S15: Efficient Digital Forensics Case Management | Exterro INFORM

All right, welcome to the last session of Exterero in form. Uh, as I as I jumped into the to the pre- lobby, I told Fran Wazak or W as he's known. Uh, last but not least, right, we're going to close it out with a bang. Uh, so thank you for all for being here. And if you've been bouncing from session to session, you know how the interface works. So, you have the emojis at the bottom. Sign of life. Go ahead and uh push some of those emojis for W here as we get going. And then over on the right is the chat. Feel free to ask questions. He told me I can interrupt him as we go. So, as questions come in, I will just cut him off or, you know, he can provide me some openings to, you know, hey, any questions? But, uh, let's be chatty. Let's be chatty for him. Q&A also and then we'll run some polls. We got three polls as we do as we have done we'll go through there. So W I'm going to hand it off to you to introduce yourself your presentation and uh if you if you have any questions for me you can ask I'll be here >> otherwise it's all you man. >> All right thank you. Hey everybody I'm Farand Siwisak. I'm a senior special agent with the South Carolina law enforcement division commonly known as SLED. Um, I've just reached 25 years in the law enforcement capacity, all being a police officer. I started right in the beginning of January of 2000 with the Spartanberg County Sheriff's Office, which is in the upstate of South Carolina. Uh, I spent five years with the sheriff's office. Uh, three years on uniform patrol. That that was your uh your your classic street cop marked car uniform um job description. I did about a year and a half in a rural setting, country setting, and I did another year and a half in a more urban uh setting. So, I got I got a great I got a great taste of of all of life's um uh life situations and and communities. Um I spent two year two years as a detective with the sheriff's office uh generally working anything that was not a murder or an armed robbery. Um then I was assigned to the burglary task force. I was actually a burglary detective for for a year. Uh in 2005, right in the beginning of 2005, I saw that the state um uh sled is the the state police for the state of South Carolina. Here in the southeast, we don't have just one state police agency. We in the southeast generally they break it up between the highway patrol, the state, you know, the state bureau of investigations. That's what North Carolina calls it. Georgia has the Georgia Bureau of Investigations were where SLED and then of course we have the Department of Natural Resources. Well, SLED uh posted a job posting for their computer crimes unit. I had email email I think I had I had a Yahoo account which I still have today. Uh that that bad boy runs interference for all my shopping and you know enter your email here. That that guy is working for it. So my Gmail and my other emails can can stay pure and untouched. Um so that that's pretty much where my uh oh and fantasy football too. That was that was pretty much my computer knowledge. Um so I applied to the state for the computer crimes unit. Just let's you know let's throw a Hail Mary out there. Um through the through the interview process, the hiring process. uh mostly it was geared around uh law enforcement based situations, not so much uh uh digital forensics or or computers. So I I I did fairly well because they hired me in, you know, summer of 2005 and and I've been there since. Um I started in I started working fraud cases because I did some white collar crimes at the sheriff's office. So, I did a lot of um internet fraud cases at the time uh you know with PayPal especially uh before they really they they really clamped down and things like that. Um receiving IC3 complaints uh and that's what I worked on. Then they generally or slowly I guess you could say worked me into digital forensics. Um, I took Bedra from the National White Collar Crime Center, which is what that was the basic data um, recovery and analysis class. That was a one-week class. That was your zeros and ones and registries. Um, and then I worked in uh, to IDRA, which is an intermediate school. And then they once once the agency, my bosses realize I could survive those free classes minus travel and lodging, they started sending me to vendor classes. um, ENC case, FDK, uh, things of that nature. And eventually when the National uh, Computer Forensics Institute, NCFI with the Secret Service started taking off, I pretty much did most of those multi-week classes throughout my career, plus the equipment. You can't you cannot beat the equipment. Um, so I I've been there ever since uh, doing that. I also do have an investigative case load which would con you know mostly IAC internet crimes against children cases, Cam cases. Uh and then you know online threats to um you know government officials or anything along anything of credibility. Uh we we do investigate that. So that's mostly my case load. Uh uh for a while I dip my toe into network uh intrusions. I have enough to survive the conversation if I'm in the room with people that actually know what they're doing, but that's about it. Uh the newer guys in the office have been taking more advanced classes and that I took some in 2012, but that's that's not my strongest point when it comes to uh my investigations or my digital forensics. Um and I also I volunteer for Iasis. All right, that's the International Association of Criminal International Association of Computer Specialists. Um, and it's Iasis, not ISIS. I do not volunteer for ISIS. So, anybody watching the FBI, it's ISIS. I spent two years uh teaching mobile device forensics for them. And then I moved on to their marketing department, volunteering their marketing department, and I am the current host of their theis podcast. Quick plug for that. You can find that wherever you find your podcasts. Um, just a little quick uh housekeeping note. Um, there are protesters right outside this door. Very heated topic. Um, the protesters are in the form of a 7PB Chihuahua and a beagle. So, if you hear any of that activity, my my my wife is out there trying to trying to, you know, manage manage the crowd. But if you do hear any outbursts, I do apologize. But hey, that's live television. You know what? What what what can you do with that? So, what are we going to talk about today? Well, we're talking about efficient digital uh forensic case management. Now, the reason I told you so much about my background is because this is going to be from the perspective of, you know, the grizzled seasoned veteran. Okay? I'm talking to you, the individual, all right, digital forensics examiner. Some of it will touch on, you know, the lab as a whole. But really, I'm talking about what you can do personally in your workload, in your daily work life that will help you out, make things a little bit more, you know, sweeter and streamlined. Of course, streamlined um without without compromising your efficiency or your your accuracy and your integrity. Okay, number one is accuracy and integrity. You got to make sure you have that at all times. But, you know, work smarter not harder on on a lot of these on a lot of these uh cases if not all of them. So, let's just go ahead. I'll I'll tell you what we'll be talking about here. We've got some objectives. Um the importance of case management in