5 Reasons Why You Need a Digital Forensic Examiner

 

April 29, 2015

5 Reasons Why You Need a Digital Forensic Examiner:

Lists are all over these blogs, aren’t they?  But I bet you haven’t seen the top 5 reasons you need to hire a digital forensic examiner!  Not to be outdone, we’ll try to keep it to only five:

1)     Data is everywhere

Think about all the digital devices you own and use.  Chances are, as this graphic shows, you probably use your handheld portable device(s) in the morning, transition to laptop/desktop computer(s) during work hours, then go back to mobile with heavy use of tablets during the evening hours (because you and your partner don’t want to watch the same TV shows).

This graphic doesn’t even take into account the internet of things (IOT) and cars with constant connectivity and GPS.  So the bottom line is, virtually everything you do during the day will involve a digital device on some level and leave a digital footprint.  That data is stored on those devices and if you’re involved in some sort of dispute, accident, encounter, etc. that may lead to legal action down the road, you’re going to want a trained digital forensic expert to acquire, analyze and report that data for you. 

2)     Data breaches affect everyone

In the past year or so, we’ve seen dozens of high-profile data breaches occur in the private commercial and government sectors.  Sony, Target, eBay & Anthem, just to name a few.  And no one has been immune from the spoliation of this data, even the rich & famous (i.e., Ben Affleck & Amy Pascal).  But for everyday consumers like us, it means that our personal information could be shared with unsavory types, so whether you’re hiring a digital forensic examiner yourself or your bank is hiring one to help find out what happened and by whom, it does affect you

3)     Chances are, you’ll be involved in litigation at some point

It’s a fact that the U.S. houses roughly 50% of the world’s attorneys and attorneys make money by handling legal matters.  Not all legal matters are contested, but when they are, you want the data to show the truth.  And if you believe #1 (data is everywhere), the likelihood that you will not only be involved in some sort of contested litigation, but that that litigation will likely involve retrieving & reporting data that is pertinent to your case in a verifiable, forensically sound & virtually airtight manner is very real.  From divorces to child custody to distracted driving personal injury to criminal cases, the ubiquitous nature of the devices we carry and the data (i.e., evidence) they store cannot be denied.

4)     Your IT guy probably doesn’t know squat about Digital Forensics

Information Technology (IT) is a huge field.  It encompasses everyone from help desk agents to information security officers and everyone in between.  Generally, when we think about IT, we think of the computer geek; the guy we call when we can’t access our email, when the computer “broke”, when our company-owned phone is acting funny or some other every day run-of-the-mill problem.  They’re good at that stuff and the information security guys are good at setting up networks and systems to prevent data breaches, but generally none of them are trained adequately to secure digital evidence, forensically acquire that evidence, analyze the evidence or testify about the evidence and the procedures they took.  These skills require special training and experience.  Do IT folks have access to it?  Yes.  Do most of them take this training? No.  Call a professional.

5)     The Police can’t do it all

Cybercrime & electronically-facilitated crime is no doubt on the rise.  When we get calls from potential clients stating they’ve been hacked, we refer them to the police because computer trespass and theft of personal information is a crime, but most of the time, they call back a couple weeks later for our help.  The police, especially local police, don’t have the resources to investigate, analyze data and report as to what may have happened.  And hacking is just one example.  In a day & age when everyone carries a micro-computer with GPS, a microphone, camera and telephone in their pocket, which tracks their moves, the value of the evidence that those devices store cannot be understated.  Unfortunately, along with being involved in litigation, you’ll probably also be the victim of a crime at some point.  If the police don’t have the resources to adequately investigate the incident, it may be worth it to call someone who does!

So there’s our list.  If nothing else, we hope this serves to educate just some of the reasons why you may need a digital forensic examiner on speed-dial.  Is a digital forensic examiner someone you need every day?  No.  But much like your car mechanic, your exterminator and your lawyer, you sure want to know how to contact a good one when the time comes! 

Did we mention our contact information is below?

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: ProDigital4n6

Digital Forensics & Mental Health

February 20, 2015

Digital Forensics & Mental Health

As a former law enforcement officer, tactical team member and child exploitation investigator, I’ve certainly seen my fair share of gruesome car accidents, injuries, violence and child victimization.  And while the police generally get quite a bit of attention with regard to the concerns of Post-Traumatic Stress Disorder, seldom (if ever) are the civilian counterparts in digital forensics afforded the same considerations.  I’d like to user this forum to start changing that mindset, if even a just a little.

Background

Soldiers, medics and front-line combat personnel certainly see some of the worst man has to offer.  From wounded comrades to children being used as homicide bombers, the horrors of combat have been well documented throughout history.  One of my personal role-models is Lt. Col. Dave Grossman, whose written works “On Killing” and “On Combat” break down the stigma typically associated with the “John Wayne” and Hollywood imagery of combat and tell the truth about how traumatic combat really is.  From men displaying acts of pure cowardess to defecating themselves, these actions are real, physiological symptoms of operating in a high-stress environment, such as combat.  In civilian law enforcement, it’s often reported that a very high percentage of officers involved in combat situations in which they had to kill or seriously wound another person don’t work in the field much more than a couple of years after the incident.  The very fact that police officers, firefighters & combat soldiers receive hazardous duty benefits means society has deemed their positions not only of higher value than other public servants, but that they also have a high propensity for danger.  This is why I would cringe whenever another police officer would tell me to “stay safe.”  There’s nothing safe about these positions.  If you want safe, go work in a library.

