The technical piece of DFIR is not difficult. If you know what you are looking for, and you know how to find it, the work is actually easy. I do not say this to mean that anyone off the street can do this work without training or education. I mean this as in once you are technically competent, the actual work allows you to excel even more so, technically, because it becomes easier.  But this is where a bottleneck holds up progress in the DFIR cycle. The presentation phase of DFIR work is the only piece that turns the most competently proficient forensicator into a little kitten.

The Too Long: Didn’t Read version of this post

If you can’t effectively tell the story of your DFIR work, your DFIR work doesn’t matter, no matter how good you are.

Now for the important details

Since I am a visual learner, colorful infographics and flowcharts make it easy for me to understand a concept. In DFIR, we have lots of these, for which I am grateful. Cycles of this, that, and the other, all showing easy-to-follow workflows.

One problem with an infographic is that the information is generally very minimal. For DFIR, we have many visuals that broadly display a “Cycle of DFIR” as:

1. Create a plan of the work
2. Do the work
3. Evaluate the work
4. Repeat

This is good. Practically every infographic related to DFIR, or the Intelligence/investigative cycles give varying visuals of Wash > Rinse > Repeat.  The one-piece that I see little on is that of the importance of being just competent in the presentation as in technical. And eventually, the presentation is the end of an investigation or response. No case is never-ending. Some are longer than others, but eventually, there is an end of some sort.

Who should be chosen as the best person to present a finding or case?

Every person on your team must be proficient to some extent in the presentation of their interpretation of data. Data can be a single artifact or the entirety of an incident/investigation, and everything in between. Not being able to effectively present evidence nearly negates doing any work at all. Let me say that again: If you can’t tell the story of what you did, then nothing you did matters.

You may have done the most awesomeness of DFIR work in the world, but if you can’t relay the story of that work, it was for naught. This applies to any work. If a police officer makes an arrest of the most violent felon in the community but cannot effectively present the facts of the investigation to a court, then the violent offender might not be convicted and go free. If a forensic analyst finds the key artifact on a storage device but is not able to describe the why and how of that artifact, then that artifact is meaningless along with the effort to find it.

The reason that ‘we’ do not take presentation seriously is that ‘we’ understand what we did. We understand what happened. And we expect everyone else to know exactly what we did without us having to explain ourselves. This is partly due to ego (see my post on ego in DFIR).

Presentation Training

Where are the courses in presentation? How about courses in court testimony? Sure, I have seen one or two over the past decade, but nothing as compared to the technical courses available. Not even close. Yet, every technical training course in the world is useless if the presentation is not up to the same level of competence. It is one thing for a policy to state, “Evaluate the actions taken” and quite another to train and give someone the experience in relaying technical information to another.

The newest and most junior person on a team must be able to present their work to their supervisor or trainer. Expect the presentations to be better over time, and this is up to the seniors to critique the juniors.  An attorney-friend of mine always preferences his questions to me with, “Forgive me, but to make sure I understand what you are going to say, pretend that I am a fifth-grader.” My friend-the-attorney is on the genius level of IQ and knowledge, but he has his ego under control enough to make sure he is going to understand what is coming.

Report writing is presentation?

I’ve not met anyone who loved writing reports. I have seen some do more work to get out of writing a report than the time it would have taken to quickly knock out a sheet of paper with words on it. Report writing is a presentation and should be taken just as seriously as speaking in front of 500 people or the CEO of your organization.

Report writing is also a fantastic training opportunity for junior DFIRers. If someone can effectively get the words on paper, they most likely will be able to get the spoken words out as well. Both of these take practice. It will never be perfect. But it will improve over time. And it will keep improving as long as the practice and experience continue.

Are you in charge?

Train your team to present! You will benefit your team more than you can imagine with just a few minutes at a time. Have a team member write up a half-page of an artifact (or anything) and explain it to everyone. Be sure that every person is verbally engaged in debriefs and evaluations. Encourage and require every person to present their work, their opinion, and their suggestions in both a written and spoken format.