digital forens forensics. It's easy to get lost in in the nest in the miss. So, I just we're going to talk about what features you have to to make things easier. Documentation. Okay. uh being in it as long as I have and you you'll hear from every cop known to man. If you don't write it down, it did not happen. Okay, write it down. All right, standard operating procedures. All right, you have your agency's SOPs standard operating procedures as well as maybe your units and then yourselves your own your own guidelines. you do the notes you took that when you put these things into practice they become a habit and with that habit it eventually just becomes you know second nature if not first nature to you I will touch on AI um I'm I know people earlier today touched on it I'm going to talk about it from how to use it without letting it control what you do and again I'm talking your daytoday activities when it's great to use it, when I would not use it, and when to uh validate uh what AI has found. And then the most important topic I'm talking about today, and probably one that I am going to focus the most time on is efficient communication. And what do I mean by efficient communication? I'm talking about the back and forth between you and the submitting agent, the submitting party. um how to effectively, I guess you could say, uh get what you want from them to help them help you. Okay? Make your job easier, give them the results they need in a timely fashion, and how to go about doing that. So, let's talk with uh documentation. All right? First thing is write it down. It didn't happen. I already talked about that. And I'll tell you the reason for that is if you do a an exam on an item, a cell phone, a computer, a refrigerator, now these days, a vehicle, doesn't matter. Are you going to remember every single thing you did a year from now? And that's a quick year from now when it goes to court. You're sure as heck not going to remember it two years from now. So document what you do because you'll have total recall two years from now when everything goes to court and you're like what the heck case is this? I don't remember this guy's name or what I worked on. Well, once you see your notes, everything will come back to you and you have your notes to to refer to. Provides a clear timeline for your activities. All right? So everything you've done on that case and you don't have to write a book. There's no reason to write a book on it. But write it in enough detail that if you're out sick this one day or if you're you leave, you you quit, you get fired, you win the lottery, somebody else in your unit can go and understand what it is you did on that case and they could they could go from there either take it over or they could explain to a prosecutor or the submitting party on what you've been doing on this case. It also facilitates your continuity. Uh, what's that mean? You're working on something. Two weeks before Christmas, you got vacation days you have to burn and you leave. Christmas, the holidays, New Year's, you come back and you start working on the case again. Are you going to remember what you actually did on that case? If you do, great. Great. But I'm I'm quickly approaching 50 years old. My memory is still great, but I'm not 18 years old anymore. So when you can note down what you did by just looking at your notes, you know where you can pick up from. So that's just a a small little tidbit, but it helps you a lot because I know most of every software out there has some sort of logging benefit, but it's you have you ever saw any sort of logging from uh any of the softwares out there? It's you're it's a ticker tape parade. So, it's easier just to have your own notes, your familiarity of your own handwriting to base what you've done everything on. All right. Documentation starts with the chain of custody. All right. That goes from everything. If you go on a search warrant and you recover the items there, that chain of custody starts with you. All right? If somebody brings it to your lab, your shop, if your private sector brings it to your office, all right, that's when you start your signatures. This shows from start to finish where that property, where the items have been, and who's had control over them, either from a human being to a lab to evidence holding and back to the people submitting parties that gave you the items. We talked earlier about analysis logs. Okay? Uh most softwares, if not all of them, do create logs for everything that you've done. Uh but what do they create them in? They create them in text files. Okay. What's a great way to make it as forensically sound as possible on the cheap for those text file logs? Turn it into a PDF before you put it into your case file. Now, it's I mean they somebody could always argue something, but at least you secured the document somehow somewhere. when you're done with that case, add your case file. That hopefully those times on those logs will match what you've written down in your notes and that should ease any sort of questioning on that matter later on down the line in court. All right. Then you have your report of findings. Okay. That's pretty much your your report. This is what I found. This is where I found it. That could be in the form of your report from the software company. That is your um your forensic report that shows all the the detailed information about the device you worked on as well as your bookmarks and everything along with that with as also your agency's reporting system whether that may be. Okay. If you your agency only wants you to write a sentence or two or if they want you to write a whole paragraph on something that's based on what your company or your agency wants you to do. Also, the tools that you used and what you worked on. Um does again doesn't have to be doesn't have to be detailed. Uh you know I used you know FTK 2.0 on this case you know uh any anything along those lines. 2.1.1.5. Um, ju just just mark that down. If you if you use multiple tools, say you use multiple tools, you shouldn't have one tool in your toolbox anyway. All right? Even if you can only afford one paid tool, there's plenty of free tools out there that are pretty pretty good. Validate, as always, I'll get into that in a little bit, but the free tools uh can can get you to where you need to be in a pinch. I'll also talk about that when we start talking about murder cases towards the end of the uh presentation. >> All right. >> It was while we're while we're at a slide split, uh Michael said you could also hash the PDF once you're done with it and put that in your report so that it would you know if anything changed obviously the hash would change later as well. >> Yeah, that that's next level. Absolutely. That's a good You know what? Let me go ahead and write that down here. >> And then and I'll let you comment on that. Go ahead. Go ahead. >> No, no, I that's that's a good but and I actually knew that. Um I'm not I'm not faulty for that. I should have brought that up, but hey, um that's that's good stuff right there. So, um and now I lost my part on where I wanted to be. All right. No, go ahead. Next one. >> Uh this I'll read it verbatim because they literally say doesn't have to be answered quite yet, but a question about personal experience from Tommy. What was your most difficult court case that you had to defend your process against? Have you ever had your evidence