Let me disclaim a bit.  I don’t know everything about writing or publishing.  All I know is what I have done.  With that, I have been asked about writing books (computer/digital forensics topics) over the past few years.  Let me give my experience to anyone considering writing a forensic book.

To start, I have written three books so far, meaning that I am writing more.  Two of the three published books have had co-authors.

I’ll go through some of the questions I have been asked already.  First off, I have been flattered and humbled each time someone asks for my opinion on writing books, and each time I have answered questions about the process, I have realized that I could have done things differently or better.  Not everyone asked the exact same questions, but they are very similar.

I considered any person who wrote a book to be an ultimate expert in their field and did not feel I was at any level of credibility to write.  But, I asked someone I respected in the field who had written several books already and he said, “DO IT!”.    I’ll leave out the name of who convinced me to go for it, but suffice to say that I took his advice seriously. 

Unfortunately, all I asked was, “Should I write a book?” and didn’t ask anything about the process.  That was Mistake #1.

This was easy.  I thought of a book topic that I wanted to read about; a book that I would buy right then if it were on Amazon.  Of course, if the topic was already written and in print, I would not have written a book on the same thing as I just would have bought it. 

I thought about the topic of my first book (Placing the Suspect Behind the Keyboard) when I was a narcotics detective, years before I got into digital forensics.  The reason came about due to drug cases where I had a ton of cases where providing drug possession was difficult due to each incident (multiple persons in a car and a bag of cocaine under one seat, third party owner of a car, etc…).  Getting into forensics later in my police career, I came across the same issues in proving who was behind the keyboard in child exploitation cases and so forth.  So, that topic was in the making for about a decade.

My second book (X-Ways Forensics Practitioner's Guide) was written out of personal necessity. I wanted a book on how to use the forensic tool I use everyday.  I have never appreciated the X-Ways Forensics manual.  I find it hard to read, difficult to find the information I need, and would prefer something tell me exactly how to use X-Ways Forensics.  I had written a few things about X-Ways and posted online but figured a book on X-Ways Forensics would be best.  The manual does what it is intended to do: give information 'about' X-Ways Forensics, but not tell 'how' to use X-Ways Forensics.

My latest book, Hiding Behind the Keyboard, was written mainly as a follow up to my first book in order to add some updated information including some related mobile forensics information.  Both Placing the Suspect Behind the Keyboard and Hiding Behind the Keyboard complement each other and I wrote both to be long lasting with concepts that can be used with evolving technology.

For me, I choose Syngress.  I have a lot of Syngress books and always check for latest releases from Syngress. There are a few other publishers that print digital forensics topics, but I just like the Syngress titles and formats.  I did not consider other publishers but should have (Mistake #2) as it makes better sense to know what other publishers offer instead of just one.

I suggest go with whichever publisher publishes books that you like and would like to write in the same manner.  What I mean by this is, some publishers have strict guidelines on how you write and what your write.  If you go with a publisher that wants your book to be a college textbook, be prepared to forego a lot of your creativity.  You may have to write at a 10^th grade reading level, segregate the book into sections that can fit into a college course year or semester, plus other requirements that will make your book into a textbook.

For me, Syngress is different.  I have found that the author has so much leeway in writing that the book can be written to fit practitioners’ needs.  I enjoy forensic books that get right to the point with the author giving ‘war stories’ of how the techniques worked in real life.  I also like that Syngress books seem to speak directly to you, examiner to examiner, and not as if you are a student following a syllabus.

So, the answer is go with what fits you, and if they won’t take you, go with someone else.

I get this one a lot.  I did think about it and still do.  In fact, I will be self-publishing a book just to see how well it works.  Since I haven’t done it yet, I can’t recommend it.  What I can say about self-publishing is that you own the work.  That is a major point.  With a publisher, you don’t own the work; the publisher owns it.  That means if you want to write a 2^nd edition, you can’t unless the publisher approves it.  That might be a major issue if you are writing about your own software or something you ‘own’ or ‘discovered’ on your own.

Publishing through a reputable company gives you many benefits that can outweigh ‘owning your work’.  For example, Syngress has distribution channels set up already.  Their name is heavy.  They handle everything.  Cover design, editing, payments, sales, reprints, marketing, and author support is all covered with a publisher.  That does not mean there isn’t a cost.  The author gets a piece of the pie after everyone else is paid.  That is the price to pay and if you are working cases full time, then it most likely will be a price well paid.  If you want the least amount of hassles, find a publisher.  There are always speed bumps in a book publishing process, but when you are self-publishing, those speed bumps can turn into brick walls if you don't know what you are doing.

Oh my, don’t do that.  You can if you want.  Several people that asked me had already written most of their book or finished it.  In my opinion, I think it best to have the outline and propose the outline to a publisher.  Most publishers have a form that you can fill in the blanks and submit for a book.  If they like it, you are good to go.  If not, you can try again with a different outline to fit what they believe would be a good book.  Take a look at Syngress as an example of writing and submitting a book proposal.

One thing to think about if you are planning to write first is that you might be too late.  As one example, I had considered writing about a topic, thought about it for a few weeks, put together an outline, thought about it for a few more weeks, and by the time I decided to propose the topic, I found that someone had just said they were going to write the exact same book. I took too long (Mistake #3).  I tossed my outline and learned that it is better to propose a topic as soon as you think about because if you don’t, someone else will.  If you write a book before even letting the world know about it, you risk someone else getting a contract to write the same book when they didn’t do anything other than submit a proposal.   In theory, since your book is complete, you could publish well before the other book comes out, but that is not something I would want to do.

Well…on the first book, I had asked a few people to co-author the book with me and was turned down.  Being my first book, those rejections hit kinda hard.  I didn’t ask anyone else for fear of more rejections, so I wrote the book myself and in the end, glad that I did.  I recommend that if you are going to write several books, write at least one by yourself.  It is well worth the experience.

On the X-Ways Forensics Practitioner’s Guide, I took the chance to ask someone to be a co-author because I did not feel that I could cover the software well enough.  I had been using X-Ways Forensics since its first version (over 10 years!) but still felt I may miss something.  On a whim, I asked Eric Zimmerman and he accepted to co-write the book.  Mind you, I never met Eric, and I asked him with an email that we communicating on a separate topic.  Basically, out of the blue, I asked and he accepted.  Much easier than my first book….and of anyone in forensics to help write a book on X-Ways Forensics, Eric is the man.  I lucked out on that one.  As a side note, X-Ways Forensics has gotten a LOT MORE traction as a forensic tool due to the book, which was what I wanted.  The more people that use X-Ways Forensics, the more R&D that goes into it, and the better tool I get in the end J

For the third book, when I talked about writing it, I had several people ask to be a co-author, including some of who turned me down on my first book.  But, I had my mind set on a mobile forensics expert, who happened to be local to me.  John Bair was my first pick and I had to drive down to his office and practically con/vince him to do it, for which I am grateful he accepted.  John is one of those cops who are busy because they work and barely have time for writing a book.  I sincerely appreciated him taking time to help with the book and hopefully set him on a path of writing books in the future.

So, write one by yourself and write others with a co-author.  It just depends if you have enough expertise in a topic to write an entire book yourself, or if you need help to meet deadlines. As far as how to ask someone…just ask.  Send an email.  Call.  Mail a letter. Anything.  Just ask.  Don’t be surprised at what you get when you ask.  Those who turned me down with my first book…I know them personally, some for almost 20 years, but they turned me down.  With Eric and John, I never met either but both agreed.  You just can’t tell who will say yes and who will say no.  I recommend ONLY asking someone you really want to be a co-author.  If you asked someone the B-team because you think someone the A-team will say no, you will get what you get for a co-author. I say, go straight to the A-team.  The worst that can happen is that they say no.

