Pro Digital is Joining ArcherHall

September 1, 2022

I built something someone wants. So, I sold it to them.

When the happenstance came along that I was introduced to the CEO of ArcherHall, a Sacramento-based nationwide provider of litigation support and eDiscovery services, I took it in stride. We had a great call, but I had no expectation that it would blossom into anything. It did, and over several months of discussions we came up with an exciting plan for the future that works well for everyone.

So here’s what’s changing: Not much. 

I will continue to serve current and future clients in the role of Director of Digital Forensics and eDiscovery for ArcherHall out of the former Pro Digital office & lab in the West End of Richmond, VA. We have worked very hard to cultivate the relationships with the attorney-clients with whom we work consistently, and it is our goal to continue to foster those relationships for years to come. Professional Digital Forensic Consulting (dba Pro Digital) will cease to exist as a business entity, and I will join ArcherHall. Because ArcherHall has more financial backing and people performing the casework, the analysis work on future cases will have the benefit of a team of experts working on them with expanded capabilities of tools, training, experience, and knowledge. It’s a win-win for our current and future clients.

I will continue to teach as much as possible at the University and private sector levels. I thoroughly enjoy teaching and it’s a great “side-hustle”. This blog may be moving, but it will still exist. There are a few other exciting things on the horizon regarding publications, which I’ll announce on my personal Linked In and personal Twitter feeds. I will stay an active and vocal member of the digital forensic community and hope to be able to contribute more as I will not have the time investment overhead of running a business on a daily basis.

That’s the biggest part that will be changing: The administrative side of running a digital forensic consultancy will largely be removed from my responsibilities. Clients can expect more structure, team-based communication and an overall more immersive and responsive experience from me and ArcherHall.

The natural question that would be posed is “why?”  In my multiple conversations and meetings with ArcherHall’s CEO, Chief of Staff and Managing Directors, it became apparent that we share the same approach and values in our role as digital forensic service providers.  Those values include integrity, professionalism and a service-based approach forged with an entrepreneurial spirit.  These are the core values that Pro Digital’s clients have come to expect and will remain as tenants of our practice moving forward.

I’ll wrap up this blog and personal note by thanking everyone who has helped make this possible. When I registered the LLC for Pro Digital back in 2013, I did so as sort of a lark and a fallback position. A little more than a year later, I left full-time law enforcement work and invested in Pro Digital fully and have been churning it ever since. Every close person in my personal and professional circles has helped make this possible in some way or another, from my ex-wife to my children to my current fiancée. My brother and my sister, both successful business owners who offered so much advice to help get started and stay in business. Experts in other areas of forensic services, including noted authors, other DF entrepreneurs and very smart people in our industry. Mentors at Cellebrite and IACIS and the Virginia State Police and Instructors with the Department of Homeland Security and the US Secret Service, as well as colleagues from my 2012 BCERT class. If you are reading this, you know who you are, and I am forever grateful for your contributions to the success of Pro Digital and me personally.

In closing, I’d only ask that we, as an industry, always strive to be and do better. I’m not perfect, nor am I the professional ombudsman of the digital forensic service industry. I get educated on areas of improvement regularly and take those lessons in the way they are intended. I can always learn more & do better and am regularly excited to do so. Digital Forensics as an industry can also work toward the standards of constant improvement. Our profession deserves it. Our clients and case stakeholders deserve it. And most importantly, the justice system needs it. Our industry will only grow over the coming decades. It’s incumbent upon all of us to nurture the profession and ensure that it remains a path to the truth in the cases we work.

Onward….

-Patrick

Author: 

Patrick J. Siewert

Director of Digital Forensics & eDiscovery

ArcherHall

About the Author:

Patrick Siewert was the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA). In 15 years of law enforcement, he investigated hundreds of high-tech crimes to precedent-setting results and continues to support litigation cases and corporations in private digital forensic practice. Patrick is a graduate of SCERS & BCERT and holds several vendor-neutral and specific certifications in the field of digital forensics and high-tech investigation and is a court-certified expert witness in multiple digital forensic areas. He continues to keep in touch with the public safety community as a Law Enforcement Instructor and Adjunct Professor at Virginia Commonwealth University.