thrown out? And if so, why? So, >> yeah, I could I could answer that now. Um, yeah. Um, in uh my wife and I were not married yet. I don't even think we were engaged. It was probably uh 2012 2013. Um, timestamps. All right. Uh, it was a it was a CSAM case. Of course, they called it, you know, CP or child porn back then before they did child sexual abuse materials. Um, it was in an area just uh in South Carolina. Uh, I live my home base is an hour from Charlotte. I was in the furthest northern county in South Carolina uh right before you get in North Carolina, hence Charlotte. And it was I spent 13 hours on the stand defending timestamps on a case. Uh, you know, well, you say he you say he downloaded this picture. I was like, well, I never said he did it. that picture was downloaded to his computer at this date in time. Um, I spent a full day on a Thursday. I started first thing Thursday morning. Uh, we broke for lunch. And there is no lone lonelier place that I know of. I'm sure there is in a Siberian prison somewhere than not being able to talk to anybody on a lunch break. Your prosecutors, your fellow witnesses, your co-workers, nobody, nobody's going to want to talk to you. Nobody wants to tarnish anything cuz there you cannot discuss the case. And um I went to Sonic Drive-Thru by myself and it I don't even think phones were where they were now. So I couldn't even watch my phone. I just I just cried in my tater tots and my double cheeseburger because I was just, you know, ostracized from everything. Came back from lunch, had a full day right to probably six o'clock. The judge wanted to run late on Thursday so the trial could be finished up on Fridays. And then I did a full half day on um on that uh Friday on it. Um every you know with cross and everything like that. Uh everything was above board. Um but I knew I think I knew the uh based on the preliminary hearing from the case that they were going to attack timestamps. So the week before I refreshed everything I ever knew about time stamps and I it I was able to beat it. Um, have I ever had evidence thrown out of court? I have. And this is a wooden desk. I have not. Um, uh, you know, is it something I've done or or or didn't do? I don't know. That's just the luck of the draw. But, um, I fortunately our agency has a lot of, uh, procedures in place for documentation. I'm not going to say I write everything down. I'm not, you know, a toll sto or or anybody. I'm not walking around my notebook, but um with with with the documentation, it it it shows you that it shows the the prosecution, it shows the defense that no, this guy's really he's he's up on top of things. Less less for them to attack. So, uh nothing's been thrown out yet. I'm not going to gloat about that, though. Was there another part of that question, Justin? >> Uh no, that was uh Have you ever had any of your evidence thrown out? And if so, why so you didn't? Um somebody or somebody I can see their name. Christine said, "Uh, you are sounding very ANAB certified. RCSI lab is ANAB certified. So, your techniques sound very, very familiar." Yes. And in my notebook, you see me fidgeting over here. I'm trying to keep my Kindle Scribe alive because I I'm throwing a lot of initials at people and I got to remember what the initials are. And I actually, yes, we are certified, which of course stands for the ANSI National Accreditation Board. What is ANSI you may ask? Well, that is the American National Standards Institute. So, yes, we are we are ANAB which is I think pretty much across the board for all that. Uh my paperwork is paperwork in my lab. Um it's it it's easier to buy a house and spend two hours at closing I think sometimes. But it does save you it does save you the endgame because you do not want to come back in court. I cannot stress that enough. So it is it it does save you from yourself. So yes, that's that's the answer to that question. And now I don't have to worry about my um remembering those those are the tough acronyms to remember or those two ones. So >> see the chat's doing you some favors there. >> Yes, absolutely. Absolutely. The chat's running this thing for me actually. >> Yeah, crowd sourcing. >> All right, let's get back into it. That's that's chat caught up. My only my only pointless contribution was I now know how you track time. It's before marriage and after marriage. So >> yeah, that that's Yeah, that's Yes. Yeah. Uh yeah, it's marriage. It's before marriage, after marriage, and then if I really got to get into it, was it before CO or after COVID? And I think, you know, and that's that's those are my you know, those are my time hops right now. >> Cool. So >> um emitting key steps in the analysis process. Um what what's a key step in the analysis process? Well, that's going to be when did you image it? you know, when was it acquired? Uh, when was the report written? Uh, things of those nature. Um, uh, investigative findings. Okay. The the big one. You got the smoking gun. You got the video of the guy killing his wife or something along those lines. Um, I would I would keep a track of the important things. uh not every detail, but you want you want the big things to you want your not notes to coincide if it's if it's down by, you know, seconds or a minute or something like that from the from the software's logs to your notes. Um I I just wouldn't put anything to the tenth of the second on on on your own just handwritten notes. Um and then lack of standardization across cases. uh you know a vehicle forensics is going to be from from the step process. It's going to be a lot different than your cell phones and then from your computers. Okay. But all your cell phone exams for the most part uh should follow the same flow. Same with your vehicles uh same with your your hard drives, computers. Um and why is that important? It's important because it once again for the individual uh it's habit forming and that just becomes your second way of life. That's how you do things. My first day of doing uh forensic exams with my FTA, David Given sat me down and he was showing me end how to use it. I grabbed a legal pad, a yellow legal pad, and as he slowly told me uh everything step by step on what to do from start to finish on a case, I wrote it down and then I taped it above my workstation, like a little cabinet thing. And I would always look up and have to refer to that for a while until until um it just became it became second nature. And I kept that I still have that thing. It's my office folded up. That's that's going in my scrapbook uh when when I when and if I finally retire. Um so that's that's standardization. It it's a bend don't break uh you know situation. You got to have a little bit of flexibility and I we'll go into that uh here in a couple slides. Um, there is digital uh case management software out there. Um, I'm not going to mention names, but there there's plenty to run for you. We we have our own digital uh case management software. Back when I started, we used Excel spread. We used an Excel spreadsheet. We lived and died by that SL spreadsheet. It was backed up and that backup was backed up. Uh, now everything is imported. Everything's done, you know, obviously via the software and stuff like that. That's great. Our chain of custodies Everything is done in one in one case management system. Everything's one print away. Everything's one email away. Uh we also have uh with that