I read an article that China used technology to spy on users via their phones (https://www.theguardian.com/us-news/2020/dec/15/revealed-china-suspected-of-spying-on-americans-via-caribbean-phone-networks). 

Here is my white paper analysis.

#1 - If a device has connectivity with at least one other device, it can be,  has been, or will be compromised.

#2 - If a device has the ability for connectivity with at least one other device but isn't connected yet, see #1.

#3 - If a device is airgapped from any other device, it can still be compromised.

#4 - If a device has a speaker, someone you don't know can hear you.

#5 - If a device has a camera, someone you don't know can see you.

#6 - If one nation-state is monitoring your device, probably another one is too (maybe your own government!).

The good news is that criminals are more easily identified, tracked, arrested, charged, convicted, and incarcerated.

The bad news is that every bit of your life is logged somewhere, by multiple entities without your consent or knowledge.

Question I received: How long does it take before I can expect to get into a DFIR career?

Answer: It depends!

It depends on your available resources + available time + motivation to learn.

Meaning

The more of each of these that you have, the faster it will be. A lack of resources (software/hardware) means scraping together machines and free/open-source tools. A lack of time means squeezing in minutes here and there over a longer period of time.

A lack of motivation is the most important factor because, without motivation, you will never make it regardless of your available resources. Period.

Motivation

By the same token, motivation is the biggest factor to make up for a lack of resources.  Do not ever underestimate the power of motivation.  The sheer force of drive. The unstoppable energy of determination.  If you are driven to succeed in face of anything, then you will make it. It does not matter where you start from, age is irrelevant. Education level meaningless. Socio-economic background means nothing.

I say this full well knowing that someone with a high education or "elite" status in society with unlimited sources starts farther ahead than you or I. I say this because without motivation, resources are useless and any success is limited and a dead end. With motivation, there is no limit. You will have to work harder.  Study more.  Endure stress and keep moving forward against friends or family advice to quit. Others will appear to effortlessly pass you by. Everything will seem more difficult. And it will be.

Keep the pace

It is one foot in front of the other. That should be your focus. Your goal is not to master the entire registry at the same time that you have a goal to master Linux logfiles.  Learn a registry concept. Then a registry hive. And a key. One step at a time.  As long as you keep moving forward, you will move forward.

Mentor

Find one. Follow your mentor. Know that your mentor, whether you ever met or communicate, has gone through exactly what you are going through. Maybe they had an even more difficult time with circumstances you'll never know. The best mentor is the one that motivates you. It is the person that you know will pull you forward as long as you make the effort to make the effort.

An example of making the effort

When I was a much younger Marine, I had an aptitude for humping a pack (ie; long, forced marches carrying a heavy backpack).  I had the same pains as everyone else, blistered feet, sore back, muscle cramps, and lots of sweat! But I would never quit and never quit putting one foot in front of the other.  A new Marine behind me on one of the marches didn't do so well, but he tried.  So on a really long hump, I told him to grab ahold of my backpack straps (the straps that you use for your sleeping bag). I said, "Hold my straps and as long as you keep walking, I'll help."  The secret was, I didn't pull him at all, but he kept going. He learned that as long as he worked and did his part, he'd be able to keep up.  He never really needed to hold my straps that day, and he only needed it for a few minutes that he could do it. He just needed to know everyone goes through the same pains and understands, but if you do your part, everyone is there for you.

You are next

Know now that someone is going to look to you as a mentor, if not already.  You won't know who they are, but they are watching you. They are hanging on your every word.  They are inspired by you. They are motivated by you, all because they know you made the effort and didn't quit. There are more than a few peeps in DFIR that I watch like a hawk because they inspire me every day. On the days when I don't believe that I know enough, I fall back on my mentors and their work. I fall back on those who give a little of themselves by sharing, and speaking, writing, and teaching.  Do not be surprised that if and when we meet, I tell you that you inspired me.  You never know when something that you did or said made a difference to someone else who is also swimming in the ocean of DFIR information, trying to figure it all out. 

This thing we call "DFIR"

DFIR (Digital Forensics Incident Response) is simply one small part of the Information Security world (or cybersecurity). There are many sub-fields, cross-fields, and related fields, but none are DFIR. The people in DFIR are awesome. Infosec is one thing, but DFIR is something all by itself. I look at DFIR as the Green Berets of Infosec (or Navy SEALs, or Marines, or SWAT...take your pick, but you get the point). In those communities, everyone pulls more than their own weight. They work to excel in their respective expertise. They help each other. They work as team players. For this, DFIR has advanced and advances in skill and knowledge beyond practically any other field.If you are new to DFIR, welcome to the family.  If you have been here a while, be sure to hold the door open to the new folks. They bring a whole new world of motivation, innovation, and drive that benefits us all.

Let me dispel your notion of what an “expert” is. An expert is someone who has more information than you. That’s it. Imagine being stranded on a deserted island with a group of people and only one knows how to fish. That person just became an expert on fishing.

The legal expert

There are legal definitions of an expert geared specifically toward testimony. In short, experts can give their opinions (interpretations) of facts in testimony, while every other witness can only testify to the facts obtained by first-hand knowledge. There is an exception of a lay opinion, but let’s stick to the high level for now.

Without getting deeper into the legal aspects of a court expert witness, everything below directly benefits becoming a court expert if you ever choose the path of the expert witness.

The community expert

The community expert is the person who knows more than most of their community. In DFIR, this would be the person that could probably be a legal expert, but not necessarily so. It may be someone who writes amazing forensic software, teaches at conferences or courses, writes and shares their work, and all the while, never going to court to testify as a court expert witness.

We have a lot of these experts in the DFIR community, whether they know it (or like it!) or not. We look up to them and glean as much information as we can to improve.

Who knows what

All of us in DFIR know something that all of us know. Things like, ‘what is a hard drive’ is something that everyone in this field knows. Don’t be surprised to hear that many people outside of the computer field do not really know anything about hard drives.  Within this example, there are those who are experts in hard drives, but as a high-level topic, we all know something about hard drives.

Then there are those in DFIR who know something that we don’t know. There are absolutely more people that know about reverse engineering malware at an expert level than me!  If your level of knowledge and skill of reverse engineering malware is not at the expert level, that does not mean you cannot be an expert at anything else, or that you even need to know anything about reverse engineering malware. We have our niches and thankfully, we mostly have different likes and dislikes!

And there are the things that you know more about than the rest of us in the community. This is where your expertise in a topic can shine.  Focus on this one.

Brett’s tip

Work on becoming a community expert from this moment for two reasons. One, you will grow professionally and personally from the effort, and two, the community will benefit from your efforts. This becomes a cycle of the more you work on your expertise, the more the community benefits, resulting in you having more data to become more of an expert.

What should you focus on? Any topic that interests you!  One recommendation would be to pick an artifact and learn all about it. Learn more than anyone else.  Test your assumptions. Validate your findings. And write about it. Talk about. Share it. Congrats. You’re on the way to becoming an expert in that artifact!  Maybe even the only expert in that artifact.

Another idea could be to pick a FOSS (free and open-source software) and master that tool! Help with its development and testing. Make that tool into a widely used community forensic app and BOOM! You’re an expert in it.

Why do you want to be an expert?

• *  Professional recognition (within your community)
• *  Career (get hired or promoted)
• *  Challenge (self-improvement without concern of others)
• *  Fame (media, publishing, teaching)
• *  Fortune (selling yourself but not literally)
• *  ___________ (your personal reason!)

How long does it take?

Some studies show it takes 10,000 hours to become an expert. Other studies 'debunk' the 10,000 hour studies, and still others write that in 2 hours, you can be an expert.  The thing that is left out in many of these studies is the subject of expertise. A world-class tennis player surely will need thousands of hours of practice to reach near perfection in tennis. As would a musician. Conversely, an information technology professional would need far fewer hours of practical application and testing to master a topic such as building a computer.

There is plenty of research online that you can read on the number of hours that research shows results in expertise. I believe that time is an important aspect of expertise, but absolutely not the only or most important aspect.

How to become an expert

Becoming an expert is simple, but that does not mean it is easy. Simple, as in, all you need to do is study, put into practical use, and know well enough to teach it.  This is not easy because it is work!

• *  Focused study (the learning of foundations)
• *  Diligent practice (the practical application)
• *  Teach others (writing and/or speaking)

Study is the foundation, as you can’t teach what you don’t know. Or more accurately, if you try to teach something that you don’t know, it will be painfully obvious to your audience. Diligent practice is completely different than practice. Taking piano lessons and throwing your fingers around for an hour just to fill an hour of practice is not just useless practice, it is detrimental in learning bad habits. Don’t just “read” a book on your topic: engage in the content!  Do not just test a theory, but deep dive into every aspect of it.

When you think you are ready to teach, then prepare to teach by checking everything you know. You will end up learning more, solidifying what you thought you knew, and now almost ready to teach. I say “almost” because teaching in itself requires practice and time to get it right! The mere act of teaching others does not mean you automatically are an expert. You have to be good at it too!

The road to being an expert

There are checkboxes to keep track of your path to expertise. Here are a few, and within each item there are dozens of DFIR related sub-items to fill the checkboxes.

• *  Publish works in trade publications, peer reviewed works, journals, books
• *  Speak at trade conferences, universities
• *  Research, test, and validate your works
• *  Get interviewed by media
• *  Be awarded grants, awards, fellowships
• *  Spend time in academic study
• *  Spend time with practical applications of your work
• *  Discover, invent, develop processes
• *  Peer review the work of others
• *  Have your work peer-reviewed by others
•  

Factors that affect time to reach expertise

Mentor/trainer/coach/formal education

Figuring out how to ‘do it’ takes much longer than someone showing you how it is done.  Finding your errors is difficult, but easy when someone is evaluating, critiquing, and mentoring you.

Both of my kids grew up with classical piano and violin lessons. They practiced every morning at 5AM. They practiced after school. They practiced a lot. The biggest lesson that I pushed was that it is better to have perfect practice for an hour than a thousand hours of bad practice. Practice makes permanent, and that is a difficult task to undo. Mentors can check your work, critique it, and enforce the drive for perfection over the drive to compile hours of useless work.  Practice does not make perfect! Perfect practice makes perfect.

Hands-on versus academic research

An expert can solely be a pure academic without much (or any) practical application. An expert can also be a practitioner with virtually no academia.  A mix of both absolutely will reduce the length of the path to expertise.

