result of the computer crimes lab,” said Boulder County prosecutor Tim Johnson.

Johnson mostly prosecutes sex assault and domestic violence cases.

“It’s those kinds of cases that we’re using technology very effectively on,” explained Johnson. “If we can have a device that’s there, that’s neutrally saying, ‘This is what happened.’ That’s better than a lot of witnesses’ testimony and a lot of their memories as to what happened. That often times makes or breaks a case.”

Johnson provided three examples of criminal cases resulting in convictions that were boosted by digital evidence discovered at the Boulder County lab.

The first case included graphic video and a voicemail recording.

Video of an altercation between Emily Cole and a male victim was captured on a neighbor’s cell phone. The video showed Cole struggling with a man at the doorway and picked up audio of what was said during the fight.

The man can be heard shouting, “This is my ex.”  Cole screamed, “I’m covered in blood!”  The man shouted back, “It’s my blood.”

“At this point, no one knew what was going on,” Johnson said. “Even the neighbors don’t know what’s going on. In fact, when police arrived, they find her (Cole) with blood on her face, and they thought initially she was the actual victim in this case.”

Johnson said Cole was arrested and convicted, but during the trial she claimed that she was the victim.

“But this (video), recorded off the victim’s cellphone 45 minutes before the event, really demonstrates what she had intended to do,” said Johnson.

Johnson played an audio recording from a voicemail Cole left for the victim that included, “I know where you live.”

Johnson cited another example of digital evidence used in court during a different case.

Boulder County computer forensics analysts extracted and mapped GPS coordinates that revealed Luis Gutierrez’s route as he stalked an underage girl. Photographs of the child victim discovered on Gutierrez’s computer helped to seal his conviction.

“All of that would have gone undetected, because no one was there to see it,” said Johnson.

In a third case, Johnson said Marciene Sullivan was convicted and put in prison for the creation of child pornography.  Johnson said during Sullivan’s trial, the child victim could not speak about what happened.

“Our victim, who is nine, she really was not available to testify. But because of the digital evidence, we could proceed with the prosecution without her,” said Johnson.

The Boulder County computer forensics team discovered video and pictures Sullivan captured of his attacks   hidden on the man’s computer hard drive.

“And because of that, he’s serving a 40-year sentence, which is the largest prison sentence that we’ve had in Boulder County on the creation of child pornography,” said Johnson.

Johnson said digital evidence has turned technology against criminals and provided closure for victims.

“It’s bringing justice to the victims. Because otherwise, a lot of these (cases) go unsolved,” said Johnson.

Source: http://www.thedenverchannel.com/news/local-news/7news-granted-exclusive-access-to-boulder-computer-forensics-lab-where-digital-evidence-is-uncovered

High Tech Crime Solutions


http://stolencomputeralert.com, http://hiphopsecurity.com, http://www.GregoryDEvans.net, http://ParentSecurityOnline.com

Robert, please tell us a little about yourself and your role at Guidance Software

I’m the new Product Marketing Manager of Forensic Solutions which includes EnCase Forensic, Encase Portable and Tableau products.

I have been in marketing for over 15 years with technology brands like
Hewlett Packard, Kodak, and most recently in e-Discovery with Ricoh
Legal.

Version 7 of EnCase introduced
significant changes, the reaction to some of which was mixed within the
forensic community. What kind of feedback did you receive from users?

For our customers who have been using EnCase, the new look of Version 7
was a bit of a transition and took some adjustment. For new users
however, the interface is similar to the look and feel of other popular
programs so we’ve seen the learning curve for users new to the software
become shorter.

From a customer experience perspective, Guidance
marketing and technical support has provided webinars and other tools to
assist users in making a smooth transition. We believe their investment
in getting comfortable with the new interface will increase their
efficiency.

Further, as we have upgraded the software culminating with Version 7.05;
we are learning that the increased speed of processing data and several
of the new features including prioritized processing are dramatically
helping our customers increase their productivity…

Read more

View full post on Forensic Focus Blog

High Tech Crime Solutions


http://www.computersecurityguru.com, AmIHackerProof.com, http://computer-security-expert.com, http://computersecurityexpert.net

Internet Evidence Finder (IEF) review

Posted January 30, 2013 By

Reviewed by BitHead (discussion thread here).

When this review started at the beginning of August 2012, Internet
Evidence Finder (IEF) was a project of Jad Saliba of JADSoftware. At
that time the version was 5.41.