Email: psiewert@archerhall.com

Twitter : @RVA4n6 

Web: https://archerhall.com 

ArcherHall on LinkedIn: https://www.linkedin.com/company/archerhall/ 

Patrick Siewert on LinkedIn: https://www.linkedin.com/in/patrick-siewert-92513445/ 

Apple’s New CSAM Detection Policy Analysis

 August 10, 2021

Apple’s New CSAM Detection Policy Analysis

Several times a year, there seem to be current events or topics that strike a chord both inside and beyond the digital forensic community.  We’ve discussed these in previous articles with regard to the Carpenter v. US decision and Apple’s previous spat with the FBI in the wake of the San Bernardino, CA terrorist attack.

As no stranger to these current event discussions (i.e., controversy) when it comes to matters of privacy and cooperation with Law Enforcement, last week we had another “bombshell” dropped by Apple that in a new US-based update, they will be subjecting user’s on-device photos to hash analysis attempting to track down images of known child sex abuse material (CSAM) that may be uploaded to iCloud and forwarding this information for follow-up to the National Center for Missing & Exploited Children (NCMEC) or other law enforcement investigative entity.  Here, we’ll discuss how this works and explore both sides of the issue.

How CSAM Detection Works

It is a commonplace practice for internet (or electronic) service providers (ISPs/ESPs) to work in conjunction with law enforcement to detect known CSAM images.  The first question naturally is, what is a known CSAM image?  Simply put, an image becomes known CSAM when a victim has been positively identified in the image.  This routinely comes through the investigation of new/unknown images and positive identification on the children in those images.  Often times, the images are within a series, depicting child sex abuse of one or more victims in the same setting with the same abuser and around the same time frame.  Law enforcement entities such as NCMEC, DHS and the FBI all maintain file hash databases of these images for use by law enforcement in investigation.  These file hash values are used to track down purveyors of child pornography across peer-to-peer networks, as well as those who may upload and share CSAM images to cooperating ESPs such as DropBox, Gmail, Yahoo, Kik, etc.  

Once a known CSAM image has been identified by the ESP by hash value, the offending party’s account information as well as the specific date/time of upload and manner of upload are all provided to NCMEC as an investigative lead.  NCMEC then performs a variety of open-source intelligence gathering on the offending party and provides the information to law enforcement in what is known as a Cybertip.  An affiliate or cooperating law enforcement agency receives the Cybertip for investigative follow up, which can include knock-and-talk, search warrant, additional investigation or a combination of these (or other) investigative methods.  Some Cybertips go nowhere.  Some, like one I worked while a member of law enforcement, are not eligible for a search warrant, but end up in a knock-and-talk, consent search and confession from the offending party of not only possessing CSAM, but molestation of his 10 year-old step daughter.  The value of Cybertips in the hands of properly trained investigators cannot be overstated.

Whether or not you know it, you are explicitly agreeing to this process in the End User License Agreement (EULA) by using any of these services.

One Side of the Argument: Privacy

Privacy is understandably an important issue to users of technology across the spectrum.  Apple has traditionally been very privacy-centric in their practices, including refusal to help the FBI unlock the iPhone belonging to a terrorist couple who killed several people.  And privacy is very important to almost all users.  The argument here on the privacy side is that, by Apple’s own statement, they are installing an agent on iDevices to subject photos to a hashing algorithm and then alert law enforcement if a “threshold” of CSAM content is discovered.  This is a half-step further in a direction than what Google, Yahoo or Kik do to detect CSAM content in that they detect content uploaded to their servers and report what is suspected CSAM to NCMEC.  Apple is detecting content on individual devices and reporting suspected CSAM content that may be shared via iCloud which meets the “threshold” to NCMEC. 

In some spirited discussion about this new policy on Linked In recently, it was pointed out that this may be a violation of a user’s 4^th Amendment rights against unreasonable search & seizure because Apple is acting as a would-be agent of law enforcement and “searching” people’s photos on their devices without a warrant.  We’ll discuss this a bit further in the next section, but this is a valid argument on its face.  But like with most things in life, the devil is in the details.  