Trying to master everything or one thing

The bigger the pie you want to be in expert in, the longer it will take to become an expert in it. If you want to be an expert in all-things “Digital Forensics and Incident Response”, you may need more than two lifetimes!  However, if you want to be an expert in “Internet forensics” or “prefetch artifacts”, then you can do that in shorter order, certainly within your lifetime and probably within the next 12 months.

Pick your target. Make sure that it is a reasonable goal. Focus on it and work towards it.

Reaching the plateau

There is a plateau, but you don’t want to get there. As soon as you stop learning and growing, you will have plateaued. Any expertise that you gained fades exponentially as time goes by. Choose to plateau when you no longer need the skill that you mastered.  The DFIR field is an ever-growing and dynamically changing field that needs constant upkeep to keep up, let alone excel in.

Sharing is a big part of improvement

The more that you share your work, along with being open to critical responses, the faster you will reach the expertise you are working toward. If you ignore or do not want to accept critiques, go ahead and put that lawn chair out on your plateau, because that is the result of not evaluating the community evaluation of your work. The more open to suggestions of improvement, the more you will improve.

Who is eligible to be a DFIR expert?

This is an easy one. Anyone. Literally anyone with the drive and determination regardless of background or any individual characteristics can be expert in their youth or old(er) age.  It is never too early and never too late. Whew!

You might be an expert already

You might have read through this post and realized that you have already done everything, but never considered yourself an expert. When you realize this, there one suggestion that I have for you.

Know when it is the time to be humble, and when it is time to bring out the expertise credentials, and know when you are an expert.

Your expertise can (is!) the key to someone else learning, growing, inventing, and discovering amazing DFIR things that are waiting to be found. Your expertise can bring the truth into a legal case based on your opinion and interpretation of facts and evidence. Experts carry an enormous responsibility.

There is no shame in being an expert. If for no other reason, become an expert to be more than competent in your job. I don't recommend shouting from the rooftops that you are an expert, but I do recommend acting as an expert when needed. Everyone will benefit, appreciate, and grow from it.

PS. There is no magic formula, cheats, or vitamin that exists to make you an expert. It is all up to you to make it happen!

Almost two years ago, I wrote about burning out in DFIR (“Only race cars should burn out"). I still stand by what I wrote at the time and if you haven’t read the post, take a read of it to maybe get a tip or two that could be helpful for you or someone you know.

I want to peel back one aspect of preventing burning out that some take too far, which is not doing any DFIR activities on your personal time. There is a fine line between work and personal time, in that keeping both separate from each other is healthy and necessary. However, that line is different for each person and it shifts back and forth during each person’s career. The more skilled that you become, the less time you need to maintain your skills. I find it difficult to have a bright line that no DFIR professional development using some personal time is reasonable.

The short version

The longer version.

What does this have to do with doing DFIR stuff on your own time?

While in the Marines, I married and my new wife made sure that work and home were separate, and that both lives supported each other. Later, in police work (especially when doing undercover work for years), the line between work and home was still solid, and still supportive of each other.  By supportive, I mean that each life (work and home) had focus during each respective shift, in that, when at work I focused on work and when at home I was an active and involved family participant.  I did my best to avoid working at home and also avoid bringing my family life into work. That was my bright line. Your mileage may vary. Understandably, some things are unavoidable no matter what you do.

Working at home (not working from home)

Working from home is not the same as working at home. By working at home, I mean bringing your work into your home when it should be left at work. You know what I mean…working on that exam or report in your off time, away from work because you “need” to get it done, many times without compensation from your employer.  Doing this on a regular basis cracks open the burnout door. This is working at home when you should be working on home. Any employer who overtly or subtly requires this type of unhealthy work ethic will eventually see the destruction of that employee's home and work life.

Back to those tweets and the competition

I have hired and managed people in the field (and let some go) and although I have never implied or required anyone to work at home, I have fully supported their professional development outside of work hours. This is the difference that I feel is imperative to state. If you want to be a competitive hire, advance in your field, or improve your skills, you probably need to spend some of your off-work time on professional development.

For entry-level positions, it is cutthroat. For higher-level positions, it is cutthroat. For promotions, it is cutthroat. Unless other factors are in play, such as favoritism, every single person competes with everyone else to get the job, the promotion, or even be assigned the “best” cases.  Doesn’t this make sense? Shouldn’t the most qualified person be selected? Of course, it does!

Listening to advice is risky, but necessary. It is risky because the advice may not apply to you and only apply to the person giving you the advice. It is necessary because none of us know what all of us know. For example, you might be told to “never improve your skills on your own time unless your work pays for it”, or that “you should only improve yourself at work”. This might be good advice to someone who already has a high skill level but terrible advice for someone without experience or recently learned skills.

Take advice with a grain of salt. Maybe it applies to you. Maybe it does not. Either way, you won’t know for sure until the results are in on whether the advice was good or bad (for you) after it is too late to change your mind. In the end, we are each responsible for the decisions we make. Even fully taking the advice from any person that results in absolute failure is the responsibility of the person making the final decision, not the advice-giver.

Professional development

When I hear DFIR professionals encourage new or not-so-new practitioners to not improve themselves on their personal time, I take a look at who is giving that advice. Have they not taken professional development, continuing education, or college courses on their own time away from work? Have they not read a technical book in their free time, or paid for books with their own money? Have they not ever turned on a computer to test a theory that popped in their head while at home? Or have they held true to their advice of only improving their skills while being paid at work which resulted in their current success? My guess is that most have spent quite a bit of time in their personal life to at least be competitive enough to create opportunities for themselves.

Side story: I was given a comp registration (free!) to a DFIR conference that I was speaking at a few years ago to give away. I offered the seat to someone that I felt could use it since he worked less than 10 miles away from the conference venue. His agency approved his attendance at the conference to attend on his work time (vacation not needed!) but the agency wouldn’t pay for his meals as it was physically a 5-minute drive from his office. What was his response? He turned down the conference! He said that he will not spend any time or money outside of work to learn forensics because he expects his agency to pay for everything. I found someone else that took the offer..and they paid for their meals.

I tell this story as an example that there are some decisions on how much sacrifice you are willing to make to improve your skills. In this example, it was the cost of 2 lunches and 1 dinner, which he paid anyway since he certainly ate during those days of the conference while he was at work instead of attending the conference .  For him, his line was absolutely not a penny spent from his pocket or second used from his personal time to better his skills.

The point

Know the distinction between:

** Working at home

** Working from home

** Improving your skills in your personal time

** Improving your skills on your work time

There is a time and place for everything. Manage the time. Manage the place. If you have the belief that your employer is responsible for improving your skills, I can promise that you will be stunted in your skill growth.

It is within your personal time that balance is important to manage. If your personal life fails, your work life will not be far behind. Balance results in the exponential growth of personal and professional, while the imbalance in one or the other will wreck both.

Generally, work time is immovable, and you should only work during work time (minus breaks). You are being paid to work, so this makes sense. Good management ensures that you have a good work workload balance.

Your sleep time should be solid too. Some nights might be shorter than others because of emergencies, but again, generally, you need to maintain good sleep habits. This is your responsibility.

But for your personal time, balance is much more difficult! Family time, hobby time, vacation time, and basic free-to-do-nothing time is bunched together here. This is 100% your responsibility to maintain and balance. You can’t increase it without affecting something else, but you can manage the best use of it. Anything you add to it will decrease some other parts of it.  If you add too much, then sleep gets whittled away. Add more and perhaps work becomes negatively affected.  Or if you stretch out work, your sleep and your personal time gets robbed.

You and I both have 24 hours in a day and cannot change it. It is how we fill that time that matters.

Summed up!

You make your own decisions based on the information you have at your disposal. Balance your personal life with your work life. Maintain balance within your personal life with professional development that benefits your entire timeline and does not detract from it.

You can have a career without any professional development and without ever spending a minute outside of work on your competence building. But you can also choose to spend time, as needed and as reasonable, to develop your skills using some of your personal time.

Short version: Any social media platform can be compared to the biggest, greasiest cheeseburger that you can find.  You know that the cheeseburger is unhealthy, but you choose to eat it anyway.

TikTok is worse for you than a cheeseburger

Many of us mis/use the Internet by installing apps that we know collect our data. We tweet, share, post, repost, reshare, retweet, and say little (if anything!) about the dangers of the platforms that we use.  It is a “risk worth taking to connect with friends and family online.” 

We partake in this ocean of data collection platforms because, like the cheeseburger, we are willing to willingly trade our personal data and intimate details of our Internet behavior to strangers for something that we want even though we know it is not good for us.  And like eating a cheeseburger yesterday, a new day begins today, and we are seemingly unharmed from yesterday’s use of these platforms, which encourages us to eat another cheeseburger (I mean, log into TikTok again).  We justify this unbalanced trade so that we can “connect” with friends and family online.

TikTok is like a triple stack, bacon cheeseburger.

Every person working in any aspect of “information security”, from the IT admin to the deep-diving forensicator, knows all about how social media platforms are purposely developed for the collection of data of its users. We know without doubt that the sole purpose of these platforms (ie, the code) is to collect personal data from users to specifically sell it. Yet, here we are using them, to connect to friends and family.  To be honest, we also know that one day, all of the unhealthy cheeseburgers will hit us hard one day. But we ignore that warning.

We are all breached

In defense of using “malicious” social media platforms, I hear the argument often that since the breaches have already happened, we have nothing left to lose.  It is true that our personal data has been breached, leaked, stolen, and sold multiple times. Our DOBs, SSNs, and mother’s maiden names have all been collected by hackers many times over and we used to treat our DOBs and SSNs as practically TOP SECRET information! But now, for less than five bucks, you can get anyone’s DOB and SSN in minutes.  For a little physical effort on a keyboard, you can probably find it for free.

The point that I stress is that our behavior is being collected. Our behavior speaks volumes more than our biological identity, especially when behavior is tied to an identified person.

Sure, when Facebook monitors your website visits, this is collecting your behavior, but even that is not what I am talking about. Facebook wants your browsing history and purchasing history so that it can make money from your Internet behavior. If Facebook informed every user in big, colorful letters that it is providing Facebook free in exchange for users’ Internet history and personally identifiable information, they would lose exactly no users. No one cares because the effect is almost unnoticeable. By the way, I am not defending Facebook in the least bit.

An entirely different level of ‘breached’

I consider every social media platform as malware even as I also use social media. How bad is that!?!  The most devasting impacts of social media platforms is not the selling and reselling of our phone number in order for a company to sell us something. It is not about being sent targeted ads. It is about the type of our information that is not being sold which is the worst kind of breached: our offline behavior.

