All About The Latest CTFs, CFPs, C2C, & All The News For You To See

Embark on an enlightening path as we meld the celebration of Black History Month with the dynamism of mobile forensics. This episode is a tribute not only to the past but a clarion call for the future, as we honor Annie Easley, the trailblazing NASA computer scientist, while also navigating the rapidly evolving landscape of digital investigation tools. As your guides, we unravel the intricacies of open-source forensics tools, and the necessity of test devices, ensuring your knowledge remains at the forefront of technological advancements.

With a constant eye on professional growth, we're excited to share information about upcoming conferences, training and opportunities to sharpen your digital forensic skills. We share our experiences, opening doors for you to learn and grow right beside us. Our conversation takes a stimulating turn as we discuss the Rabbit R1, a new AI gadget that promises to redefine app interaction and its implications for data privacy. As we dissect the nuances of AI in fingerprint analysis, we invite you to journey with us through the maze of modern forensics, where even the uniqueness of fingerprints is called into question.

As we wrap up, our passion for the subject matter shines through with the introduction of cutting-edge features in mobile forensics updates, and the vital role of resource management in our field. We laugh over the meme of the week but also reflect on the serious undertones it brings to the prioritization of forensic cases. Closing the session, we express our heartfelt gratitude for the engagement and support that fuels our podcast, leaving you with an anticipation for deeper discussions and discoveries in the episodes to come. Join us, and together, let's shape the narrative of digital forensics and its rich connection to history and innovation.

Notes

Honoring Annie Easley-Black History Month Feb 2024
https://elective.collegeboard.org/annie-easley-computer-science-pioneer

Testing and Validation
https://www.hexordia.com/blog-1-1/unlock-rooting-pixel6a
https://blog.d204n6.com/2020/08/setting-up-testing-lab-of-ios-and.html

Paraben Forensic Innovation Conference
https://pfic-conference.com/

Free Android Training from Belkasoft
https://belkasoft.com/android-forensics-training

Cellebrite Case to Closure Summit and Awards
https://global-c2c-summit-2024.cventevents.com/event/ec371a30-107d-4ce4-8bad-44e331148339/summary
https://cellebrite.com/en/c2c-summit-digital-justice-awards/

Magnet Virtual Summit/Capture the Flag
https://magnetvirtualsummit.com/
https://magnetvirtualsummit.com/capture-the-flag/

Rabbit R1
https://www.theverge.com/2024/1/9/24030667/rabbit-r1-ai-action-model-price-release-date

AI- Fingerprints Unique or Maybe Not?
https://www.cnn.com/2024/01/12/world/fingerprints-ai-based-study-scn/index.html

Layoffs Due to AI
https://www.theverge.com/2024/1/14/24038397/google-layoffs-just-the-beginning

Hidden Gem in iOS 17
https://www.linkedin.com/posts/luca-cadonici-41299b4b_ios-ipados-passcode-activity-7152770642168160257-VJ7C

Android Auto Reboots
https://www.bleepingcomputer.com/news/security/grapheneos-frequent-android-auto-reboots-block-firmware-exploits/

The LEAPPS
https://github.com/abrignoni

Insights, Insots, Inseyets!

Get ready to navigate the complexities of digital forensics with the latest industry insights, as we shine a light on Cellebrite's recent rebranding journey. From the quirky 'EYE' twist in their new product names to the strategic significance behind the move, we've got it all covered in a dynamic discussion that promises to clarify and critique the changes afoot. Plus, we'll dive into how Cellebrite is contributing to the tireless work of child protection organizations, aligning tech advancements with noble missions.

We will guide you through our thoughts relating to advertising effectiveness in the forensics domain, and why the quality work of forensic professionals trumps any single tool on the market. The art of communication from businesses about their products and the role of technology in boosting company progression is key.

The conversation turns to the exciting potential of recent password recovery innovations from Arsenal Recon's Password Sledgehammer and new support for location based and messaging applications in the LEAPPs!

As we wrap up, the discussion turns to the thrilling possibilities of Android device analysis and the ever-evolving policies of giants like Google. We're not just talking about the next big thing; we're living it, breathing it, and sharing our experiences with you. So plug in, turn up the volume, and prepare for an episode that’s as informative as it is engaging.

Notes:

Operation Find Them All-
https://abcnews-go-com.cdn.ampproject.org/c/s/abcnews.go.com/amp/Business/wireStory/cellebrite-donates-ai-investigative-tools-nonprofits-find-missing-106321858

Magnet Forensics Acquires High Peaks Cyber-
https://forensicfocus.com/news/magnet-forensics-acquires-high-peaks-cyber-further-bolstering-the-magnet-graykey-labs-research-team/

Arsenal Password Sledgehammer-
https://arsenalrecon.com/products/arsenal-image-mounter/downloads

Life360 Stark4N6-
https://www.stark4n6.com/

Analysis of Android Settings During a Forensic Investigation-
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html

Google Location Data News!-
https://www.forbes.com/sites/cyrusfarivar/2023/12/14/google-just-killed-geofence-warrants-police-location-data/?sh=245f8f422c86
https://www.washingtonpost.com/technology/2023/12/14/google-maps-location-history/

New Year, New Tools, New Ways of Thinking!