The interface was simple, and IEF was an easy to use tool that found a
lot of artifacts and displayed them in an easy to follow report.

In the middle of August I was contacted by Adam Belsher of JADSoftware
and told there was going to be a few major changes coming to
JADSoftware. A week later Saliba announced “JADsoftware has a new
identity, including a new company name – Magnet Forensics.”

In
his first blog post on the Magnet Forensics site, Saliba wrote, “A lot
has changed since I launched JADsoftware and first developed Internet
Evidence Finder (or IEF) while working as a police officer and forensic
examiner. After a couple of years juggling both jobs, I realized IEF had
enormous potential to help you perform better investigations, so I
decided to dedicate myself to developing the software full-time. The
growth the company has experienced since then has exceeded my highest
expectations.”

And there were a lot more changes than just the name…

Read more

View full post on Forensic Focus Blog

High Tech Crime Solutions


http://ParentSecurityOnline.com, http://computer-security-expert.com, http://HackerForHireinternational.com, http://stolencomputeralert.com

Interview with Eddie Sheehy, CEO, Nuix

Posted November 30, 2012 By

Eddie, can you tell us something about your background and your current role as CEO of Nuix?

I joined Nuix
as CEO in 2006 after working for quite a few high-growth finance and
technology businesses. What I loved about Nuix was the precise detail
the software could expose about the information it indexed. Having that
degree of detail at scale could make a huge difference to the way an
investigation played out.

After about a year with Nuix, it became clear to me we couldn’t take on
Access Data and Guidance directly –they owned the forensic investigation
market. So we expanded into eDiscovery, and later information
governance, as a way of growing the business. In 2011, having reached a
more tenable scale, we decided to go back into investigations. That has
been one of the most satisfying aspects of my time at Nuix.

What products and solutions does Nuix offer?

Nuix offers products and solutions
for forensic investigation, eDiscovery and information governance.
There’s a fair amount of overlap between those categories, for instance
our Enterprise Collection Center technology for gathering evidence in
the field is used by investigators and for eDiscovery and our processing
engine underpins all three verticals.

Indeed, at the heart of these products is our patent pending
unstructured data indexing engine. The Nuix engine has unique load
balancing, fault tolerance and intelligent processing technologies that
enable it to process huge volumes of unstructured data at high speed and
with forensic certainty…

Read more

View full post on Forensic Focus Blog

Hi Tech Crime Solutions


http://www.GregoryDEvans.com, http://www.Locatepc.net, http://stolencomputeralert.com, http://computersecurityexpert.net, http://www.hackerforhireusa.com, http://www.GregoryDEvans.net, AmIHackerProof.com, http://ParentSecurityOnline.com, http://TheCyberWars.com, http://hiphopsecurity.com, http://HackerForHireinternational.com, http://www.computersecurityguru.com, http://computer-security-expert.com

Jonathan, we last interviewed you back in 2008, what have you been doing since then?

In early 2008 I started Forensic Control after four years as a computer
forensic employee. It began as a vehicle for my contract work but soon
developed into a business in its own right, becoming relatively well
known – albeit within the fairly small world of computer forensics! I
moved further and further away from my roots in public sector work, and
found myself really enjoying the faster pace and challenges in the
corporate world; there was no going back for me. During this time I was
fortunate enough to work on some very interesting cases including the
Deepwater Horizon oil spill and the estate of Elvis Presley.

You recently became the Managing Director of First Response. Tell us more about the company and your involvement.

First Response was set up in January 2012, and at present is being run
alongside Forensic Control. There are three joint owners of the company;
myself, John Douglas and Bill Lindley. John (the Operations Director),
Bill (the Chairman) and I bring together over 30 years’ experience of
working in the industry. We decided to bring the forensic operations of
our separate companies under one roof which was a natural progression
for each of our companies. We think we complement each other very well!
There’s some more background on First Response in the recent Forensic
Focus news item.

I’ve known Bill and John professionally and socially for years; as well
as offering what we believe is a first-class service, we enjoy our work
and enjoy working with each other – for me, this is of fundamental
importance.

In terms of my involvement, I’m a typical managing director/CEO though
with a very much hands-on role. You’re as likely to find me imaging an
unusual server configuration, analysing the content and reporting back
to the client as much as dealing with the behind scenes management.

Can you give us some recent examples of cases First Response has worked on?