Online dis/mis/information directly modifies our offline behavior, both intentionally and unintentionally by Internet platforms and other users. A person or persons in one country can cause a person in a different country to behave against their best interests or against the interests of their own country through misinformation, disinformation, and even with bullying online behavior. This can happen to corporations and even to governments, or more accurately, by corporations and governments.

We know it, but we ignore it, because we like cheeseburgers

TikTok is clearly malicious. Your PII and offline behavior are both being captured.  TikTok is malicious in the clear definition of being malicious. Data is collected surreptitiously for bad purposes, in the sense of marketing of “TikTok is totally free; we are not taking any personal information <wink wink>.”

A guy on reddit reversed engineered #TikTok

Here’s what he found on the data it collects on you

It’s far worse than just stealing what’s on your clipboard: pic.twitter.com/oqaQyYDXT2

— Dan Okopnyi 🇺🇦 (@d1rtydan) June 28, 2020

This is an unstoppable train

The train has left the station: Offline behavior of geolocation data, smartphone contacts, IP addresses, personal photos, bank account information, connected apps, the places you regularly visit, the routes that you regularly use, and the dates and times of your travels and destinations. All of this is in the hands of the developers of the apps on your device.

With the right machine learning, the right artificial intelligence, and the right intuitive design of an effective operation, you could start riots, create race wars, bankrupt corporations, shutdown economies, sway elections, and even start kinetic wars between countries based on this information.

No, I am not overreacting

In 2013, in a book that I wrote, I stated that “…mobile devices are practically an attached GPS device on the user.”  I should have added “…without needing probable cause for a warrant.”  And could have added, “…and can be used as an effective behavior modification device.”

All of this is already happening. It’s not a new method of warfare. Psychological operations have employed for many wars for as long as humans have warred.  The only difference is that with the Internet, PsyOps is more effective, easier, and quicker to see results. Where a few decades ago, a PsyOps campaign may not see results for months or years, we can see results in mere days and hours. Push the right buttons on the right person and a riot is sparked.  Our devices not only give our location but also collecting the identity of those near us who also have connected devices. Think about it: a gathering of any social group can be completely identified in minutes by date, time, location, and the personal contacts between people based on the physical distances of each person's mobile device.  What could you do with that information if you wanted to modify the behavior of a group?

I am past preventing the misuse of PII or collection of offline behavior. I think all of us should move past that, including our government. For as long as people use the Internet, this information will be collected maliciously or with consent. The more effective measure is what to do about the effects of what we cannot control. How do we correct our misdirected behavior created by trolls and enemies? How do we separate what is fake from what is real? What is our countermeasure?

We can ban malicious apps today, but without question, others will come tomorrow. Apps that we assume to be non-malicious today can easily turn malicious with the change of a few lines of code at any time of use. If not the app itself, malicious insiders will always, and have always, stolen and sold information to adversaries. We can't blot out the sun but we can put on sunscreen.

A forensics-thinking approach

One thing about the digital forensics mindset is that everything in the electronic data world is questioned during an analysis. No competent forensic analyst will blindly accept the date of a file as being the actual date of the file without some corroborating data. One point of circumstantial evidence is just an opinion.  We need more than a single point of data to separate a fact from opinion.

The same holds true for every social media platform. We cannot blindly accept that our use of any platform is free from being used to harm others or ourselves by malicious actors or even the platform provider (sometimes they are the same!).  Bots, puppet accounts, and hijacked accounts are most always trusted at first glance, and many times, continue to be trusted until it is too late.

Question everything that makes you question questions

One of the traits that makes a good investigator is listening that little voice in your head that asks, “Why…”.  You have an ability that raises red flags and gives doubt, but you have to act upon that ability. Humans are too quick to accept what they see or hear, and thereby not question it.  Have you ever walked into a new restaurant, got a bad feeling, ate there anyway, and ended up regretting it? That's what I mean. Find the answers to the questions of the little voices* that you hear.

In a digital forensic case, acting on uncorroborated evidence can result in case dismissals, or worse, wrongful convictions. In the offline world, acting on uncorroborated information can result in personal and physical attacks on innocent people or worst, the complete breakdown of a society.

There are no coincidences

I did some time in military intelligence units and one of the things that I learned was that there is no such thing as a coincidence. Anything that happens, happens for a reason and someone was behind it happening. I carried that experience and training into undercover investigations in law enforcement by creating "coincidences' in my cases. It was a simple op to gather intel on criminals and 'coincidently' to bump into them to develop relationships without having to be introduced. These planned coincidences resulted in going from zero in a case to practically being #2 or #3 in an organization.

The Internet is no different. There are no coincidences on the Internet. Everything has a purpose and plan. Whether individuals create dissent, or they are useful idiots in a bigger operation by organizations or nations, consider that there is something behind everything if it is on the Internet. More so with the "free" social media platforms.  You are not the product in these scenarios. You are the pawn.

The hard way of surveillance

At a federal task force, my group needed to come up with a plan to install listening devices in a house. The house was irregularly occupied and of course, always locked. The team that actually installed the devices had a plan. We created a 'power-line down' ruse in the neighborhood to stop all incoming traffic, the install team broke into the house through the garage, cut a hole in the wall to access a room, installed the devices and software, repaired the hole that they cut out, and left undetected. That was a major operation and the occupants didn't have a clue until they read the affidavit...

In another case, I needed to install a hardwired-GPS on a vehicle that was extremely difficult to catch at a place for the installation. The only way feasible was to get a search warrant to steal the car, order a key from the manufacturer, install the GPS after 'stealing' it, and then "report" the stolen car to local PD as a stolen recovery.  Again, lots of work just to install a GPS.

Today, if I were a spy and wanted to do these things, I would walk down the hall to the computer team and request development of a free, social media app. Then I would market it like crazy to the country/countries of choice.  And monitor it and wait until my targets, or the children of my targets, or the friends of my targets installed the app. Then I would be in their home, quite literally in the sense of being able to hear and see anything. And potentially influence them. Or I could influence the populace slightly by pushing a few key users into a pre-planned direction of disruption. Not that this could be happening now.........I wonder if I could get law enforcement officers, political figures, movie stars, and their children to use my app?

A step in the right direction

Be prepared to address what is coming. Be prepared with solutions to the problems when people start complaining. When your government wants to implement an overreaction to a perceived problem, be prepared to have a better-measured response. 

Consider the current encryption debate. The government can’t break encryption, so their solution is banning encryption altogether (a backdoor is an encryption ban, fight me if you want). Any person in information security knows that this is not only an over-reaction, but it will be the biggest detriment to security in the history of security. There are better solutions. One would be for investigators to do better jobs in their investigations rather than outright ban encryption.

We are all smart enough to know what is happening with the breaches, the leaks, and the malicious social media platforms. If the data is not being sold for profit, it is being caressed into a format useful for warfare (cyber or otherwise).

As a side note, every country is doing this to their own countries in the search of potential dissidents and criminals. Remember that what you do today may be illegal or unacceptable tomorrow. Some governments may allow for the past to go unpunished, which other governments may (will) retroactively punish past behavior that was legal at the time but subsequently made illegal.

You Should Already be in Condition Yellow

Anyone working in the infosec field should be in Situational Awareness Condition Yellow. Being aware of threats now decreases the time between identification and action which thereby increases your odds of success to handle threats.

Of course, we are aware of the threats that the Internet holds for society. From cyberbullies pushing victims toward suicide through nation-states creating internal turmoil in their enemy’s countries using online PsyOps. But being aware is only one step. We should be thinking of countermeasures and remedies.

Be ready for when those in Condition White begin to overreact, you can bring them down to Yellow when they go straight to Red without a plan. No one wants to hear from complainers without solutions, and by being ready with something, you will be further ahead and maybe we can get this right the first time.

Until then, cut back on the cheeseburgers because the day to pay up for those burgers will be here soon enough.

*by little voices in your head, I mean "gut feeling", "intuition", "bad feeling", "paranoia", or anything else describing the feeling that something not quite right.

Jessica Hyde of Magnet Forensics sat down together (virtually...) to talk about forensics.  In case you missed it, here it is!

A “new” article on imposter Facebook accounts was published today in the Philippines.  I put “new” in quotes because this is not a new issue, but I am glad that more public attention is being given to spoofed social media accounts.

I am referring to imposter accounts as “spoofed”, “faked”, and “imposter”, where the account was not created by the user. Conversely, there are fake accounts created by a user as a multiplier to voice misinformation/disinformation, but not used against a real person. The fake accounts of real people are a different matter.

How does this affect you, aka: TL/DR?

A fake account can affect your personally by:

• *  Ruining your personal reputation,
• *  Destroying family relations,
• *  Getting you fired from your job,
• *  Having criminal charges filed against you, and
• *  Creating a risk of being sued.

On the professional side of using Facebook as part of OSINT investigations, you can be led on rabbit trails of false and misleading information whereby you put an innocent person at risk of all of the above bullet points, plus other devasting problems that I probably overlooked. Simply, if you find your suspect's account and use that information as a foundation of fact, you will be chasing an innocent person being framed with disinformation.

I wonder how many alibis have been successfully used with disinformation on social media platforms...

Today’s News is Old News but it is Relevant News for Today

In the Philippines article, students and journalists are the targeted victims with spoofed Facebook accounts created in their name and without any other information, such as personal photos. Fake accounts have been happening for years, so this is not new. However, it is just as relevant today as it was years ago. Perhaps more so now than ever before.

I am using “Facebook” throughout this post as Facebook is this article’s focus, but everything that I say about Facebook can be applied to almost any social media platform.  Social media has been an amazingly positive force in the world for connecting people and sharing information, but just as any tool that has an incredible power to do good, the same tools have the power to do the exact opposite for bad.

https://www.bloomberg.com/news/articles/2020-06-07/philippines-probes-proliferation-of-impostor-facebook-accounts

Found 3 fake Facebook accounts using my name last night. Already down (I think?) after I reported. One good thing about having a unique name is I’m sure the accounts are not owned by actual people with the same name as mine. pic.twitter.com/7TBptLnofU

— Jodesz Gavilan (@jodeszgavilan) June 7, 2020

So what?

With a standard disclaimer that I am not a lawyer, creating fake accounts probably isn’t a crime in most countries, because who cares if a fake account with no information on it was created.  Certainly, fake accounts may violate the TOS (terms of service) of the platform provider and the accounts can be removed by the provider.  

