Digital Forensics: Adding Value To Title IX (Title 9) Cases

September 14, 2020

Digital Forensics: Adding Value To Title IX (Title 9) Cases

For the past several years, there have been multiple business articles stating how the private sector digital forensics industry will be growing exponentially in the near future.  This is partially due to increased data breaches, increased civil litigation filings where data is at issue and increased electronically-facilitated criminal activity.  One area where we are seeing a decided uptick in the need for forensic data acquisition, analysis, consulting & expert testimony services is Title IX cases, which occur largely on college campuses.  According to Harvard University:

“Title IX is a US federal civil rights law passed as part of the Education Amendments of 1972. This law protects people from discrimination based on sex in education programs or activities that receive Federal financial assistance.

Title IX states that:

‘No person in the United States shall, on the basis of sex, be excluded from participation in, be denied the benefits of, or be subjected to discrimination under any education program or activity receiving Federal financial assistance.’”

Since it’s initial passing, Title IX has grown to include claims involving sexual harassment, discrimination and sexual violence.  The odd procedural issues with Title IX claims are that they may be made personally or anonymously, may or may not lead to a formal administrative charge against the accused and the accused may or may not even know the claim was ever made about them until long after the claim has been filed and/or adjudicated.  This can lead to problematic issues surrounding due process, rights to face one’s accuser and false claims made against the accused.  Further, if the accused graduates college and submits to any type of background investigation for employment, the presence of the claim on their formal educational record will likely cause expulsion from the hiring process.  Because of all of these controversial factors, recent years have also seen Title IX civil litigation blossoming into another area where justice may be sought by either the accuser or the accused.

Digital Forensics In Title IX Cases

Because Title IX claims deal mainly with college-aged claimants and accused persons, who undoubtedly use their mobile devices to a high level, the likelihood of having data in some form that may show extensive contact between the parties and serve to add value to the case is fairly high.  Whether the data is stored on a mobile device via chat or texting apps, pictures, call history, voice recordings, web history and/or email, the appropriate forensic acquisition of this data is of paramount importance to identifying the circumstances surrounding the alleged event.  Title IX cases are legal proceedings, however there may be no law enforcement investigation and the proceedings may not have a judge or attorneys present, which can put one or both sides of the matter at a procedural disadvantage.  However, the accusation and disposition of the proceedings have a long-lasting effect on the accused and/or the claimant.  Because the outcomes of these proceedings are essentially permanent and potentially impactful for a lifetime, the use of screen shots or tools with which the mobile device’s data can be easily altered prior to presentation to document contact between the parties involved is highly discouraged, as discussed in our recent article here. 

Another area that should not be overlooked in Title IX claims is data that may reside on one or both party’s computer systems.  While it’s a digital evolutionary fact that much of modern class and professional work can be conducted on mobile devices, many mobile devices are still not ideal for composition of long-form text such as research papers, lengthy emails and files or documents with larger data sets.  Email exchanges between the accused and the claimant as well as synced text message contact (iMessage, WhatsApp, etc.) over desktop applications could also be vital evidence in the Title IX claim, some of which may not be present or available via forensic data acquisition from the mobile device. Additionally, it’s very likely that the mobile device in use by either party has been charged and/or synced by the computer system at some point in the recent past.  Depending on a number of different parameters, this may lead to a backup of the mobile device data being created, which can then be acquired, analyzed as if it were the mobile device itself and used as evidence in Title IX proceedings.  While the Rules of Evidence or Civil Procedure may not be an overwhelming consideration in Title IX cases, the potential that evidence may be used in later formal courtroom litigation dictates that the evidence used in the administrative proceedings should be acquired and analyzed in a forensically sound manner.

Conclusions

Title IX cases present a host of challenges for virtually all parties involved.  As with all formal proceedings, the truth of the matter can ultimately boil down to the evidence, and particularly the strength of that evidence.  Because so much can be at stake with regard to the future of both the claimant and the accused, the appropriate documentation and forensic acquisition and presentation of data in the case is vital to proving or disproving the claim.  People increasingly live their lives on their devices, whether it be a mobile device (phone, tablet) or a computer or a combination within the various data storage ecosystem.  The good (and sometimes bad) thing about this ubiquitous connection to electronic devices is that they document nearly everything for us.  This becomes evidence in many legal and administrative proceedings, but the “devil in the details” can ultimately rest on the proper handling, acquisition, analysis and presentation of the data involved in the case.  When someone’s future is at stake, why risk presenting bad, unverifiable or lacking evidence?