Ever found yourself piecing together a complex jigsaw puzzle of digital evidence? That's precisely the journey we invite you to embark on in our latest episode packed with tools, tales, and tech. We're not just talking shop; we're handing you the magnifying glass to examine the intricacies of JSON files with JSON CRACK, and introducing a python tool to automate investigations involving Google Drive File Stream artifacts, DriveFS-sleuth.

This episode is a testament to the craft of digital forensics, featuring a blog from Mattia at Zena Forensics that aides in answering the question, "Has the user ever used the XYZ application?". As we unpack the nuances of reverse engineering and celebrate the updates to Hexordia's Evanole, we're reminded that the heart of digital forensics beats to the rhythm of relentless inquiry and meticulous method.

We delve into the advanced research and exploitation methodologies With Magnet GrayKey Labs and converse about the importance of these capabilities as well as validation. This is coupled with a live demonstration involving SEGB files and the data that can be overlooked without research and the validation of multiple tools.

Raise your glasses—here's to the exuberant spirit of learning and the relentless pursuit of truth that defines our community. So, are you ready to elevate your understanding of the digital landscape and smash those New Year's resolutions? Join us, and let's make 2024 a year of 4K clarity—in forensics and beyond!

Notes:

JSON Crack-

https://jsoncrack.com/

DriveFS Sleuth — Your Ultimate Google Drive File Stream Investigator!

https://amgedwageh.medium.com/drivefs-sleuth-investigating-google-drive-file-streams-disk-artifacts-0b5ea637c980

https://github.com/AmgdGocha/DriveFS-Sleuth

Advanced Research and Exploitation Methodologies With Magnet GRAYKEY Labs

https://www.magnetforensics.com/blog/advanced-research-and-exploitation-methodologies-with-magnet-graykey-labs/

Has the user ever used the XYZ application?

https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html

Evanole New Year Reveal!

https://www.hexordia.com/evanolece

Christmas Miracle: Android Memory Forensics. Doing what we didn't know was possible.

Ever thought about the thin line between privacy and morality? Well, join us, , as we deep-dive into the ethical complexities surrounding this issue in today’s digital age. We bring to you exciting updates from a recent workshop in Panama, where enlightening exchanges with digital forensics experts from all over the world were had.

Our exploration takes us through the workings of XRY and XRY Pro, as well as RAMDCoder, a game-changer in analyzing memory dumps from Android devices. We'll show you just how to navigate this tool, offering a glimpse into the future with the upcoming updates that promise to revolutionize device profiling. Intriguing, isn't it? Get ready as we take on mobile device forensics, focusing on the Samsung Galaxy S21 Ultra, and the treasure trove of data within its RAM. Learn from our experiences, including how we recovered from missing a crucial step in the extraction process. Oooops user error strikes again!

As we wrap up, we'll discuss phishing attacks and the crucial role organizations play in preventing them. We believe in the power of research and validation, especially in the digital forensics field. We’ll also share insights from Jessica Hyde of Hexordia, underscoring the importance of peer-reviewed research in our field. Get a good laugh as we humorously compare Apple to Darth Vader, highlighting the challenges they present for forensic examiners. SEGB for the WIN! This is an episode that you will not want to miss!

Notes:

Chat encryption: A moral responsibility or a moral abdication?

https://arstechnica.com/tech-policy/2023/12/meta-defies-fbi-opposition-to-encryption-brings-e2ee-to-facebook-messenger/

What makes epoch timestamps tick?

https://www.cclsolutionsgroup.com/post/what-makes-epoch-timestamps-tick

CheatSheet: https://assets-global.website-files.com/5f02f2c93eab87a6ea84e2f3/656da27da36e0c5cd1715d8a_EpochCheatsheet.pdf

MSAB XRY:

https://www.msab.com/

BrowserState.db last_visited_time?

https://doubleblak.com/beta/browserstate

SEGB Parsers!

https://github.com/cclgroupltd/ccl-segb

What To Expect When You Are Expecting in a Digital Forensics Class, Two Hardware Solutions, One Neat Tool Capability For Windows, and a Partridge in a Pear Tree.

Get ready to journey into the world of digital forensics as we share our insights on the crucial art of utilizing a diverse range of tools. A single tool just won't cut it, and reliance on just one could cause you to miss out on important finds. We also give our listeners the floor, inviting you to voice your thoughts on the IACIS Advanced Mobile Device Forensics class, and the topics you'd love to see covered.

How do you feel about forensic extraction tools? We dissect unique features of tools like duplicators, TX1, and Atrio, and dive into latest updates from OpenText and ArcPoint Forensics. These updates have made it possible to create Android and iOS backups using duplicators, a game changer in the field. With Atrio, we open up an intriguing discussion about their forensic triaging and AI capabilities. We discuss the role of AI in identifying CSAM and brainstorm ways to enhance the tooling.