Your team will grow by leaps and bounds when every person can articulate their reasoning, their opinions, their findings, and their conclusions. If there is one person that cannot do this, you have a weak link that will minimize the work of the team, regardless of how technically competent that person may be.

Motivating your team

Sometimes you may have a team member that does not see the importance of being able to explain effectively. Expect it. They simply don’t care that someone else doesn’t get it. This is your weak link and one way to motivate someone who doesn’t want to present their story (ie, their work), is to require it. I’ve not met good senior leadership who wouldn’t take a few minutes out of their day to help their organization, specifically helping someone in the organization that may need it. With this, I have had juniors who just didn’t get the importance, ultimately get the importance when being told to explain their work to the ‘big boss’ and that the ‘big boss’ better be able to understand the story in less than 2 minutes. Motivation achieved!

Becoming a better storyteller

Speak in front of others. Speak some more. Then when you think you got the hang of it. Keep speaking. If you happen to throw up occasionally, you are on the right track. (see my post on Puking in DFIR). I am speaking at a few events in April, May, and later this year. All are virtual, but the experiences of presenting are just as important to me as the information that I hope to convey to others. There is no point in your career where you don’t have to practice presentation skills because you obtained competence. Competence is like a sinking boat. Once you stop scooping out the water of a sinking boat, it will sink. Same with presenting DFIR information: once you stop doing it, your competence will wane.

When does presentation happen?

Ultimately, at least with a legal or internal investigation, there is a final presentation. This is the last chance to fully tell the story of your analysis. The final presentation should be a culmination of all the other presentations that should have occurred during the investigation to team members.

There are intermediate points in any analysis where periodic updates are given, questions asked, course directions changed, and leads followed. Use each of these opportunities as experience in storytelling as you adjust the story to the varying audiences you have. The same story told to your team will need to be told much differently when told to decision-makers who are outside of your technical world. These are valuable experiences that teach you how to change the pace, flow, and language based on your audience when telling the same story. This is a skill that can’t be bought and more importantly, can’t be faked.

About that motivation

If you are like me, whenever you get a task assigned, or volunteer to do something, tension starts. You want to do a perfect job. You don’t want to make any mistakes. And you over prepare to expect the worst.  This is what happens when you agree to present on a topic. Hours to prepare over weeks for a short presentation. Then checking your presentation. Then research again to make sure nothing changed since the last time you checked your information.

In addition to re-learning the topic, however, is that the experience of presenting will make sure that your next presentation will be even better. So, every presentation that you see someone do, keep in mind that that presentation was probably better than the last one, but won’t be as good as the next one.

I'll be at @NCCC_MA's cyber crime conference (virtually) on April 27.https://t.co/AEmFaRyMEb #DFIR pic.twitter.com/0D7ya0jFuI

— Brett Shavers 🙄 (@Brett_Shavers) April 16, 2021

Come join me and many others this year at the @MagnetForensics
Virtual Summit #MVS2021 #DFIR.

Registration can be found below & YES it's FREE!https://t.co/zECTwOkAp9 pic.twitter.com/IOOXdKWtRV

— Brett Shavers 🙄 (@Brett_Shavers) April 10, 2021

To those who helped me

I will openly admit that I have held some serious grudges in the past with team leaders. I distinctly remember one of my squad leaders in the Marines who ordered me to describe a field mission to my section leader because I didn't put the effort to explain it well enough to my squad as asked.  To be honest, I put no effort in it to my squad as I thought it was a waste of time.  After all, we had been planning that thing all day together....we all knew what we were going to do. That was a painful lesson to learn, but was needed. I used the same lesson many years into my law enforcement career. For those who helped me comprehend the importance of telling a story, I hope to repay that patience of dealing with me with my continuing to help others learn the same lesson.

Tell the story of your work so that it is understood. Decisions are made from it. Your competence is judged by it. And depending upon your job, you could have someone's life, liberty, or livihood hanging on the balance of your spoken words.

I was asked an age-old question via a Twitter DM today:

"Should I pull the plug or image live?"