Author:

Patrick J. Siewert

Principal Consultant

Professional Digital Forensic Consulting, LLC

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Wherever You Need Us!

We Find the Truth for a Living!

Computer Forensics -- Mobile Forensics -- Specialized Investigation

About the Author:

Patrick Siewert is the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia USA.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation investigations in Virginia court history.  Patrick is a graduate of SCERS, BCERT, the Reid School of Interview & Interrogation and multiple online investigation schools (among others).  He is a Cellebrite Certified Operator and Physical Analyst and Instructor, as well as certified in cellular call detail analysis and mapping.  He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.

Email:  Inquiries@ProDigital4n6.com

Web: www.ProDigital4n6.com

Pro Digital LinkedIn: https://www.linkedin.com/company/professional-digital-forensic-consulting-llc

Patrick Siewert LinkedIn:  https://www.linkedin.com/in/patrick-siewert-92513445/  

Training Review: X-Ways Forensics

April 15, 2016

Training Review: X-Ways Forensics

I’ve been involved in computer/digital forensics since 2009, starting off my first training with Basic Data Recovery & Acquisition (BDRA) given by the National White Collar Crime Center (NW3C) in Fairmont, WV.  Many of you have probably started your forensic training at NW3C or any of the other governmental or non-governmental entities that offer basic training.  Starting with BDRA and progressing through my forensic training, I’ve observed one (mostly) universal characteristic about the trainings:  No matter the host/vendor, no matter the tool-specific application(s), no matter the level of complexity of the subject matter, it’s very hard to make computer forensics training ultimately compelling and engaging.  Maybe it’s because we sit in a chair for 3-7 days and stare at a computer screen all day long.  Maybe it’s because there’s some overlap with training we’ve received previously.  Maybe it’s just because we don’t want to be there (everyone loves to be “voluntold” to go to training), but the fact remains, it can often be dry and sometimes even boring.

When I left the public sector and launched Pro Digital Forensic Consulting, I did my research about which tools to invest in initially.  Without question, there is a different mindset when you’re paying for the tools and licensing yourself as opposed to your department or company paying for them, so I was very discriminating about what I wanted, what I needed, what I thought might best serve my clients in the future.  With the ever-growing need for dedicated tools for both computer and mobile forensics, I decided to invest in tools with a dedicated purpose.  Having been a previous user of a very popular and widely-used tool, I reached out to them first.  Their salesperson was less than knowledgeable and even told me “I don’t do forensics myself, so maybe tech support could answer your question”.  This turned me off.  And being a self-admitted non-conformist, I decided to go in a different direction for several reasons: 1) from my perspective, the “heavy hitters” in the computer forensic industry were trying to take on too much re: mobile devices, eDiscovery, etc., 2) the same “heavy hitters” were forcing users to use tools that were less than stellar by way of newer versions & updates that were not as effective as previous versions and 3) I kept hearing great things from real-world computer forensic practitioners about the German-based tool, X-Ways Forensics.  With all that in mind, I made a leap of faith toward X-Ways as my primary computer analysis tool in 2014 and haven’t looked back.

Training in the Use of X-Ways Forensics

As every experienced examiner knows, computer forensic tools all try to do the same things, but some have strengths over others.  They also have their own terminology which is sometimes tool-specific.  Having only used X-Ways Forensics (XWF) very seldom during my time in law enforcement, I opted to partake in an online course of study that was created by Brett Shavers.  The course was good because it gave a very basic overview of how to set up XWF and use XWF to work cases effectively.  Brett and former FBI Special Agent Eric Zimmerman also wrote a book that I would recommend to all users of XWF because it’s great for a quick-reference to intermediate guide.  The book is entitled X-Ways Forensics Practitioner’s Guide.  It got me to a functional level, but I knew I needed more.  

