Speaker 1: Imagine this scenario, a multi billion dollar fraud scheme right
Speaker 1: blown wide open just by a single email or maybe
Speaker 1: a Loane thumb drive.
Speaker 2: Yeah, or think about a vandal documenting their own crime
Speaker 2: on YouTube using their phone, thinking they're completely.
Speaker 1: Anonymous, exactly. And this isn't science fiction, is it. It's
Speaker 1: the real world of computer forensics.
Speaker 2: It really is. And today we're taking a deep dive
Speaker 2: into that pretty fascinating world. We're using excerpts from Hacking
Speaker 2: Exposed Computer Forensics, second Edition, And you know, the book
Speaker 2: itself says this isn't an incident response handbook. It's more
Speaker 2: of a guide to understanding how digital evidence really changes investigations.
Speaker 1: That's a really important distinction. So our mission for you,
Speaker 1: our listener, is to sort of unpack how these forensic
Speaker 1: investigators uncover those well invisible digital footprints.
Speaker 2: From really complex corporate fraud like that multi billion dollar example,
Speaker 2: down to individual misconduct, and.
Speaker 1: We'll look at what it takes to make that evidence
Speaker 1: actually stand up in court, how the field has evolved,
Speaker 1: the tools, the techniques, and.
Speaker 2: Really why it's just so vital in today's world, which is,
Speaker 2: let's face it, completely driven by information.
Speaker 1: Okay, So let's unravel it. Where do we start the evolution?
Speaker 2: Maybe, yeah, let's zoom out a bit. Computer forensics has
Speaker 2: just fundamentally changed investigations since say two thousand and four,
Speaker 2: when the first edition of this book came out. Right
Speaker 2: back then, investigators, you know, they spent ages wading through
Speaker 2: paper documents.
Speaker 1: Mountains of them, I can picture it.
Speaker 2: But now electronic evidence it's not just a piece of
Speaker 2: the puzzle. It's off in front and center. It's crucial
Speaker 2: for figuring out not just what happened, but the intent
Speaker 2: behind it all.
Speaker 1: Intent, right, that's key.
Speaker 2: Think about the huge financial crises like two thousand and eight,
Speaker 2: two thousand and nine, subprime mortgages, all that stuff. Digital
Speaker 2: forensics was absolutely essential in exposing the fraud underneath it all.
Speaker 1: That's a massive shift. And it's not just about the
Speaker 1: technology itself, is it. There's a big human element here too. Oh.
Speaker 2: Absolutely. The author's Aaron Phillip, John Lovelin, Rudy Peck, Peter Marcatos,
Speaker 2: Andrew Rosen, and the technical editor Luis Sharinghausen Junior. They
Speaker 2: come from really diverse backgrounds. You've got high tech investigations,
Speaker 2: ip theft experts, law enforcement folks from the EPA's Criminal
Speaker 2: Investigation Division. Wow, even people from the National Computer Forensics Lab,
Speaker 2: Electronic Crimes Team, and commercial litigation.
Speaker 1: So it really underscores that blend. You need the technical
Speaker 1: skills and the legal know how definitely.
Speaker 2: And one thing the book does which is quite clever,
Speaker 2: is use these attack icons and countermeasure icons.
Speaker 1: Okay, tell me about those. How do they help someone understand?
Speaker 2: Well, think of them as like signals for you, the listener.
Speaker 2: An attack icon highlights something that could mess up an investigation,
Speaker 2: like what, for instance, like an investigator accidentally writing data
Speaker 2: onto the original evidence drive while they're trying to copy it.
Speaker 2: That's a huge no.
Speaker 1: No, right, that would compromise it. So if the attack
Speaker 1: icon warns you, what does the countermeasure icon?
Speaker 2: The countermeasure shows you exactly what to do to avoid
Speaker 2: that problem. So, for that hard drive example, the countermeasure
Speaker 2: is correctly hashing the drive.
Speaker 1: Hashing like creating a unique digital fingerprint.
Speaker 2: Exactly a fingerprint, and then you verify that fingerprint after
Speaker 2: you've made the copy of the image. Okay, And the
Speaker 2: book rates these risks based on popularity. How often does
Speaker 2: this happen? Simplicity? How easy is it to make this
Speaker 2: mistake impact, how bad is the damage? And then a
Speaker 2: final risk rating.
Speaker 1: So it's all about making sure that evidence is, as
Speaker 1: you said, unassailable.
