I was part of an interesting and product online podcast today. You can check it out at: http://nopskids.com/live/
The topics ranged from hacking, forensics, how to catch hackers, and a little on how criminals sometimes get away with it. Although I didn’t give any tips on how to get away with a crime, other than DON’T DO IT, I did speak a little on some of the things that can be found forensically on a hard drive. Actually, I think I only had time to talk about one thing (the Windows registry) for a few minutes and nothing of which that has any impact on a criminal using the information to get away with a crime.
The one thing I wanted to stress that even if every top secret, secret squirrel, spy and investigative method was exposed, criminals would still get caught using the very techniques they know. Proof in the pudding is seeing cops being arrested for committing crimes. You’d figure they would be the most knowledgeable of not getting caught, but they get caught. Same with accountants being arrested for fraud, and so forth. I’ve even arrested criminals when they had in their possession, books on how not to get caught. The most diligent criminal can be identified and arrested by simple mistakes made and sometimes by sheer massive law enforcement resources put on a single case to find a criminal or take down an organization.
With that, I learned a few things from the podcast too. One of the moderators was actually a case study in my latest book (Hiding Behind the Keyboard). To be an expert, to be knowledgeable, and to be more than just competent requires talking, listening, and sharing. That doesn’t mean sharing trade secrets or confidential information, but it does mean having conversations to learn your job better.
When I worked as a jailer, I talked to every person I booked (at least the sober arrestees and those cooperating with the booking process). I asked personal questions like, “how did you get started with drug use?” and “how did you start doing X crime”? I learned a lot after hundreds of bookings. I learned so much that when I make it to patrol and hit the streets, I had a big leg up on the criminal world, in how it worked with people. That directly helped me in undercover work. I spoke to so many criminals, both as a police officer and as an undercover (where they didn’t know I was a police officer), that I learned how to investigate people who committed crimes. I was darn effective.
The point of all this is that talking to “the other side” is not a terrible idea. Working on the law enforcement side, I promise that if you have a conversation with a criminal defense expert, you will learn something to help win YOUR case. If you talk to a hacker, you will learn something to help figure out YOUR cases. The best part, like I said, nothing you give will make a criminal’s job easier. In fact, anything you say will only make them worry and make more mistakes.
If you are more-than-competent, you can do your job like a magician. My first undercover case was buying a gram of meth from a cold phone call of a guy I didn’t even have a name for. As soon as we met, I recognized the meth dealer as someone I arrested a half dozen times when I was in patrol. Luckily for me, he didn’t recognize me and believed my UC role. Arrested, booked, and convicted. This was a career criminal with dozens of arrests who probably met more cops that I ever did at that time. Still, he was arrested, by me, because I was more-than-competent in my job. Digital forensics work is no different.
Talk to everyone and share. I promise you will get more than you give. And there is no shame in learning that you don't know it all, because none of us do.
By accepting you will be accessing a service provided by a third-party external to https://brettshavers.com/
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
© 2023 Brett Shavers