I thought this was a rhetorical or 'homework' question, because how would I know?  I gave a short answer of it depends on this and that, assuming that the question was being asked generally. But then,

....he messaged that he was standing in front of a machine, onsite, and was wondering which was best...oh my..

Some of the problems

I sincerely did not know which was best because:

(a) I was not there,

(b) I was not part of the planning process,

(c) I have no idea of the case/data objectives, and

(d) I have no idea of the machine configuration.

Apparently, this forensics company had no plan other than to meet onsite and image whatever computers were there...

Some solutions

My only and best answer ended up being:

(a) Make a reasonable decision for today and

(b) Make a plan next time.

The forensic process begins before processing forensics begins

We hear all the time about making plans before starting work. "Work" can be a highly critical military mission or just driving to the office. Both require a plan. The highly critical military mission will have many more details and require more time to prepare than simply driving to work, but both require planning. If you think that driving to work doesn't require planning, then I would assume that you are continually late to work.

If we visualize what "forensic processing" is, we tend to think of things like indexing, running Python scripts, filtering data, and carving data. Rarely do we think of planning as part of forensic processing, yet planning should be considered the number one top tier aspect of every DFIR "operation". Before starting any process on data, you need to make a plan, regardless of your evidence being a 1MB file or 1PB of storage on dozens of devices.

No plan survives first contact

Few things go perfectly as planned, no matter how much time and effort you put into the plan. You would be mistaken to take that to mean planning is a waste of time. It simply means that you cannot plan for absolutely everything, but you can plan for many things, and for those things that were unforeseen, you will handle them on the spot. Having a plan gives you more time to make decisions. More time to think means less chance of rash, uninformed, misinformed, or ignorant decisions.

So the next time my Twitter DM buddy goes onsite, he will have a plan on how to approach devices. Even if the plan is to dead box image everything (ie: pull the plug), having a plan for devices where pulling the plug is impossible or unreasonable (encryption, etc..), can be made beforehand. This reduces time to preserve data, decreases risk of data destruction, and increases success in collecting all targeted data.

No. I am not just talking about pulling the plug

There is not a time that I touch evidence without a plan unless the evidence is unexpectedly placed in my hands. This goes way back to working a district as a police officer. If I saw evidence, I would have some plan of how to (1) identify and preserve the evidence and (2) how to collect it before touching it. Sometimes this would take half a second and on occasion, it would take hours. The same applies to electronic evidence. Do not process it without a plan.

Case failures

Cases can fail by no fault of your own. And they can fail specifically and spectacularly because of you. Personally, I'd like to take myself out of the failure equation with planning and then use the gifts of planning to address the unforeseen circumstances.

Plan for the known to give you more time to handle the unknown.

Practical Benefits

In case none of this makes sense or means much to you, here is the practical aspect to take to the bank: If you were to spend 30 minutes planning your DFIR work (collection or analysis or presentation or etc...), you can save days or weeks over the life of that one case.  DAYS OR WEEKS by spending MINUTES to plan. ON EVERY CASE. Have you ever wondered why a coworker can plow through case after case, doing great work while you might be struggling to keep your head above water? hint...it is not because of being better skilled...

If you are overwhelmed with work (who isn't?), you can mitigate a good portion of that caseload with proper planning. I have seen investigators drowning in a heavy caseload for the sole reason of failing to plan anything on any case. At some point, it is obvious that an investigator is the bottleneck in cases being late or unfinished because the investigator, or analyst, chooses to not plan.

Side note: I asked permission to blog about this from the person who DM'd me with a promise of not disclosing the name of the person or company.  I think it important to share past errors to reduce future errrors.

We are of a curious mind, we the forensic examiners, private investigators, OSINT professionals, and journalists. Our work is for the public good, and we are skilled in the effective wielding of the most powerful weapon on the planet: INFORMATION!

We are experts in searching for it. Experts in interpreting it. Experts in sharing it. Experts in creating it. Sometimes, we are completely inept, or even malicious in handling it and totally screw up.