Speaker 2: Precisely. Unassailable is the word, because when we get to
Speaker 2: the Bedrock principles, the core idea is that evidence must
Speaker 2: be defensible, it must be unassailable. Why because it's almost
Speaker 2: certainly going to end up in court.
Speaker 1: Okay, So what are those absolute must do safeguards the
Speaker 1: non negotiables.
Speaker 2: Well, first and foremost, you've got the chain of custody.
Speaker 2: This isn't just paperwork. It's a super meticulous record, right.
Speaker 2: It shows exactly who had the evidence, when, what they
Speaker 2: did with it, basically proving it hasn't been tampered with.
Speaker 1: How do they prove that digitally?
Speaker 2: Using those cryptographic hashing functions we mentioned MD five SAHA one,
Speaker 2: they create that unique digital fingerprint at key moments. If
Speaker 2: even one tiny bit.
Speaker 1: Of data changes, the fingerprint changes, the.
Speaker 2: Fingerprint changes, proof of tampering or at least proof that
Speaker 2: something changed.
Speaker 1: Okay, so it's like a digital tamper proof seal, got it?
Speaker 1: What else is critical?
Speaker 2: Then there's completeness. Investigators have to and the book says
Speaker 2: this look in every nook and cranny.
Speaker 1: Every nook and cranny.
Speaker 2: Why so exhaustive because, as the book puts it, lawyers
Speaker 2: hate new evidence popping up unexpectedly in court.
Speaker 1: Uh. I can imagine it.
Speaker 2: Can completely derail a case. No client wants that kind
Speaker 2: of surprise, especially when you know their reputation or even
Speaker 2: freedom is on the line.
Speaker 1: So meticulousness is key. What about the human factor bias?
Speaker 2: Maybe good point that leads to bias awareness. This field
Speaker 2: demands full disclosure. Absolute impartiality makes sense. The book even
Speaker 2: suggests bringing in a third party firm if there's any
Speaker 2: potential conflict of interest, like, uh, maybe the lead investigator
Speaker 2: head dinner at the suspects house two years ago.
Speaker 1: Yeah, that wouldn't look good.
Speaker 2: Any hint of impropriety can just sink the evidence in court.
Speaker 1: Okay. So to manage all this complexity, is there like
Speaker 1: a standard process?
Speaker 2: There is actually the Electronic Discovery Reference Model or EDRM.
Speaker 2: It came about in May.
Speaker 1: Two thousand and five DRM. Okay.
Speaker 2: It basically provides a standard framework brings some order to
Speaker 2: analyzing and producing electronic data for legal stuff.
Speaker 1: What are the first steps in that model?
Speaker 2: The initial steps are crucial first define the scope what
Speaker 2: are we looking for? Then identify all the places data
Speaker 2: might be PCs, phones, cloud storage, you name it right.
Speaker 2: Then you strategize how to preserve that data, lock it
Speaker 2: down and critically establish that chain of custody as soon.
Speaker 1: As possible, preserve document.
Speaker 2: Only after all that groundwork has done, should investigators even
Speaker 2: start to preview the data, and only using forensically sound tools,
Speaker 2: you know, to make sure they don't accidentally change anything.
Speaker 1: Okay, so that's the process Bedrock. Now let's get out
Speaker 1: of the digital hood. What are the computers themselves? The
Speaker 1: book uses a.
Speaker 2: Cool analogy, yeah, the human body analogy. It compares computer modules, biosos, processor,
Speaker 2: hard disk to things like the heart, lungs, eyes. Well,
Speaker 2: each part does simple tasks, right, but when they work
Speaker 2: together they perform incredibly complex functions. Same with the computer,
Speaker 2: simple parts, complex results.
Speaker 1: That's a great way to think about it. And hard
Speaker 1: drives they get special mention.
Speaker 2: Oh yeah, marvels of modern engineering. They talk about the
Speaker 2: platter spinning and the read write heads flying over them.
Speaker 2: The analogy is like a mock one plane just two
Speaker 2: feet off the runway. That's how close and fast they operate.
Speaker 1: Wow, that's incredible precision.
Speaker 2: And for newer systems they mention SaaS drives that serial
Speaker 2: attached SCSI. It's an evolution of the older SESI interface,
Speaker 2: offering much faster speeds, which is really important when you're
Speaker 2: trying to be huge amounts of data quickly.
Speaker 1: So modern storage is amazing. Yeah, what about older stuff?