I gauge the time from the date of the signed contract to the date of printing.  Anything before that day doesn’t really count.  Thinking about writing and talking about it doesn’t do much until you sign your name to get it down.

Remember that I am only talking about Syngress and my experiences, but generally expect that your book won’t be on a shelf (or Amazon) for about a year.   Most likely, you will be sending in a chapter a month until done.  Then it takes a month or so to edit it (by the publisher to fix grammar and spelling), and then maybe two or three months to print it. 

If you write faster, the book gets printed faster. If you write on time, the book is going to take time to finish.  With a co-author, you can cut the time in half.  Seriously.  You can cut the time in half.  There were several times that I thought Eric Zimmerman didn’t need sleep.  Eric is a machine.  He writes at the speed of light and I think his first drafts were practically final drafts.  John was on spot too.  When you have authors like that, your book is going to be available fast/er.

But no matter what you do, when you publish through a company, there is extra time needed than if you did it yourself.  I am certain that if Eric and I self-published, the book would have hit the stores within 5 months.  If you realize that putting a PDF on the Internet does not compare to publishing a book, you will have patience for the process.

Yep.  Doing it again already.

Yep.  Go to a publisher’s website, download the book proposal form, and fill it out right now.  Then share it with trusted peers to get their opinion.  Find a co-author if you need. Then submit your proposal.  Start now because I promise you, someone is thinking about that very same topic right now.

If you self-publish, you do.  You pay everyone.  You pay the co-author, editor, cover designer, printer, etc…

If you go through a publisher, you will have no out-of-pocket expenses, other than what you spend for your book materials (may need to buy and test software, etc…).  Everything else is taken care of by the publisher.  Part of being paid a small piece of the pie is that the finances are not your responsibility. 

This is a difficult question, because Harry Potter made JK Rawlings into a billionaire and there are more books that anyone can guess that didn’t make enough to buy a cup of coffee.  The answer, like anything in forensics, is that it depends.  If you write a popular book, it will sell.  For example, the X-Ways Forensics Practitioner’s Guide sold out before the first printing was even started. It went into a second print before the book was even available.  It just all depends.  I will say that if you intend to retire off a digital forensics book, you better write something like “Harry Potter and the Cyber Criminal.”

To get a little closer to an answer, I would say that if you really are thinking about making money with this kind of book, you can make some.  At least enough for a nice vacation every year or maybe buy a new car with one of the checks.  

Plenty. 

Co-authors: You can cut down the process if you have a co-author in a few ways. First off, share the writing and write at the same time.  For example, if you are due one chapter a month, rather than each co-author write their chapter every other month, both can write a chapter every month.  That will cut the process time in half.

Have your co-author review your chapter, and review your co-author’s chapter before submitting them each month. That cuts the tech editor’s time down to almost nothing.  It also cuts the final editing down as well.

Tracking changes: Use a file sharing program to keep track of the chapters.  DO NOT email drafts between authors and your publisher until they are FINAL.  When you email a draft to your co-author, and then you receive a draft from your co-author, then another, then one gets crossed in an email, you will all be confused to which draft is the current draft.  Some changes may even be missed.  Use something like SpiderOak or Dropbox.   Edit the files there so that all changes are tracked.  Which brings up tracked changed. Use MS Word and turn on tracked changes.  If you have never used tracked changes before, research it and you will see that it is the only way to go to keep track of changes. 

Timeliness: Get your chapters done early.  A month may seem like a long time, but I promise you that you will have one or more days that get too close to the deadline.  Procrastination is not an author’s friend.  If you are a procrastinator, don’t self-publish because it won’t happen.

Contributors, helpers, co-authors: There are a lot of people you can call upon to help with your book, and you need some of these regardless.  A co-author is optional, but like I mentioned, can be beneficial.  If you are thinking of a co-author, go straight to the A-team.  Don’t be shy.  Be prepared for a rejection, but such is life.

A tech-editor is a necessity in this field to make sure that what you think is correct is.  You don’t want to profess a forensic method to work when you are wrong.  Have your work peer-reviewed by a tech-editor.  The good thing is that you can usually pick your tech-editor.  As with going for the A-team with a co-author, the same theory applies to your tech editor.  Look at books you read, courses you attended, experts you see listed online, and pick who you want to review your work.  Ask and cross your fingers.  Then keep asking until someone says yes.  And if no one says yes, ask your publisher to find one, which they usually can if needed.

Contributors work the same way.  If there is just a single topic in a single chapter that you need help with and want a contributor, just find one and ask.  That’s all there is to it.  Add their name to the book as a contributor, the publisher takes care of the contract and payment. 

Errors: You will do your best to not make grammatical errors.  Your tech-editor will try to catch grammar errors (even though they focus on the accuracy of information more than grammar), your co-author will try to catch your errors, and the final editor (from the publishers, who I assume have PhDs in English…) will try to find any remaining errors.  BUT, there will still be a grammar, spelling, or sentence error of some sort that happens.  I have a book on my shelf that has the author’s name MISPELLED on the back cover.  These happen.  It is expected. Just do your best to minimize them.

Opinions: Before and during the process, ask opinions from those you respect, about what you are writing and intend to write.  If you hear a lot of, ‘that’s not something I would want to read or buy”, take it to heart.  You are writing for people to read it, otherwise, stick to a diary.   This doesn’t mean to forego your ideas and creativity, but be sure to write something that people want to learn about too.

Complimentary books: You will most likely get a set number of books from your publisher as complimentary copies to do with as you wish.   I suggest that instead of sending a book to mom, a book to your brother, and some to your friends who nothing to do with forensics, send them to someone who will write a review.  Your mom is going to love your book, but most likely, she isn’t going to understand what you wrote unless she does forensics.  Sure, keep one for your shelf, but give away the others to those who would have bought it.

Here comes the strange part about the comp books.  I’ve given all of my comp books away and politely asked for public reviews (on Amazon or their blogs).  Of the 99% I sent (I kept one of each book…), less than half wrote a review anywhere. I could have given the other half to family and friends and gotten a better response. Oh well.  Apparently, this seems to be the case across the board as I’ve asked and heard the same thing from other writers.  As a kind suggestion, if you ever get a comp copy of a book, write a review on Amazon.  It will be appreciated greatly.

One more thing on the comp copies.  After the comp copies are gone (maybe there were 10 or 20), they are gone.  The author does not have a never-ending supply of ‘free’ books.  If you get a book from an author that is not a com copy, that means the author bought it, usually at full price.  With bulk orders, there is a discount, but the discount is usually not better than what can be found on Amazon.  A friend of mine (in forensics) was over to visit one day and saw one of my books on my shelf.  I asked if he wanted to look at it and he thought I said, “do you want to have a free copy of my only copy left of the book I wrote?”.  And he took it…..so when a book cost $59.95, that is the price the author pays too….for the book that s/he wrote…therefore…reviews are a nice way to say thanks for book.

Practice first: I wrote a few PDFs that were put online.   Some call these “white papers”, but in reality, when we write these, they are essays that may or may not be peer reviewed.    However, they hold weight in (1) experience in writing that publishers will look at, (2) as in informal surveys in how readers respond to your writing and ideas, and (3) testing the waters of putting yourself out there.

The scariest thing is putting yourself out in the public eye.  Most of us in this field are hyper-paranoid of everything.  Few of us jump into the water without putting our toes in first.  Those who do are not any braver than you.  They just say to themselves, “screw it, I’m doing it”.   Our paranoia comes from the risks of being doxed online because we put our names online (take a look at Brian Kreb’s experiences and you’ll see what I mean).  Others are afraid of having their written words used against them in court on a case by an opposing expert or opposing counsel.   And some are just too shy or embarrassed.