Another point brought up in discussion was the fact that Apple is projecting that they have the technology to scan files on your device generally, which could be more of a concern in the future.  This is very powerful technology that has the capability of infiltrating people’s devices without their express knowledge and potentially providing information to a third party, possibly for criminal investigation.  Furthermore, it opens the door for a would-be hacking entity to exploit this new door that Apple has opened on a much wider scale.  The security and data privacy implications may only be in the early stages.

The Other Side of the Argument: Child Safety

As a former law enforcement investigator on the Internet Crimes Against Children Task Force, I can assure you that proliferation of CSAM images across the internet is a real problem.  While doing this work also in the private sector, I’m sometimes asked how law enforcement knows that the images are of children and not simply people in their upper-teens who could easily be mistaken for someone over 18.  They know.  The most egregious examples of CSAM material involve infants and toddlers in sexually exploitative scenarios that no investigator can ever un-see.  These images are by-in-large not questionable in age or physical development.  They are small children, even sometimes babies.  Are there exceptions to this?  Yes.  Teens who possess smart devices also possess the ability to make their own images and share them with whomever they wish, particularly if their parent/guardian is not tech-savvy or they have not been taught the impact that the decision to share explicit photos can be long-lasting when it comes to the internet.  These images sometimes become part of criminal investigations as well, and they can be added to the CSAM database if the correct criteria and procedures are in place.

So why is Apple’s decision generally a good one for law enforcement?  The approach that investigators take with CSAM images is that a child is victimized every time these images are viewed or shared.  This then requires law enforcement investigation and intervention to help stem the flow of these images across the internet and decrease child sexual exploitation.  Apple’s cooperation in this mission opens a door not previously available without another third-party alerting NCMEC of images potentially stored on a device.  Additionally, with the proliferation of human trafficking, particularly of missing children, Apple’s new policy gives law enforcement another tool in the proverbial toolbox to help track down and locate missing children.

The argument that this practice goes against 4^th Amendment protections against unreasonable search & seizure is a compelling one.  But there are some arguments to the contrary.  First, no one has a Constitutional right to own an iPhone.  If you don’t like Apple’s new policy, switch to Android.  Second, whenever we get a new i-Device (iPhone, iPad, iPod, etc.), we are prompted to “Agree” to Apple’s terms of service in the EULA, and this is in perpetuity for the time we use their software and hardware.  It is Apple’s discretion to change or updated the terms of this policy, as they have done recently with implementation of this new practice.  In short, we gave them permission to do this.  Finally, an argument can be made that while Apple’s practice for detecting CSAM images goes a half-step beyond other ESPs, the protection of children from sexual exploitation is worth whatever freedom we give up.  There is a tried & true adage that liberty and security rarely go hand-in-hand.  We frequently give up liberty for security.  Been to the airport lately?  

Finally, the argument was also brought up about mistaken identification of traders of CSAM images through this new process.  If we take Apple’s statement at face-value, there is a one in “one trillion chance per year” that this could happen, meaning it is far less than statistically insignificant.  I’m also quite certain the army of Legal Counsel at Apple have thoroughly reviewed and signed-off on this practice.

Wrapping It Up

This is a hot topic that won’t soon go away.  Apple has caught heat many times for many different approaches over the years and this is just the latest measure to garner such attention.  It is ultimately up to us as the consumers of Apple to decide… Do we want to give up a tiny bit of privacy (for now) in furtherance of the mission to stem the flow of child sex abuse images or do we care more about privacy over the content of our devices?  It’s a personal choice and fortunately, we still have the freedom to choose in the United States!

NOTE:  Article with additional information published on 8/9/2021:  https://www-bbc-com.cdn.ampproject.org/c/s/www.bbc.com/news/technology-58145943.amp 

Author: 

Patrick J. Siewert

Founder & Principal Consultant

Professional Digital Forensic Consulting, LLC 

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Wherever You Need Us!

We Find the Truth for a Living!

Computer Forensics -- Mobile Forensics -- Specialized Investigation

About the Author:

Patrick Siewert is the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA).  In 15 years of law enforcement, he investigated hundreds of high-tech crimes to precedent-setting results and continues to support litigation cases and corporations in his digital forensic practice.  Patrick is a graduate of SCERS & BCERT and holds several vendor-neutral and specific certifications in the field of digital forensics and high-tech investigation and is a court-certified expert witness.  He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business servicing litigators and their clients, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.