Speaker 1: What if the evidence isn't on a super fast SAS drive?
Speaker 1: What challenges pop up? Then?
Speaker 2: You mean the eight tracks of the computing world.
Speaker 1: Floppy disks, floppy discs. I remember those.
Speaker 2: They're actually surprisingly tough physically, But the book warns, woe
Speaker 2: be the investigator who has to deal with them? Why
Speaker 2: is that their formatting methods were often really obscure, poorly documented.
Speaker 2: It can be like digital archaeology, just trying to get
Speaker 2: the data off.
Speaker 1: Them, so like digging up ancient artifacts. Yeah, do investigators
Speaker 1: actually run into these much anymore more.
Speaker 2: Than you'd think, especially with older systems, maybe long running
Speaker 2: fraud cases. And then you have tape backups? Oh yeah,
Speaker 2: servers often use tapes right, commonly used for servers, but
Speaker 2: extracting evidence from them. The book calls it a dicey
Speaker 2: proposition at best. Dicey Yeah, because there's just so much
Speaker 2: variety in the hardware the software. You might find date tapes,
Speaker 2: dlt L. Each one is its own little puzzle to
Speaker 2: figure out, like a nightmare it can be. And then
Speaker 2: moving to more modern stuff, you have memory technologies, memory cards,
Speaker 2: digital cameras, MP three players, smartphones. They're everywhere exactly and
Speaker 2: they are very frequent sources of evidence. The absolute key
Speaker 2: principle when handling these is read only. You cannot risk
Speaker 2: modifying the data accidentally.
Speaker 1: Read only got it. So once you understand the devices,
Speaker 1: you need the right place to work on them, the
Speaker 1: forensic fortress, the lab. What makes a good lab, A.
Speaker 2: Well equipped lab is non negotiable. You need serious processing power,
Speaker 2: a big monitor for detailed work, external drive bays, lots
Speaker 2: of RAM fast internal drives like SATA or SCSI.
Speaker 1: So powerful gear, But what about securing the lab itself
Speaker 1: and the evidence within it?
Speaker 2: Security is layered physically. You need high grade materials for locks,
Speaker 2: multiple authentication methods, pins, maybe fingerprints, and detailed logs of
Speaker 2: who who enters and leaves.
Speaker 1: The last makes sense, keep track of everyone.
Speaker 2: Network isolation is also critical. An air gap physically disconnected
Speaker 2: from outside networks or at least a very robust firewall.
Speaker 2: You have to protect your trusted forensic systems from well,
Speaker 2: curious and malicious crackers out there.
Speaker 1: Keep the bad guys out.
Speaker 2: And don't forget environmental stuff, fire protection, automatic suppression systems,
Speaker 2: fireproof storage, to guard against unforeseen natural disaster. You're building
Speaker 2: a protective.
Speaker 1: Bubble, okay, a secure bubble. What tools are essential inside
Speaker 1: that bubble? What can't an investigator work without?
Speaker 2: Right blockers? Absolutely essential. These are forensically sound devices. Think
Speaker 2: of them like a diode or a check valve for data.
Speaker 1: A check valve. How does that work?
Speaker 2: It ensures data can only travel one way from the
Speaker 2: evidence drive to the forensic workstation. It physically stops the
Speaker 2: computer from running back to the evidence drive.
Speaker 1: Ah, preventing those axidle modifications we talked about.
Speaker 2: Exactly which could make the evidence useless in court.
Speaker 1: That's clever, like a one way street for data. What
Speaker 1: about investigators working out outside the lab in the field, Yeah.
Speaker 2: They need a field kit. It's got essentials. Permanent markers
Speaker 2: for labeling everything, clearly, anti static bags to protect the electronic.
Speaker 1: Basic but crucial stuff.
Speaker 2: Very crucial and for really sensitive drives, especially if you're traveling.
Speaker 2: The advices use padded boxes and if you have to
Speaker 2: hand carry them on the plane, don't check them. Protect
Speaker 2: that evidence.
Speaker 1: Okay, So you've got the lab, the tools, the mindset.
Speaker 1: Now the actual hunt for data. How do you collect
Speaker 1: evidence from say a single computer in a forensically sound way.
Speaker 2: It's very methodical, almost like a ritual. First step, power
Speaker 2: down the system properly, then physically disconnect the power cord,
Speaker 2: eject any media CDs, DVDs, USBs. And the book even
Speaker 2: mentions the old paper clip trick for a stubborn CD
Speaker 2: ROM drive.