case management system, we do have standardized uh templates for not only our logging but also our reports. Everything's a drop- down menu. Um everything from the point of intake uh is when it's logged in. Everything autofills as far as IMEI, serial numbers, uh things of that nature. when you get when you get down to the nitty-gritty of like size of the phone, you know, memory size or, you know, hard drive size, it's up to us to enter that information in uh later. Uh that was especially, you know, especially prudent with you, you know, Apple iPhones, you know, used to be, you know, they had them on the inside lid or on the on the little tray and stuff like that. And you you my eyes are well, heck, nobody's eyes can read those. If you could, don't waste your time in digital forensics. go be a pilot somewhere but with a magnifying glass or you know take the picture with your phone and blow it up the IMEI eyes but now you know most everybody all the softwares report the IMEI and what do you want that for well that's just further further identification on that on that model again going back to court are you well how do you know this is the phone you worked on well you know all the numbers are matching up um peer reviews uh again we have a peer review process uh and actually I our cases get reviewed twice. We get a technical review, then we get an administrative review. So, our our stuff is looked at twice before it's, you know, blessed and and sent. No, no, sorry. Yeah. Geez, I mirrored it for you Catholics out there. Um, uh, peerreview process. Are you going to spend all day looking at every single thing on your co-worker's case? No. But you could spot it. You know, random random facts, especially the important ones. Are the links working? is was what he said he found. Is it where it's supposed to be? Uh a couple a couple random shots of that. Uh you could if it's going to be right in a few places, it's going to be right all over. Um don't don't use that as a quote on me, but that's come on. It it's going to be uh standard operating procedures. There is no way to make this sexy. Um I could probably read you my tax return and it would be more joyful for you guys than this. All right. It provides a consistency in your workflows. Uh reduces errors and inefficiencies and ensures compliance with legal standards. Why? Again, I said this before, SOPs save you from yourself. Okay? It makes sure that everybody in that unit is doing the same thing for every case uh in what type of case they're working on. They're making sure that they handle it the exact same way. Why is that important? Again, you're on vacation. you leave uh your co-workers and your bosses should probably think, you know what, yeah, he did. He followed everything according to our procedures. Once again, in court, did you follow your exact procedures on this? Yes, I did. How do you know that? Well, because I do that every time. And here's our here's our book, our standard operating procedures. It reduces errors and inefficiencies because it's already laid out for you. What you're supposed to do should be already scaled out and you could just follow it. Now, you can't be a mindless just, you know, person just going out there and just wee. No, you have to think for yourself in a lot of this. So, you got to use a combination of your SOPs and thinking outside the box. You could think outside the box. As long as you keep your arm, your your arm could stay outside the car. As long as the rest of you still has your hands on the steering wheel, I see no problem with that. Um, and then of course it it ensures compliance with legal standards. That just makes sure once again you're covered in everything you do. You covered yourself. We have a term in police work. I'm sure it's all over the place. CYA that means cover your ass. Okay. Only you can do that. Make sure you can do it every time you can because if you don't cover it, somebody's going to exploit it and expose it. Justin, how we doing? We doing good. >> We're doing great. All right. Yeah. Hey, I'll just read you one one thing uh just for the edification of all. Uh John says uh regarding the timestamps timestamps and accuracy of the date and time on the computer anticipating timestamp questions on cross. I looked at other files on the computer created around the same date and time. I found files showing that the subject was on the computer buying a second computer at the time. The web page had the date and time embedded in it at the bottom which was accurate. helpful info. Due to it being the stone age of digital forensics, the defense was illprepared on the topic, so never brought it up anyway. But I thought that was cool. And then he follows it up with the purchase computer was also secured by us in the search warrant. You know, brand new imaging machine or something. But uh that that's awesome. And also that's a great that's a quick easy validation too. You know, you use you know he used it he used the other information on the computer against against itself and validated what it was. That's that's that's a that's a genius absolutely genius move right there. Um yeah. Uh speaking of that real quick, uh yeah, back in the Stone Age, the defense attorneys would almost take your word as, well, I wouldn't say they took it as gospel, but they would ask questions that had no relevance to anything. That's not the case anymore. Uh they're getting they're getting very better. The defense attorneys have their own list serves and and rightfully so because if you do everything you're supposed to do, I welcome I welcome uh you know, defense experts. You know why? Because at a defense expert, if you did your job the right way, it when they come and look at that case, when they review what you did, they do their own things and they find exactly the same thing you found. They're going to go, they're already getting their paycheck, by the way. They're going to go back to that defense attorney and be like, "Yeah, it's not looking good. You might want to plea things out." So, defense experts probably, depending on a murder trial or anything like that, will get you out of court if you do exactly everything you're supposed to do. That's just a little tip from your uncle W on that one. Um, getting on with this, uh, key elements of effective SOPs. You know, I've said it's a step-by-step workflows for your common tasks. Okay, that's your that's your flowchart. That is just from intake to the evidence leaving your office, leaving your lab. All right, guidelines for approved tools. All right. Uh, every time we use a tool in our lab, we have to validate it. Every major version that comes out of the tool we already have, we validate it. All right. uh quality control through the review process. That's also backed into the peer review I talked about on the slide or slide before where your work somebody is checking your work uh right after you've done it. And then I talked about flexibility and thinking outside the box. This is your having a little a little bit of flexibility for uh challenges that may came come up that you obstacles you have to overcome and it's not in your policy and how to do it. Well, if you can find the most forensically sound way to do it, document it as to why you had to do it, uh you should be okay and good to go. And I'll tell you why. Because on this next one, all right, on on standard operating procedures, we have to