Sure. I think First Response’s main strength is in having both a great
technical depth and an ability to communicate complex matters in a way
that an average lawyer or director can easily understand and then act
on. This helps our clients tremendously as it did in the two examples of
cases I’ll outline…

Read more

View full post on Forensic Focus Blog

Hi Tech Crime Solutions


http://www.GregoryDEvans.com, http://www.Locatepc.net, http://stolencomputeralert.com, http://computersecurityexpert.net, http://www.hackerforhireusa.com, http://www.GregoryDEvans.net, AmIHackerProof.com, http://ParentSecurityOnline.com, http://TheCyberWars.com, http://hiphopsecurity.com, http://HackerForHireinternational.com, http://www.computersecurityguru.com, http://computer-security-expert.com

The webinar “Pitfalls of Interpreting Forensic Artifacts in the Windows Registry” is now online here.

If you encounter any difficulties viewing the above page, the webinar is also available on YouTube here.

In this webinar, Jacky Fox, student at UCD School of Computer Science
and Informatics, presents the results of her dissertation on Windows
Registry reporting. Jacky will be available in this forum thread for about an hour to answer any questions.

View full post on Forensic Focus Blog

High Tech Crime Solutions


http://www.GregoryDEvans.com, http://www.Locatepc.net, http://stolencomputeralert.com, http://computersecurityexpert.net, http://www.hackerforhireusa.com, http://www.GregoryDEvans.net, AmIHackerProof.com, http://ParentSecurityOnline.com, http://TheCyberWars.com, http://hiphopsecurity.com, http://HackerForHireinternational.com, http://www.computersecurityguru.com, http://computer-security-expert.com

Guidance Software Inc. has announced the release of EnCase® Forensic version 7.05.
This latest version of the industry-standard forensics software
features key enhancements that enable investigators to work with data
sets earlier and faster in order to both begin and close cases faster
than ever before. Speed enhancements in the EnCase Forensic v7.05
evidence processor have reduced significantly the processing time for
both small and large data sets. Digital investigators can now rapidly
process evidence files of virtually unlimited size, dramatically
reducing case backlogs. With EnCase Forensic v7.05, investigators can
uncover evidence up to nine times faster than previous versions using
the greatly enhanced evidence processor…

EnCase Forensic
v7.05 also improves investigative efficiency by automating common
investigation tasks and significantly reducing manual efforts.
Prioritized processing lets users process an early subset of evidence
and make it available more quickly for analysis by investigators. They
can also choose to continue or to stop processing remaining evidence.
Enhancements to the analytic capabilities of the product’s built-in Case
Analyzer offer forensic examiners deeper insight into computer systems
through higher-level reports on metadata and the ability to compare
potentially related artifacts side-by-side. Examiners can establish
hyperlinks to original documents and images within reports. In addition,
the results of a keyword search can be viewed and analyzed while that
search is ongoing…

Read more

View full post on Forensic Focus Blog

High Tech Crime Solutions


http://www.GregoryDEvans.com, http://www.Locatepc.net, http://stolencomputeralert.com, http://computersecurityexpert.net, http://www.hackerforhireusa.com, http://www.GregoryDEvans.net, AmIHackerProof.com, http://ParentSecurityOnline.com, http://TheCyberWars.com, http://hiphopsecurity.com, http://HackerForHireinternational.com, http://www.computersecurityguru.com, http://computer-security-expert.com

In this webinar, Jacky Fox, student at UCD School of Computer Science
and Informatics, presents the results of her dissertation on Windows
Registry reporting – focusing on automating correlation and
interpretation. After the webinar Jacky will be available in the
Forensic Focus webinars forum to answer any questions.

Date: Thursday, November 1st 2012
Time: 12PM (midday) EDT US / 4PM GMT UK / 5PM CET Europe
Duration: 20 mins

There is no need to register for this webinar, simply visit http://www.forensicfocus.com/webinars at the above time (the webinar has been pre-recorded and will be archived for viewing later if you are unable to attend)

View full post on Forensic Focus Blog

Hi Tech Crime Solutions


http://www.GregoryDEvans.com, http://www.Locatepc.net, http://stolencomputeralert.com, http://computersecurityexpert.net, http://www.hackerforhireusa.com, http://www.GregoryDEvans.net, AmIHackerProof.com, http://ParentSecurityOnline.com, http://TheCyberWars.com, http://hiphopsecurity.com, http://HackerForHireinternational.com, http://www.computersecurityguru.com, http://computer-security-expert.com

Join the mailing list

Check your email and confirm the subscription

%d bloggers like this: