[00:00.000 --> 00:07.020]  Difficulty is not the most elegant solution, but we have something going for you, and considering how many people are in this room, we have something, I believe, truly special.
[00:07.300 --> 00:10.800]  Here's the last talk for this room, but not necessarily the least.
[00:10.980 --> 00:16.940]  It is Computer Forensics, Possibility, Probability, Opinion, and Fact, by Joe.
[00:18.260 --> 00:18.620]  Thank you.
[00:19.400 --> 00:21.400]  So, all right, we're going to work through this.
[00:22.080 --> 00:27.300]  I like to walk, so I couldn't get the resolution thing fixed.
[00:27.300 --> 00:31.880]  If you guys can leave the lights on, then I can see who people are and do this.
[00:32.000 --> 00:36.760]  All right, I am Joe Cicero, Possibility, Probability, Opinion, and Fact, Computer Forensics.
[00:36.800 --> 00:38.580]  I guess I have to do my down arrow here.
[00:39.620 --> 00:41.280]  Let's start with the normal disclaimer.
[00:41.560 --> 00:42.460]  We've seen this all day.
[00:42.680 --> 00:43.700]  I am not a lawyer.
[00:44.180 --> 00:44.800]  I'm not.
[00:44.800 --> 00:50.080]  Even the lawyers are saying, you know, I'm not your lawyer, but I'm not a lawyer.
[00:50.200 --> 00:52.320]  I work for lawyers, but I'm not one.
[00:52.600 --> 01:00.100]  And one of the things I cover in my classroom is words and punctuation mean things.
[01:00.880 --> 01:16.320]  And those of you that remember, it was DEFCON, I don't know, I think it was 16, the MBTA versus the MIT students, the Massachusetts Bay Transit Authority, some MIT students figured out how to ride for free.
[01:16.620 --> 01:18.100]  They didn't break the law.
[01:18.400 --> 01:19.660]  They just figured out how to do it.
[01:20.240 --> 01:22.360]  And their talk was squashed.
[01:22.420 --> 01:23.840]  It was stopped at DEFCON.
[01:24.120 --> 01:26.000]  And they ended up in a lawsuit.
[01:26.240 --> 01:32.500]  And that lawsuit was decided partially on the placement of a comma in a sentence.
[01:32.500 --> 01:47.160]  And it reads, for those of you in the back that can't see it, first, the text in the section indicates, by the placement of a comma before the clause to be a protected computer, that the offender must both transmit information to the protected computer and cause damage to that same computer.
[01:47.460 --> 01:50.560]  So one of the things that I like to bring up to my students is I'm not a lawyer.
[01:50.960 --> 01:53.520]  You're not a lawyer, unless you're a lawyer out there.
[01:55.220 --> 01:58.620]  You know, you can't read the law and understand it.
[01:58.780 --> 02:00.020]  That's for lawyers and judges.
[02:02.220 --> 02:02.860]  All right.
[02:03.100 --> 02:05.860]  My disclaimer continues, because I work for a college.
[02:06.800 --> 02:12.960]  Per the code of conduct policies, employees should clearly identify their opinions as personal and not on behalf of the college.
[02:13.280 --> 02:19.920]  So, the views expressed in this presentation are solely those of the presenter and do not necessarily reflect those of my employer.
[02:22.280 --> 02:24.820]  Everything going on is as is, where is, and the condition it's in.
[02:24.900 --> 02:26.220]  No warranties expressed or implied.
[02:26.340 --> 02:27.360]  Blah, blah, blah, blah, blah.
[02:27.600 --> 02:27.880]  All right.
[02:28.020 --> 02:30.040]  Now we're done with all the disclaimers.
[02:31.140 --> 02:31.520]  All right.
[02:31.560 --> 02:31.940]  The schedule.
[02:32.080 --> 02:33.380]  Normally, I don't like to talk about me.
[02:33.460 --> 02:36.500]  I like to get right into whatever my research is or whatever I'm talking about.
[02:36.540 --> 02:41.700]  But it has a lot to do with the computer forensics that I'm doing on the defense side.
[02:41.700 --> 02:43.280]  So I'm going to do a little bit of talk about me.
[02:43.580 --> 02:45.600]  And then I'm going to talk about accidental downloads.
[02:45.600 --> 02:52.920]  Two years ago at HOPE, at 9:30 on Sunday morning, I'm really happy with the turnout here.
[02:53.300 --> 02:56.120]  I thought, boy, I wonder if it will be like 9:30 on Sunday morning.
[02:57.840 --> 03:02.800]  I did a talk about the need for a computer crime innocence project.
[03:04.420 --> 03:07.600]  And the HOPE committee did not want me talking alone.
[03:07.680 --> 03:08.320]  They didn't know me.
[03:08.440 --> 03:09.340]  They didn't know how I speak.
[03:09.460 --> 03:10.320]  They didn't know my background.
[03:10.700 --> 03:19.080]  And they said, we'll have you come and talk, but we want to have an attorney and possibly some other panelists on the panel with you.
[03:19.880 --> 03:29.080]  So they contacted the, uh, uh, the computer, or not the computer crime, the, the innocence project at, I think it's Cardoza University.
[03:29.480 --> 03:31.040]  It's New York University.
[03:31.300 --> 03:36.900]  And said, we have this guy coming in to present, uh, on, on the need for a computer crime innocence project.
[03:37.320 --> 03:39.280]  Would you be interested in presenting with him?
[03:40.860 --> 03:44.540]  But some of the cases he'll be talking about are CP, child pornography.
[03:45.320 --> 03:45.840]  No.
[03:46.040 --> 03:47.020]  We're not interested at all.
[03:47.220 --> 03:50.960]  So they'll defend murderers who are not guilty.
[03:50.960 --> 03:58.760]  But they apparently won't defend people who have, who are being prosecuted for child pornography, but are not guilty.
[03:59.360 --> 04:00.720]  At least that's what I was told.
[04:00.860 --> 04:02.760]  It's too controversial of a subject.
[04:03.700 --> 04:08.700]  So rather than, and a lot of that talk had to deal with malware downloading illegal content.
[04:09.580 --> 04:12.460]  Today, I'm going to be talking about accidental downloads.
[04:12.600 --> 04:22.200]  How easy it is for someone who's not really computer savvy, or maybe slightly computer savvy, to end up with illegal content on their drive and they did not know it was there.
[04:23.140 --> 04:25.520]  I'm going to go through a quick scenario-based exercise.
[04:26.200 --> 04:28.180]  Nothing in computer forensics is quick.
[04:28.820 --> 04:35.900]  So to have 55 minutes to talk, now probably about 45 minutes to talk, I'm not going to have a whole lot of time to go into detail.
[04:36.340 --> 04:40.680]  Everything I'm talking about is a basic computer, not a HOPE Attendee's computer.
[04:41.360 --> 04:41.800]  Alright?
[04:41.900 --> 04:43.420]  It's a general public's computer.
[04:43.600 --> 04:54.960]  I'll go through that, and you'll get to see an idea of what I go through when I do a forensic examination, and what students in my classroom go through when they have to do a forensic examination.
[04:55.020 --> 04:56.580]  I teach a computer forensics course.
[04:56.780 --> 04:59.940]  It's a one-hour lecture and a four-hour lab.
[05:00.540 --> 05:03.880]  And I've had students drop the class because it's too boring.
[05:04.380 --> 05:05.580]  Four hours of lab.
[05:05.740 --> 05:06.420]  I say, what do you think?
[05:06.500 --> 05:08.640]  This is CSI Miami?
[05:08.900 --> 05:09.980]  It doesn't happen in an hour.
[05:10.780 --> 05:12.540]  We're going to talk about the cost of a defense.
[05:12.540 --> 05:16.440]  So should you get prosecuted for a crime you didn't commit?
[05:17.080 --> 05:19.480]  Or, what I like to say, you're a little guilty?
[05:20.000 --> 05:21.680]  How much is that going to cost you?
[05:21.880 --> 05:25.540]  And especially when we're talking about CP, you might say, who's a little guilty of that?
[05:25.620 --> 05:27.020]  You'll get an idea of that when we're done.
[05:27.220 --> 05:30.420]  And then I should have some time for questions, comments, and contact.
[05:33.020 --> 05:34.520]  Okay, a little bit about my background.
[05:35.900 --> 05:40.620]  I'm a network specialist instructor for Northeast Wisconsin Technical College in Green Bay, Wisconsin.
[05:40.620 --> 05:44.380]  I primarily teach Linux, network security, and computer forensics.
[05:44.660 --> 05:47.840]  Many times people see that and they say, oh, he teaches Linux.
[05:48.140 --> 05:50.100]  He must not know anything about Windows.
[05:51.220 --> 05:54.000]  The computer forensics course is all Windows-based.