Email:  Inquiries@ProDigital4n6.com

Web: https://ProDigital4n6.com

Pro Digital Forensic Consulting on LinkedIn: https://www.linkedin.com/company/professional-digital-forensic-consulting-llc

Patrick Siewert on LinkedIn:  https://www.linkedin.com/in/patrick-siewert-92513445/  

Three Myths About Digital Forensics as a Practice

July 14, 2021

Three Myths About Digital Forensics as a Practice

Following up on last month’s article about “Three FAQs About Digital Forensics as a Service”, we thought it useful to spend some time debunking some myths about digital forensics from both a general practitioner and service provider perspective.  

Every industry comes with “urban legends” or popularized myths that surround the practice.  Many of these rarely represent reality and some are outright false.  The more intriguing or interesting the field, the more pervasive these falsehoods can be.  Digital Forensics is no different than any other industry in this respect.  The reality is that TV and movies have sensationalized what we do to the point where there are several misconceptions about the practice of digital forensics, which run the gamut of the various sub-sets of the practice and affect those in law enforcement, private sector litigation support, incident response and government contractors.  While Hollywood has tried to make the profession “sexy”, there are some realities to this field, including the long hours spent staring at a computer monitor, developing a script or researching an application.  While not overly exciting, those are activities in which any practitioner worth their salt needs to engage on a regular basis… But it doesn’t make for good TV.

In order to dispel some common myths about our field, three of these misconceptions are discussed in this article.  This selection of industry myths has been garnered through discussing and working cases with people outside the industry over the combined time in law enforcement and private sector practice of digital forensics for the past 12 years.

Myth #1:  Nothing Is Ever Truly Deleted

I wish this were true.  However, the reality is that it is not.  Not only are there anti-forensics methods readily available to users on the market (i.e., Hillary Clinton and “BleachBit”), but increasingly there are measures being put in place at the manufacturing level for both mobile devices and higher-end computer systems that make deletion of data a permanent state.  To be more accurate, the security over the stored data is such that when and item is deleted, it is often not recoverable.  

For example, on an iPhone, data is stored in the same basic way for most applications.  However, if an item is deleted from the phone, depending on the type of item (i.e., picture or video vs. text message), the item is sent to free space on the phone memory, which is encrypted and not accessible through the forensic process.  The image may not be gone, per se, but it is not accessible or viewable.  On newer Mac computers and other devices equipped with solid-state memory (i.e., not a spinning hard drive), there is a process in place called “Trim” which also helps clean up the free space of the memory and makes recovery of deleted items extremely difficult, if not impossible.  In the era of heightened data security, these measures are becoming more commonplace.  Deleted text messages that were once partially recoverable are now increasingly unavailable, even with the most state-of-the-art forensic tools.  

There are almost always alternative storage methods, however.  Hard backups (computer-based) or copies or cloud-based data can all be potential areas where valuable evidence can exist, but the reality of the digital consumer marketplace is that if all we have is the device and nothing else, we may not get your deleted data.  

Myth #2:  If It’s Deleted, It’s Gone

I know this sounds totally contradictory to the previous comments and Myth #1, but just because it’s deleted, doesn’t mean the evidence you need is gone.  Indeed, this is and always has been at the heart of the forensic process.  We utilized industry-standard methods to acquire, analyze, recover and report about the data.  The emphasis with this myth is the recovery part.  I tell potential clients and attorneys all the time, the data is *usually* stored in more than one place.  The aforementioned cloud-based data storage being the most ubiquitous, but there can also be additional data stored in some surprising places.  The more data we can get our hands on that is related to the matter at-hand, the more success we will have in getting you some evidence that will help confirm or refute your assertions in the case.  There are also methods of analysis that a trained, competent examiner will attempt to incorporate in many cases, including partial recovery of valuable data from places like file-slack (leftover space where a file may have previously existed) or volume shadow copies that are automatically created in Windows.  