My opinion on public exposure is that when you publish something, you are reputable.  For example, if you publish a book through a noted publisher, such as Syngress or Cengage, your book has been peer reviewed to the max.  It has been professionally published, reviewed, printed, marketed, and will be used as citations around the world. If you don’t want your words used in a students graduate thesis, or as fodder in a court case as a citation, or cited in other books, then don’t write.   But if you want your name to be in the same sentence as ‘expert’ or ‘reputable’ or ‘published’, then write.   Sign your name and jump into the water.  It will be either warm or cold, but jump in.

If you are curious if any of your past works (white papers/PDFs) online have been cited by others, check out https://scholar.google.com/.   You may find that your works are already being touted by others as cited works.

Dude, when you review books, be kind.  If you didn’t really the book, there isn’t a need to slam the author.  Simply say that you didn’t enjoy the book because of a, b, and c.  I’ve seen reviews of some books (thankfully not my own!) that were down right cruel.  Let’s be nice people.  No one writing a digital forensics book will be retiring off that book and really took a risk of jumping into the public eye.

These are just my opinions.  I would suggest checking out some older posts from Harlan Carvey’s blog (https://windowsir.blogspot.com/2014/05/book-writing-to-self-publish-or-not.html) on publishing.  He has written some good advice on publishing, and like I mentioned, everyone is going to have different experiences.

Lastly, if you have read this entire blog post, that talks about writing a book on some topic in digital forensics, that means you have thought about doing it.   And reading this post to the end means you even have a topic or two that you believe would make a good book.  That means I am speaking directly to you at this point and suggesting that you DO IT!

One of the workstations I have ranks up there in the clouds insofar as hardware.  You name it, this machine has it.  Lots of it.  Crammed into a huge case with lots of lights and liquid cooling hosing.  I call it the “Monster”.  No matter what I throw at it, it chews it up, spits it out, and smiles asking for more.  Seriously.  It’s a dream machine of a forensic workstation.

One thing about it however is that no matter how fast it is, or how cool it looks, it doesn’t really do forensics.  You see, I have this other little computer (laptop).  It’s really really small and light.  No CD/DVD drive, one USB port, and stuffed with high-speed hardware, but not that you can stuff that much in such a small laptop.  I call this one my “Little Baby”.

When I go somewhere, I take my Little Baby.  It does everything I need for the most part.  I would not want to try to index a terabyte or more to index, or try to do any serious processing with it.   However, this Little Baby does forensics work.  I've done forensic work in the offices of lawyers, in front of judges, and in court.  Each time using my Little Baby (I have a few, but they are all my Little Babies).  

I mean this in the manner that it’s not the machine, but the examiner, that does the forensic work.  If you forego “processing” and “indexing”, the forensic machine comparisons in speed become irrelevant and everything comes down to the examiner.  I mean everything.  The best examiner can use X-Ways or Encase or FTK or any open source forensic tool on practically ANY computer when it comes down to deep-diving into electronic evidence.  The machine allows the examiner to use a software to access the media.  That’s it.  A million gigs of RAM won’t let you examine the registry any faster than 4GB will.  Your eyes and the stuff between your ears will get the job done.

When I teach forensics, one of the things I try to get across is that it is the person that gets the job done.  Flashing lights are cool on a computer, but if the examiner doesn’t know how (or where) to find evidence on a hard drive, then the flashing lights are not going to help.  If the examiner does not have critical thinking skills to investigate (or now commonly being described as "hunting") threats or evidence, then the tools are useless.

Don’t get me wrong. I like fast machines.  I need fast machines for some work.  But that work isn’t typically “forensics” but rather automated processes like imaging, or indexing, or some specific processing or decryption. That type of work requires computing power to get done.  Once that part is done, it comes down to fingers, eyes, and brain to do the real work.

I’m not advocating to not have a Monster machine or two, but I am advocating to rely on your brain, not the machine to the analysis.

BUT.  There is always an exception to forensic machines.  If you choose to have a RAM-sucking, space-eating, and overly-hungry-system-resource software as your primary forensic software, you are going to need a Monster machine to run it.  And if you expect to take that resource-intensive software outside the lab for use, you’ll need a 15-pound laptop along with a small RAID box to bring along so you can use it.

Be able to do anything you need to do with anything you have at hand at anytime needed. I've been around a lot of people with a lot of excuses ("I can't do this without my particular workstation or my particular software or etc...").  The world of DFIR is similar to the military. Make do with what you got.  Excuses not accepted.

I’m sure Picasso could paint a masterpiece using peanut butter and jelly.   An effective digital forensics analyst could do worse than being able to run a forensic application on a little bitty laptop if she knows what she is doing.  The most important tool in DFIR work?  That's your brain.  Think critically.  Link inferences.  About hardware and software?  Those are just things to let your brain connect to the evidence.  

In short, become a Picasso of forensics.  

Someone quoted me! Super cool!

I have taught digital forensics at the University of Washington (on and off) for the better part of a decade.  I have also been a guest speaker at several universities for longer than that.  One thing that I learned from the continuing education courses is that most of the students are already working adults with many already working in the IT industry, and I take advantage of their experience by incorporating it into the classroom.

For example, I have had attorneys (prosecutors, public defenders, and civil attorneys), police officers, federal agents, software developers (some were founding members of commonly used software), and a few ‘white hat’ hackers in my courses.  Students who did not fit in any of those categories sat right next to them.
 

That was the benefit to the students: being able to absorb information from fellow students with years, if not decades, of experience.  On the first day of every course, I stress this to the students.  Take advantage of the 10-minute breaks, not by checking your email, but by talking.  Those 10-minutes breaks produce more relevant information than can be gained from a Google search, because you can talk to the people who have done it, do it every day, and want to share.  Rather than 'read' about a case, speak directly with someone who does those cases.

As for me, you better believe I took advantage of the students with experience, all for the betterment of the courses and myself.  In my prior law enforcement career as a city cop, I was a detective that worked undercover and was assigned to state, local, and federal task forces as well as investigated cyber-related crimes that spanned the planet.  I also investigated multi-national organized crime groups (drug trafficking organizations, gun trafficking, outlaw motocycle gangs, street gangs, human trafficking, counterfeit goods, etc…), terrorist cells in the United States, along with a few other crimes that took me across several states.

I give my brief background not to brag, but to show that even with my experience, I gained something from every class from nearly every person and I asked for it directly.  When I found that I had a software developer from a major software company in class, who worked on a program that I use daily…I used him for discussions in class on incorporating that program into forensic analysis reporting and visualization.  Every student in the course may not have recognized the value of speaking with someone instrumental in that one program, but we all learned new ways to use something in forensics that we would not have learned otherwise.  

Courses with law enforcement and attorneys as students also created a great amount of material and discussion based on how they do different aspects of the same job, in their different positions, titles, and agencies.  Hearing from a federal public defender talk about how forensics fits in with her work alongside a prosecutor talking about the same information but applied differently really gives the entire room a wide spectrum of knowledge.  Throwing in the investigator perspective rounds it all out. 

Granted, I’m only talking about continuing education programs.  I’ve taken and spoken at a few college degree programs where the students are students and not yet even in the workforce.  That type of class is an entirely different animal where the instructor had better know what she is talking about.  And yes, I’ve taken courses where a professor had never connected a write-blocker to a hard drive, ever…not in real life or in the classroom…never testified…never created a forensic image…yet teaches the students to do this by reading a book.  That is not the case with most schools, but certainly a few.  