Speaker 1: Ah, good old paper.
Speaker 2: Clip, and this is vital. Fill out a separate chain
Speaker 2: of custody form for every single item you remove, every
Speaker 2: hard drive, every flash drive, every DiscT document, everything.
Speaker 1: Every single piece tracked. Okay, Then comes imaging the drive right,
Speaker 1: that sounds critical.
Speaker 2: It is the critical step. This is where tools like
Speaker 2: end case or the DD command and Linux smart ftk
Speaker 2: immager come in.
Speaker 1: What do they do exactly?
Speaker 2: Their main job is to create an exact bit for
Speaker 2: bit copy of forensic image of the original drive. Every file,
Speaker 2: every deleted fragment, all the hidden data gets preserved.
Speaker 1: The perfect snapshot.
Speaker 2: Yes, and a crucial point. When you're imaging a drive
Speaker 2: on a Windows system, you must use a hardware right blocker.
Speaker 2: Why specifically Windows, because Windows automatically tries to write system information, timestams,
Speaker 2: log entries to any new drive it sees. If you
Speaker 2: connect and evidence drive directly, Windows will write to it instantly,
Speaker 2: compromising its integrity. The right blocker prevents that.
Speaker 1: Got it essential for Windows. So once you have the image,
Speaker 1: the snapshot, what's next, bag and tag.
Speaker 2: Exactly, you properly label the original drive using tamperproof peel
Speaker 2: and stick labels. Document everything on the label and in
Speaker 2: your logs. Then secure storage a locked location, access strictly controlled,
Speaker 2: only authorized personnel, ready for court.
Speaker 1: Okay, that covers the traditional approach. But things are changing, right,
Speaker 1: Remote investigations are becoming more common.
Speaker 2: Yeah, the whole business climate is pushing things that way.
Speaker 2: Thing wrongful termination suits, IP, theft, new regulations, it's all
Speaker 2: forcing current forensic approaches to evolve.
Speaker 1: As the book says, how.
Speaker 2: So, well, you've got global companies, massive amounts of data
Speaker 2: spread everywhere, and tricky workplace privacy issues. Sending an investigator
Speaker 2: on site isn't always practical or even possible anymore.
Speaker 1: And privacy. Yeah, that sounds like a minefield.
Speaker 2: It can be. The book highlights a major pitfall violating
Speaker 2: private sector workplace privacy. If a company doesn't have a
Speaker 2: clear acceptable Use policy an AUP, or just a clear
Speaker 2: policy on employee privacy expectations that employees have acknowledged, that
Speaker 2: company is really exposed to liability.
Speaker 1: So what's the fix?
Speaker 2: The countermeasure a well written AUP that employees actually sign
Speaker 2: off on. It needs to clearly state what's allowed, what's monitored,
Speaker 2: and what the expectation of privacy is or isn't on
Speaker 2: company systems. That's the company's.
Speaker 1: Legal shield, crucial for any business listening. Yeah, so if
Speaker 1: physical collection is hard, what's the remote alternative tools?
Speaker 2: Like in case enterprise. Their true power, according to the book,
Speaker 2: is accessing data on a live system remotely.
Speaker 1: Without physically taking the drive.
Speaker 2: Exactly, with just a few clicks, you can potentially access
Speaker 2: and image the data. You can even do it covertly
Speaker 2: sometimes covertly. Yeah, though you always have to consider network speed.
Speaker 2: Imaging terabytes over a slow connection that could still take days,
Speaker 2: but it avoids the need for physical access.
Speaker 1: Okay, and what about those little USB drives you mentioned them? Earlier.
Speaker 1: They seem like a huge risk for companies losing data.
Speaker 2: Oh, a gigantic risk for corporations, especially for IP theft
Speaker 2: people just walking out with sensitive data.
Speaker 1: How to investigators track those? They seem so easy to hide.
Speaker 2: That's where digital footprints get really specific. Investigators dive into
Speaker 2: the Windows registry.
Speaker 1: The registry like the computer's central logbook sort of.
Speaker 2: Yeah, it's a huge database of settings and activity. They
Speaker 2: look specifically at a key called USB store USB store yep,
Speaker 2: it's like a guestbook for USB devices. It logs when
Speaker 2: a device was last plugged in. Even better, it often
Speaker 2: records the device's unique hard coded serial number the instanciety
Speaker 2: that's a very reliable way to track a specific thumb drive.