review it once a year, maybe. Um, my boss is watching. I hope he doesn't uh uh hold me too much to this, but I do believe it's usually a once a year thing. It comes across my power DMS that I have to review it. I that can't be written in stone. Um, and then uh you know, we review it once a year. And also though, as I said earlier, if you have a obst obstacle that came up, wasn't followed in your SOP, you wrote down what you did, that could be added to your standard operating procedures as that situation comes up. Um, when I first started in in doing digital forensics, our capabilities for doing well, the cell phones themselves uh were non-existent. They were, you know, a step above the Nokia with the dad case, the plastic, you know, see-through case, and the little antenna. At best, you were uh the Verizon one store or whatever it was just transferring contacts from one thing to another. So, cell phones didn't exist, vehicles did not exist. Um, you know, drones, you know, drones didn't exist. So, every time uh audio we do audio uh enhancements now everything you have to evolve with it and the only way to evolve with it is to note what you did and add it to your uh standard operating procedures and it's it's it's a it's a constant evolution for for that matter. Benefits of SOPs. I'm I'm learning this term um onboarding. Well, that's just a training of new agents. Okay. This way, you don't have to constantly retell the new newbies what they have to do. They can refer to the manual every step along the way on their on their steps. All right. You have uh inc improved consistency and reliability. Well, everybody's on the same page. If everybody's going to be on the same page, you're going to know what your co-workers are doing. Your co-work your your co-workers are going to know what you're doing. Okay? and it minimizes your risks. All right, that's that's a big thing. You you you you don't want to be too much of a cowboy out there as well as just overseeing things, being too cocky. All right, that that the SOP will kind of ground you a little bit and and force your force your nose to the ground while you're doing while while you're doing that uh while you're doing your work. So, I can't stress it enough. It saves you from yourself. Artificial intelligence. All right. Everybody has an opinion on which way they're going to go with this. My opinion is they're taking over anyway. Just embrace our dark, you know, computer overlords. Um, it they do it does have it does have some some beneficial capabilities. All right. Obviously, it's going to speed up. It's going to work faster than the human eye can. Okay. Um, I like to use it for triaging. Um, hot case comes in. Uh, you have a a uh what do you call them? A voyer case, right? A voyerism case. The the cameras in the locker room, the cameras in the in the bathroom, the cameras, you know, in the in the bedroom, whatever. Well, usually these guys, they'll have, you know, 100,000 200,000 images, videos you got to look at. that that takes that takes a couple days, but you know, you have you're going to have pressure from the submitting agency. You're going to have pressures from above to close cases. Okay? You got to find a sweet spot of doing your job as effectively and as accurately as possible while also managing expectations. So, I'll use it on triaging cases where you want to get something out the door. It could also work with your narcotics cases, uh, your CSAM cases. All right? I'm not saying this is your full report. I'm not saying to rely on it for court purposes, but what does it do? What it does is it gets the information out of your hands. Information need to know information that can go to the investigating agent, the in the detective, whoever. They could use that to further their investigation, their investigation out in the field. Then you could go back and finish the job, do your due diligence on that case. Now, I just wouldn't send it out without verification, too. You want what AI found, you do want to validate a couple key points to make sure. All right, this this this is, you know, this is doing what's supposed to do. Send that case out there, they could go ahead and get the arrest on the case. And then once they get that arrest, then you could almost maybe sit and wait to see what the prosecution is going to want to do on that case. Because once the prosecutor gets the case, I'm going to talk about this a little bit more when I when I speak about murders. Once that prosecution gets the case, they're going to want their own things looked at and then you're going to have to red deep dive something. Okay? So, so you got to learn how your prosecutors work, um, how your attorney general's office works. Well, it it saves you if you're going to look at something for two weeks and then two years from now look at it again for another two weeks on two different things, you kind of got to find your balance for where you work and who you work for, um, do I really want to get into it now when that the rest is already made or do I are they going to make me look for things further down the line? uh something something you need to look at and I I can't I can't give you a blanket statement on that. You you got to figure that one out as time as time goes on with you working. >> Hey W, I'm gonna I'm gonna cut in here for a couple things. >> Oh yeah. Yeah, please. >> So back on the documentation, uh Michael says lesson a lessons learned documentate lessons learned documentation can help you become better at your job. Uh so I think that's pretty cool. Then Kathleen asks, "Oh, also I put up the poll." So if if you're if everyone is just listening in the background, go answer the poll on AI and I'll give you the results of that here in a second. Oz um Kathleen says, "What data set are you using for AI?" >> Oh, I'm sorry. Uh say that again. I'm sorry. >> What data set are you using for AI? >> Oh, the data set. No, I just we're we're not we're not too far into we just use the ones that are attached to uh Magnet and Celbrite. where and and then honestly I only I'm only using it for for images uh videos and then as far as narcotics cases. We we're not we're not diving too far we're not diving too far into it in our lab just yet. Um we also have policies in place in my agency um concerning AI. So I wouldn't say we're I I wouldn't say our hands are tied behind our back. We're we're just we are purposely taking the whole AI thing as as as slow as as slow as possible. So, we just use we just use a software applied um artificial intelligence. That's that's that's what we're using right now. It it it will it will eventually evolve into something, but that's that's that's the speed of where we're at right now. >> Okay. >> Um so, the poll has been up and so it says, "Do you use AI in your analysis?" Uh 3% said always, 47% said sometimes, 20% rarely, and 30% never. So >> yeah, that's fine. I mean, that's I I did not want to use it at first and I dip my toe into it. It It's all right. It just helps out with the for me, it helps out with the multi- the the the volumeness of of of images and videos on on on a case. So, it's easy, you know, and narcotics always want, you know, pictures of the drugs, uh, you know, pictures of the guns with the on the bed with the background so they could they could, you know, show show things like that. the the the stuff in the software works pretty pretty good. At least