[05:54.160 --> 06:00.180]  All we're doing is analyzing Windows systems, though we're using a Linux-based forensic tool.
[06:00.880 --> 06:05.880]  The network security class is all looking at the security of Windows-based systems.
[06:05.880 --> 06:12.680]  The Linux system is a Linux... or Linux class is a Linux server class that we have Windows clients.
[06:12.820 --> 06:14.180]  So I know plenty about Windows.
[06:15.460 --> 06:27.640]  I've had positions covering every aspect of computers, including help desk support, technician, programmer, network administrator, director of technology, computer security, and incident response team member, and computer forensic examiner.
[06:27.640 --> 06:29.460]  Why do I go through that?
[06:29.760 --> 06:43.740]  Well, I think the top ones, which many of you might be at that position in your career, help desk support, technician, programmer, really help me understand what normal users do when it comes to using their computer.
[06:43.740 --> 06:53.820]  A lot of times when I'm sitting down with an attorney and I'm explaining how something happened, it's... you have to understand that this person didn't know what was going on here.
[06:53.940 --> 06:57.480]  The average user, they don't know half of what's going on on their computer.
[06:57.740 --> 06:58.980]  So certain things are possible.
[06:59.240 --> 07:01.020]  I'm a former United States Marine.
[07:01.260 --> 07:07.740]  My last duty station was with Special Operations Training Group, Tactical Warfare Simulations, Evaluations Analysis Systems.
[07:07.740 --> 07:12.820]  It's where I got my start with computers, Windows 3.1, and a UNIX server.
[07:13.340 --> 07:23.100]  And I've spoken nationally at DEFCON HOPE, the last HOPE, which was the next HOPE, and this HOPE, and the UAT conferences, so...
[07:23.100 --> 07:23.780]  All right.
[07:24.020 --> 07:27.180]  How did I get started from a criminal law standpoint?
[07:28.140 --> 07:31.620]  Well, you know, you teach long enough, you have a lot of students.
[07:31.720 --> 07:35.980]  And one of my students was the network specialist for a law firm.
[07:35.980 --> 07:39.980]  And that law firm ended up with a CP case, child porn case.
[07:40.620 --> 07:52.680]  And the lawyer told the student, boy, you know, I've worked with a firm out of Milwaukee, but the case went from one examiner to another examiner and never got enough information.
[07:52.680 --> 07:53.920]  It was very expensive.
[07:54.160 --> 07:57.040]  I don't know, you know, I don't know if I want to do that.
[07:57.200 --> 07:58.740]  Maybe you could help me, to the student.
[07:59.100 --> 08:01.360]  And the student said, sure, I bet I can help you.
[08:01.560 --> 08:04.880]  And they got a copy of the drive at the time you could get the drive.
[08:04.880 --> 08:05.820]  You can't do that anymore.
[08:06.500 --> 08:08.200]  At the time, they could get a copy of the drive.
[08:08.360 --> 08:12.060]  And, of course, he hooked it up to a computer and started looking at it.
[08:12.140 --> 08:16.760]  And all the forensic data went away because there was no right blocker.
[08:16.860 --> 08:17.920]  He wasn't doing it right.
[08:18.360 --> 08:23.900]  And after seeing that, he said to the attorney, well, there's this instructor over at the technical college I had.
[08:23.960 --> 08:24.840]  Maybe we could bring him in.
[08:25.440 --> 08:27.540]  And I'd never done a criminal case.
[08:27.680 --> 08:30.180]  I said I'd be willing to talk to you about it.
[08:30.640 --> 08:35.000]  So I came in and I started looking at it and I got quite an education from it.
[08:35.180 --> 08:42.420]  Those of you that can go working for a firm that does forensics are going to learn a lot from the guys that have been doing forensics a long time.
[08:42.520 --> 08:43.940]  There was nobody for me to learn from.
[08:43.940 --> 08:49.200]  So I found out he had did this to the drive and I said, well, we can't use this drive.
[08:49.340 --> 08:50.340]  We need to get another drive.
[08:51.120 --> 08:54.280]  Now, back then, it took a long time to image a drive.
[08:54.460 --> 08:57.040]  How'd you like to be the cop that gets the phone call?
[08:57.080 --> 08:58.480]  We need another copy of that drive.
[08:59.080 --> 09:00.280]  So he was not happy.
[09:00.380 --> 09:04.500]  Of course, he imaged the drive and sent E01 files, which are in case files.