Speaker 1: Wow, so even a simple USB stick leaves a pretty
Speaker 1: clear trail. What about other user actions? How do you
Speaker 1: piece together what a suspect has taken or done on
Speaker 1: the computer?
Speaker 2: Now? Really unmasking activity? Take Microsoft Office documents. They're often
Speaker 2: full of hidden metadata.
Speaker 1: Get a data like data about the.
Speaker 2: Data exactly hidden fields called custom properties, things like review, cycleide, author, email,
Speaker 2: even email subject. This stuff can directly link a user
Speaker 2: to a document, sometimes even showing the email addressing CA.
Speaker 1: Came from hidden right inside the file.
Speaker 2: Sometimes, but interestingly, this info is often stored outside the
Speaker 2: main document file, in little companion files like adhosse dot
Speaker 2: rcd or review dot rcd.
Speaker 1: That's sneaky, so much hidden info.
Speaker 2: And investigators can also search for something called the PI,
Speaker 2: which can lead to the document's unique MC address m
Speaker 2: MAC address.
Speaker 1: That's like the network cards fingerprint.
Speaker 2: Precisely, it's like the VIN number for the network card
Speaker 2: on the computer that created or last saved the document.
Speaker 2: A very powerful identifier.
Speaker 1: Okay, so documents, bill secrets. What about web browsing. Let's
Speaker 1: start with the Internet explore. People use that for ages.
Speaker 2: Yeah, and here's the interesting thing about IE. Even though
Speaker 2: it's old, it's kind of a digital tattletale. Also, because
Speaker 2: it was so deeply woven into Windows, it left tracks everywhere.
Speaker 2: Every click, every site visit often got logged and hidden
Speaker 2: files called index.
Speaker 1: Dot dot index dot det.
Speaker 2: Yeah. They act like lookup tables for browsing history, cash files, cookies,
Speaker 2: and cookies themselves store useful stuff like use names, site preferences.
Speaker 2: It's often less about what they searched for and more
Speaker 2: about proving they were on a certain side at a
Speaker 2: certain time.
Speaker 1: So even if you think you deleted your history, IE
Speaker 1: might still hold clues. What about Firefox? Is it different?
Speaker 2: Firefox is generally a bit tidier. Its files are more consolidated,
Speaker 2: usually easier for investigators to parse.
Speaker 1: Except uh oh, except what?
Speaker 2: Except for its history file format called m ork. The
Speaker 2: book does not mince words here. It calls m ork
Speaker 2: what happens when open source goes bad?
Speaker 1: Oh? Why so harsh?
Speaker 2: Apparently it's just a really complex, difficult format to extract
Speaker 2: reliable data from, sometimes a real headache for investigators.
Speaker 1: Good to know. Okay. Besides browsers and documents, what else?
Speaker 1: In Windows tracks user activity?
Speaker 2: There's a really important artifact called user assists.
Speaker 1: User assists, Yeah.
Speaker 2: Think of it as Windows keeping notes on what programs
Speaker 2: you run. It logs the application's name, its path, how
Speaker 2: many times you run it, and the last time you
Speaker 2: ran it.
Speaker 1: That sounds incredibly useful.
Speaker 2: It is especially for spotting programs run from a USB drive,
Speaker 2: or even figuring out what applications were used right before
Speaker 2: they got deleted. It shows intent and action.
Speaker 1: Okay, let's shift here slightly specialized investigations. Mobile devices. First,
Speaker 1: They are everywhere.
Speaker 2: Absolutely permeated our lives, as the book says, and because
Speaker 2: people are so comfortable with them, they sometimes will take
Speaker 2: risks they wouldn't normally take, like.
Speaker 1: The examples we started with documenting crimes on their.
Speaker 2: Phones exactly, or the book mentions a gangster taking a
Speaker 2: picture of a deceased person with his phone. That casualness,
Speaker 2: that comfort level, it's nothing but good for investigators.
Speaker 1: Grim But I see the point, and the tech has
Speaker 1: changed massively since two thousand and.
Speaker 2: Four, huge changes from those early PDA cell phone combos
Speaker 2: to today's smartphones. Tools have evolved too. Parabin's Device Seizure,
Speaker 2: for instance, can pull data from literally hundreds of models
Speaker 2: of cell phones. What kind of data call logs, contacts,
Speaker 2: text messages, SMS, mms, sometimes even deleted stuff or voice
Speaker 2: recordings In case also has tools for older palm ost devices.