By the way, you can report a fake account to Facebook here: https://www.facebook.com/help/1216349518398524?helpref=hc_global_nav

As far as criminal laws are concerned, the Internet doesn’t create a new world of criminal laws as the Internet only facilitates existing crimes electronically. The laws are basically the same, but have a sexier title like, "computer facilitated". Meaning, harassing someone online with racial or threatening comments is not different than doing the same thing at a workplace. Threats are threats. Identity theft is identity theft. The Internet just makes it easier, faster, and more explosive. Please don’t @ me with laws on Internet crime…I’m speaking extremely broadly on the legal aspect of fake accounts. I want to focus on the more important issues that affect you personally and affect your cases.

Technically, a fake account is just a fake account if it just sits there, right? I mean, I even checked my name in Facebook and found a fake account! No photo or any information, but it is there.. This is a fake Facebook page in my name (again, I did not create this).

https://www.facebook.com/pages/Brett-Shavers/163135850514643
In case you may be thinking that this could be a different “Brett Shavers” with a Facebook page, I highly doubt it.  In fact, this fake page was created with me specifically named based on seeing (1) author under my name since I am an author, (2) Renton Police Department as a related page, which is where I was a detective in my former career, and (3) Amped Software- Forensic as a related page since I am somewhat involved in deeply involved in forensics.

There is also a notation (4) of “Unofficial Page”, which Facebook defines as a page that was not created by the named user.  If I want, I can claim this page, or merge it, or ask that it be deleted. If I were to do this, I assume it would begin a game of whack-a-mole.

The interesting thing about me and Facebook is that I do have a personal Facebook page, but I don’t use it. Nothing is on it. I don’t like the concept of Facebook for many reasons. I created it in a futile attempt to prevent someone from creating a fake Facebook in my name.  My effort was completely in vain. My real page looks like this (again, I did create this page).

How many fake accounts are out there?

This is one of the unknowns in life, as you can’t know the unknowable. However, Facebook has deleted BILLIONS of fake accounts.  More specifically, Facebook has taken down over 5.4 BILLION fake accounts.  Consider that the planet’s population is about 7.8 billion and that there were at least 5.4 billion known fake Facebook accounts. Still, this is not the most important issue to you as I move toward the juicy stuff!

The juicy stuff!

By now, I know that your brain has already gone through a dozen scenarios of how bad this situation with fake accounts sucks.  I can’t think of a better word than “sucks”, because that is how this feels. To make sure that you covered the most important scenarios in your head, here are a few to think about if you missed one.

What can a fake Facebook account do against you?

• *  Target you personally
• *  Target your professional
• *  Target your criminally
• *  Target your civilly

These are easy to see. In this world of angry Internet users, any person can be the target of an army of one or an army of many through Internet attacks. A fake account can make you seem to be a far left/right political threat, a criminal peddling some form of criminal evidence (drugs, stolen property, etc..), or use your name/account to post threats to businesses, people, or to a government. None of these are good and all will require substantial resources to remedy, as in, prove your innocence. Also, the permanent effects of personal damage online is…permanent.

Criminals can (do) scope out targets and monitor their social media accounts. Creating a fake account in their target's name takes this one step and a million miles further. Imagine a fake Facebook account in your name that friends one of your friends. In minutes, your entire life’s connections can be mapped out with friends of friends and friends of those friends, and so forth. One fake account and you are completely exposed to an attacker. Before you are made aware, the account can be removed and you now your attacker has a complete dossier on you for their mission of destruction.

Not cool at all.

How can fake Facebook accounts affect your investigations (criminal or civil)?

• *  Misleading information
• *  Disinformation

For those who use OSINT (open source intelligence) as part of your job with either civil or criminal investigations, any criminal can create a fake account to throw you off their trail and on the trail of an innocent person. Imagine finding someone admit to a crime on Facebook, in their name, with their photo! That breaks the case!  But if it was fake, you may or may not figure it out, and if not, an innocent person could end up charged and convicted of a crime that they did not commit.

Regardless if you can figure out if the account was faked, the effort involved to verify and corroborate the information wastes valuable time in any investigation. Your casework is affected nonetheless.

A bigger threat?

• *  Facebook data collection
• *  Government collection from third party Facebook

Facebook collects personal data. And it sells it to other businesses. And it gives it to governments. We expect that now. The surprise no longer exists that Facebook is a data collection machine that makes money off its users’ personal information. But that is not the issue, because if you don’t want to be part of that machine, you can avoid creating a personal account. Right?

Wrong. Facebook might make a personal page for you anyway without telling you anything about it. If they don’t make a personal and public page for you, they are certainly collecting your information anyway, even if you have never ever visited a www.Facebook.com website..ever.

Packet Storm wrote an amazingly important article in 2013 that describes basically your personal is collected by Facebook through friends and family on Facebook. Many in the security field are aware of this, where John Doe will post on his Facebook page about Jane Smith. Jane Smith might not have a Facebook page and is doing everything to avoid being online, but now her friend John just outed Jane to the Internet world.

Take this a step further. When John logs into the dozens of social media accounts through his mobile device or computer, he will usually give access to his contacts to the social media platform. Now, dozens of social media platforms have Jane’s contact information, even though Jane has no account on any of these platforms.  Eventually, these contacts are collected by Facebook through the same manner of allowing access to the user’s contacts, and Facebook practically has the contact information of every person on the planet who has an email address or name.

Facebook has been questioned about “shadow” accounts or “invisible” accounts and claimed that the collection of this information was a technical glitch. This bug was, in effect, mapping the world regardless if everyone had a Facebook account.

The bigger threat, even more important than being targeted by criminals, is that of being wrongfully targeted by a government.  Let’s take the Philippine’s situation as an example.

“This was first reported by U.P. Cebu’s official student publication Tugani, which said it found fake accounts of student activists who were arrested in an anti-terrorism bill protest on June 5.” - https://www.bloomberg.com/news/articles/2020-06-07/philippines-probes-proliferation-of-impostor-facebook-accounts

It seems that students who were protesting and subsequently arrested, discovered fake Facebook accounts in their name. What would the purpose of that be, other than tracking people critical of their government? Over the course of human history, every group of people has had their turn of being critical of their government. Everyone takes their turn. Some nations allow public critiques without interference and other governments execute dissidents on the spot, in the street, for all to see.

3^rd Party Access Trumps 4^th Amendment protection

But the United States has the 4^th Amendment! Come back with a warrant, bro! This is true, and generally, the Constitutional protections are followed by the US government (all levels).  I say “generally” because there is always an instance of abuse that occurs inadvertently or intentionally.

Most people aren’t intimately aware of Constitutional Rights, and when asked, will usually recite something that they remember from a Hollywood movie or TV show. They don’t get it right often. Those “in the know” know that Facebook’s data is not protected by the Constitution. Your home and everything in it is protected from unreasonable search and seizure, but the data collected by Facebook (or any 3^rd party) is not.  That means knocking on Facebook’s door with a written request for data bypasses the wall between your data and the government.

The issue is when the data with your name on it is not your data but is tied to you. Or perhaps it is your data, collected and curated by Facebook that your entire life is memorialized in a neat zip file. Hopefully, the information collected was not disinformation by a competitor or criminal or scorned lover wanting to set you up for a fall.

All Existing Data is at Risk to be Breached

Social media platforms and any company that collects data are under varying degrees and sometimes opposing requirements of data preservation and data destruction. Some types of data is required to be maintained for a certain number of years and other data is mandated to be destroyed in a different number of years or months. Some providers swear to not keep any data.

The thing is, no one really knows how long data is kept or destroyed. Personally, I have written affidavits for data that should exist but told that it does not. I have also received data that should have been destroyed but was “overlooked”, resulting me getting extra information… On top of that, I have personally seen corporations not even know the data that they were maintaining that they certainly should have destroyed (legally) a decade earlier.

This data, all of it, including the fake accounts, are ripe for the taking by anyone with access to the data. Access does not only imply “legal” access, but any access to include hackers. It’s bad enough for your real data to be stolen, but it may be much worse if fake data is stolen and attributed to you.

What can you do?

Unfortunately, it is whack-a-mole with your private data and doubles with the fake accounts that might be attributed to you. At one point, I made a Keybase account, where you can verify the platforms and websites under your control. I verified everything in hopes that if a fake account was made (which there are a few for me…..), I could easily point to a verification site to disprove the fake news.

But, Keybase was purchased by Zoom, and with Zoom’s security problems, I deleted my keybase. The good news is that Keybase doesn’t allow me to recreate my account with my same name. That in itself is a good security feature for you. I recommend creating a keybase account and then delete it in order to prevent someone from creating a keybase account in your name. Of all fake accounts, Keybase would be a bad one to have made in your name as it professes to the world that you are you. Another example of platforms communicating (ie, sharing) data between each other is Zoom's iOS app sending data to Facebook as reported in Motherboard. The funny part? Even if you don't have a Facebook account, Zoom sends it to Facebook anyway. Add to this that Zoom purchased Keybase. Before you start spiraling out of control in conspiracy theories with social media platforms, keep in mind that I am only focusing on the fake Facebook accounts.

A personal story

Way back when, when I was a new patrol officer, my wife made a website.  This was really incredible at the time. To give you a hint of when this was, it was during dialup, and websites were made by straight typing HTML. WYSIWYG wasn’t a thing yet, but she taught herself and made a site on one of the free platforms at the time. It was a family website and because I was in law enforcement, I stressed to not use our names or personally identifiable information, especially as our kids were young at the time. Anyway, her website became popular and made it into several print magazines in Japan. Oh yeah, the website was in Japanese. This will be important to know shortly.

The punchline is that one day in patrol, dispatch sent me a message on my MDC (mobile computer) and said something to the effect of, “Hey. I found a website with pictures of you and your family on it. Did you know that?”

Long before the Internet searching became really easy, a dispatcher somehow found me online with my family, on a website that was in Japanese. My wife took the site offline when I told her.

Later, in my undercover days, my threat level substantially increased. I flew around the country and internationally, many times unarmed (dumb in-country rules...), and hung out with organized crime. My conversations were talking to people about people that they killed or had killed, informants that were tortured, corrupt cops, smuggling humans across borders, and all things drugs and guns. I had cars drive slowly in front of my home, been followed on more occasions than I want to remember, and bumped into targets while off duty while with my family.  During this time, I found that a relative of mine was posting pictures of me and my family online, even knowing the job that I was doing. I blame the ignorance of security more than anything, but to be unaware that photos you send to friends and family end up on their social media platforms is uncool without asking permission. Then at a point, I had threats and guns stuck in my belly added to the mix.  Having a gun stuck in my belly and also my personal information exposed online, I can say that the Internet exposure was worse. Oh yeah, my ID was stolen with all of this too.