In the course I teach at the University of Washington (I will call it “my” course…), I give students maximum hands-on, maximum time on the keyboard, maximum time working with the tools and maximum real-life information so that they are not only near-competent to competent, but marketable.  I call my course, “Brett’s Digital Forensics Bootcamp” (without the yelling). I don’t like wasting time and I want to teach a course that I wish I could have taken when first starting out.  That means getting your hands on data as much as possible.

One last point about continuing education programs (for higher education courses)

A conversation I had last week about DFIR certifications ended with me talking about continuing education and college degrees as perhaps a better route over certifications for certain people.  For anyone already in the IT field, I find that a continuing education certification from a major university to be ‘better’ than a vendor certification, or if not better, certainly worthwhile.  I say ‘better’ in the sense that most people in IT already have some certs on their resume.  They may not be digital forensics certs, but technology-related certs nonetheless.  Certs also expire, or are discontinued because a business goes out of business or decides to create a new cert.  Having a continuing education cert from the University of Name Your College doesn’t expire, has more clout (or is that now called klout?) through regional accreditation, and is most times considered graduate-level instruction. 

Another benefit of a continuing education course is that since the courses are not vendor specific, the whole gamut of tools can be explored along with the SPECIFICS OF THE JOB.  Vendor courses focus so much on the sale and function of their tool, little time is left to the other aspects of the job that are just as important, if not more important.  I’ve taken well over a dozen vendor courses and I cannot remember any of the courses teaching forensics, other than what their tool does for forensics.

Not knowing how to collect, analize, and present defensible evidence effectively makes the examiner ineffective, incompetent, and can ruin a case.  Especially when someone has not been taught "what is evidence", finding the elusive evidence is near impossible if you don't know what it is.  Even police officers must know the elements of a crime in order to know what a crime looks like.

Yes, you must know how software works, but you also must know the job.  It’s like driving.  You may know how to drive a car, but if you don’t know the rules of the road, you will end up getting ticketed or worse.

Most people in the DF field know or know of Jimmy Weg.  His blog was one of the most popular in the community, but like anyone, Jimmy has retired and will be retiring his blog.  

However, he has offered the blog to be used by anyone until the domain expires.  I know that one DF association (IACIS) will be archiving the blog for its members and Jimmy graciously has allowed me to archive it as well for anyone to use as reference.

Over the next weeks or so, I will be adding each of Jimmy's posts onto my blog, with Jimmy as the author.  You will be able to find all his blog posts on my blog, but under the JustAskWeg category (http://brettshavers.cc/index.php/brettsblog/categories/justaskweg).  Some of the posts are old, as in 2 years which can be old in the tech world, but the information from those posts, especially those concerning virtualization should be relevant for more years to come.  Jimmy's blog is one of those blogs that are valuable to many folks working in the DF field, and it is my pleasure to host his blog while it is still useful. Thanks to Jimmy!

About Jimmy Weg

Not to get into the long history of WinFE, but rather focus on the course I created about 2 years ago…it’s time for an update to the course.  There have been almost 5,000 people that signed up for the online WinFE course since 2014.  WinFE has been taught everywhere since its inception, from colleges to federal forensic courses to everything in between.  

Technology changes and with that, WinFE needs to be updated along with a second related topic to be included in the course.  In the next few weeks, I am updating the WinFE course and adding Linux distros to the mix (only the most current Linux forensic distros, not the outdated and non-maintained systems).  The new course is tentatively titled,

"Bootable Forensic Operating Systems"

or something to that affect of having both Windows and Linux forensic boot systems.

The intention of this new course is the same as the previous course: Give forensic analysts additional options in collection, preview/triage, and analysis.

On a side note, I have had about a dozen or so emails about WinFE telling me that;

1. You have to use a write-blocker

2. You can’t trust bootable media to be forensically sound

3. No one does it this way anymore

4. Today’s computers don’t allow booting to external media

Each time, I have said, “You’re right.  Feel free to use what you want.”  I really don’t see a need to argue with anyone set in his or her ways in the DFIR field.  My opinion is simply that if something works, use it.  If something doesn’t work, don’t use it.  This applies to WinFE, a Linux forensic boot disc, or a write blocker as much as it applies to X-Ways, EnCase, or FTK.

Seriously, if WinFE works for you in a given situation, and you have a choice, feel free to use it.  It’s been battle-proven more than enough.  Same with the Linux distros. If you like it, and it works, and it fits to your needs, why not use it.

With that, I still believe forensically sound bootable media still has its place in the forensic world.  The upcoming course will talk all about it, including building a WinFE and perhaps even putting together your own Linux distro.

…only with decryption, and even at that, it does everything else superbly.

I probably caught your attention if you are an X-Ways Forensics user.  The only thing that sucks about X-Ways Forensics is that it doesn’t do encryption.  By “doing encryption”, I mean that it doesn’t decrypt encrypted files or systems.  Besides that one aspect of forensic work, X-Ways Forensics rules.

**UPDATED X-WAYS FORENSICS PRACTITIONER’S GUIDE ONLINE COURSE**

I completely updated and extended an online course based on my book, the “X-Ways Forensics Practitioner’s Guide”.  It has taken some time to create a course that has 95% of what you need to use X-Ways Forensics without being an overly long instruction of the software.  The remaining 5% changes every week or so with new features and updates added by X-Ways.  This course covers X-Ways Forensics up to version 19, but know that X-Ways will be adding new features every week that aren’t included in this course yet.  After enough ‘little’ features and improvements have been added, more content to the course will be added as well.

Here is the gist of this post

My personal experience with X-Ways Forensics started because I was a curious about a ‘new’ forensic program based off of Winhex. I only tried X-Ways Forensics because (1) it was cheaper than anything else, (2) looked kinda cool, (3) and got deep into the actual files like a hex editor.  However, I tried to figure it out and the best way to do that was to host a course.  The only reason I gave X-Ways Forensics a chance was because X-Ways agreed to give a training course in Seattle if I would arrange it, their first course ever.  After seeing how X-Ways worked in that one course, I was hooked using X-Ways Forensics as my primary forensic tool for well over a decade.

I have met many examiners who have tried to use X-Ways Forensics and have nearly always gone back to their other tools, like Encase or FTK.  Mostly, I see this to be because of fear of change and lack of information to use X-Ways Forensics.  There were no books about X-Ways Forensics.  The manual was (is) clearly lacking in giving instruction in using X-Ways, the courses were (are) expensive and not typically where you’d like them to be.  Compared to Encase, as one example, books on using Encase have been around for some time, Encase has been taught in government forensic courses for well over a decade, and courses have been planted everywhere around the world for so long that it seems strange to not have a course local to you every year or so.  Plus, the other tools throw parties, like huge beer fests poolside in Vegas or somewhere neat.  X-Ways? No parties.  No beer fests.  It’s all down and dirty with hex, which is just the way I like it.

The manner in which this online course works is similar to the book that Eric Zimmerman and I wrote on X-Ways Forensics.  We wrote, and titled, the book for practitioners.  The manual is not for practitioners.  Do not start reading the manual hoping to find the ‘how to use X-Ways’.  Do read the X-Ways Forensics Practitioner’s Guide to find out.  Unfortunately, books and manuals simply do not fill the remaining gap of instruction and demonstration.  Short videos on Youtube won’t do it either.  You need a course to learn what you need to learn as fast as you can learn it in order for you to be able to use it right away.

If you cannot attend the official X-Ways Forensics course due to time/money, or maybe you want a refresher to the course you took five years ago, or maybe you are in a forensic course in college that uses X-Ways, this online course is the least expensive you can find (the only one currently in the world) that fills that need.

I can promise that after you complete the course, you will have a different perspective of X-Ways.  You most likely will use X-Ways Forensics as a secondary or validation tool.  Many of you will move completely over to X-Ways Forensics and turn your other tools into secondary tools.  Some of you will turn your entire lab into an X-Ways Forensics lab that uses the “other tools” as validation.