[09:04.620 --> 09:06.300]  I couldn't read in case files at the time.
[09:06.440 --> 09:09.820]  There was no product that allowed me to convert that and read it.
[09:10.000 --> 09:11.700]  So it had to go back again.
[09:12.860 --> 09:18.840]  It was a series of funny problems with that case.
[09:18.960 --> 09:22.900]  But it turned out that I learned a lot and I was able to help them out with it.
[09:23.020 --> 09:24.260]  So that's how I got started.
[09:26.340 --> 09:28.400]  Types of cases I've done since then.
[09:28.660 --> 09:29.160]  Divorce.
[09:29.320 --> 09:29.720]  Malware.
[09:30.360 --> 09:30.860]  Cyberstalking.
[09:30.980 --> 09:31.460]  Embezzlement.
[09:32.160 --> 09:33.940]  Acceptable use policy violation.
[09:34.620 --> 09:36.160]  Potential for civil litigation.
[09:36.380 --> 09:37.300]  This is really interesting.
[09:37.560 --> 09:44.000]  If you are in the forensic field or you're planning on getting in the forensic field, I was called by an attorney.
[09:44.200 --> 09:46.620]  Actually, it was an attorney who knew an attorney who knew an attorney.
[09:46.840 --> 09:49.340]  Called me up and said, We have a defendant.
[09:49.580 --> 09:50.820]  Actually, it wasn't a defendant yet.
[09:50.940 --> 09:54.160]  We have a person who's worried about getting sued.
[09:54.700 --> 10:02.120]  And the evidence that he's not guilty is on a work computer, but he's quitting.
[10:02.780 --> 10:06.820]  And he's worried that... and it had nothing to do with work.
[10:06.920 --> 10:07.940]  Work didn't have a problem with it.
[10:08.300 --> 10:14.300]  He's worried that three months or four months down the road, all that data will be gone.
[10:14.600 --> 10:16.380]  And that person will come back to sue him.
[10:16.420 --> 10:17.900]  And he'll have no way to prove that he was innocent.
[10:18.880 --> 10:19.880]  Can you help us out?
[10:20.060 --> 10:24.660]  And all I ended up doing was a forensic image of the drive and handing it to them.
[10:24.660 --> 10:26.400]  And I thought to myself, What a...
[10:26.400 --> 10:27.940]  Boy, they're a cash cow.
[10:28.160 --> 10:28.400]  Right?
[10:28.500 --> 10:35.120]  You start advertising to the attorneys, Look, if you ever have this problem, you might want to image the drives and save the data.
[10:35.580 --> 10:38.240]  In the state of Wisconsin, a new law was passed.
[10:38.420 --> 10:42.400]  And that new law says that K-12 educators who are...
[10:42.400 --> 10:44.660]  And I use this term loosely...
[10:45.460 --> 10:47.480]  Caught surfing porn at work.
[10:48.260 --> 10:48.700]  Alright?
[10:48.700 --> 10:50.500]  Now, I don't know what that means.
[10:50.680 --> 10:54.880]  I don't know if that means someone walked up behind them and saw them surfing porn at work.
[10:54.880 --> 10:58.260]  Or the logs say they were surfing porn at work.
[10:58.560 --> 11:00.420]  There's a huge difference there.
[11:01.180 --> 11:02.580]  They can now be fired.
[11:03.100 --> 11:08.240]  And the minute that law came out, I sent out an email to all the K-12 institutions in my area.
[11:08.480 --> 11:11.580]  And I said, What are you doing to preserve the evidence?
[11:11.780 --> 11:13.900]  In the case, they're not guilty of that.
[11:13.900 --> 11:18.660]  I got a few responses back, basically saying we don't do anything like that.
[11:19.300 --> 11:22.400]  And the rest of them were no response, which basically means we don't...
[11:22.400 --> 11:23.560]  We're not doing anything like that.
[11:23.680 --> 11:26.960]  And I thought, back to potential for civil litigation.
[11:27.160 --> 11:34.460]  If you're in that position, find somebody who can forensically image the drive so that the evidence that you're not guilty is still around.
[11:34.740 --> 11:36.080]  And I do CP cases.
[11:36.220 --> 11:37.700]  CP stands for child pornography.
[11:40.200 --> 11:44.980]  When it comes to CP, many seasoned professionals don't take the cases.
[11:45.300 --> 11:48.020]  In fact, many seasoned professionals don't take defense cases.