I have more of these types of stories than any one person should have, but the point is that the Internet is a dangerous place for not only those with intelligence or law enforcement jobs, but for any person who somehow gets in the crosshairs of an angry person, or someone who needs a scapegoat for their crimes. Fake social media accounts are a serious concern, and for you, the IT, Infosec, or DF/IR pro, your first responsibility is to protect your family. Protect the world as a secondary task as you get to it.

Stay safe.

Billions of fake accounts: Who's messaging you on Facebook?

https://bigthink.com/politics-current-affairs/facebook-banned-accounts?rebelltitem=1#rebelltitem1

Philippines Probes Proliferation of Impostor Facebook Accounts

https://www.bloomberg.com/news/articles/2020-06-07/philippines-probes-proliferation-of-impostor-facebook-accounts

Facebook has shut down 5.4 billion fake accounts this year

https://www.cnn.com/2019/11/13/tech/facebook-fake-accounts/index.html

DOJ to probe sudden surge of fake Facebook accounts

https://www.cnnphilippines.com/news/2020/6/7/DOJ-probe-fake-Facebook-accounts.html

Shadow profiles: Facebook has information you didn't hand over

https://www.cnet.com/news/shadow-profiles-facebook-has-information-you-didnt-hand-over/

Facebook: Where Your Friends Are Your Worst Enemies

 https://packetstormsecurity.com/news/view/22713/Facebook-Where-Your-Friends-Are-Your-Worst-Enemies.html

Facebook admits year-long data breach exposed 6 million users

https://www.reuters.com/article/net-us-facebook-security/facebook-admits-year-long-data-breach-exposed-6-million-users-idUSBRE95K18Y20130621

Zoom + Keybase

https://keybase.io/blog/keybase-joins-zoom

ZoomiOS App Sends Data to Facebook Even if You Don't Have a Facebook Account

https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account

The fantasy

So many people ask how they can start a career in the DF/IR field, which is completely understandable. The glamour is there. Hollywood shows vivid and dynamic computer screens depicting the fascinating work of forensics and incident response, from James Bond flicks to any of the CSI tv show series.

And the money! There is so much money to be made! WHAT A GREAT JOB!

The reality

You need to know computers. I mean, you really need to know about computers, from the basic fundamentals of how a computer works physically with hardware through how software works on that hardware. You need to be a generalist and a specialist. The time spent to learn what you need to learn requires more than you can imagine and at that point, you will still be incompetent for working in this field. You’ll just know that you don’t know enough.

Then when you feel like you have learned “enough” to do the job, if you haven’t kept up with technical aspects of the field every day, you will realize that you have fallen behind in competence faster than a boulder plummeting down a high cliff.

After you read a dozen books on the topic, spend thousands of dollars in courses and conferences, practice with all types of software, your climb to the hill of knowledge will feel like the hill is growing and you are not making any headway. 

Every device that you touch will seem like Groundhog Day because not only will it be a different scenario than the prior device, but your objectives will be different, and the software that you once used might not work for what you need this time. That means learning a new tool to handle a new device on a new case, all the while, trying to keep up with the changes that were made in an operating system from last week.

You will quickly learn that CSI on TV has it all wrong. You won’t be solving anything in the timespan of a primetime TV show and will be explaining to your boss or client constantly that Hollywood has forensics all wrong, and that you have to do research on the analysis. Then your confidence will fall because you will feel that you should have already learned how to do analysis on this particular device, but you have to now do research and figure it out like it’s the first day on the job.

Once you get the hang of this career, for as long as you want to be competent, you will be constantly seeking out training, reading, practice, and research. If you didn’t realize it before, you just learned that the process to keep up is never-ending!

Your reality

If you still want to work in DFIR after all of that, then you might be made for it. This may be your path.  I spoke about much of this with Jessica Hyde of Magnet Forensics this week, and I stand by everything I said about trying to talk someone out of a difficult profession because there are some jobs that require more effort than other jobs in terms of preparation and sustainability.

For each of us, there are jobs that we could not be paid enough to do. Those same jobs where we would never work are the same jobs that some people would pay to have. Each person is different as each job to each person is different, and there is a sliding scale for career preferences.

Any and every job is honorable. No job is beneath any of us. And if we are fortunate in this life, we can choose a job that fits both our wants and needs. DF/IR is no different in that aspect with any other profession.

The one aspect where DF/IR is different is the effort required to get started. Compared to a job where minimal skill is required, or where the skill is fairly easy to obtain, DF/IR  is not only not easy, it is laborsome. With that comes making a commitment to carry through just to get a chance of working in the field. If you are not committed, you are not going to make it.

If you ever competed in anything, from music to sports, you know that it takes many hours of perfect practice, many errors, and extreme focus just to be able to be competitive against everyone else. You can tell in seconds those who have prepared from those who have not. There is no competition when there is no preparation.

On the visual below, if DF/IR is not on the far green end of the arrow for you, you might not make it because it is too easy to give up on anything, let alone something that you are not fully committed to do.

Boot camp is not what you think

If DF/IR sounds like a military boot camp to you, then you got the picture that I am trying to get across. It is boot camp for your brain. You need endurance. You need focus. You need to learn to walk all over again and eventually you are running.

Few things in life are more frustrating and defeating than not getting what you worked for.  We are impatient. We want what we want when we want it and not a second later. If you are lucky, you get what you want when you want it. For the rest of us, it will take time, effort, failure, time, effort, failure, time, effort, failure, and eventually success. Time = days or years, different for everyone and everyone’s personal situation.

Excuses are like…

During my first week in Marine Corps Boot Camp, a drill instructor was yelling at a recruit who had just given an excuse for failing at a task. The DI yelled "Excuses are like assholes. Everyone has one and they all stink!"  I don’t believe DIs can swear anymore by the way..but the point was well made to me and I was really glad to learn it by not being the recruit being yelled at. Don’t worry. I was given my fair share of being yelled at every day.  The point is that everyone has excuses and they get in your way if you let them get in your way.

There are some factors that will eliminate you from a specific job. For example, to be a firefighter, you need to be able to physically carry firehoses upstairs to put out fires. If you cannot physically do that for any reason, you won’t get that job. Same with being a house painter. If you blind, painting houses isn’t going to be possible. If you are able to perform a job, then the odds are good that you can get that job with effort.

Barring circumstances that physically prevent you from doing DF/IR, you can do this job. That might make it sound like anyone can do this job, but that is far from the truth. The only people who can do this job are the ones who dedicate themselves to continual education to keep up and learn. For those who DF/IR is for them, keeping up with the field is more entertaining than watching an action movie because it is exciting and challenging. For those who struggle with spending the time to prepare, learn, and keep up, DF/IR is not for them.

You cried?

If you didn’t get into the school of your choice for the DF/IR degree of your choice or were turned down by the job that you really wanted, or failed to pass a certification that you studied weeks for, or couldn’t figure out something that you believe to be simple for everyone, then you are probably still on the right track. This is normal. 

And if you sat in the middle of your room and cried about your choice of working to get into DF/IR, that is ok too. You are probably still on the right path. If you consider quitting to do something else, you are even still probably on the right path.

The defining point is that after you do that once or twice or a hundred times, you stand up, crack open the book, and get back to it. If you keep doing that, you will be fine. Do not let yourself get in the way of what you are working toward.  Quitting is simply what happens when you find out that what you thought you really wanted, you didn’t want bad enough. No matter how often you fail, it is only failure when you stop trying.

Yes, it does take time.

Timing is everything. If you are lucky (I am not….), by the time you are qualified to do DF/IR, the demand is so great that you have the pick of where you want to and how much you will accept to be paid.  You might not have any downtime between qualified to work and actual work.

For many others, it might take years to get where you want to go. Actually, it probably will take years to end up where you want to be. This is not only ok, but to be expected. Achieving what you want sooner than expected is nice but do not let this be your measure of success.

I get it

Sometimes the timing is not right for what you want. Maybe you are too early or too late for what you are after. Sometimes there are things out of your control that can prevent you from walking one path, but that does not mean you cannot walk another path that might end up being the better path for you.

Life happens to all of us. We hope to avoid life’s tragedies, but the tragedies are waiting on your path just as they are on the path of everyone else. We confront what we confront when it is time to confront them. We don’t choose when they happen, but we choose how to react.

With that, for anyone wanting to sincerely step off the DF/IR path because of any reason, I fully support the decision, because that decision to quit is probably the right decision. By the right decision, I mean that quitting means you weren’t meant for that path, but also means there is another path more fit for you.

But for those who are on the spectrum that they would pay their salary to work in this field, to learn the bits and bytes of data, and to spend whatever energy is required to get there, I am right behind you making sure you keep going.  You can cry along the way or even toss your laptop against the wall in frustration as long as you decide to keep moving forward. Cry. Wipe off the tears. Get back to work. You will be fine.

Hang on…you’re already in DF/IR?

If you do this job already, by now you should have encouraged at least one person who had a spark of DF/IR to move forward (maybe one of those folks was me!). Be an inspiration to the next generation. We now live in a world of the most negative social media, call out and cancel culture, where anyone can be brought down publicly for no reason at all. This is our world, the electronic world, the “cyber” world, and by virtue of our job, we are responsible for safety of all people. Be the force of good and make your name one to be remembered for helping someone, not tearing them down.

The experiences of anyone in this field are awesome! They are even more awesome when you can ignite a small spark of inspiration in someone who may use these skills to change the way we do business, change the way we think about DF/IR, and potentially change the world.

Don’t think this doesn’t apply to you, regardless of where you sit. You have more power to inspire someone to make discoveries in this field that would not be possible except for the spark you lit in someone. That’s pretty cool in my book.

The meat and potatoes

A bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical aspects of the work has not changed. But what about the investigative aspect?  Oh yes. That part of DFIR has certainly changed. The key change is geolocation, and it is more important than you may realize at first glance.

The full meal

Every investigation with any aspect of an electronic device has been affected due to COVID-19 and its consequence of stay-at-home/work-at-home. As far as investigations are concerned, device geolocation is perhaps the biggest impact. There are also other subtle aspects of the quarantine to take advantage of in your investigations, whether you are involved in civil or criminal investigations or corporate matters. The benefits are there to be had. Individual privacy is yet another issue but let us start with investigations.