In most cases, the proverbial smoking gun is not a realistic possibility.  We have certainly worked and seen cases where the smoking gun has come about and it has always met with great success, but the reality of our practice is that we will likely find *something* to help you, but it may not be the one piece of evidence that will confirm or refute the matter at-hand.  Will it add value?  Most likely.  The real value comes in with the examiner’s ability to articulate what they did, how they found what they did and to explain these findings in non-technical terms that everyone can understand.  

Tools don’t do the work.  They present the data for the analyst to do the work, so make sure your analyst is knowledgeable and not afraid of doing the work.

Myth #3:  It’s Just A Phone… What’s The Big Deal?

It’s not unlikely that the origination of this myth is rooted in our innate perception of the fact that the size of things should equal more cost.  Bigger vehicles cost more than smaller vehicles.  Bigger houses cost more than smaller ones, and so on.  So why should a device that fits in my pocket be more of a challenge to acquire and analyze data than my laptop or desktop computer?  

In recent years, the marketplace has demanded that phones be more complex, store more data and be much more secure than your computer.  Apple comes out with a new iteration of iPhone every year, and they usually (and much more quietly) update their computer hardware and software as well, but the emphasis since the inception of the iPhone has been on the mobile device.  So what’s so problematic about it?

As I tell attorneys and their clients frequently, many times we are acquiring the data that Apple allows us to have.  To be clear, this is almost always more than what the user could do themselves and in a forensically sound manner appropriate for evidence presentation, but Apple can be quite restrictive for non-law enforcement to obtain data.  We get the basics – messages, photos, videos, web history, and supported app data.  Many times we can also analyze unsupported app data as well.  But much of the deleted data is unavailable.  In recent years, more advanced methods for acquiring iPhone data have come about, but they are only available on certain iterations of the iPhone hardware and software.  But to be clear, we always try to get as much data as possible.

Android phones are increasingly problematic as well.  Last year, we had a Samsung Galaxy S20 in for acquisition and analysis.  I was amazed at how little data we obtained, despite multiple attempts at multiple different methods of acquisition.  Fortunately, the mobile forensic tool developers are always coming out with newer ways to get more data for our use and analysis, but it’s a constant game of catch-up.  

A final point about the volume of data that can be analyzed on phones, Apple currently has up to 512 GB of storage on an iPhone.  Some Android phones are pushing to 1TB or more worth of storage.  That may not seem like a lot when you’re using the phone, but it’s A LOT of data.  And the more we have to search that mountain of data, the longer it takes.  These are not the Nokia flip phones we all had in the mid-2000’s.  They’re not even the Blackberry Pearl you had and thought was so cool.  These are complex computer devices with as much storage capacity as many commonly used computer systems, with many enhanced security measures.  They may be small, but they’re mighty!

Wrapping It Up

The myths discussed here are a small sample of the push-back we sometimes get when it comes to the length of time and the cost associated with acquisition, analysis and reporting about the data on these devices.  For those in law enforcement, phones are seized daily and sometimes the means by which to simply acquire the data are challenging and time-consuming (if not impossible).  We are not miracle workers, but we do try to get you data that you can use in your case to help confirm or refute your suspicions or claims.  Just know, it’s not always easy, it’s not always quick and it’s unfortunately not always possible.  Sometimes, we just don’t know until we get into analyzing the data!

Author: 

Patrick J. Siewert

Principal Consultant

Professional Digital Forensic Consulting, LLC 

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Wherever You Need Us!

We Find the Truth for a Living!

Computer Forensics -- Mobile Forensics -- Specialized Investigation

About the Author:

Patrick Siewert is the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA).  In 15 years of law enforcement, he investigated hundreds of high-tech crimes to precedent-setting results and continues to support litigation cases and corporations in his digital forensic practice.  Patrick is a graduate of SCERS & BCERT and holds several vendor-neutral and specific certifications in the field of digital forensics and high-tech investigation and is a court-certified expert witness.  He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business servicing litigators and their clients, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.