One thing the online course does not do is teach forensics.  You might learn a little something since the course uses publicly available forensic images and gives suggestions on workflows (based on case types, such as picture intensive or user document intensive cases), but don’t expect this course to teach everything about forensics.  For that, you need to take a digital forensics course to show what a “lnk” file is, or how to examine the registry.  The X-Ways Forensics Practitioner’s Guide course teaches you how to plug the X-Ways Forensics dongle into your machine and push all the buttons you need to push to get what you are looking for.  That’s more than half the battle for any forensic software: what button do I push to get forensic artifact “x”, “y” and “z”?

Watch the introductory video (free) to get a handle on why you should take this course.  Whether you have been using X-Ways Forensics for more than a day, new to X-Ways Forensics, or thinking about trying it out, this course is the fastest, least expensive, and easiest method to learn. Bar none.

Virtual machines have always been one of the neatest aspects in computer technology.  My first exposure to a virtual machine was in a digital forensics courses I took at FLETC and I knew that this would be the coolest thing ever.  The coolness factor of being able to run one operating system (the virtual machine or VM) inside another operating system (the host) has not grown old for me especially because of the forensic and security implications that exist more so today than that day of first exposure.

It has been 10 years since I wrote the first of two papers on virtualization and forensics.  The first, “vmware as a forensic tool” and subsequently “Virtual Forensics: A Discussion of Virtual Machines Related to Forensic Analysis”.  Some of the information has been outdated, but most of the information and certainly the concepts are still in play today.  I recommend looking at these two papers to get started on thinking about VMs as it relates to your cases.

Skip forward some years after those first papers; I began to find VM use occur more often on forensic cases in civil litigation matters.  In the majority of the cases, the VMs I found were not used to facilitate any malicious activity, but did result in longer examination time of each hard drive with VMs.  In one case of my cases, a single hard drive contained over 50 (yes, FIFTY) virtual machines and each one VM had multiple snapshots and practically all were being used with malicious intent.  After that case, I made sure to include virtual machine investigative information in two books I wrote (Placing the Suspect Behind the Keyboard and Hiding Behind the Keyboard) to make sure investigators consider VMs as a source of evidence.

There was a time when computer users, including criminal using computers, were oblivious to the amount of evidence a forensic analysis can recover.  Those days are virtually gone since most anyone with a computer knows for the most part, that a ‘deleted’ file can be recovered.  In addition, with Hollywood producing movies and TV shows showing forensic analysis of computers, common criminal knowledge now includes knowing about electronic evidence that is created on computers and forensics recovers it.  Every push of a button, click of a mouse, and click of a link litters the system with evidence.  The litter (creation/modification/access/deletion of files) is everywhere in the system, spread out among various locations from the registry to free space to system files, and most can be attributed to a user’s activity.  Getting rid of every bit of the electronic litter is practically impossible, even as certain amounts can be wiped securely.

However, with a VM, all of that electronic litter, aka evidence, is kept within one file that stores the virtual machine.  The user need only wipe that one file to destroy all the electronic litter and evidence that was created during the malicious activity.   The only evidence able to be found will be on the host, and usually that will just show a VM had been started.  The malicious activity/user activity…gone.    Going a step further, a VM booted to a Linux bootable OS (even to an .iso file), will have no evidence saved in the VM to begin with.

I am not discounting other important evidence, such as network logs, captured traffic, or the evidence that can be recovered on the host machine.  That is all good evidence too, but when the actual user activity is contained in a single file that can be wiped securely, digital forensics gets harder if not downright impossible.

A recent article I read on malicious use of VMs goes one-step further.  In the article (https://www.secureworks.com/blog/virtual-machines-used-to-hide-activity), an attempt to remotely start a VM inside a compromised system failed only because the compromised system was also a VM.  Considering that scenario, a hacker starting a VM on a compromised machine can effectively hide nearly all activity within that VM by subsequently wiping it after the hacker is finished.  Incident response just got harder.

Not only are virtual machines used to facilitate criminal activity, but can also be used as a tool to compromise systems.  One creative example of malicious VM use can be read here: https://www.helpnetsecurity.com/2016/08/18/compromising-linux-virtual-machines/  where virtual machines in the cloud can be used to attack another virtual machine if hosted on the same server.  Now that is clever.

Virtual machines are here to stay for all the good uses they provide, which also means they are here for all the bad uses too.  In the world of cyber-cop vs cyber-criminal, every day is another day where each side tries to out-MacGyver the other side with something new, unique, and sometimes pretty cool.

My personal library of digital forensics books has grown from two books to two shelves of books.  All nonfiction.  All technical.  All specific to specific sub-topics in digital forensics.  My fiction bookshelf is full too, but my nonfiction bookshelf is most important since I have dog-eared and marked up each one as references.

I have bought and read so many digital forensics books that when I see a good forensic book on Amazon, I have to double-check my collection to make sure I don’t order the same book twice.  I’ve even published three digital forensics books and they also sit on my shelf because I even refer back to them as needed…and I wrote them!

When I first started in digital forensics, it was called “computer forensics”.  This was in the days of yanking out the plug from the back of the machine, seizing every mouse and keyboard, and imaging every piece of media for full exams that took weeks for each one. Training was hard to come by unless you could afford to travel for weeks on end across country. 

Luckily, I was lucky. My employer (a police department) sent me everywhere.  West coast, east coast, and the mid west.  I had in my collection about three forensics books because there weren’t any others I could find.  These few books were so generic that as a reference in doing the actual job, they were mostly books giving a 10-mile high overview of what to do.

My very first forensic case was a child pornography and child rape case that involved “one” computer in a single-family residence.  I was told it was “one” computer, but when the search warrant was served, I found a home network consisting of a server with 25 computers connected to it…plus more than 50 hard drives laying around EVERYWHERE in the house and probably no less than 500 CDs.  Wires were everywhere, tacked to the ceiling, in the attic, and under the carpet.  Some computers were running, others off.  The case detective simply said, “Get to work.”  And I had three books as a reference and training to rely on.  I was also the only forensics examiner in the department…that was a long day and the three books were of no help.

After surviving that case, I have seen more books on sub-topics of sub-topics in the field of forensics get published month-after-month.   With each book, I keep saying, “I sure wish I had this book a few years ago.”  Three of the books I wrote were books that I was waiting for someone to write, but got impatient and did it myself (with help from two other co-authors).  The books published today in the field of digital forensic and incident response are simply invaluable.  Anyone starting out today in the field has a wealth of information to draw upon, which is a good thing.

On top of the nonfiction books I have already published (including ghost writing book projects), I have a few fiction books wrapped up and ready to go.  Soon….hopefully soon…they will be published and put on my fiction bookshelf, and when they do, it will be something I’ll be talking quite a bit about.  The value of a good fiction book is just as important as the nonfiction.  Fiction may not be able to help you with your job like a good nonfiction book can, but it certainly can give you some good reading with a good story.

Due to a dozen tragedies, a half dozen fires popping up, and twice as many projects due at the same time, I’ve been way late in updating an X-Ways Forensics course along with updating the WinFE.  But now, the X-Ways course is about done to be uploaded as soon as the finishing touches are finished.  The new course includes a whole lot more than originally made and updated to the current version of X-Ways (everyone currently registered will receive an email when  the course has been published (no cost to current registrants). 

The WinFE online course will be depreciated and replaced with a longer ‘Forensic Boot CD Course” that includes Linux forensic CDs along with some updated WinFE  information.  The goal of this course is to complete cover just about every aspect of using a forensic boot OS (CD/DVD/USB), with examples of the most currently updated Linux forensic CDs.  There are plenty of outdated distros to avoid and those are not described in the course.

