In an attempt to understand what has happened during the breach of Sony Picture's computers, DFI News has contacted SANS Institute's DFIR team. In an email interview, Jake Williams, an Instructor at SANS, provides his insights into the complex digital forensic story unfolding at Sony.
Not long ago, mobile device forensics was a relatively straightforward process. Contact lists, SMS messages, and call logs were obtained and examined for evidence using specialized forensic technology. But with the blistering rate of advances in mobile technology, the explosion of mobile data and devices, times have drastically changed.
Dirt is full of life, microbial life. Although dirt seems to be an inert, lifeless material, one gram of soil may contain up to eight billion living bacterial cells. Grave soil found next to dead and decomposing human bodies is teeming with many microbial secrets that have yet to be uncovered.
The National Fire Protection Association’s (NFPA) Code for Flammable and Combustible Liquids, NFPA 30, is an excellent resource and introduction to the hazards of these materials. Without getting too bogged down in technical details, there are a few concepts that need mentioning and understanding at the outset.
To increase hard drive storage capacity, manufacturers have been able to decrease the size of magnetic grains which comprise data bits. This allows for a greater number of bits of data to be recorded. However, the grains are so small that they can potentially interfere with each other. This diminishes their ability to maintain assigned magnetic orientations and data would become corrupted, leading to an unreliable and unusable hard drive.
When you arrive at the scene, establish secure, central areas for clean equipment, items to be disposed of, and items to be decontaminated. For the first area, I used to take a clean biohazard bag, open it up, and spread it on the ground.
A good autoclave safety program must include documentation. Principal investigators and supervisors are responsible for ensuring proper records are kept up to date. Autoclave users should be responsible for recording autoclave run information.
Typically, managers dread having to perform employee assessments and experience high anxiety anticipating them. For the employee, too, who is about to undergo a formal performance assessment, the procedure is a high-anxiety producer. So what typically happens is that two very nervous people get together, try to act calm, and just “get through it.” It doesn’t have to be that way.
Effective training in professional ethics doesn’t primarily consist of rote memorization of rules, but instead must prepare the examiner in the art of ethical issue spotting. Similarly, an effective code of ethics consists not only of certain static core principles, but also may consist of components that can be adapted over time to keep pace with the law and with professional norms.
As I've mentioned before, understanding what is possible—not just by you, but by others—is crucial. Prints are a good example. In the past, we couldn’t lift prints from certain surfaces. Now, experts can lift latents from documents, papers, and adhesive tape.
The mobile device industry is evolving very quickly. To stay current on the latest devices and the proper techniques for acquiring and analyzing data, smartphone and mobile device forensic analysis training courses are becoming more and more necessary.
This apparently innocent question may be the one you agonize over the most. Personally, we feel there is no substitute for face to face interviews and a physical walk through of each laboratory. The crucial thing here is that the auditor or surveyor must be trained and knowledgeable about the type of work being performed in the laboratory undergoing the safety audit.
A month after rebranding from Telecom to Spark, the leading New Zealand ISP had received collateral damage from the conflict between Russia and Ukraine. Fights there have never really been toe-to-toe, but, on Friday evening, September 5, Spark engineers announced that a layer-3 DDoS attack was causing an overload of its DNS servers.
When compared to a typical hard drive, SSDs are totally different in design and functionality which leads to some difficult issues to deal with pertaining to their forensic analysis.
Contamination of equipment at a crime scene is a serious problem and can occur in many ways. Any time your equipment comes into contact with blood, fluids, or other substances at a scene, you run the risk of contamination.