[11:48.200 --> 11:59.240]  So it's very difficult for you to find somebody, if you get involved in a case like that, and I'm presuming you're innocent, to get a forensic analyst who has a lot of experience to help you.
[11:59.380 --> 12:03.700]  Many cases on the East Coast have professionals that are on the West Coast.
[12:04.520 --> 12:06.260]  Have professionals that are on the East Coast.
[12:06.580 --> 12:14.920]  People have to travel that far in order to get somebody to take care of their case, to get a seasoned professional, somebody who's dealt with it.
[12:15.300 --> 12:22.720]  So if you get involved in one of these cases, it's rather difficult to find somebody who's competent to help you, unless you're lucky out here.
[12:23.060 --> 12:25.340]  I'm assuming many of you are on the East Coast.
[12:25.480 --> 12:27.420]  So you might have professionals out here.
[12:27.520 --> 12:29.220]  It might be a state away, but they're out here.
[12:29.220 --> 12:35.100]  And again, the whole selection committee had numerous rejections.
[12:35.240 --> 12:38.740]  They didn't just contact the Innocence Project.
[12:42.580 --> 12:46.820]  They contacted all kinds of other people, and they just said, no, he's talking about CP.
[12:47.080 --> 12:48.200]  No, not interested.
[12:49.540 --> 12:57.100]  You are guilty before proven innocent when you're convicted or when you're being prosecuted for one of those crimes.
[12:57.100 --> 12:58.420]  All right, one of these quotes.
[12:58.520 --> 12:59.200]  I love this quote.
[12:59.420 --> 13:04.140]  I'm not in favor of imprisoning the innocent, but I'm not enthusiastic about freeing the guilty either.
[13:04.540 --> 13:05.600]  That's where I am.
[13:06.060 --> 13:06.400]  All right?
[13:06.500 --> 13:09.500]  So this talk is not about how to get away with a crime.
[13:09.620 --> 13:14.660]  And I liked hearing some of the previous lawyer talks say that also.
[13:14.880 --> 13:17.520]  I'm not here to say, ooh, but if you do this, you'll get away with it.
[13:17.720 --> 13:18.620]  That's not why I'm here.
[13:18.680 --> 13:27.500]  Why I'm here is to show you how easy it is to get prosecuted and potentially convicted of a crime you did not commit.
[13:28.360 --> 13:40.720]  In the cases that I've dealt with, I'm always amazed at how much evidence is brought up against somebody, and it's frivolous, and it's easily proven that there is no evidence there.
[13:40.920 --> 13:42.060]  So that's why I'm here.
[13:43.360 --> 13:44.000]  Okay.
[13:44.180 --> 13:45.640]  Let's talk about accidental downloads.
[13:48.200 --> 13:49.000]  All right.
[13:49.100 --> 13:49.920]  I have some images here.
[13:50.040 --> 13:52.120]  I have Trust Guard security scanned.
[13:52.540 --> 13:53.120]  Trust Guard.
[13:53.360 --> 13:54.560]  McAfee secure.
[13:54.840 --> 13:56.100]  Tested 19 June.
[13:56.380 --> 13:57.280]  Hackers safe.
[13:58.460 --> 13:59.140]  Certified.
[13:59.240 --> 14:01.140]  Hackers scan safe shopping.
[14:01.440 --> 14:06.560]  And the question is, what do these images mean to the average user?
[14:08.120 --> 14:09.440]  Safe on this side.
[14:09.540 --> 14:10.460]  You want a t-shirt.
[14:11.040 --> 14:12.040]  What size?
[14:12.380 --> 14:12.800]  Large.
[14:12.960 --> 14:13.560]  Large.
[14:13.560 --> 14:18.960]  There is a HOPE 9 New York 2012 embroidered t-shirt.
[14:19.560 --> 14:22.760]  The gentleman said that you're safe when you're on that website.
[14:23.060 --> 14:24.340]  And he's exactly right.
[14:24.560 --> 14:28.820]  The average user sees that, and that means you're safe on that website.
[14:28.940 --> 14:29.900]  That's what they think it means.
[14:30.100 --> 14:33.400]  Now, HOPE attendees, what does that actually mean?
[14:34.240 --> 14:36.480]  I can't give that many t-shirts away.
[14:37.940 --> 14:38.780]  Absolutely nothing.
[14:38.780 --> 14:41.540]  It means somebody was able to put an icon on a website.
[14:41.540 --> 14:43.380]  Somebody sold them a service.