Until the Forensic Boot CD Course is uploaded, you can download the Mini-WinFE builder from this link: http://brettshavers.cc/files/Mini-WinFE.2014.07.03.zip  as currently, the reboot.pro download link for Mini-WinFE is broken.  I have sent the developer a message to repair it.

I have given 20 presentations this year and that was only in the first half of 2016 (although, I have not scheduled anything for the remainder of the year to finish some projects).

In each of the presentations, whether the attendees were parents, children, law enforcement, or digital forensics analysts, I have always been able to give really good examples of compromises.  On the day of the presentation or day before, I search for a recent breach and will most always find a good one.  If I search a day after the presentation, I sometimes find a new breach that would have also been a good example of a hacking incident.

So for the cybercrime preventation talks, I tell everyone that anyone can be a victim no matter what you do.  Sometimes you are specifically targeted and other times, you fall into a group of victims from a third party breach.  And the more 'third party' accounts you have, the more risk of having your personal data exposed.  For example, if you have a T-Mobile phone, Premera for health insurance, applied for a government security clearance, shop at Home Depot, and ate at Wendy's, you potentially have had your personal data or credit card information compromised five times by doing absolutely nothing wrong.

Digital forensics analysis is the easy part of an investigation. That is not to say that the work of digital forensics is simple, but rather recovering electronic data is a rote routine of data carving and visual inspection of data. Interpreting the data requires a different type of effort to put together a story of what happened ‘on the computer’.  As important an analysis is to determine computer use, it is just as important to identify the user or users and attribute computer activity to each user.  An investigation without an identified suspect is a case that remains open and unsolved..sometimes for years or forever.

In many investigations (civil and criminal), identifying the computer user is obvious through confessions or by process of elimination.  Proving a specific person was at the keyboard is barely a consideration since the person either admitted control of the device or was caught red-handed and the examiner can focus more on the user activity on the computer devices rather than spending time identifying the user.

However, simply accepting the suspect’s identity without further investigation into other aspects of the suspect’s identity may sell the investigation short.  Whether the suspect is known or unknown, compiling a complete identity of the suspect adds important information that is beneficial to a case, such as motives, intentions, and identification of more crimes.  The most important point is that a physical person that has been identified, or even arrested, does not give a complete identity of that person.  It is only the physical identity.  Investigators should strive to compile a complete identity that includes digital identities.

So what’s in it for you?

Building a case against a suspect requires more than just finding evidence.  A case needs evidence to point to a suspect as well as showing motive and opportunity.  Providing evidence of every identified persona of a suspect paints a picture of the suspect, to include intent, desires, motive, behaviors, and overall character to add to the supporting evidence.  In short, you get a better case.

The Complete Identity

A physical identity (aka biometric identity) and digital identity comprises the complete identity of a person.  Biometrical features of a person, such as fingerprints and eye color, are bound to the physical identity and typically permanent to the person depending on the feature.  Although eye color can be temporarily changed with color contacts and hair can be temporarily dyed to a different color, the majority of physical features cannot be changed without drastic injury or surgery. 

Internet users create digital trails of use and subsequently (and without intention) create digital personas based on their unique computer use.  The normal, everyday use of the Internet creates a digital identity that is based on Internet surfing habits (the Websites visited), communications made online through forums, chats, e-mails, blog posts and comments, and through the accounts created for online services to include online shopping.

Compiling the digital identity and physical identity may seem like an obvious and easy task, but assembling the identities is not so simple.  In an ideal case, a suspect has a single physical identity and a single digital identity, but in reality, a person may have multiple physical personas tied to a single physical identity and multiple digital personas.  Some personas may be intentional while others unintentional.  For example, a criminal wanting to travel in a name other than his true name may create or purchase a fake driver’s license. As he goes about using the fake or stolen driver’s license, he creates a persona under the false name.  Although this persona is not truly a ‘physical’ identity, as it is not biometrically tied to a physical body, it is part of his physical identity as he uses the false name as if it were his true name. 

One example of a digital identity is the accumulation of normal Internet and computer use.  A person’s computer use is generally a reflection of that person’s personality, desires, and intentions.  The unique activity of one device is typically replicated across devices under that person’s control.  For instance, given a new computer, a user will configure it by personal preference by arranging icons, colors, sounds, and folder structure to save.  When the user has an additional computer, both computers will have a very similar order of computer activity when used over time and will even look the same, such as the placement of desktop icons and wallpaper choice.  Configurations of the computers will likely be similar, if not exact for some items, and Internet use will most certainly mirror each other by bookmarks and frequently visited Websites.  Merely comparing the type of computer use and configuration between two or more devices can give an indication that the same person used all of the devices. 

Adding to the complexity of finding both digital and physical identity of a suspect is that of multiple aspects of both types of identity.  A person leading a double life may have two spouses and two jobs with one being a false identity.  This person is physically tied to both identities, even if the false identity contains no true information.   Leading a double life is an extreme example of a fake physical identity, and examples that are more common include using a fake ID to make consumer purchases, or using fake names to register at hotels.  The depth of a fake physical identity depends upon the person’s intention and resources. Types of physical identifiers are seen in the following figure.

Digital identities, being far easier to create, generally mean that any one person can have multiple, or even hundreds, of fake digital identities.  A harassment suspect may have dozens of online identities that he uses to harass a single victim or victims through repeated e-mails from different e-mail accounts created to appear as different people.  In any investigation, treat each digital identity as its own identity that will be tied to a physical person at some point in the investigation.  Each identity gives information about a person based on the fake identity, whether the only information is the username of an e-mail or a completely falsified social networking account.

An example of having multiple digital identities is that of one fake identity used to create specific online accounts and a different fake identity used to create other specific online accounts.  In this manner, a person is simply trying to distance himself from something (such as registering for a pornographic Website) by using a fake digital identity while using a different fake identity to distance himself from other aspects of his online life.  An investigator who can identify the fake accounts adds to the case by showing the intentionally hidden aspects of a personality, motive, or intention of the real person based on the real person’s actions under the fake digital identities.  A pedophile whose physical identity has no ties to pedophilia may appear innocent until fake digital personas are found and tied to his physical identity.

Of note is that each person has a true physical identity and a true digital identity.  Typically, the true digital identity shows the real information, such as a real name, and is easily tied to the physical person.  However, every identity and persona (real and fake, digital and physical) should be compiled together to show the complete identity of a person.  False information is just as important as the true information to build a complete picture of a suspect.

A great example of tying a physical identity to a false persona is in the Silk Road case where the creator of Silk Road (Ross Ulbricht) used his public e-mail/forum (rThis email address is being protected from spambots. You need JavaScript enabled to view it.) account on the open Internet to market the Silk Road.  One simple post eventually tied his legitimate physical identity to a secret, false, and criminal persona on the Dark Web site, the Silk Road.

Identifying the digital identity becomes easier as Big Data continues to grow exponentially through massive data collection by government and corporations.  Social media sites contribute to identifying digital identities as the connectivity between sites exists through single usernames, using the same e-mail address across online accounts, and algorithms created to ‘find’ friends based on relationships and Internet use.  The digital identity is the sum of all electronic information of a person.  Corporations have been compiling digital identities of consumers in order to focus on advertising efforts.  Investigators should focus on compiling digital identities of suspects to determine motive and opportunity.

Any investigation benefits by compiling the complete identity of suspects.  Whether the identities contain true information about a suspect is not as relevant as tying the identities and personas to a person. Motives and intentions are clearer with a complete picture of a person in both the physical and digital worlds. 