Ethics matter

Ethical behavior not only keeps your reputation solid but also keeps you from being sued or jailed. The cancel culture falls into a category of ethics, where if an infosec professional engages in canceling a person on the Internet, they are (in my opinion), the epitome of being unethical by wrongfully turning legitimate OSINT into the Baseball Bat of Internet Mob Justice. Ethics matter. The truth matters.

A recent example. Welcome to 2021.

Refer to the story for details (https://patch.com/illinois/chicago/trolls-wrongly-accused-retired-firefighter-capitol-riot-murder). In brief, an unidentified person (Figure 1) suspected of murder was misidentified (Figure 2). The identification was based on a posted image of the actual suspect in which OSINT was most certainly used to find a similar image online. The OSINT worked to find a similar image, but the verification of the match by the finder failed as did the action taken afterward. Rather than forward to law enforcement to verify, an Internet mob piled on an innocent person.

Could it get any worse? Sure. Once you blindly jump feet first into a rabbit hole, everything you come across that you believe to be true will become collateral damage. Even in this example, the innocent son of an innocent victim gets drawn into the wrong accusations. This may not seem to be a big deal, but the careers and reputations can be permanently damaged. Friendships, family, promotions, and even careers can be lost on a false allegation! It is so so easy to prove yourself correct if you are hellbound to do so, even when everything that you find is false but perceived in a way to support your belief.

An older example. Back to 1996

An older example from 1996 is the Richard Jewell case. Refer to the story for more details https://en.wikipedia.org/wiki/Richard_Jewell. Again, this was another misidentification, and Internet pile up that resulted in an innocent person’s life is forever turned upside down. This one was so bad that a movie was made out of the story. There are plenty of other misidentifications that you can find online or unluckily be involved in. Misidentification is not new. Law enforcement has had its fair share of accusing and arresting the wrong people for the same reason that Internet mobs have made: failure to verify and corroborate.

Did I somehow forget that I dated Nicole Brown Simpson?

Part of my incredible year of 2020 was getting a phone call from a reporter. I get calls from reporters on occasion, but this one was totally different. The reporter asked if I wanted to give him a statement before he printed an article about me having an affair with Nicole Brown Simpson in 1993.

First off, this didn’t happen. My shock was how could I be accused of something that I didn’t do by a nationally recognized reporter? Second, I immediately had visions of being splashed across the Internet of having an affair with OJ Simpson’s wife! My wife would not be pleased….

The details on this story, as told to me by the National Enquirer reporter was that he was holding photos of me arm-in-arm with Nicole Simpson in Cancun or Cabo San Lucus (I forgot which he said) in 1993. I told him that he has the wrong “Brett Shavers” but his response was that his ‘database’ was correct. I suggested that he not print the story because it is false, but if he did print it, to let me know because I’ll see what crazy mileage I can get out of it, mostly to write a blog post about it.

Then it got a little weirder. I told the reporter that I was in my first year of patrol in a police department during that time and I probably wrote a ticket or made an arrest on the alleged date of the photo, didn’t take any vacation that year, and married (my wife would certainly know if I flew off to Mexico without her and our kids!).

The reporter’s first reaction: “So you’re telling me that law enforcement was involved in her murder?!?”

So now you have a reporter who accused the wrong person and immediately created a conspiracy that law enforcement was involved in a murder and ready to write a story about that.

All I said was that he needed to check his sources and verify and that if he printed the story, I’d prove it false and go from there. By mere coincidence, I had a dated photo of me from a local newspaper from that time frame. I emailed it to the reporter and I think the reporter accepted that I looked much different from the person in the photo that he had. The more I think about it, that probably means that the guy with Nicole Simpson was better looking than me....

The point of this story is that anyone can be falsely accused by anyone for anything, and once the Internet dogs of war have been released, irreparable damage will occur. On top of that, this reporter was so dead set that I was the Brett Shavers that dated Nicole Brown Simpson, that he immediately jumped to a conclusion that since I was in law enforcement at the time, that law enforcement must be involved in her murder!  I do credit the National Enquirer for actually double-checking and finding out that they had the wrong person. Of course, if they printed their photo, my photo (backed by a local newspaper) would prove it to be false. Still...don't do this!

