Forensic timelines are chronological records of the events that occur relative to a crime. The timeline can list the relevant events proceeding the crime, all events related to the crime from the initial discovery of the crime to the resolution of the case. They are created by investigators to document the evidence they collect and …
Each month, I receive several calls from individuals who claim their phones have been hacked. This can be a very upsetting experience when it happens. Sometimes they’ve contacted law enforcement or even forensic experts and have been told, “Sorry, there isn’t anything we can do to help you.” This only adds to the sense of …
More than one legal case has boiled down to an examination of the timestamps of files on a device such as a laptop or mobile phone. At Lucid Truth Technologies, we want our emails and blog posts to contain concise insights that can make or break a case for you. Timestamp analysis is a perfect …
My friend and colleague, Kevin Ripa of the Grayson Group of Companies, has published some astonishing research [1] that shows Microsoft Windows can inaccurately report the serial numbers of the drives attached to the computer system and may even report the same incorrect serial number for multiple drives. This can lead a forensic analyst to …
Forensic analysts can be wrong about the USB Drives attached to a computer in evidence. Read More »
A year ago, I was asked to investigate the body-worn cameras used in a case involving a young man accused of resisting arrest and the possible use of excessive force by the officers restraining him. The video recordings of four officers and a squad car were provided. The overarching question was how come, at the …
Last month, I had the opportunity to present a talk titled “Stories Your Cell Phone Can Tell About You” to the Madison DC608 Monthly Meetup. DC608 is the Madison chapter of DEF CON Groups and is a collection of cyber security enthusiasts with a wide range of skills and experience levels. I had lots of …
This question comes up in various forms, for example, when an employee is stealing intellectual property from their employer or if there was a breach of medical records. Most recently, it was a colleague that asked, “Do you have any script that looks inside of a local directory for PHI or PII?” By PHI, we …
At Lucid Truth Technologies, our clients ask us interesting questions about technology and forensics. Once, we were asked, "Can the location of a cell phone create an alibi?" On a cell phone, the location history data that gets logged can come from multiple sources, including cell towers, Wi-Fi, and GPS, each with varying levels of …
Can the location of a cell phone create an alibi? Read More »
A client recently asked me to analyze a mobile phone forensically to prove that a specific text message was not sent from the phone. This message is the focal point of a very public civil lawsuit. I explained that what I could do is examine the phone and see if I could find traces of …
Can you prove a text message was not sent from a particular phone? Read More »
Recently, I have been working on my estate plan. Naturally, as a forensic analyst, I have an interesting perspective after examining multiple computers and phones of those that have passed. Also, consider that important information may be kept in cloud services like Google Drive, Dropbox, MS OneDrive, etc. Dealing with the death of a loved …
Digital Purging and Accessing Data Upon One’s Death Read More »
