I was recently asked to testify as an expert in a criminal trial. During the trial, the federal prosecutor read the following portion of the BitTorrent & Digital Contraband research paper [1] that I wrote for SANS Institute: "The Trojan Horse Defense is a specific application of the more general "some other dude did it" […]
The Trojan Horse Defense Read More »
Digital Hashing for Lawyers: Understanding the Essentials for Criminal Defense Introduction In the digital age, where most of our communications, transactions, and even personal activities leave a digital footprint, understanding the nuances of digital forensics has become crucial for legal professionals, particularly criminal defense lawyers. One such nuance, often overlooked yet fundamental in the realm
Digital Hashing for Lawyers: Understanding the Essentials for Criminal Defense Read More »
Who said What? Coping with hundreds of hours of audio evidence Recently, I have had multiple cases where a substantial portion of the evidence was from body-worn video or recorded phone calls. In one case, a dozen police officers spent several hours executing a search warrant and questioning the home’s residents. In another case, the
Who said What? Coping with hundreds of hours of audio evidence Read More »
Forensic timelines are chronological records of the events that occur relative to a crime. The timeline can list the relevant events proceeding the crime, all events related to the crime from the initial discovery of the crime to the resolution of the case. They are created by investigators to document the evidence they collect and
The Importance of Forensic Timelines Read More »
Each month, I receive several calls from individuals who claim their phones have been hacked. This can be a very upsetting experience when it happens. Sometimes they’ve contacted law enforcement or even forensic experts and have been told, "Sorry, there isn’t anything we can do to help you." This only adds to the sense of
Help! My phone has been hacked! Read More »
More than one legal case has boiled down to an examination of the timestamps of files on a device such as a laptop or mobile phone. At Lucid Truth Technologies, we want our emails and blog posts to contain concise insights that can make or break a case for you. Timestamp analysis is a perfect
Don’t Get Tripped Up by Timestamps! Read More »
My friend and colleague, Kevin Ripa of the Grayson Group of Companies, has published some astonishing research [1] that shows Microsoft Windows can inaccurately report the serial numbers of the drives attached to the computer system and may even report the same incorrect serial number for multiple drives. This can lead a forensic analyst to
Forensic analysts can be wrong about the USB Drives attached to a computer in evidence. Read More »
Why is Crucial Bodycam Footage Missing? Missing bodycam footage: A year ago, I was asked to investigate the body-worn cameras used in a case involving a young man accused of resisting arrest and the possible use of excessive force by the officers restraining him. The video recordings of four officers and a squad car were
Why is Crucial Bodycam Footage Missing? Read More »
Last month, I had the opportunity to present a talk titled "Stories Your Cell Phone Can Tell About You" to the Madison DC608 Monthly Meetup. DC608 is the Madison chapter of DEF CON Groups and is a collection of cyber security enthusiasts with a wide range of skills and experience levels. I had lots of
Forensic Phone Images for Geeks Read More »
This question comes up in various forms, for example, when an employee is stealing intellectual property from their employer or if there was a breach of medical records. Most recently, it was a colleague that asked, "Do you have any script that looks inside of a local directory for PHI or PII?" By PHI, we