Unleashing the Internet dogs of war!

One thing about mob rule is the lack of personal, moral, and legal responsibility. It is quite easy to create a passionate stir, lead a group of people to the edge, incite emotion, and nudge the group over the edge into an all-out attack while at the very same time, avoid responsibility for causing it, especially if done anonymously. This is not ethical.  The Baseball Bat of Internet Mob Justice does not stop. It does not think. It grows and beats the victim until nothing of substance is left.

The anonymous and double-anonymous complaints

Here is something that happens commonly on the Internet:  “I will not name this person, but they are (name a group that this person belongs to) and they did (name the social norm violation).”

This type of accusation demonizes an entire group of people for committing some violation of a social norm, and now everyone in that group is now suspect. Any person speaking up in that group will then call attention to themselves and be misidentified as the violator. Additionally, it doesn’t solve any problem and most importantly, the claim cannot be verified or disproven.

This is not justice in any sense of the word. Quite the opposite and worse when the complaint is anonymous. Even if the offender is identified but the complainant is anonymous, the offender has no way to face their accuser. Yes, I know the Internet is not a court of law, but as we all know, the court of social media is sometimes harsher than any court of law ever could be.

How does any of this apply to us?

The Digital Forensics/Incident Response field is primarily investigative in nature and as such (1) be aware of your personal biases and beliefs, and (2) take measures to keep your personal biases in check. It is far too simple to let an internal bias affect your judgment, which affects your investigative/analysis plan, and ultimately affects your conclusions.

Society does not need a law enforcement officer who has a bias against any specific or general group of people, as that bias will negatively affect the community at large and wrongfully targeted individuals.

Society also does not need unethical people who work in ethical fields to wrongly accuse others because of internal biases, beliefs, or false conclusions to what they believe to be true. Any one of us can go down rabbit holes of “investigating” someone or some event and lead ourselves down the wrong path because of preconceived beliefs, failure to verify information, and a determined mindset to prove ourselves right rather than find the truth.

Professionalism in this field requires us to be professionals to be trusted and have our word to be trusted. That doesn’t mean a stiff personality, lack of humor, no personal opinions, or being impassionate. But it does mean being fair and impartial, and also maintaining the appearance of being fair and impartial.

Best investigative method to prevent this from happening to you

Follow the evidence. Disprove that which is false. Prove that which is true. Confirm, verify, corroborate.

In my law enforcement career, I have seen a few examples where investigators did not do this. In one example, a search warrant was served on an innocent family’s home. The warrant was served by SWAT (I was not on the team at that time), but SWAT was innocent. They only served the warrant as written by the case investigator and signed by the judge. The investigator failed at the most basic task of verifying an address. The address on paper wasn't even close to the physical address. I’ve seen this almost happen in another warrant service, but fortunately, I was aware of the real address and stopped the warrant from being served while the team was AT THE FRONT DOOR! Again, this was an instance of not verifying information.

In every instance (there are more!), verification was not done. Investigators had a belief and followed only the evidence that supported their belief. When an investigator does that, every single time they will prove their beliefs to be right, when factually, they were wrong. This never ends well.

All of us are prone to making mistakes with assumptions. Unfortunately, there is not much accountability when this happens with Internet allegations. Reporters may falsely accuse someone, ruin the person’s life, and the only accountability is publishing a correction article. On the Internet, people delete their posts and walk away without care that the Internet remembers forever.

On the Internet, accusations can be made, even anonymously, spread through the Internet like a virus, and even if proven to be false, no accountability to the accuser when destroying someone’s life. We need to be better than that, and if any of us falter, others should take the care to gently remind to take a step back, breathe, and verify before releasing the dogs of war online.

**side note**

I was "OSINTing" the reporter while on the phone and verified his name, number, email, and other information.