at least makes people happy. So >> yeah, >> if they're happy, I'm happy. >> Cool. All right, you got 21 minutes. That's your That's your clock there. >> 21 minutes. All right. Um, so I already said it reduces a manual effort. All right. It it does identify details maybe uh humans may miss. Um, but then again, you got to you got to over once AI does something, you got to go behind it and make sure it it it didn't miss something that you found. And I talked about with the with the images, it does make large volumes small. Okay, that's that's one of our that's one of my little mantras here. Uh you know, I was on uh Justin's podcast last year, maybe earlier this year, although we talked about making big volume small volume. Um so that it is it is beneficial for that. It it it makes your workload a little a little lighter. All right. And obviously we have the risks of AI outside of the Terminator movie. Um, you know, you don't want to over rely on on AI whatsoever. All right? You gota you got to remember that you're you got to be in control of it. It could be very easy to be sucked into push button forensics. I know sometimes that's easy. Sometimes you can get away with it based on the case, but you still got to remain diligent in that. You're also at the mercy of the AI creator. Um, you know, if you if you that Chinese AI thing that just dropped that's competing with chat GBT, you know, if you ask if you if you ask it anything about, you know, Tianaan Square or something like that, I guarantee that AI is not going to tell you anything about it. You're always you're always at the mercy of who's who's the creator of it. So, just keep that in mind. And it also can get you once again hked up in court. If you just said hit the AI button and it produced everything, you handed that out in court, you're going to get absolutely massacred on the stand because you didn't do anything science related. All right? Use you used a calculator for those math problems. You don't know how to do long division yourself is what the defense attorney is going to tell you when you're on the stand. And that's that's a situation I don't want to be in. Nobody wants to be in. So, just some just a quick quick example of AI and how it's not quite exactly there 100%. I plugged into a um this was maybe Gemini, I believe, the Gemini Plus. I just typed in two Godzilla's working digital forensics cases in a lab setting. Well, it hit the mark and it missed the mark. All right. Godzillaas, they breathe fire. At least Godzilla does. This one's drinking a candle. So, I it kind of it kind of it's in the ballpark. It It's doing the right thing. Those what I think are key keyboards are extremely tiny. But then again, Godzilla's are kind of big. So maybe that is to scale with the keyboards and the Godzilla. The other Godzilla is just drinking a coffee. He's he's had enough. And their lab is looks like a restaurant in Tokyo. So I mean, they kind of they it kind of hit the mark, but then again, you could see where it where it misses out on. It does miss out on things that you got to go behind. It tried its best. put it that way, you know, give it give it a a purple ribbon for 10th place, but it um it it didn't do what I wanted it to do. I could have gotten into more detail with it. I just just wanted a quick and everybody knows these things. I just thought it was pretty funny that it was a the setting for it. So, um best practices for using AI. All right. Obviously, validate validate everything you do all well all the time, but if whenever you do anything with a new tool or a tool, validate your findings. You don't have to validate every single finding. Validate key points, random points. Make sure it adds up. All right? You want to use it as a support. It's not to replace you, right? We do not want to make a AI replace us. Uh hopefully it doesn't happen anytime soon. Um but I who knows who knows every other 80s movie was about it. Um and then of course, uh document what you did. you know, yeah, I used the the software's AI finder to spit out these images, but I did validate a few key points with it. Make sure that you you you write down uh what you did. That's all you got to do. That saves you that little piece of paper will save you so much effort along the ways. Um, so that's I believe that for AI. Any questions on that? I think that's at that's at nauseium these days with with any kind of presentations. So, communication, let's narrow the scope. All right. Why communication matters? Well, it does narrow the scope of for your analysis analysis for your examinations as well as your evidence prioritization. You get a case in has 20 items. Everything from five cell phones, four computers, hard drives, and there's always a a blink camera system in there or something like that. Well, heck, that's very daunting. that that that's an extremely large case to work especially today's uh you know the size of memory and things. This is when you call you call the submitting agent. Hey, what what phone was on him at the time you did the search warrant? What computer was the one that was on when you hit the house? Break it down. Find through communication your most what the investigator is going to tell you he thinks is important. That's what you work on first. If you have a cell phone uh that belong to the guy as well as a 4 terbyte computer hard drive, I would work on that cell phone first. It's a smaller object. Get that out the door. Okay. What does that do? Makes the investigator happy that you gave him something right off the bat and he could look around on it and see see his findings. Work on that computer. Now, that computer is going to take you a little bit more time to work on. Then you could start, do I really? If you find something in these main in these main uh items right off the bat, they're going to be less prone to want you to look at everything. Okay? You don't have to look at that Gateway 5000 computer that's stained with cigarette smoke from 1998. It has cockroaches living in it. You really probably don't have to do anything with that. So, you could get a case that's 20 items, probably narrow it down to four or five if you just keep talking to the guy. All right? That's it. It's it's it it's it reduces the amount of time uh you have to waste on something again. Uh big data becomes small data. All right? I said it once before, I'll say it again. All right? This limits again what you have to work on. A daunting case you think you'd never get done finishing, you could get done within a couple weeks, a few weeks. All right? And it also ensures your investigative goals are met. You're you you're pretty much a customer service to a customer. All right? You want to make sure that they're happy. If they're happy, you're going to get less phone calls on your cell phone or your office phone asking, "Hey, why aren't you doing this? Um, why aren't you doing that?" It it saves you saves you emails. It saves you a phone call. All right, speaking of this, best practices, the phone call. You could send an email. You could send a text. Those are timestamped. It shows the content of it. That's great. But, as you know, my wife and I could text all day. She's at work. I'm at work. The whole a text is essentially what would be a one minute phone call conversation. You could get a lot more information going back and forth on an actual phone conversation than you can an email and