Comments for South Carolina Digital Forensics Association

Comment on DFIR Truisms by Graham Kuzia

Graham Kuzia — Mon, 04 Mar 2013 19:08:47 +0000

I couldn’t find a link to email the host of this website, so I’m hoping you’ll see this comment. I am the Program Developer over the Digital Forensics program for law enforcement at the American Academy of Applied Forensics in Charlotte. I’d love to offer your association members some training. We have both in-class and online classes, which are free/reduced cost for law enforcement, depending on the class. These include both cell phone and computer forensics, basic to advanced courses. Please email me if interested. graham.kuzia@cpcc.edu

Comment on DFIR Truisms by Clay Boswell

Clay Boswell — Tue, 08 Jan 2013 22:40:06 +0000

keydet89 – I like those additions; especially the absence of artifacts. So very true when looking at evidence when anti-forensics techniques may have been used.

Comment on DFIR Truisms by keydet89

keydet89 — Tue, 08 Jan 2013 11:55:35 +0000

If you didn’t document it, it didn’t happen.

The absence of an artifact where you expect to find one is itself an artifact.

Comment on Avenues to Entry into DFIR by Clay Boswell

Clay Boswell — Fri, 04 Jan 2013 21:21:11 +0000

Hey Tom thanks for the support.

I’m looking for others to help contribute articles directly on the site…you interested? If so, I can setup an account for you. Let me know.

Comment on Avenues to Entry into DFIR by tomslovenski

tomslovenski — Fri, 04 Jan 2013 00:59:33 +0000

Great Blog Dude! Keep up the super job!

Comment on Avenues to Entry into DFIR by keydet89

keydet89 — Sat, 29 Dec 2012 15:12:24 +0000

Clay,

I’d be happy to share my experiences and lessons learned.

Comment on What areas of DF are you interested in? by Clay Boswell

Clay Boswell — Sat, 29 Dec 2012 02:17:11 +0000

You've touched on a pet-peeve of mine - report writing. I may not be the best at keeping case notes, but I hope practice makes me better. While handling a case I can honestly say I agonize over nearly every word in my written reports. I write what I find, draw conclusions based on those findings and offer opinions of how any certain activity may have occurred. Then, as time permits, I set my report aside for at least a day so I can come back to it and read it from a critical point of view, like someone might who is on the opposing side of my case so I can see where gaps may exist. Then I strive to fill the gaps - whether they be completeness, accuracy or understanding of my written words. WHY do this? Quite frankly I've grown into this habit; however the driving force for doing so is you never know how sobering your report may sound until you hear parts of it extracted and read back to you in a legal proceeding. The first time this happened to me, I had chills go up my spine simply because inflection of words I wrote made my written report sound different than I intended. (Shame on me.) Now I try to get another set of eyes to review my written (and notarized) words prior to submission because, for me, the best time to explain what I mean is by saying it properly the first time. (And I'm still practicing that skill every single day!)

Comment on Avenues to Entry into DFIR by Clay Boswell

Clay Boswell — Sat, 29 Dec 2012 02:02:09 +0000

Hi keydet89. No restrictions at all on this group other than a a desire to share broad information based on lessons learned in the DFIR field. The SC twist comes from having a group of DF practitioners in the local area who could meetup on a regular basis. You might be aware of two conferences held in SC every year - TechnoSecurity & Forensics Investigations Conference + Mobile Forensics World. I hope as the group and the discussions grow we will have the opportunity to meetup in Myrtle Beach in June 2013.

Comment on What areas of DF are you interested in? by keydet89

keydet89 — Fri, 28 Dec 2012 22:26:39 +0000

Report writing – I posted a PDF example report to the Win4n6 group on Yahoo sometime ago. Oddly enough, a lot of folks in the community want to see how to do it, but don’t want to share any of their own materials. Report writing starts with your other documentation…you know, that stuff no one does, like keeping case notes? Do it right, and the report writes itself.

Forms – easy-peasy. Everyone’s got these already. The really big issue is not using them.

Comment on Avenues to Entry into DFIR by keydet89

keydet89 — Fri, 28 Dec 2012 22:22:51 +0000

Interesting post, thanks for sharing.

“…ability to maintain a personal network of like-minded DFIR individuals who you can bounce ideas of off;”

Are you restricting this to just SC?