Email:  Inquiries@ProDigital4n6.com

Web: https://ProDigital4n6.com

Pro Digital Forensic Consulting on LinkedIn: https://www.linkedin.com/company/professional-digital-forensic-consulting-llc

Patrick Siewert on LinkedIn:  https://www.linkedin.com/in/patrick-siewert-92513445/ 

Keys To Success in Digital Forensics: Incident Response vs. Litigation Support

February 22, 2021

Keys To Success in Digital Forensics:  Incident Response vs. Litigation Support

Digital forensics as a practice and as a service has been evolving for since its inception.  Among the evolutionary explosions we’ve seen in the field are the hardware, the size of data repositories, the data storage technology and the tools we use to acquire and analyze the data we come across in our analysis cases.  The advent of remote work, cloud data storage, universal use of email and internet-based applications and the development of bad actors on a worldwide scale has confirmed that the field of digital forensics will be not only present, but necessary now and well into the future.  We’ve also seen offerings in academia growing with colleges offering coursework in both undergraduate and graduate programs focusing on digital forensics.  What is sometimes overlooked, however, is the nuance that there is more than one path within the field of digital forensics.  So which path will you choose:  Incident Response (IR) or Litigation Support?

Incident Response Path

To help to identify which path is appropriate, it’s probably best to first define the particular path.  Digital Forensic Incident Response (DFIR) is defined loosely by a myriad of online resources as incorporating digital forensics techniques to identify bad actors at the heart of malicious attacks on networks networks and systems.  This can include malware/spyware infections, hacker attacks, data theft, data leakage, etc.  This is often referred to as an arm of Cybersecurity and is part of what many cybersecurity professionals do.  But all one has to do is look up jobs for a Cybersecurity Responder or Engineer to read the litany of responsibilities that are associated with these positions to realize that it is truly only one part of the listed responsibilities.  I’m often boggled when I search for job openings in Digital Forensics and find the dozens of listings that have very little to do with digital forensics at all, but because the job of a DFIR responder is partially to deal with these incidents, forensic response is listed as one of the desired skills.  The argument could be made that the forensic component is a dedicated position in itself.

Regardless of that, the work of a DFIR responder is somewhat different than that of a litigation support professional in several ways.  First, the manner in which you acquire the data to be analyzed can be very different.  It is a common practice in IR work to acquire logical data from a network repository for analysis and not a “dead box” physical acquisition of the data.  This is a practical consideration because networks in enterprise environments can’t be shut down for a physical acquisition.  Many times, network logs, Windows event logs, registry entries and IP log files play a crucial role in determining who is responsible for the incident.  Acquisition and analysis of these logs can be tedious and may only lead to part of the conclusion about what happened.  The job of an IR digital forensic professional is absolutely necessary, particularly in large corporations and those that store sensitive personal information.  We hear about data breaches of personal information almost weekly and security-minded practitioners struggle with constant pulpit-pounding of good practices leading to good security.  

Regular readers of this blog know well that I put forth regularly that “forensics” means the acquisition, analysis & reporting of facts associated with the data in such a manner that is presentable in a Court of Law.  While it is no doubt possible that an IR professional could work a case that would lead to litigation, it is far less likely than in the litigation support realm.  As such it’s probably safe to say that IR practitioners could reasonably be more on the technical side than the presentation & explanation side.  However, every incident has at least one stakeholder, so the ability to explain very technical matters to very non-technical people is still a vital skill.

Litigation Support Path

It’s probably safe to say that when many people decide on a Digital Forensic course of study, they probably think of litigation support as their main path, probably due to the romanticization of the field in TV shows like CSI.  We hear about data breaches in the IR realm all the time, but we rarely hear in popular media the outcomes of their investigations.  Litigation support can be (and often is) the exact opposite.  Most law enforcement digital forensic practitioners are involved in litigation support and do so in very high-profile incidents.  Many private companies are also involved in digital forensic litigation support.  So what does a litigation support analyst do?  We acquire, analyze and report on evidence most often specific to a particular person, company, etc.  The means by which we acquire this data often differs from the IR path because we generally have physical access to the suspect or target media to be analyzed. This means we can acquire physical repositories, instead of just logical data.  Of course, mobile forensics can be a large exception to the last statement, but generally speaking and with current technology, we are able to acquire physical memory of stand-alone computer systems and workstations.  (However, that will probably not always be the case.)

Law Enforcement works criminal litigation support by identifying a criminal suspect, seizing their electronic equipment, acquiring & analyzing same as part of their investigation and reporting about their findings.  Part of their reporting often comes in the form of formal expert testimony in court, which is one of the biggest differences between IR and Litigation Support.  It requires further refinement of the skill of presenting very technical matters to very non-technical people.  