Speaker 1: What's the biggest challenge with phones?
Speaker 2: Passwords and encryption are often the big hurdle. Getting past
Speaker 2: lock screens requires specialized techniques, sometimes specialized hardware.
Speaker 1: Right, so phones are one specialized area. What about massive
Speaker 1: enterprise storage terabytes of data on raids, sands NAS systems.
Speaker 2: Yeah, dealing with systems holding terabytes of data that weren't
Speaker 2: really designed for easy desktop access is another big challenge.
Speaker 1: How do they tackle say arrayed array.
Speaker 2: For raids you often have to image each disc individually
Speaker 2: and then reconstruct the array digitally. For some network attached
Speaker 2: storage NAS systems, you might even need to take the
Speaker 2: system offline for a whole day to get a clean image.
Speaker 2: It can be disruptive.
Speaker 1: And tapes still tricking, Still.
Speaker 2: Tricky, Yeah, same issues with varied hardware and software. But
Speaker 2: tapes do have one unique advantage that physical rite protect tab.
Speaker 1: Ah like on old floppy discs or VHS tapes, a
Speaker 1: built in hardware right blocker.
Speaker 2: Exactly, a nice little forensic safeguard built right in.
Speaker 1: So with all this data terabytes, how on earth do
Speaker 1: investigators search through it efficiently? It sounds impossible.
Speaker 2: That's where full text indexing is a life saver. Tools
Speaker 2: like Glimpse or Access datas FTK use clever indexing methods
Speaker 2: like binary search trees.
Speaker 1: Binary search trees.
Speaker 2: Yeah, it's a way to organize the data so you
Speaker 2: can search massive amounts terabytes of data in seconds. Literally.
Speaker 2: It lets investigators zero in on keywords or relevant files
Speaker 2: incredibly quickly. Huge time saver.
Speaker 1: Okay, investigation done, data analyze. Now the endgame reporting and
Speaker 1: the justice system reporting seems crucial.
Speaker 2: It's one of the most crucial parts, the book argues,
Speaker 2: because if you can't clearly explain your findings communicate.
Speaker 1: The facts, all that hard work was for nothing.
Speaker 2: All of your hard work will be for not exactly.
Speaker 1: Forensic tools generate technical reports, sure, but those aren't the
Speaker 1: final product.
Speaker 2: What makes a good final report, then, say, for internal use, it.
Speaker 1: Needs an executive summary, high level, easy for a non
Speaker 1: technical person like an executive to grasp the key findings.
Speaker 1: The evidence needs clear annotations explaining why it's relevant, and
Speaker 1: often you convert the final report to PDF to lock
Speaker 1: it down prevent changes. Okay, and then there are more
Speaker 1: formal legal documents, declarations, affidavits right.
Speaker 2: Declarations are typically for judges or lawyers. They need non
Speaker 2: technical language, clear paragraph numbering for easy reference, and affidavits
Speaker 2: add a layer of formality, a notarized signature that gives
Speaker 2: them stronger legal weight.
Speaker 1: What about testifying as an expert witness? That report is
Speaker 1: different again.
Speaker 2: Yes, and the key thing here is discoverability. As a
Speaker 2: testifying expert, your opinions are independent, but your work product
Speaker 2: everything related to forming that opinion. Everything, every document, every
Speaker 2: email notes, maybe even a doodle on a napkin if
Speaker 2: it relates to the case. It's all potentially discoverable by
Speaker 2: the opposing side and open for questioning. No secrets.
Speaker 1: Wow, that's intense pressure takes And how does the court
Speaker 1: process itself differ for digital evidence in criminal versus civil cases.
Speaker 2: In criminal cases, law enforcement usually seizes the original media.
Speaker 2: An interesting point the book makes is that the victim,
Speaker 2: the complainant, can sometimes lose control over their own crime
Speaker 2: scene once law enforcement takes over.
Speaker 1: Huh, didn't think of that.
Speaker 2: And civil cases, civil courts often give more control to
Speaker 2: the private parties involved in the lawsuit. They might manage
Speaker 2: the collection and analysis more directly, often hiring their own
Speaker 2: forensic experts.
Speaker 1: Okay, let's bring it back to real world impact. Yeah,
Speaker 1: fraud and IP theft. IP theft sounds devastating for companies.