Now that you know the ‘why’, become competent in the ‘how’ in each investigation with thorough research to find the connection between each identity in order to place your suspect at the keyboard.  Digital forensic skills are necessary and important, but solid cases usually need some old fashioned, gumshoe detective work too.

I was part of an interesting and product online podcast today.   You can check it out at: http://nopskids.com/live/

The topics ranged from hacking, forensics, how to catch hackers, and a little on how criminals sometimes get away with it. Although I didn’t give any tips on how to get away with a crime, other than DON’T DO IT, I did speak a little on some of the things that can be found forensically on a hard drive.  Actually, I think I only had time to talk about one thing (the Windows registry) for a few minutes and nothing of which that has any impact on a criminal using the information to get away with a crime.

The one thing I wanted to stress that even if every top secret, secret squirrel, spy and investigative method was exposed, criminals would still get caught using the very techniques they know.  Proof in the pudding is seeing cops being arrested for committing crimes.  You’d figure they would be the most knowledgeable of not getting caught, but they get caught. Same with accountants being arrested for fraud, and so forth.  I’ve even arrested criminals when they had in their possession, books on how not to get caught.   The most diligent criminal can be identified and arrested by simple mistakes made and sometimes by sheer massive law enforcement resources put on a single case to find a criminal or take down an organization.

With that, I learned a few things from the podcast too.  One of the moderators was actually a case study in my latest book (Hiding Behind the Keyboard).  To be an expert, to be knowledgeable, and to be more than just competent requires talking, listening, and sharing.  That doesn’t mean sharing trade secrets or confidential information, but it does mean having conversations to learn your job better.

When I worked as a jailer, I talked to every person I booked (at least the sober arrestees and those cooperating with the booking process).  I asked personal questions like, “how did you get started with drug use?” and “how did you start doing X crime”?  I learned a lot after hundreds of bookings.  I learned so much that when I make it to patrol and hit the streets, I had a big leg up on the criminal world, in how it worked with people.  That directly helped me in undercover work.  I spoke to so many criminals, both as a police officer and as an undercover (where they didn’t know I was a police officer), that I learned how to investigate people who committed crimes.  I was darn effective.

The point of all this is that talking to “the other side” is not a terrible idea.  Working on the law enforcement side, I promise that if you have a conversation with a criminal defense expert, you will learn something to help win YOUR case.  If you talk to a hacker, you will learn something to help figure out YOUR cases.  The best part, like I said, nothing you give will make a criminal’s job easier.  In fact, anything you say will only make them worry and make more mistakes.

If you are more-than-competent, you can do your job like a magician.   My first undercover case was buying a gram of meth from a cold phone call of a guy I didn’t even have a name for.  As soon as we met, I recognized the meth dealer as someone I arrested a half dozen times when I was in patrol.   Luckily for me, he didn’t recognize me and believed my UC role.  Arrested, booked, and convicted.  This was a career criminal with dozens of arrests who probably met more cops that I ever did at that time.  Still, he was arrested, by me, because I was more-than-competent in my job.  Digital forensics work is no different.

Talk to everyone and share.  I promise you will get more than you give.  And there is no shame in learning that you don't know it all, because none of us do.

I had the amazing honor of speaking before a full room at Enfuse this week.  This was not only my first time speaking at Enfuse, it was my first time at Enfuse. The conference was put together well.  Kudos to poolside event coordinator.  Those who know my forensic tool choices also know that I do not use Encase as my primary forensic tool.  However, I have a license for v7 and have used Encase since v4 (with sporadic breaks of use and licensing).

This year at Enfuse, I did not speak on any forensic software (or hardware) at the conference. I gave a snippet of two recent books I published (Placing the Suspect Behind the Keyboard and Hiding Behind the Keyboard).  I say “snippet” because one hour is not even near enough time to talk about the investigative tips in the books.  I was able to give a few good tips that I hope someone will be able to take the bank and boost case work.   I could spend weeks talking about investigative methods of not only finding suspects that are using computers to facilitate crimes, but also to place them at a specific device with both forensic analysis and traditional investigative techniques.   

After my talk, I received emails from some who did not or could not attend my Enfuse talk; I am providing my slidedeck for them and others who may want to see high-level notes from the Powerpoint slides.  However, I removed a number of slides that had personally identifiable information to avoid any embarrassment from Google searches and cases.  I did not get to a few slides in the presentation due to time (only one hour!), and I removed them as well.   Nonetheless, the meat and potatoes of the presentation is in the below PDF. (slidedeck removed).

A few toughts on digital forensic skill development and giving away investigative secrets

Forensic examiners/analysts generally follow the same path in skill development, with some exceptions of course.  For most of us, the tools are just plain neat and we initially focus on the tools.  High tech software and using the type of hardware that you cannot find at Frys turns work into play.  We dive into the box, swim around in it for days, weeks, or even months, and then we pull out every artifact we can to write a report of what happened ‘in the box’.  Writing a report usually means pushing the "Create Report" button. I suggest that every examiner go through this stage quickly and move forward.  Get it out of your system as soon as you can. There is more to digital forensics than the toys, I mean, tools.

Digital forensics investigators must investigate, unless your job is solely looking at data because someone else is investigating the case.  This is where leaving the stage of ‘playing with high-tech toys’ turns the new forensic examiner into a real digital forensics crime fighter.  When an examiner can integrate data recovered from ‘the box’ with information collected from ‘outside the box’, using any tool and investigative method available, we have a competent and effective digital forensics investigator, not just a tool user.

I have always believed that a good digital forensics investigator can practically use any software, as long as the software can do the job, without relying on the software to do the complete job.  Pushing a button to find evidence, then pushing another to print a report does not a forensic analysis make.  Just as Picasso could paint a masterpiece only using an old paintbrush and watercolors, a good forensic examiner can make a great case with only using a hex editor and gumshoe detective mindset.  The high-tech tools should be used to make the work easier and faster without becoming a crutch.

And that was the inspiration of why I wrote Placing the Suspect Behind the Keyboard and Hiding Behind the Keyboard, boiled down in two simple intentions:

1) To push forensic examiners out of the high-tech toy reliance into becoming a well-rounded, effective, efficient, and competent investigator.

2) As a reminder to the former investigator-turned-forensic-analyst to get back into the investigative mindset.

If you are currently in the ‘gotta-have-the-most-expensive-tools-on-the-planet’ stage while at the same time not working outside the CPU, don’t fret. It happens to most everyone, and not just in the digital forensics field.  When I was a young Marine, I went to the local army surplus store and base PX to buy every cool tool I could think that would help me in the field.  I had so many ‘tools’ that my ALICE pack looked like a Christmas tree dangling a five years' worth of trinkets from New Orleans’ Mardi Gras parades.  After one trip to the field, I realized how much money I wasted on unnecessary gear (if you could actually call some of those things I bought "gear"..) and focused on using only the things that work and making things work for me.  Digital forensics work is no different.  Consider yourself DFIR SEALTeam 6 once you can work a case using ANY computer and ANY tool.

Giving away trade secrets?

There is a long-standing problem in the digital forensics world: Sharing, or rather, lack of sharing.  Yes, experts and practitioners share their work, but many do not.  I completely understand why.  When you share your ideas and research to the public, there is a fear that the bad guys will see it and use it for their benefit.  The fear is that once the methods are known to the criminal world, the methods become ineffective.

In short, that thinking is incorrect.

First off, cybercriminals and criminals, in general, share information with each other.  They share the methods when they work together to commit crimes, they share it online,  and they share it during their stays in the big house.  Still, they get caught.  Still, they make mistakes. Still, the methods work against them.  I have even arrested drug dealers when they had in their possession, books on 'how not to get caught dealing drugs'.  Cybercrime is no different.  An entire website can be written on how to get away with crime on the Internet and read by every cybercriminal, and yet, they can still be identified, found, and arrested.  