Unfortunately, I also knew that XWF doesn’t offer open training in the US quite as often as some of the “heavy hitters”, nor are the locations always convenient.  For instance, there are only four open classes scheduled so far in 2016 in the US.  However, because I’m an XWF customer and user, I received an email late in 2015 about the 2016 training dates and, lo & behold, one was offered in April, 2016 in Manassas, VA… Very convenient for Pro Digital!  The cost of the training was very reasonable ($1,799.00 USD) especially in comparison to other vendor-sponsored training, whether online or classroom-based.  The list of what is included in the X-Ways Forensics I course may be found at this link:  http://www.x-ways.net/training/index.html

Course Content & Delivery

The XWF basic course is not for beginners in the field of computer forensics.  If you have no forensic experience, I highly suggest taking the NW3C courses (BDRA & IDRA) or their equivalent before attending any vendor-specific training.  You must have prior knowledge of basic forensic terminology and a basic to intermediate understanding of how files are allocated in different formats, how different operating system versions work, how file carving works, disk partitioning and a number of other concepts that are considered basic computer forensic knowledge.  Simply put, if you don’t have this knowledge, you will be lost and you won’t get anything out of the training.  I would also suggest that it may be beneficial to have some knowledge of how forensic tools work generally.  You don’t need to purchase one of the expensive tools to do this.  Consider downloading Autopsy from SleuthKit and some training disk images and experiment with it.  Naturally, I’d suspect most of you reading this are very familiar with tools such as EnCase, FTK, Nuix, IEF etc.

Our instructor for the week was Fotis Mouratidis.  As mentioned previously, XWF is a German-based company and, as such, their instructors are European.  If you’re in the US and weary about language problems, don’t.  Fotis was very fluent in English, as well as 3 other languages.  He was also very knowledgeable about the tool itself.  While that should be a “no-brainer” for a vendor-instructor, it’s not always a given that they know (almost) everything they need to know about the tool.  Fotis walked us through such tool-specific topics as initial set-up of the tool, the multitude of case and user-specific options that XWF provides, the benefits of XWF over other tools (like disk imaging speed and compression rate) and how to use XWF in a very efficient manner.  

X-Ways Forensics training is somewhat no-frills, but I don’t need frills.  I need good information that I can use to work cases better, and I got that.  You’ll need to bring your own laptop.  Fotis didn’t come with Pelican cases full of freshly-imaged computers for us to work on, but he didn’t have to and honestly, I appreciate the ability to use the tool on my equipment to see how well they work together.  X-Ways provides a number of training disk images on which to practice and complete practical exercises as well as training licenses for the duration of the class.  The handout materials follow the PowerPoint presentation, but in keeping with good presentation practice, they only have a snippet of information so you are forced to concentrate on the instructor’s presentation where the real knowledge base resides.  I highly recommend bringing a notebook and taking frequent notes on items that may be of particular interest to you.  Throughout the 4-day course, I took a dozen pages worth of notes… and I still feel like that wasn’t enough.

One definite observation that I noted several times is that the instructions and the tool itself are very precise and specific.  Remember, XWF is a German-based company.  Throughout history, Germans have always been thorough and precise in their engineering of anything of quality, so it helps to keep that in mind during the training, practical exercises and when using XWF.  The tool will do exactly what you tell it to do.  Fotis reminded us of this several times with regard to the tool-specific X-Pert Certification test and process that is available through X-Ways Forensics.

Brief Notes About the Tool

Of particular note about XWF are a few points: First is the filtering features in XWF.  There are a multitude of filtering options in XWF that can help narrow the focus of your investigation.  Not only can you filter by file type, size, dates, etc., but you can filter by metadata information, child objects, file attributes and a number of other categories.  What is even better is that XWF does a good job at telling you those filters are in place.  In using other tools, I’ve often fallen into the trap of trying to search for evidence while a filter is on, only to waste time (and frustration) because the tool didn’t have enough “idiot icons” telling me there was a filter in place.  XWF tells you in at least 3 different places that there is one or more filter activated.  It’s a small, but nice feature and it can save aggravation and wasted time.