Private companies who engage in Litigation Support also have a similar approach to casework, but work Civil disputes as well.  These civil cases may be everything from divorce/custody matters to intellectual property theft to employment disputes to independent analysis in criminal defense cases.  No matter the court of the case at hand (i.e., criminal or civil), the litigation support professionals seek to add clarity, value and definition to the matters they work as part of the adversarial justice system.  

Similarities between Incident Response & Litigation Support

We’ve highlighted the main differences between IR and Litigation Support, but there are naturally many similarities.  The basic knowledge of how data is stored and analyzed is probably the largest similarity.  Both paths need to have a good basic understanding of data storage and forensic implications thereto.  Another similarity can be in the tools we use.  Fortunately, most modern and popular digital forensic tools, whether open source or proprietary, are capable of handling both IR and litigation support work.  The nuance factors in with the examiner’s ability to properly use the tool, given the particular type of case or incident.  Some forensic tool vendors like to say their tool has “been validated in Court”.  This is a misleading statement.  Tools don’t get validated in court.  Examiners get qualified as Experts in Court and their findings are validated because of their requisite knowledge, skills, abilities and experience.

Finally, the most important part is that the approach philosophy is and needs to be the same across the digital forensic spectrum.  In every case, we operate on the approaches of objectivity & neutrality, analyzing the data as the data is presented to us and never allowing personal bias or beliefs about the suspected parties involved to cloud our ability to prove or disprove what happened.  Digital Forensics is a scientific discipline.  It requires us to constantly evaluate evidence in a neutral environment to arrive to a conclusion of fact.  As experts in the field, we are afforded the ability to draw conclusions based upon our knowledge and experience, even if the data doesn’t explicitly show us what those conclusions are.  But those conclusions are always supported by the data and never created out of conjecture or bias.  

Wrapping It Up

In every field, there are nuanced sub-sects.  If one decides to be a doctor, they can become a surgeon or a psychiatrist.  If one decides to be a lawyer, they can become a corporate risk manager or a criminal litigator.  The refined skill sets for the two paths within the same field are where the differences lie and Digital forensics is no different.  There are nuances within the two paths of Incident Response and Litigation support that dictate which skills will be highlighted and which will be of less value to hone and refine.  Knowing the difference is key to the practitioner’s success, particularly early in the field of practice. Can a DFIR practitioner choose to switch between IR and Litigation support (or vice-versa)?  Absolutely!  Many litigation support professionals from law enforcement retire to work for IR shops.  The take-away here is to start the thought process about which path is the best fit for you.  Ultimately, everyone involved the practice of digital forensics wants to get to the heart of the matter, just like all doctors want to help their patients and all lawyers want to serve their client in the best manner possible.  So do some soul-searching and drill down about what path you’d like to choose.  And as a wise man once said, “Go with your gut, but use your head!”

Author: 

Patrick J. Siewert

Principal Consultant

Professional Digital Forensic Consulting, LLC 

Virginia DCJS #11-14869

Based in Richmond, Virginia

Available Wherever You Need Us!

We Find the Truth for a Living!

Computer Forensics -- Mobile Forensics -- Specialized Investigation

About the Author:

Patrick Siewert is the Founder & Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia (USA).  In 15 years of law enforcement, he investigated hundreds of high-tech crimes to precedent-setting results and continues to support litigation cases and corporations in his digital forensic practice.  Patrick is a graduate of SCERS & BCERT and holds several vendor-neutral and specific certifications in the field of digital forensics and high-tech investigation and is a court-certified expert witness.  He continues to hone his digital forensic expertise in the private sector while growing his consulting & investigation business marketed toward litigators, professional investigators and corporations, while keeping in touch with the public safety community as a Law Enforcement Instructor.

Email:  Inquiries@ProDigital4n6.com

Web: https://ProDigital4n6.com

Pro Digital Forensic Consulting on LinkedIn: https://www.linkedin.com/company/professional-digital-forensic-consulting-llc

Patrick Siewert on LinkedIn:  https://www.linkedin.com/in/patrick-siewert-92513445/