Second, lack of sharing only hurts us all. If you were to find a better way to find evidence, but keep it to yourself, the entire community stagnates.  But when shared, we push ourselves ahead in skills.  Do not be afraid that the bad guys will get away with crimes if they know how you catch them.  Just as watching a Youtube video on Marine Corps boot camp does not make boot camp any easier, criminals that know how we place them behind a keyboard does not negate the process that can place a suspect behind a keyboard.  In fact, the more they know, the more chance they will slip up more than once out of sheer fear of how easy it is to put enough investigative resources to find a criminal that cannot be countered with any amount of preparation.  

    If you have been in the digital forensics world for more than a day, then you know about peer reviews of analysis reports.  If you have ‘only’ been doing IR work where forensics isn't the main point (as in taking evidence collection all the way to court), then you may not be reading reports of opposing experts.  Anyway, the opposing expert peer review is one of the scariest reviews of all since the reader, which is again, the opposing expert, tries to find holes in your work.  The peer review is so effective to push toward doing a good job that I think it prevents errors by the examiner more than it does help opposing experts find errors of the examiner.  Peer reviews take different shapes depending on where it is being done (review of a book draft, review of a report, etc...) but in general, a peer review is checking the accuracy of the written words.

    Academia has always been under the constant worry of peer reviews.  One professor's journal may be peer reviewed by dozens of other professors in the same field, with the end result being seen by the public, whether good or bad. Peer reviews are scary, not for the sake that you made a mistake, but that maybe you could have missed something important that someone else points out to you.

    If you read a tech book and write a review of it (formally in an essay/journal, or informally on social media), consider yourself a peer reviewer of tech writings.  That which you say, based on what you read, is a peer review of that material.  Think about that for a second.  If you are in the field of the book you are reviewing, you practically are tech reviewing that book for accuracy (so make sure you are correct!).  That is a good thing for you as it boosts your experience in the field.  Always be the expert on the stand who can say, “I’ve read x number of forensic books and have given x number peer reviews on social media, Amazon, essays, etc….”.  If for nothing else, this shows more than that you just read books.  You read for accuracy and give public review of your findings. Nice.

    There is some stress in writing a peer review because you have to be correct in your claims.  Sure, maybe some things in the book could have been done a different way, but was it the wrong way?  The manner in which you come across in a peer review is important too.  Crass and rude really doesn't make you look great on the stand if you slam a book or paper.  You can get the point across just as well by being professional.

    Writing books takes no back seat to peer review stress, especially when it comes to technical books.  Not only does the grammar get combed by reviewers, but the actual technical details get sliced and diced.  Was the information correct? Was it current and up-to-date?  Is there any other information that negates what was written in the book?

    So, to get any positive reviews makes for a good day.  Not for the sake of ego, but for the sake of having done it right so others can benefit from the information.  Writing is certainly not about making money as  much as it is putting yourself out there to share what you have learned at the risk of having your work examined under a microscope by an unhappy camper.

    Which brings me to my latest reviews for Hiding Behind the Keyboard.  This is my third tech book (more to come in both nonfiction and fiction) and with each book, I have always cautiously looked at Amazon book reviews each time.  Not that I have written anything inaccurate, inappropriate, or misleading, but that I just want to have written something useful in a topic that I wish existed when I started out in the digital forensics field.  My best analogy of what it is like to write a book is to walk outside to your mailbox nude and then check Facebook to see what people say about you…then do it again.  At least I don't have a Facebook account...

    So far, the reviews for my latest book show that I did a good job (my gratitude to the reviewers).

And that brings me to another point of this post. 

    One of the social media reviewers is actually in a case study in the book.  Higinio Ochoa read and reviewed my book in a Tweet (as seen below).   

Finally finished reading @Brett_Shavers "Hiding behind the keyboard" and let me tell ya, the man killed IT! https://t.co/2qlQIDTYRn

— Higinio Ochoa (@0x680x690x67) April 29, 2016

    You will have to check the Internet to get Hig’s story, or read it my book…  Suffice to say he was a hacker who was caught, and then ended up as one of the case studies in my book.  Positive reviews from forensic experts are great, but so are reviews from former hackers that can double-validate the work.  Like I said, it takes a lot of guts to write a book and almost as much guts to peer review it in public.  That’s what we are doing when we write a review of a tech book.  We are all peer reviewers.

The King County Library System asked me to present on cyber safety topics in a very neat program they have (“When everyone’s talking about it..”).  I have been giving two separate, but related presentations and both have been well-received by those who have attended.  Mine is but a small part of the KCLS program.  I have even attended presentations that I had interest  (like the presentation on drones!).  

For the most part, I have skipped over the basics in my presentations. There really isn’t much need to talk about “what is email” or “the Internet is a bunch of computers connected together”.  We all know that kind of information.  Rather, I have been giving practical advice on what to do right now to reduce the risk of having your devices compromised by hackers and reducing the risk of predators accessing your children online.  Every bit of information I talk about is real time applicable, from reducing your digital footprint to surfing the Internet while maintaining your privacy.  I even show how to use the Tor Browser and encrypted email!

In every presentation, I am seeing parents take notes furiously, ask serious questions, and show a genuine interest in online safety for their families and themselves.  For me, this is easy stuff.  I have already raised two kids in the digital age of Facebook and cell phones (hint: they survived, but still not easy).  And I have investigated cybercriminals (hackers, child pornographers, and others who have used technology to commit crimes).  That is the biggest benefit to attendees I try to give.  Cram as much pertinent information from what I know into an afternoon or evening presentation that can be put to use right away.  Free to anyone.

This is one of the few presentations you can step out the door and put the information to use before you get home.

But if you think this is just another Internet safety program, you are mistaken.  I go through how to use social media to help get (or keep) a job, get into (or prevent getting kicked out) of school for families and individuals, and reduce the risk of cyberbullying.  I show how easy it is for anyone to be a victim by clicking the wrong link or opening the wrong email along with ways to identify the dangerous links and emails. The term "Third party provider" takes on a whole new meaning to attendees when they are shown the ways their personally identifiable information (PII) can be stolen when stored on third party service providers such as their health insurance company or a toy company.

Most importantly, I answer tough questions. Although I give some guidance on creating family rules and personal use of technology, I leave it up to the invididual and family to decide what is appropriate. My guidance is to show how to create rules on the foundation of safety. Everything else is up to personal morals and values.

I’d like to credit the King County Library System for adding these presentations to their program this year because cyber safety is probably one of the most important topics today.   Everything comes down to cyber.  Whether it is personal information being leaked or hacked online or a child being lured from home, cyber is serious.  You can use technology safely and still enjoy the benefits but to ignore safety is like betting the farm on the Roulette wheel.  You never know when your number will come up, but when it does, it will hurt and hurt for a long time.

As far as this program (When everyone's talking about it) goes, KCLS nailed it.  I have organized more than a dozen training events and several conferences over the past decade.  I know exactly the effort needed to put something like this together and KCLS did it right.  If you are in King County, Washington, you really should check out the programs.  They do a fantastic job at a price you can't beat anywhere.  

As for me, I only have two more talks left.  All you need to do is show up.  No RSVP.  No charge.  Free parking.

Again, kudos to KCLS for putting this great program together.  Let's do it again next year.

----------------------------------My next talks----------------------------------

Cell Phones in the Family

Woodmont Library

26809 Pacific Hwy S, Des Moines, WA 98198

April 30, 2016      2PM – 3:30PM

Cell Phones in the Family

Newport Way Library

14250 SE Newport Way, Bellevue, WA 98006

June 23, 2016       7PM – 8:30PM