XWF is also very easy to install, customizable and portable.  Once set up, the tool stores all of your options in a configuration file that can be easily copied and transferred upon installation of a new version (versions are updated every 3-4 months).  If you have a particular type of file header that isn’t included in the search list, all you need to do is add it and save and it can be searched for from that point forward.  One of the big reasons I invested in XWF is because it is lightweight and portable.  By that, I mean that it is not a resource hog like some of the other tools.  There is no external database that needs to be run on a separate disk for optimization.  XWF doesn’t eat up a ton of resources on your machine to simply examine the evidence.  It can be run from a thumb-drive if necessary, which can also make it an ideal tool for live response and/or advanced triage on-scene.  The GUI can be intimidating to some who prefer lots of fancy icons and colors, but it too can be customized to highlight certain types of files that may be of interest in your case.  It’s not going to dazzle you if you like the shiny, pretty things, but at the end of the day when you need to get the job done, XWF does it very, very well.  As with all other tools, the more robust hardware you incorporate, the faster XWF will work.  This is particularly true if you’re trying to work and process more than one case at a time, which XWF allows for as a user option.

If you are used to features like the picture gallery, file preview, timeline (calendar) and details/metadata, XWF also incorporates those and they don’t take forever to load or view.  If you are investigating a potential security breach and your investigation has narrowed to a particular day (or set of days), then a simple click on that time frame highlights the activity for the period(s) in which you are interested.  For all of the tool-specific symbols and icons, XWF offers a full-time “legend” button, just in case you get mixed up between using three different tools and need a refresher as to what the XWF icons mean.  It’s a nice, functional feature.

Conclusions

Having attended a multitude of different training offerings including instructor-led, online and webinar-based, I would rank the XWF training among the best.  Fotis kept the class moving along and knew how to demonstrate everything we covered effectively and simply and because of how it was presented, we had to pay attention to learn what he was presenting.  He was patient and easy-going and, as his car-pool partner for most of the training, I can say he’s a genuinely nice person.  But the true measure of the quality of training is 1) how much you get out of it and 2) does the instructor compliment the subject matter and vice-versa?  As one who has used XWF for a couple of years, I learned how to do things better, faster and more efficiently.  I also learned many new features I didn’t know were part of the tool.  As for the instructor-tool synergy, they complimented each other very well.  The instructor was able to flow with the tool demonstration and instruction and the tool flowed right along with him. 

 

Most of the time, I come away from a week-long computer forensic training drained, knowing that it was necessary, but not looking forward to the next one.  This time, when the training was over, I found myself almost immediately researching when and where the XWF Advanced course was offered and how to make it work with my budget and schedule.  Sadly, it appears there may not be an open advanced course scheduled in the first part of 2016, but I’ll be keeping my eye on the 2^nd half of the year and beyond to see when I can take advantage of this great training again.  If you’re impressed with the simple elegance of how your computer forensic tool functions and can help you work cases better, I highly recommend signing up for the next X-Ways Forensics training in your area!

**NOTE**:  Special thanks to the Virginia Department of Forensic Science for hosting this valuable training and making it available to the wider digital forensic community! 

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Globally

We Find the Truth for a Living!

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS, BCERT, the Reid School of Interview & Interrogation and various online investigation schools (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Customer Service in Digital Forensics

January 23, 2016

Customer Service in Digital Forensics

My first jobs as a teenager were in customer service.  The brief first foray into the world of customer service was at an amusement park, which ironically, was anything but amusing.  After 3 months there, I transitioned to a retail environment where I worked for several years and into college.  You might be surprised to learn that the transition from retail customer service to public service in law enforcement was not all that much of a leap.  The biggest overall difference is the personal danger aspect.

After leaving law enforcement to start my own digital forensic consulting company, I find that many of the lessons, skills and techniques I learned working in a retail environment serve me quite well in dealing with attorneys, clients and the general public.  This is an intangible that I propose often gets lost among both governmental and private sector digital forensic practitioners.  We all have customers -- from the crimes against person detective to the special agent accountant to the corporation who feels they’ve been the victim of intellectual property theft.  The natural tendency is for us to treat our customers like they need us.  They need our skills, our knowledge and our expertise to help analyze, interpret and explain what may have been going on in their cases.  But the truth is, we need them at least as much!