The almost inevitable fallout from working these positions is some sort of psychological damage, most commonly referred to as Post-Traumatic Stress Disorder or PTSD.  While it’s often the butt of jokes from people who have never worked in dangerous situations, it’s also a real phenomenon.  For example, I have two friends & former co-workers who responded to a domestic dispute that turned violent.  The aggressor in the situation grabbed his pistol and began shooting his family members, then at my friends as they arrived at the house in response to frantic 911 calls from the shooter’s family.  One of my friends had to shoot and kill the man who was about to shoot and kill him.  The other friend shot at the man from a distance, but they both delivered deadly force.  This incident occurred over 4 years ago.  One of my friends is still in law enforcement, the other is not, but they bond over the incident and speak to each other yearly as a reminder of how fortunate they are to be alive after that day.

The stress of combat isn’t the only environment where a public safety practitioner can fall victim to the psychological effects of trauma.  As a child sexual exploitation investigator, I would routinely work in an undercover capacity chatting online with grotesque, sick men (yes, they were all men) who consistently talked about doing horrible, vile things to a person they thought was a young girl (age 13) - from rape to incest & marriage to pregnancy.  In addition to those cases, I would routinely attempt to identify and arrest people involved in the trading of child pornography images on the internet.  These images are not of 17 year-old girls, they are of small children, sometimes infants, being bound, drugged, raped, molested and violated in acts you can’t even imagine.  These acts are recorded then traded and shared amongst people with similar interests.  Initially, I would investigate these cases, view only what I had to in order to make the case, then submit the evidence to someone else for digital forensic examination.  As time went on, I became responsible for not only the investigation, but the computer forensics portion of the cases as well.  This meant my exposure increased from a moderate percentage to almost 100% in every case.

Forensic Examiners in the Weeds

In many ways, the forensic examiner has it worse than the investigator.  In order to get a complete picture of the evidence for court, it must ALL be examined, not just the parts that are good enough to make a case.  I recall one case (referenced here: http://prodigital4n6.blogspot.com/2015/01/case-study-commonwealth-v-emanuele.html) where there were not only mountains of child pornography images, but terabytes of adult pornography and bestiality images too.  As the forensic examiner in these cases, once the images are viewed, you can’t un-see them.  Some of them are so vile and disgusting, they make you gag.  These images get emblazoned in your memory for a time and the best thing you can do is take a break from the work and try to let the memory fade.  The repeated exposure to these types of images had an effect on my marriage, my relationships with co-workers, my overall attitude and my desire to keep working.  The argument could be made, much like officers involved in deadly force incidents, that the PTSD effect from repeated exposure to images like this led to my eventual departure from law enforcement.  If that isn’t textbook PTSD, I don’t know what is.  Over the years, I attempted to talk about my haunts with a couple of different counselors, but it’s hard to relay the horror of things to people who don’t even want to know these evils exist.

If you are a digital forensic practitioner and you’re reading this, you may be thinking, that’s what we have hash sets of known child pornography for – so we don’t have to view all of the images.  While this point is very well taken, many cases still require those involved in the process to view and verify the images, regardless if they belong to hash sets of known child victims.  This is also why we show images to judges & juries at trial.  An alpha-numeric string doesn’t adequately relay what the image contains.  Not even close.

Agencies like the FBI do have measures in place to ensure the mental well-being of their agents, especially those involved in child exploitation investigations.  I do not know, however, if the same considerations are offered for civilian forensic examiners employed by the FBI who are unquestionably exposed to more of these images than the agents themselves.  Examiners have to look at it all, that’s the only way we can know what really happened.  I worked at a smaller rural agency who not only didn’t give any consideration to the stress the repeated exposure had on mental health, but denied several attempts for us to join forces with the FBI task force, which would have offered us the opportunity for yearly psychological evaluations and access to counseling.  I’m forced to wonder if this phenomenon is present for other child exploitation task force officers employed by smaller, local and/or rural agencies.  With all the political and monetary capital being fed into national child exploitation investigations and state task forces, how much is being set-aside to ensure appropriate mental health of the investigators AND the forensic examiners, whether they be civilian or sworn?

Conclusion

There is a trend afoot in the world of digital forensics in law enforcement.  The movement is progressing in many areas to transition the role of a digital forensic examiner away from sworn law enforcement officers and move toward an all-civilian digital forensic work force.  Why, you may ask?  To save money.  But what is the cost in terms of human capital when examiners get burned-out, stressed-out, over-worked and perhaps even sloppy because they are exposed to things that most people should never see?  It can be very hard for some people to remain consistently objective under those circumstances.

Perhaps it’s time to consider adding civilian digital forensic examiners to the statutory list of public servants who are afforded certain considerations because of the hazards their job exposes them to.  Do civilian examiners have to kick open doors and handcuff people? No.  But their job on the back-end of an investigation is just as important as the investigator and they are often exposed to much more psychological trauma than investigators.  

The job of a digital forensic examiner isn’t glamorous (despite the new CSI: Cyber series).  It is interesting, challenging, ever-evolving, fascinating and valuable.  I love it no matter who my “client” may be because I get to pursue the truth in every case.  But maybe it’s time for administrators to stop counting beans and start caring about the people doing the work. 

As a close friend of mine who is a retired Trooper once wisely said, the command simply doesn’t exist without the rank-and-file.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com
Twitter: @ProDigital4n6