For the most part, the impact of COVID-19 is positive for investigators. Actually, it is practically only positive.  I will be breaking down the pros and cons by way of using the below four broad categories. These are "broad" because overlap exists and it is near impossible to have a clean break from every aspect of DFIR. Every person fits in one or more of those boxes, including the privacy category.

Digital Forensics (DF) & Incident Response (IR)

How does COVID-19 affect DFIR investigations?

For criminal investigations, the geolocation impact is most dramatic. Compare the “before” and the “current” geolocation investigative aspects of COVID-19 (specifically criminals using mobile devices and Internet access points).

In the above comparison, “home” is where a person lays their head. Investigators who pursue criminals focus heavily on the “home” of a criminal, which tends to be the location where the criminal spends most of their time, stores and creates physical evidence, and where they are most vulnerable to arrest. Even one of the most primary and basic goals of law enforcement surveillance is to follow criminals and ‘put them to bed’, which simply means, follow them to their home. COVID-19 makes this much easier since everyone, including criminals, must be home, or at least be at home more than usual.

Side note: An investigative truism for the vast majority of crimes is that criminals must communicate to plan, conspire, and commit crimes. The most convenient and commonly used investigative method to capture communication is focusing on communication devices. Quarantine makes this easier.

COVID-19 Benefits Investigations

--Mobile devices

---Easier to find the home of the owner (suspect) since the device will be home more.

---Easier to identify other devices of the suspect since personal devices are also home with the suspect.

---Cell tower dumps near a crime scene will have fewer devices connected, lowering the list of possible suspects.

---“Burners” are now burned. They now travel less and are quarantined with their owners. Burners can now be easily tied to a ‘home’ and to its owner at that home.

---“Burners” will now always be near their owner’s other devices, tying them together.

---Subsequent forensic analysis post-seizure will have fewer GPS points to investigate. This is good for the purpose of fewer false alibis.

---Higher usage of all devices (burners and personal) results in more data and more evidence. There is also a higher use since face-to-face communications are less due to quarantine/stay-at-home.

--IP Addresses

---Higher use of personal Internet accounts being used.

---Higher use of borrowing neighbor’s Internet access.

---Higher chance of protective measures (VPNs, Tor, etc…) being inadvertently misconfigured or neglected for one or many communications.

With criminals being home more than usual, identifying their devices, tying the devices to them, and identifying the “homes” of criminals has never been easier.  As long as you have either the device information (ex. the phone number) or the home address, tying both together is simpler than pre-COVID 19. Consider that a mobile device, including the ‘burners’, will be living at their owner’s home for longer hours per day than before, because the owner is at home for long hours. Where cautious criminals won't turn on a burner at their home, they don't have much choice now.

• A home address can be assumed and later confirmed by using mobile device geolocation, such as from GPS coordinates obtained from service providers.
• Device information can be obtained by having the home address, such as examining cell tower dumps, or other technical means to obtain mobile device signal connections.

Another side benefit of COVID-19 for investigations is that of increased usage of electronic devices to communicate. Criminals must still leave their homes to commit traditional, non-computer crimes, but the use of mobile device communications still increases. More calls to more phones help build a more thorough link analysis of criminals and their co-conspirators. Traditional policing is also made easier with fewer cars on the road and fewer places for criminals to blend in with the public (such as at a crowded restaurant or park).

Cell tower dumps in the area of a crime, where pre-COVID 19 could result in hundreds of devices per one tower might now only have a few devices which greatly narrows the list of potential suspects of a crime.

Successful criminal hackers take great pains to hide their true identity and location. Whether it be using VPNs or Tor, one of the basic premises is to not connect to the wire with anything that ties to your home or work. For the most part, the quarantine forces the use of a home Internet connection or a nearby neighbor’s connections. One error made in complacency or technical failure can expose everything.  Investigators should take advantage of the increased possibility of tracking a criminal hacker to their home as compared to tracking to any one of thousands of public WiFi spots found at libraries, coffee shops, and throughout entire cities with public WiFi.

One negative with COVID-19's quarantine is not being able to physically place the co-conspirators together by way of geolocation, such as having two devices being at the same place at the same time. In cases that I have had, each time that I could identify the date and place that a group of conspirators would meet to talk, such as at dinner or a parking lot, being able to identify every device in the area was a good operation. This was really beneficial as not every person in an organization will call every person in that organization, so tying devices together requires more labor. Conversely, in the quarantined world, everyone in the organization will need to call more of those in the organization to communicate.

As far as when the quarantine is lifted and we reach the new normal, the historical geolocation data available will still benefit future cases, both with device forensic analysis and with third-party service providers holding the geolocation data.

Electronic Discovery (ED)

Compared with criminal and civil investigations, COVID-19 poses more risk to businesses. Companies who are allowing remote work at their employees’ homes without appropriate precautions are now creating a situation of intermingled personal and business data.

Employees who know have open access to their employer’s systems using personal devices might be the biggest risk to employers in the past decade. On one hand, data mingling can cause a substantial legal issue in litigation, where company data might be intentionally or inadvertently saved onto personal computers. Additionally, personal computers that may have outdated anti-virus or unsupported operating systems could increase the chances of a company being compromised through an employee’s personal system.

Companies that had been supporting remote work by way of providing systems that are maintained by internal IT staff and using protected connections (not simply directly connecting to the network…), have no concerns that they did not have before COVID-19. For the rest, I can foresee some problems.

Open Source Intelligence (OSINT)

OSINT is fun for the curious. It is also an effective investigative method as well as an effective victimization tool. With COVID-19’s quarantine, the impact is that for those who want to remain semi-private regarding their homes, yet still remain socially available online, they will be more at risk of exposure.

Being at home more means most photos to be posted on social media will be those taken from the home. More family photos. More photos of a home’s interior and exterior. All of which can build upon safety concerns for some.  

For investigators, applying OSINT to cases where suspects are using social media simply means gathering more relevant and home-based geolocation data.

Privacy & Surveillance

Being anti-crime does not mean that you must be anti-privacy, but most governments will try to convince you otherwise. All of the above-mentioned benefits of COVID-19 as it relates to investigations to solve crimes have a perverted relationship in potential loss of personal privacy. The key questions are who is being watched, for what reason, and for what justification.

Right behind any government are the many tech companies with the ability to collect personal data from its users, privacy be damned. The intention is for the public good as it is primarily, if not solely, used as a revenue source (your data is sold and sold and sold again). Now, we are online more because we are home more (practically 24/7), which creates more data to be collected on the websites we visit, the online shows that we watch, the videos, and online purchases.

A government’s view of “data hoarding” is for the public’s benefit.

A corporate’s view of “data hoarding” is for corporate benefit.

Now comes COVID-19 and there is a merge between the two. Corporate tech giants (small tech too!) are partnering for both the public good of tracking people via mobile devices and certainly the sale of the data. The most effective way to convince anyone to give up a bit of privacy is to promise a chunk of security in exchange.  In times of panic or worry, not only is this easy to accomplish, but it is more of an exchange of a large piece of privacy for a false hope of security.

https://www.apple.com/newsroom/2020/04/apple-and-google-partner-on-covid-19-contact-tracing-technology/

Post COVID-19

I can expect to see the mobile apps being developed today that track infected persons and their interactions with non-infected being more commonly used. The Apple-Google efforts of using Bluetooth technology to track people in the name of public safety can be easily applied to many other things, much like the dating apps and other friendly location sharing apps do as well.

For the investigator, these data sources have always been treasure troves used to place a suspect at a scene but will now jump into hyperdrive in doing more by collecting data with willing user-consent, default configurations of apps, and covert monitoring.

Summary

Forensic analysis is the same. Investigations have (temporarily) changed. Good investigators continually look for breaks in a case, are always open to a break in a case, ready to exploit a break in a case, and are creative in trying to find a break in a case. Don't let COVID-19 be anything else other than a potential way to solve a case. For the business owners and managers, it is not too late to update computer use policies to protect how employees connect to the company's data.

Committing crimes today is not as easy as yesterday. Neither is keeping your privacy.

The short story on the newest Mini-WinFE 10 (aka, the download link):

Mini-WinFE has been updated and upgraded.  I update WinFE developments (including the downloads for Mini-WinFE) at https://www.patreon.com/posts/34814255.  The Mini-WinFE builder is a free download.

Are forensic bootable OSs still useful today?

Depending on who you ask, forensic bootable OSs are either extremely valuable or of no practical use. The answer is based on your job, which is why WinFE works great for some and not at all for others. For traditional forensics on deadbox machines, WinFE has a place. In ediscovery matters for data collection, WinFE certainly has a place with custodian machines. For devices that can’t be imaged or accessed other than booting the machine, WinFE has a solid place in the DFIR toolbox. If your job does not involving imaging machines in a forensically sound matter, then WinFE may not be useful to you. The value of WinFE is solely dependent on if you can use it in your job.

What is (Mini) WinFE?

WinFE (Windows forensic Environment) is a forensically sound, bootable Windows operation system, created by Troy Larson and built using a string of command lines. In short, Troy turned WinPe into a WinFe.

Mini-WinFE is easier method of building a WinFE that gives a more ‘fuller’ version of WinPE.  I selected WinBuilder, a project in use for years for customizing WinPEs, to be used as the WinFE building project. A smaller, lighter, quicker build (Mini-WinFE) became the defacto WinFE build because of ease of build and ease of use. Mini-WinFE has now evolved into using PE Bakery with Misty updating the Mini-WinFE project and Colin Ramsden’s updating the Write Protect Tool.

Mini-WinFE 10

WinFE 10 is the most substantial improvement to WinFE since its inception by Troy Larson.  Colin Ramsden did an amazing job of completely updating the WinFE Write Protect tool in his build project and with the WinFE acquisition of ARM devices.  The next phase of WinFE 10 was to implement Colin Ramsden’s upgraded write protect app into the WinBuilder build of Mini-WinFE. In this most recent improvement of Mini-WinFE, PE Bakery was chosen as an improved replacement for WinBuilder.  Both Colin and Misty have now updated the Mini-WinFE with Colin’s latest Write Protect tool.

The primary difference between Mini-WinFE and WinFE 10 is that the Mini-WinFE build, unfortunately, does not acquire ARM devices as does Colin’s WinFE 10 build. However, Mini-WinFE is easier and faster to build which is great for anyone needing a WinFE but not needing an ARM WinFE (WinFE 10).