especially text messages. It cuts down on any sort of miscommunication or a misread text or or context. All right, a phone call, one minute, two-minute phone call. It saves you a back and forth 10 emails and probably 25 texts uh that aren't even fun texts with no emojis maybe than other the thumbs up. All right. So, and then you have your ongoing updates. You want to constantly keep calling the calling the the submitting parties. Hey, all right. I'm done with this cell phone. What item do you think I should work on next? You could also interject it. Well, this computer looks like it's old. You said this crime happened in 2022. This computer is 15 years old. I don't really think I need to do anything with it. What do you want me to do to proceed? Chances are they're going to default to your thing. All right. To your opinion. Um it's it's it it sounds it sounds common sense but that's the reason why they call it common sense because sometimes it's not too common. So it's just a matter of doing police work which is asking questions. So just go ahead and ask the questions you think you need answered and uh I I said it before you help the investigator you know help them you know just help them along the way and also save them from themselves too. So that that's the common common denominator in this whole thing. You could use Microsoft Teams. You could use email. I abhore Microsoft Teams. Uh the sound of it is worse than my work cell phone when I'm on call and a spam caller calls me. That just sends that just sends shock waves down my spine. You do you should have standardized intake forms. I don't care how much information, how many dropown boxes you have on standard in uh standardized intake form. You could have a uh a whole line in there like what's the passcode to the computer? and they'll say like no passcode. Then you could call the individual submitting it like hey is there a passcode to this? Oh yeah. Oh I didn't put that down. That's night and day in an investigation. So uh standardized forms do help most of the time. I wouldn't rely that as gospel. I still make the phone call. All right. And then your communication logs for accountability. If you have your notes say hey on Tuesday at 5 o'clock I called and we talked about this. If you have an email you obviously just import your emails. You send a text message. That thing's time stamp. Just put that into your uh case notes. Uh okay. Types of cases. Justin, how am I on time? >> You've got 12 minutes till uh we are officially done, but you're technically the last session. So, >> no. Perfect. I have um this is my second to last slide. Okay. >> All right. Perfect. That time for the last two polls as well. >> Oh, yeah. You could you send out send out another one. That's fine. Yeah. >> Okay. I'll send out another one. Go ahead and keep talking and they can fill it out. All right, types of cases. All right, these are this is what we mostly see in in our shop. Murder investigations, your CSAM, your missing c your missing persons, fraud cases, and and your narcotics cases, your drug cases, your murder investigations. All right. Um, this is where you really got to get into the nitty-gritty. You got to do your, you know, your your database queries if if need be. Um, you know, everybody knows from the Alec Murdoch case, which my lieutenant, my boss, Brick Dove, um, uh, worked on. Uh, everybody knows your phone knows more about you than you know about yourself. Okay. Uh, that was a key element in that case. Very successful. Um, how it is database queries he built. I had a case similar to it. We're in 2025 was probably summer of of 2024, just just last year. And I actually used a free tool. I can't talk about the case, the details of the case because it's still obviously under investigation, but I plugged it into a free tool. It was um Ian Whiffin's uh RX, right? Yeah. Did I say that right? Um yeah. So, uh, I plugged it in and I just gave I did not know details of the case, but I gave the phone data, the the, you know, steps, you know, his heart rate steps and everything like that. I just busted that out, sent that in a PDF, sent it out to the prosecutor and the investigator. They were interviewing the guy at the time when they got the email or yeah the email of what I found. They were able to use that evidence directly during the investigation to poke holes in in the guy's case. Um so that that that was a very nice little tool. I did I got it in the door and out the door pretty quickly. Then you know you do your full you do your full exams on the case. Murder investigations also is when your prosecutor is going to come back to you and ask you for more uh information, different information than what you have. Uh you do have to spend a lot of time on them. Um because of the fact that they are going to look for every single detail, especially now since the Murdoch case, you're going to have everybody's going to want that phone turned upside down, inside out, three ways of Sunday. That that's that's what it's going to be. You have your CSAM cases. All right? You're going to have your known victim cases. If you have a known victim case, they have 500 images, 500,000 images on that case and 400 movies. You better be looking at every single image on that computer as well as every single movie. You got to find every single picture of that child. Make sure you have a picture of the child submitted to you. That doesn't happen all the time. your general I want to say your general collector CSAM cases you could sometimes get away with using AI as a starter but that is that's when you've really got to get into it and look look into the case as much as possible missing persons that would should follow behind with your murder investigations you're going to want to look at um not only uh the steps where the phone has been uh who they talk to of course but you could also look at uh I would say what's that called when you um uh you're building like uh the how they act during the day every day. They're patterns of habit. They're patterns of habit. How can you do that? Uh Starbucks app, uh the Wendy's app, Arby's app, all your apps are going to have location data on them. Uh sometimes your softwares are not going to pick up on that. So, you got to get a little deeper into it and uh you know get into the databases and look at it and and manually put pieces of the puzzle together. Uh your fraud cases, this is what I do on a fraud case. For the most part, I don't know what's a Ford signature. I don't know what part is fraudulent, what part's legit, you know, uh print search for all PDFs, text messages, every single document on there. um and weed out all the Japanese stereo instructions that come on computers. Um and let the investigator, this is when the portable case comes into play. I know people do not like portable cases, but guess what? You don't know. You don't know what's going to be fraud on a case. The investigator does print out a portable case for them. Have them review it, pick out what they want. They submit it back to you. You validate their findings. You attach it to your official forensic report. Everything's good to go. But there's no way in a fraud case that you're going to know what what what belonged to the church, what was stolen to the church, what signatures, what signature. You you you don't know that unless it's somebody in your unit's case. Same goes with drug cases. All