Customer Service in the Public Sector

For my friends & colleagues in the government sector, this can sometimes be a far leap.  You see, the reality is that many in public service don’t really have a sense of service at all.  Yes, that comment will undoubtedly bristle some of my public sector friends, but deep down, they all know it’s true.  There are folks working for the government that are there to pick up a steady paycheck, get decent benefits, not really caring to be pushed or challenged and doing (almost) as little as possible.  This article is not for them.

My purpose in this article is to refresh the sense of service of those in the government who enjoy their job and enjoy the rewards that come with doing a good job, even if it’s not always (or ever) recognized.  The homicide detective who brings you a cell phone or computer of a suspect is your first-line customer.  Without him, your job doesn’t exist and trust me, if no one is bringing you work, your superiors will eventually recognize that and start to re-evaluate your job.  Sometimes, even the most dedicated public servant sighs and gnashes his teeth when the detective (who sometimes fits the category in the previous paragraph) brings you evidence and wants you to solve his case for him.  But think about why you got interested in this field in the first place.  Think about what drives you and challenges you.  No two cases are the same.  Maybe this case will be the one in which you’ll be able to write a case-study or learn a new technique.  Maybe you’ll discover evidence that will lead to the rescue of a child or the arrest of a sexual assault suspect.  And while it’s true that the investigators are the first-line customers of the public-sector digital forensic examiner, the real customer is the innocent public and victims of crime.  They’re the ones you are there to help.  Never forget that.

Customer Service in the Private Sector

Being in private practice, you’d think having good customer service would be a “no-brainer”.  Well, in the past 18+ months since we launched Pro Digital full-time, I’ve been schooled in the fact that not every private practitioner really practices good customer service (or even knows what it is).  I’ve been pleasantly shocked to receive no less than a half-dozen referrals because of other practitioner’s lack of responsiveness and service.  I’m happy to serve their clients.  It gives Pro Digital a better reputation, expands our client-base and assures our place in the digital forensic market. 

Our customers (clients) range from spouses embroiled in divorce matters to plaintiffs or defendants in civil actions.  They all require different levels of communication, attention, education and technical expertise to help them through their cases.  Going a bit further, we help out indigent clients and accept court-appointed cases at reduced rates because our history of public service was not abandoned when we launched a private practice.  We know our clients need us to perform services they may have neither the skills nor the equipment to perform, but just because that fact is present and undeniable doesn’t mean we take our clients for granted.

Perhaps the best notion on which to hang the proverbial hat of customer service upon in private practice of digital forensics is trust.  Our clients trust us with their data, which is oftentimes very sensitive.  They trust us to be able to help them in their cases.  And they trust that we won’t over-bill or exploit their naiveté about digital forensics and investigation.  That measure of trust is one we do not take lightly, nor do we ever intend to forget.

One More Thought

I’d like to close by touching briefly on the public-private sector “rivalry”, or whatever term is appropriate to define the alleged philosophical difference in approaches between public and private sector practitioners.  Both as a digital forensic consultant and as a trainer, I’ve run into a segment of workers and “leaders” in public service with the overall mindset that what they do is of a higher calling and, because they don’t get paid as much as private sector practitioners, they are sacrificing some of themselves for the public good.  I’ve even experienced this as a contract trainer who teaches to law enforcement. 

To be honest, it makes no sense to me.  It may make some sense if I had never worked in law enforcement, but being that I also dedicated 15 years of my career to public service, I really don’t accept the notion that my counterparts in public service are sacrificing themselves for the public good.  The bottom line is, we all get paid to do a job.  (And please trust me when I say that many of you get paid much more than me!)  Government workers are paid by tax-payers to do a job, just like private practitioners are paid by clients to do a similar job.  We all have “customers” and we’re all answerable to them.  We’re all part of the system and the system needs us all to try to maintain fair and impartiality in investigations and court proceedings. 

We all have a role to fill.  Let’s make a common pledge to work together to serve everyone to the best of our ability by putting ego aside and working for the benefit of the digital forensic field, never forgetting the value of the customers we serve.  We’ll all gain from that mindset!

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Globally

We Find the Truth for a Living!

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS, BCERT, the Reid School of Interview & Interrogation and various online investigation schools (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations.

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6