WinFE 10

Using Colin Ramsden’s build of WinFE 10, you have the new capability to image ARM devices. He also completely updated his write protect tool, and his build method also includes a new forensic imaging tool that works in ARM. That is 100% cool.

For the build download of Colin’s new WinFE, check out Colin’s website, https://www.winfe.net/.

https://www.winfe.net/

WinFE Resources

WinFE Documentation

Ultimate Cheats! Windows Forensic Environment (https://www.amazon.com/Ultimate-Cheats-Windows-Forensic-Environment/dp/1790322782). Covers all-things-WinFE and is a good reference to building all versions of WinFE, from the first version to the current WinFE 10 version.

DFIR books:  Multiple books have referenced WinFE, but few (if any) have any details on the how-to-build a WinFE.

Training

If you are in law enforcement (LE), there are a few sources of WinFE training:

• SEARCH   https://www.search.org/get-help/training/high-tech-crime-investigations/instructor-led-training/windows-forensic-environment/
• RCFL   https://www.rcfl.gov/orange-county/training-schedule/secure-techniques-for-on-site-preview-stop-nw3c
• Others As part of FLETC, IACIS, short conference presentations, and others.

For non-LE, the training is even less, but you may be able to find WinFE incorporated in some college-level forensic programs.

An online WinFE course that includes printable proof of completion as part of a Patreon subscription at https://www.patreon.com/DFIRtraining.  The work-at-home/stay-at-home special of 60% off is ongoing and includes other courses too.  The curriculum of the online course can be seen at: http://courses.dfironlinetraining.com/windows-forensic-environment-winfe.

The future of WinFE

Until/unless a day comes when devices cannot be booted forensically, WinFE will continue to be a useful tool in your DFIR toolbox. WinFE has been around for over a decade, used to acquire evidence in both civil and criminal cases worldwide, taught everywhere, noted as a community accepted forensic tool in many DFIR books, and is awesome as an acquisition tool!

Something good and something not-so-good on learning DFIR

The good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and gain skills in this career than most any other professional career.

*  Resources are plentiful (such as thousands of websites, hundreds of books, colleges, trade schools, etc..)

*  Skills (aka: competence) are generally more important than pieces of paper (i.e.: certifications)

*  The DFIR field is segmented into many specific jobs (at least one surely fits you best!)

The not-so-good thing is the time and effort needed. Plus it is scary because of the time, effort, and money involved is a virtual unknown when you start out.  Then again, anything worthwhile is worth the effort and time. The time and effort needed is actually the most common obstacle that everyone faces to get into the DFIR field. Keep in mind that no matter which path in DFIR that you embark, you have a lot of barrels to jump over and they just keep coming. Sometimes, it seems that there are so many that you feel that you will never make it. Everyone gets frustrated. Many give up. Some keep going (this is you).

Let’s get something out the way first

In this game of getting of getting into DFIR, or growing your skills in DFIR, everyone has to jump over the same barrels, meaning, there are subjects and skills that you must learn, just like everyone else. No one has a shortcut to reach the end.  (PS: there is no end to what you need to learn to stay relevant and current). There is one tip that I found to work for me that might work for you. By the way, I am far from perfect, far from the smartest, and far from the best. It feels like that I have to work twice as hard as everyone else, but I realize that everyone has to work hard regardless of who you are or what your background experience may be.

First things first.

Keeping your DFIR skills up is no easier than it is to get the skills in the first place. We each know that because we know how difficult it is to get started. We are reminded of this sometimes-painful trek into DFIR each time we hear the question asked, “How do I get started?”.

As for me, as it applies to anything that I wanted to learn, the first lesson that I learned still applies today as it did the first time I really wanted to learn. That lesson is..

Eat your broccoli first.

Translated, this means to first do the things that you don’t want to do but you know have to get done. Get it over with as quick as possible. Push yourself through it. Your desire to only do what you want to do and not do what you don’t want to do is not only irrelevant, it is counterproductive.  But how does that apply in the DFIR world?

The broccoli

If you love broccoli, then broccoli is a bad analogy. But I think you see my point. I am not the biggest fan of broccoli, so when it is on my plate, I eat it first, because I don’t like it. I like the health benefits, but not the broccoli itself.  But I know by eating it first, I won’t have to suffer eating it later when it is cold and staring me in the face for 20 minutes after I finished eating my steak. To be fair, by eating my broccoli first for years, I now like it.

In DFIR, we have lots of ‘broccoli’ to eat. Hexadecimal may be one for you (unless you like hex from the beginning). Basic computer repair (A+) for another.  Network topology may be another one for you. And the list goes on. The things that are not exciting, but necessary to do the DFIR work, must be learned, otherwise, they will stare at you later as you regret not mastering these topics first.

Luckily, in the broad category of DFIR, you can avoid much of what you might not like if you choose your job carefully. I doubt you can avoid the broccoli all together, but you can minimize quite a bit by avoiding the type of jobs that require learning what you don’t want to learn. But generally, across the board, there are quite a few topics in DFIR that everyone should know. Some of the topics fall into the “must know” category. Other topics are specific to the specific type of job in broad category of DFIR.

The way I handle the topics that bore me, or that I don’t initially think to be important, is to make those topics a priority. Learn them. Become competent enough, and then move onto the things that I want to do. Otherwise, if you skip over the basics or the boring things, the day will come when you will suffer at having not done the first things first.

Programming (your brain)

For me, at this stage of life and work, I actually like the boring topics, because I have seen where a basic fundamental aspect of DFIR will cinch a case shut. Many in the field skip the basics and that is where the big failures come. I have also seen some turn a “basic” forensic thing into a whole new world of how to do forensics.

Let me reiterate

*  There is no free lunch.

*  You cannot fake competence (for long).

*  You can’t buy competence.

*  You can’t buy experience.

*  You can’t buy knowledge.

* You can’t buy determination.

*  You can’t buy dedication.

*  There are no shortcuts.

I screwed up

If I don’t catch myself making an error somewhere at some point, that means I am missing my mistakes. We all make them because we are human. The people who claim to never have made a mistake, or an oversight, or any fragment of an error only fool themselves.

The path to learning DFIR, whether new to the field or in it for decades, resembles the act of shopping for a car.  Or dishes.  Or groceries.  Or a computer. No matter which thing you choose to buy at the time, eventually you discover that you should have bought something different or at a different place for a better price. That is the way it works buying things and the way it works learning things. Some of the things work out. Some were not the best idea. But sometimes you need to have your path diverted intentionally, inadvertently, or unknowingly in order to get where you need to be.

Some of my greatest hits of learning DFIR screwups

*  Studied like crazy for a cert and failed just as crazily. Then failed again. I even failed a third time. Just call me rock.

*  Not studied at all for a cert due to over confidence (arrogance probably) and failed just as miserably. Twice.

*  Paid for certs that did absolutely nothing for me because 'everyone' says you need these.

*  Refused to get a specific cert out of spite even though it probably would have helped me get hired.

*  Renewed same certs…for no good reasons other than acronyms to put on a CV.

*  Paid for membership in “high tech” orgs that provided nothing more than a certificate of membership.

*  Paid for a cert that required no test, no exam, nothing. Too embarrassed to ever write that one on my CV.

*  Paid for an expensive course that was WAAAAYYYY above my level at the time. Gained practically nothing in the course.

*  Paid for an expensive course that was WAAAAAYYY below my level at the time. Also, gained practically nothing in the course.

*  Bought expensive software and hardware that I didn’t need, but everyone said that I did.

*  Didn't buy expensive software and hardware that I knew I that I needed, but wrongly assumed that I could use other software and hardware.

*  Not listened to advice from experienced mentors.

*  Listened to advice from experienced mentors (sometimes it works, sometimes it doesn’t…)

*  Took on cases that I ‘assumed’ I could handle, resulting in hiring people who could actually handle the cases that I assumed I could do.

*  Take the above listed items, multiply by a factor of 4, maybe 5 or 6, and that's my life in learning DFIR..

But with that, a few neat things happened along the path..

*  Hired to teach forensics at a university that rejected me as a student several years prior.

*  Hired to teach forensics to a federal agency (same agency that also didn’t hire me when I applied…).

*  Turned down a request to apply to that same federal agency that didn’t hire me (life had changed in a different & better direction).

*  Taught forensics to a packed room of PhDs who teach forensics, yet never did forensics, but wanted to learn forensics!

*  Met some of the smartest people in the world in this field, and most all have been great people!

*  Worked some of the most amazing types of cases with incredible government agencies and law firms from class action litigation to the “T” type cases (if you worked in an alphabet agency, you probably know what I mean by T…….. case).

Perceptions change

Here is how I initially looked at everyone who was working in DFIR (even before ‘DFIR’ was coined);

Wow. They are so lucky. They had all the opportunities. They must all be geniuses. They must have had it so easy their entire life. I am so unlucky compared to them. Life is so unfair. I have to work so much harder to get where they are at. They are younger than me (or older), taller (or shorter) than me. You name it, I thought it. I feel pretty stupid thinking today about what I was thinking about all the DFIR folks at that time...

Here is how I look at them now;

They had to have worked hard. They had to have had amazing obstacles to overcome. They most likely had personal issues to handle at the same time of learning this work. They struggled like me. They most certainly are determined. They most certainly know that you have to put in the work. They are definitely still learning. They surely know that they don't know everything and never will. They all had different paths, and every path had it's own obstacles and challenges.  They also know to eat the broccoli first.

I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I haven't received any public records yet from the request. I have been hired by government agencies as a consultant to help the agency find and produce response records on occasion. Mostly, I was hired because the agency did such a bad job in producing records that a court ordered the agencies to hire a third party.

In those instances, I won't talk about what the agencies specifically did wrong, but it was enough to justify a court order to do it right. The interesting thing about working on a public records engagement versus a civil litigation is that the rules are somewhat different, especially the part about a citizen's right to request public records without a need to show damage. Citizens who are curious as to what their governments are doing can simply make a request for specific records. That is pretty cool. Being in Washington (State), the MRSC website is packed with everything anyone ever needs to know about public records requests and laws.

So, back to my public records request...

Well, this request isn't part of an engagement where I have been hired as a consultant, but the subject of the request is surely important to me and should end up being important to others too. I most likely will detail the trials and tribulations of this request as soon as I am provided the start of a rolling production of records. Then I will be able to blog about records requests from the perspective of the requestor as compared to the view of the insider. One personal benefit is that I plan on learning what I can as the requestor and compare the results with what I know from being on the inside of these types of cases/records request. I am expecting that this experience will make me better when hired to search and provide records due to an entirely different perspective.