Speaker 2: It has a truly detrimental impact, loss of customers, losing
Speaker 2: your competitive edge, profits eroding. And it's not just about
Speaker 2: someone copying source code anymore. It includes stealing customer data,
Speaker 2: trade secrets, really valuable stuff.
Speaker 1: How do investigators typically find evidence of that?
Speaker 2: They might look for those intermediary files we talked about,
Speaker 2: dot sql, dot CSV, dot tab files, suggesting data exported
Speaker 2: from databases for source code, they'll compare file contents, hash values,
Speaker 2: and remember those link files and registry keys like bags MRU.
Speaker 2: They can actually prove that specific proprietary information being opened
Speaker 2: on the thumb drive direct evidence of data theft.
Speaker 1: It's amazing how these little digital traces tell a story.
Speaker 1: What about broader employee misconduct things beyond ipceft.
Speaker 2: Yeah, that covers a lot. Violating company policy, maybe using
Speaker 2: work computers for a side business, harassment, breaking non compete agreements.
Speaker 1: How was that investigated?
Speaker 2: Same techniques often, Yes, those MRU registry keys, link files,
Speaker 2: they show which documents were accessed, what programs were run manually.
Speaker 2: It paints a picture of activity.
Speaker 1: The book had an interesting anecdote about code words.
Speaker 2: Oh yeah, that was a great one. An employee used
Speaker 2: codewords and emails and calendars at their old company when
Speaker 2: setting up meetings to steal clients or discuss leaving. Okay,
Speaker 2: But when they got to the new company, they stopped
Speaker 2: using the code words. So looking back, it became easy
Speaker 2: for us to see that an innocent sounding phrase like
Speaker 2: meet me about a personal issue at the old job
Speaker 2: really meant meet me so I can take your business.
Speaker 1: Wow, the change in pattern gave them away human behavior
Speaker 1: leaving digital clues again exactly.
Speaker 2: It's fascinating how behavior translates digitally.
Speaker 1: And tying this altogether. Employee and corporate fraud. What are
Speaker 1: common digital tactics there?
Speaker 2: A classic is running second sets of books, alternate ledgers,
Speaker 2: maybe hidden Excel files, separate QuickBooks files, sometimes even encrypted
Speaker 2: data on a thumb.
Speaker 1: Drive to track the illicit stuff.
Speaker 2: Precisely tracking embezzlement or other fraud outside the official company records.
Speaker 2: Money laundering is another big area.
Speaker 1: Trying to hide where the money came from.
Speaker 2: Right schemes often involve shell companies, which investigators might uncover
Speaker 2: through emails between accomplices or using fake identities, setting up
Speaker 2: accounts in foreign banks known for prioritizing privacy and.
Speaker 1: The impact of mass of corporate scandals like Enron or WorldCom.
Speaker 2: Huge societal impact. Those scandals, uncovered partly through digital forensics,
Speaker 2: directly led to new laws like Sarbanes Oxley trying to
Speaker 2: prevent that scale fraud from happening again.
Speaker 1: It really shows the power and necessity of this field.
Speaker 1: So wrapping this up, what's the big takeaway.
Speaker 2: For our listener, Well, I think it's understanding that navigating
Speaker 2: our digital world means understanding these traces we leave behind.
Speaker 1: We've definitely covered a lot today, from tiny digital dust
Speaker 1: motes on a hard drive all the way up to
Speaker 1: complex global cybercrime view through this lens of computer forensics.
Speaker 2: Yeah, it's this amazing intersection of technology, law, and well
Speaker 2: human behavior, often in really unexpected ways.
Speaker 1: And hopefully this deep dive has shown you, the listener,
Speaker 1: that being well informed here isn't just about the text PACs.
Speaker 2: No, it's really about grasping human intent, understanding the incredibly
Speaker 2: meticulous process investigators follow, and seeing how critical digital evidence
Speaker 2: is in our justice. It holds people and companies accountable.
Speaker 1: So here's a final thought to leave you with. As
Speaker 1: technology becomes even more embedded in everything we do, the
Speaker 1: phones in our pockets, the networks connecting us globally, what
Speaker 1: new kinds of digital fingerprints are we creating, maybe without
Speaker 1: even realizing it, And how.
Speaker 2: Might those new fingerprints change the future of investigations and
Speaker 2: maybe even our whole idea of privacy?
Speaker 1: Something to think about