As most of you know by now, I’m currently training to be a psychotherapist, because I don’t have enough strings to my bow already. I know I want to practise existential psychotherapy but I’m not yet clear on whether there’s a particular group of clients I’d like to work with. I’ve recently been thinking, however, about working with law enforcement officers, particularly those who are engaged in investigating cases of child exploitation, human trafficking and counter terror. I have the advantage of understanding these industries from the inside, and hopefully with the benefit of psychotherapy training I’ll be able to make a difference to the field by helping people to deal with some of the things they’re seeing. (more…)
The other day I sat down with the guys at Magnet to take a look through some of the new features in the latest update of AXIOM, and how it compares both to previous updates and to their IEF tool.
This review will focus on AXIOM 2.5. The current version at the time of writing is 2.6; with new versions coming out every month, it’s worth keeping an eye on the new features in each release. One of the main ideas behind version 2.5 was to focus heavily on improving speed performance.
IEF has a similar workflow to AXIOM’s, but it is just an artifacts tool, whereas AXIOM is a full forensics tool. In IEF you choose your evidence sources, fill in the case details and hit ‘Find Evidence’. It will then process your evidence and give you a report on the artifacts. The point of IEF is to have everything in front of you in a format that is easy to analyse, making it simpler to find the most important things and deal with those as a priority.
One big difference between IEF and AXIOM is that AXIOM performs acquisitions, whereas IEF will just load sources that have already been acquired.
I met Chet Hosmer at DFRWS in Providence, Rhode Island, earlier this year. Over lunch I explained my upcoming digital forensics book to him, and he was very supportive. When I arrived back in England a copy of one of his books was waiting for me, along with an encouraging note.
Well, the DFIR book project has taken a backseat over the last few months due to me taking on a new psychology of religion research project, but maybe it’ll come back. In the meantime I thought I’d take a look at Chet’s book and write a quick review of it. (more…)
The hottest topic in digital forensics at the moment, standardisation is on the tip of everyone’s tongues. Following various think pieces on the subject and a plethora of meetings at conferences, I spoke to Angus Marshall about his latest paper and what he thinks the future holds for this area of the industry. You can find the interview here.
When I had a meeting with BlackBag a while ago, I was pleasantly surprised by how knowledgeable and enthusiastic the representatives seemed about their products. Not only were they open to showing me all sorts of things the tools could do, they also knew the back stories to how they were created, and why they’re necessary for the field.
So when I got the chance to review the latest version of BlackLight, I decided to go for it. (more…)
The book I’m gradually (veeeery gradually) writing about starting out in digital forensics will eventually have several interviews in it, to help people see what it’s really like to work in the industry. If you’re interested in being one of the interviewees, drop me a line.
In the meantime, here are a couple of interviews I did on Forensic Focus recently. (more…)
SQLite forensics is an important part of many digital forensic investigations. Most smartphones and computer operating systems use SQLite, with each device often including hundreds of databases. Despite this extreme proliferation, SQLite forensics is often overlooked in conversations about current trends in digital forensics. Paul Sanderson’s book attempts to redress the balance and bring attention to the importance of SQLite forensics. (more…)
I read a lot. I write a lot. I work a lot. Sometimes these things coincide. One of the ways they coincide is through writing books about my day job, for which I also read books other people have written.
Here are a few of my favourite digital forensics books I’ve read over the past few years, which I’d recommend if you’re looking for relevant reading material. (more…)
Mobile forensics is a growing subsection of digital forensic investigation. With the proliferation of devices, applications and operating systems available nowadays, it’s increasingly becoming a vital and complex field. The skillset needed to accurately acquire evidence from mobile devices may seem dauntingly wide-ranging, especially when so many of us are dealing with backlogs in the first place. How are we supposed to keep up to date with this ever-evolving challenge?
Luckily we have books like this to help us out. (more…)
A while ago I published a book. It’s a digital forensics textbook, and the guys over at Forensic Focus, where I normally write digital forensics related stuff, wanted me to promote it there. I couldn’t work out how to do that though: normally we either review books or interview the authors, but I couldn’t review my own book and I didn’t want to interview myself.
Enter Oleg, my co-author and very useful person, who took on more of the book than he’d originally agreed to when I got ill halfway through the process. Today I interviewed him on Forensic Focus about what he does as a day job, how he came to write the book, and what he thinks the most important current challenges are in digital forensics.
Take a look at the interview on Forensic Focus
I get a lot of demos and overviews of forensic software dropping into my life, and generally I don’t see a lot that differentiates one from the other.
A couple of weeks ago, however, I was given a demo of Nuix Web Review & Analytics, a solution which helps non-technical analysts to work on a case at the same time as the technical investigators.
I was genuinely impressed. Here’s my overview on Forensic Focus.
From the 6th-8th of December 2016, AccessData ran a Windows course in a training centre overlooking Trafalgar Square in London, UK. The aim of the course was to familiarise forensic investigators with the Windows operating system and give an in-depth understanding of its potential for analysis in digital forensic investigations.