Yes, I've done public records before

I have helped clients and friends file public records requests, but that was simply helping to fill out forms, craft the request, and tips on what to look for (missing threads or attachments in emails, modified documents, withheld documents, etc...). I have testified on the search for records that were claimed to be 'too difficult', and I have gone through more than enough emails to find where an email was missing. But this time, it's actually me asking for records and me having to make sure everything is done correctly, and making sure the agency stays true to the records law for my sake.

This should be a good learning experience with a hopefully good resolution. I may make the records available online to illustrate some points if I find errors, omissions, or egregious government behavior in the records (hopefully not!).

As far as the timeline...

12/2/2019    Records requested

12/9/2019     Agency replies with no date of completion or start date to produce any records but instead gives me a date of 12/23/19 just to tell me when they can give me a date that they will start producing records.

***UPDATE***

The agency gave me a production date for the year 2040. It may be a long time before I write about this experience. Yes, it's not a typo. It is the year 2040 when this request will be completed. This agency uses the Barracuda Email Archiver, which you would assume that having pre-indexed (instant search hits!), single-instance storage (no duplicates!), simple search feature (as easy as using Google!), and quick exporting of emails would not take this long...but apparently, it does.

So now the timeline of this public records request looks like this:

2019: Requested public records

2020: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2021: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2022: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2023: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2024: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2025: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2026: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2027: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2028: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2029: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2030: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2031: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2032: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2033: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2034: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2035: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2036: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2037: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2038: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2039: Jan > Feb > Mar > Apr > May > Jun > Jul > Aug > Sep > Oct > Nov > Dec

2040: Final records expected to be produced.

I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig, that I was honored that he agreed to write the foreword of a book that Eric Zimmerman and I wrote. It stands to figure that I have followed his blog for many years because I learn something every time he writes something.

Well….

His latest blog post was more than I typically expected, and I had to read it several times because Craig bared his soul with something that every single one of us would be fortunate enough to experience.  I tried to search for another way to say, “bared his soul” because that is what Craig said in his post. However, there is no other description that fits better, because that is what he did.

https://craigball.net/2019/09/09/who-am-i-if-im-not-that-guy-anymore/

I’ll let you read Craig’s blog post before reading further, and you should read it regardless of what point of your DFIR/infosec/ediscovery career point you currently sitting.  Then come back for my thoughts on the “Five Stages of Grief in a DFIR Career”.

Welcome back*

You may have already read a Swiss psychiatrist’s model detailed in a book, On Death and Dying. I’ve used that book on many occasions as a reference for teaching response to traumatic experiences to others and as a tool for coping with my own traumatic incidents. *I know you didn't read Craig's post and kept reading, but seriously, read his post.

https://www.psycom.net/depression.central.grief.html

The above visual describes the grief cycle succinctly. No need for me to add to it to describe it. But then again, I’ve done a lot of personal and professional research as well as teaching on the topic in a past career. I recommend digging further into it if this is the first time that you have seen this.

In my own life, I have gone through this grief cycle many times. Sometimes, it has taken me years to complete, and other times, seconds. Many of us are going through this now, and if not now, we will at some point in our lives. Police officers, especially those forced into deadly force incidents, will go through the entire cycle in a few seconds during an encounter and can spend years going through it after a deadly force encounter, regardless if deadly force was applied. They tend to go through this cycle a lot...same with those in combat.

Bringing this back around to you and your DFIR career

Since you read Craig’s post, you saw where it sounds that he feels his relevance has faded into a crisis of lost confidence.  If you didn’t read the post yet, do not fret; there’s a party at the end. 

This is where I see a direct resemblance to the grief cycle and a DFIR career, at least to where we will eventually feel that our relevance waned. Perhaps it will. Probably it will not.  Certainly, that which we did good, especially good for others, will never wane. The good that we did selfishly for ourselves will be forgotten faster than a long-tailed cat in a room full of rocking chairs. But the good for others is another story.

Go to work for money. Then you can do for yourself what you couldn't do before and do for others what they cannot do for themselves.

That’s what I tell my kids. Do your job, but do not be your job. The job didn’t miss you before you got there, and it won’t miss you when you are gone. But the job can help you to make this a better place by being a positive force on others.

<I’m getting to the point on the DFIR Career Grief Cycle, so bear with me>

When you create a ripple of positive change in a person’s life, you also spark a chain reaction of a tidal wave of good far past what you will ever have the fortune to see. The difference in a newcomer doing well or failing is in direct relation to your interaction with the newcomer.  Their failure or success in this field is directly tied to you. This is the point to know that the DFIR Career Grief Cycle is not a negative, but a positive in your career growth if you do it right. 

My suggestion is to push through the DFIR Career Grief Cycle as quickly as possible when it comes. Don’t be stuck at Anger, because you’ll be that ‘grumpy old person’.  And try to fly through Depression by knowing you are almost done with the cycle. Acceptance doesn’t mean the end. It means that your path has evolved, as it will for all of us, if all of us are lucky enough. The DFIR Career Grief Cycle is simply an evolution from doer to mentor or role model. Or maybe a not-so-subtle hint to move to a different job or position with a more instrumental role because your experience is incredible.

Our goal should be to be able to look back at the seeds that we planted, the good that we did, the bad that we prevented, and the positive guidance that we gave newcomers for them to grow.

We live our lives day-to-day knowing that tomorrow will never come, and that we have plenty of time to do something good for someone else tomorrow. When we accept that every new morning means that we have one less morning when we will not wake, then we can focus on what matters at home (and at work to make someone else’s life better). You have a fixed number of sunsets. A fixed number of sunrises. A fixed number of days to make a difference. Don't make the DFIR Career Cycle a Grief be one of regret, but one of satisfaction.

Craig Ball has nothing to worry about in regard to imposter syndrome, crisis of confidence, or whether or not he made a difference. I have followed his career for more than a decade. He has made a difference across the board in the forensics and electronic discovery fields as well as in the careers of many. We will all do better if we do better by others; then the grief cycle will not be feared as much as it will be welcomed.

The short story

Any person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any other person face and voice. This is known as a “DeepFake” video.  Credibility of videos will no longer exist without some form of analysis, but the assumption that a DeepFake video is credible will create enough damage before being proven to be fake. The technology is not perfect (yet), but does it have to be in order to induce the intended effect?

Tip for some: You have to look up to get this. https://t.co/tfqTuToZK2

— Brett Shavers 🙄 (@Brett_Shavers) August 28, 2019

The longer version

It is difficult to find which aspect of our lives will be more in harm’s way because of DeepFake videos. With children, cyberbullying will take on an entire new life by an exponential factor.  DeepFake cyberbullying will be the nuclear bomb of child’s bullying nightmare.  The cruelness of bullies with access to make their victims appear to do anything in a video that can be instantly spread across the planet in seconds is not something to ignore.

The direction of a nation-state’s actions can potentially be moved with video evidence that was completely manufactured.

The movie industry can profit from DeepFakes by hiring B-list actors and replacing their face with A-lister faces but I don’t see an upside for the actors…

Innocent people can be made to look guilty of a crime. Today, your face can digitally replace the face of a violent criminal who was video recorded while committing the most horrid of acts, and people will believe the video..with your face on the criminal.  Criminal charges (vigilantism is a possibility!) might be filed, an arrest made, and your reputation ruined long before the video is determined to be fake.

Photoshop (and its competitors) changed the way we look at photos. Forensically, it is not entirely impossible to exam manipulated photos to find inconsistencies based on the content or layers of an image. Still, photoshopped photos are still intentionally created to damage a reputation. I’m referring to the manipulation of a photo using any photo-editing software, not just Photoshop.

But videos…this is an entirely new world of potential damage to a person’s reputation, or worse!

Stand by for a new world of fraud and information warfare campaigns.

Your online photos

The free Internet services that we have been graciously offered over the past years, in which we blissfully post photos and videos of ourselves, family and friends, is ripe for abuse. Our Internet service providers have already abused our data, selling it haphazardly to every bidder (not just the highest bidder, but practically everyone willing to pay for it). Since data can be duplicated forever, we can be abused forever as soon as we have given our data the first time to any online company.

With that, our pictures are online. We have posted the pictures of our children. Our online resumes, ie Linkedin, have a super clean portrait which is perfect for the source of a DeepFake video (all the machine learning software needs is one picture of your face…). Everyone is at risk. We already created the source material for abuse. And we did it with a smile.

My (online) photos

Working a decade in undercover narcotics turned me into an ultra-paranoid-of-cameras person. At two points in my patrol career, photos of me in uniform were posted online by my department and local news. Then I went undercover.  Always worried about someone finding those two photos of me online at the worst possible time, I avoided cameras ever since.

Even during those years, if anyone (friend or family) ever pointed a camera at me, it was like I was ducking a baseball being thrown at me.  I did the same thing working undercover to make sure my photo wasn’t part of evidence in a case that may go public. Even with that, a family member of mine kept posting my photos online, without my knowledge, even while he knew the type of work that I was doing. Good grief. Third party control of our data is never good. Never ever.

The solution

I hate to say it, but lawyers are the only solution. They also stand to be the only people that will make out like bandits in the DeepFake future with litigation. Litigation, including criminal prosecution is the only remedy for damage and hope for prevention.

Actors will need tighter contracts to protect their image and voice, otherwise Tom Cruise will be starring in new release movies well into the next century…

Victims of cyberbullying, whether it be children or adults, will have to sue for damages, but as we all know, that which goes online tends to stay online forever.

Third party curators of our data need to be held legally responsible for something or anything. If our data is being controlled by others, without any compensation other than a free email address or data storage, then this problem will only grow.

Pandora’s box is opened and the DeepFake video is here to stay. I wonder how many Pandora’s boxes exist, because it seems that every year or so, another Pandora’s box is opened and something else pops out that does 1% good and 99% bad. I’m still looking for that 1% good that DeepFakes might provide, but I’m not holding my breath.

The future

Like anything on the Internet, it is all fun and games until someone loses a job, gets sued, gets beat up or killed, or commits suicide because of doxing, harassment, and cyberbullying.

As for me, I prefer to work on things that do good.  That's why I wrote this; to remind you that this 'thing' we do, this thing we call DFIR, is for doing good.