We share our own learning experiences from various classes, highlighting the absolute necessity of continual learning and outside research in this ever-evolving field. We also explore the features and potential of Arsenal, a digital forensics tool which aids in mounting and virtualizing E01 images. The unique capabilities provided by Arsenal to bypass the password to a Windows logon screen and access DPAPI-protected data is a must try! Whether you're a seasoned expert or just dipping your toes in the water, this episode is sure to pique your interest in the vast world of digital forensics.

Notes-

IACIS Advanced Mobile Device Forensics (AMDF)

https://iacis.com/training/amdf-advanced-mobile-device-forensics/

OpenText Duplicator Update

https://www.youtube.com/watch?v=L3qGa7H6NBs

ArcPoint Forensics

https://www.arcpointforensics.com/

DFIR Diva-

https://dfirdiva.com/

Arsenal Recon-

https://arsenalrecon.com/

Hexordia Mobile Data Structure-Virtual Live Training-

https://academy.cyber5w.com/courses/hexordia-mobile-data-structures-dec-2023

Vendor Transparency, Mobile Device Extractions, & Brigs Learns the Difference Between Validation and Verification

We are back with a mind-boggling conversation about our experiences, and the ever-evolving face of digital forensics. We're going to share some personal anecdotes, enlighten you about the changing UNIX epoch timestamp, and even discuss how we cope with the advancing age in this fast-paced world.

In the digital world, knowledge is power. We will reveal an amazing cheat sheet from Cellebrite that will simplify your understanding of extractions and the data that they yield. We’ll also delve into the concept of tool transparency, highlighting the pros and cons that come with it. We’ll help you understand why it's crucial to be informed about known bugs in a tool, and navigate the complex process of bug reporting. We’re going to discuss why it's essential to have multiple tools in your arsenal for data validation, and how manual validation is a must when it relates to key evidence.

As we wrap up, we'll talk about the implementation of ALEAPP and iLEAPP in Paraben and its capabilities to choose artifacts to report on. To add some levity, we'll also share a humorous meme that perfectly captures the essence of the repercussions of failing to validate your digital data. So, prepare to embark on a journey that’s bound to make you rethink everything you know about data extraction and tooling analysis.

Notes-

Scholarship Reminders

-https://www.iacis.com/will-docken-scholarship/

-https://www.iacis.com/womens-scholarship/

-https://www.magnetforensics.com/blog/2023-magnet-forensics-scholarship-program-apply-today/

Cellebrite Data Extraction CheatSheet

-https://www.linkedin.com/posts/heather-mahalik-cellebrite_data-extraction-cheatsheet-activity-7125138491805462528-l5-5/

-https://cellebrite.com/en/episode-23-i-beg-to-dfir-data-extractions-explained-ffs-afu-bfu-advanced-logical-digital-forensics-webinar/

Paraben

-https://paraben.com

Digital Forensics, Moot Court, and New Tool. Come Down the RabbitHole ™ with Us!

Curious about how digital forensics can unlock the secrets held by your tech devices? Join us as we shine a light on RabbitHole, an ingenious tool devised by Alex Caithness of CCL Solutions Group. This episode is sure to be a revelation, as we delve into this unique amalgamation of data format viewers. The plot thickens as we, act as your guides, to dissect the complexities of the RabbitHole - reparse feature, the free form report builder, and the remarkable ability to extract data from various sources.

We step away from the tech talk for a moment to underline the crucial role of Moot Court in nurturing digital forensics examiners. We debate the need for a supportive environment that allows mistakes, honing professionals in the field. We discuss the highlights of what qualities are needed to shape a great witness and throw light on two free cybersecurity courses related to expert witness testimony.

Don't miss our discussion on the new additions to iLEAPP! Media events from the knowledgeC database and connecting Discord attachments to message threads.

Finally we discuss changes to Shellbag artifacts that were implemented in Windows 11 updates as outlined by 13Cubed, and the meme of the week!

So, are you ready to tumble down this fascinating digital RabbitHole with us?

Notes:

CCL Solutions-RabbitHole-

https://www.cclsolutionsgroup.com/forensic-products/rabbithole

Courtroom Testimony Trainings-

CYBRARY.IT-https://cybrary.it/course/dfir-investigations-and-witness-testimony

NW3C-DF501 Expert Witness Testimony - Digital Forensic Examiners- https://www.nw3c.org/UI/CourseCatalog.html

Connecting Discord Attachments to Message Threads-

https://bluecrewforensics.com/2023/10/30/connecting-discord-attachments-threads-sdwebimage-library/

13 Cubed: An Important Change to ShellBags - Windows 11 2023 Update!

https://www.youtube.com/watch?v=M1nyMIu1Y18&t=4s

Shellbags Explorer by Eric Zimmerman

https://ericzimmerman.github.io/#!index.md