right? Your narcotics cases. It's not bad to give them a portable case. As long and you got to tell them this is not an official case. You have to look at it and send the results back to me. You got to tag these results you have and then let me do my job on it. So that that's that's how I would handle the uh drug cases. Um that's that's kind of they're easy to work. Uh but also you nothing against narcotics, but you got to you got to stay up on them to ask them. Okay, what is it? What you need? You're not going to know who T-Bone, Big Money, Pooky, and Chicken Wing are. All right, you know T-Bone's name could be Randolph Davenport. How do you know that unless you talk to the narc about it and find out who these key players is? Why Chicken Wing and T-Bone are calling each other when they're calling each other, especially in narcotics cases. Do you need something from two years ago or do you need something from a week ago? Break down that time frame, the small little segments. It makes your job a lot easier. Makes them happier. So, you got to figure out the flow with that one with uh with with drug cases. Then my final one, my tips and tricks, just these little things. Um rely on your known findings. Don't get inundated like I'm not finding anything. Figure out what you found. You're going to keep on finding things. The known factor is going to grow and grow and grow and finally light is going to cast out darkness. You're going to have more knowns than you do unknowns eventually if you just stick to it. Do not focus on what you did not find. Focus on what you did find and eventually everything ah maybe not everything. Everything will come into play. Okay? It you got to be patient with it. Um and you just have to keep on doing your job. Always take a step forward uh on your cases. Except sometimes it is necessary to take a step back like it is in baseball on a pop fly. But as long as you're working towards a goal instead of not doing anything at all and worrying about it, you'll you'll always be fine. Crock-pot forensics. What do I mean by crock-pot forensics? At 455 Eastern time, set things in motion. Let the let let your let your softwares run overnight. Okay? If you got to do data transfers from one computer to the next or one server to the next, that's when you set it. Let let the softwares do your work for you while you're not working. All right? This way you come home or you come back to work. Come home. Come back to work the next day, you got everything all set. All right? You just got to find the groove on how to on how to uh manage that. But you get a you get a free 16, 14, 12 hours of of the computer working when you're not there. All right. And then multitask cases. I could probably do safely without getting underwater probably three items at a time. I usually have a cell phone, a computer, two cell phones and a computer. Uh mostly because that's the amount of monitors I have. Um once you start minimizing maximizing windows, things uh can get shaky out of hand, especially if you're not writing everything down. So I I'm comfortable with doing three things at once. And that's probably my limit for now. Um we'll see we'll see uh we'll see what happens with that. Nope. Justin, you wanna go ahead and talk get these other ones out? >> Yep. All the polls are are running. Um, do you want me to read you off some of the results and you can comment on them? >> Yes, please. Yeah, because that's that's that's it for me. Yep. >> All right. So, which challenges most impact your ability to manage cases efficiently? So, 40% said overwhelming data volume. I don't know if I believe that. I I you know, people got a lot of cases. That sounds weird. Uh 20% said limited resources. 32% said time constraints and 8% said lack of standard procedures and protocols. So >> yeah. Yeah, it is. But it's data. Um when I first started, you know, computer was 10 20 gigabytes and that was, you know, that was like, oh my god, how am I going to do this now? My god, you nothing's nothing's 20 gigabytes anymore. So yeah. Yeah. AB, absolutely overwhelming dead. And thanks for Matt McIntyre with the pattern of life. I couldn't remember what the exact term was for that. So, >> yeah, >> Matt Matt works at Matt works at an agency. I I think I could see his office from my office. He works at an agency right across the field. So, >> but um yeah, the new he's an upandcomer in the business, but anyway, uh that's your shout out, Matt. Okay, great. >> Next poll after the very valid shout out. Uh what is the most important factor for achieving efficiency in digital forensic cases? 32% said clear and in-depth communication. 11% said advanced forensic tools. 21% said evidence prioritization and 36% so this is the number one response. Streamlined documentation process. >> That's good. That's pretty much a good a good number across the board. So >> yeah um that's that's I mean there there is no right there is no wrong answer. It depends on you know your case load where you're working and what you know what cases are coming in. So, every answer is the right answer. Um, I I think I went under. I'm sorry I rushed the last part of it. I wanted to spend more time on on things, but it's I I just wanted to make sure I got the whole thing done. Um, that's why hence I usually don't talk that fast when I'm presenting, but I wanted to make sure uh number one, I got people out before five o'clock. I I 25 years as a cop, trust me. Yeah. You don't want to go past five o'clock. So, >> well, thank you, W. And thank everyone for attending. I'm sure you've uh bounced through the sessions. Just as a last housekeeping um as we as we depart here, you guys will receive an email for a whole series like uh survey. Uh be sure to fill that out. If you didn't know, for all the poll questions you answered, we're doing a drawing for Raspberry Pies. So, for each poll question you answered, you're going to do a drawing for we have three Raspberry Pi 5 8 gig models. Uh kind of fun. And then the survey will also get you into that. And then also uh we've got a bunch of other stuff that you'll get for free after this, like a magazine, a digital magazine with W's stuff. And this will all be on demand, available, ungated, so you can uh go watch this as well as the other 14 presentations that we did throughout the day worldwide. So that'll all be uh accessible to you guys. Uh the on demand should be up by next week sometime. Uh so yeah. Thank you. >> Cool. Very good. And the most important question nobody asked. Yes, I am wearing pants. I don't have shorts on or sweatpants. I didn't know if I had to stand up uh suddenly or something. So, I am wearing pants. And then if you want to find me on LinkedIn, Fancy Wisak. I think I am the only Fancy Wisak in existence other than probably a bot or some sort of identity thief from Ghana somewhere. So, look me up on LinkedIn if you want. Um, it was a pleasure. Thank you, Justin. Thank you, everybody. Um, I'm sorry I couldn't read all the comments. is kind of running around here, but uh I appreciate everything, guys. Thank you. Be safe out there. All right. Just be safe out there. >> Thank you everyone. Thanks for joining and have a great rest of your day. And we're almost to the weekend, so have a good weekend. We'll see you. And W, you're just going to get dropped, so you as well. Have a good day. >> All right. Sounds good. >> All right. We'll see you. Bye. See you.