[14:43.400 --> 14:46.480]  Or somebody sold them a service, and the service doesn't mean anything.
[14:46.560 --> 14:47.520]  That's exactly right.
[14:47.780 --> 14:48.120]  Alright?
[14:48.380 --> 14:53.540]  So, now that we've covered that, and we understand that, let's take a look at this.
[14:54.960 --> 14:55.520]  Alright.
[14:56.440 --> 14:57.560]  I can't...
[14:57.560 --> 14:57.700]  Alright.
[14:58.040 --> 15:04.300]  Because I can't show my presentation, the back side of that screenshot is a statement.
[15:04.300 --> 15:12.620]  And it basically says, this website adheres to USC Title 18 Section blah, blah, blah, blah, blah.
[15:12.840 --> 15:16.280]  All persons on this website are 18 years old.
[15:16.920 --> 15:20.320]  And I was involved in a case where the defendant...
[15:20.320 --> 15:27.320]  I was brought in by the attorney literally to validate what his client was saying.
[15:28.640 --> 15:32.720]  Not that the client said it to the prosecution, which I was told he did.
[15:32.820 --> 15:36.620]  He told the police, look, every website I went to had this statement on it.
[15:36.700 --> 15:39.660]  He also made... he made about five statements that...
[15:39.660 --> 15:45.800]  And if you talk to enough attorneys, you'll find out the prosecutor's job is not to defend you.
[15:46.180 --> 15:47.660]  So they don't care what you say.
[15:47.920 --> 15:49.240]  You can say, yeah, I did that.
[15:49.240 --> 15:53.880]  In my experience, they're not going to go analyze the drive and say, oh yeah, you're right.
[15:54.400 --> 15:55.820]  They say, you're attorneys.
[15:56.020 --> 15:56.900]  That's your attorney's job.
[15:57.000 --> 15:57.540]  Get an expert.
[15:57.740 --> 15:58.960]  And go analyze the drive.
[15:59.100 --> 16:03.340]  So the attorney he had contacted me and said, he's made these five statements.
[16:03.900 --> 16:05.080]  I'm going to talk about two of them.
[16:05.140 --> 16:07.540]  One is, he said that this statement was on these websites.
[16:08.340 --> 16:10.160]  And I said, well, look at the charge report.
[16:10.340 --> 16:15.220]  Does the charge report say where... which websites he went to to download this illegal content?
[16:15.340 --> 16:16.720]  And apparently some of them were in there.
[16:17.220 --> 16:20.080]  And I said... and I actually was proud of myself.
[16:20.220 --> 16:23.540]  I said, hey, go to the Wayback Machine.
[16:25.400 --> 16:32.740]  And I don't know, those of you that don't know this, there's a website out there that caches the main pages of websites on the Internet.
[16:32.940 --> 16:37.420]  So the attorney went to the Wayback Machine and sure enough, there are these statements on these websites.
[16:37.560 --> 16:38.220]  I said, there you go.
[16:38.320 --> 16:41.580]  So he was reading the websites and the website had that statement.
[16:42.200 --> 16:45.700]  Another thing he said is, look, I downloaded... the guy was into pornography.
[16:46.860 --> 16:47.680]  Nothing wrong with that.
[16:47.760 --> 16:48.120]  It's not illegal.
[16:49.100 --> 16:52.080]  I was downloading these files en masse.
[16:52.440 --> 16:53.940]  I was doing great big downloads.
[16:54.100 --> 16:57.460]  I don't know what was in those... you know, I might get a thousand files in one of those.
[16:57.480 --> 16:58.180]  I don't know what was in them.
[16:58.860 --> 17:02.700]  Alright, so what does it mean when...
[17:02.700 --> 17:09.820]  Everybody understand that files might have a created timestamp, an accessed timestamp, and a modified timestamp.
[17:10.760 --> 17:18.580]  What does it mean when the modified timestamp is before the created timestamp?
[17:21.180 --> 17:23.820]  How can you modify a file before it's created?
[17:27.480 --> 17:28.520]  Not...
[17:28.520 --> 17:29.940]  Not...
[17:29.940 --> 17:30.500]  Not...
[17:30.500 --> 17:31.620]  Not...
[17:32.140 --> 17:33.540]  Not moved.
[17:34.580 --> 17:35.620]  Nope.
[17:36.140 --> 17:36.720]  Not tampered.
[17:41.800 --> 17:42.440]  Nope.
[17:43.640 --> 17:44.480]  Not tampered.
[17:45.000 --> 17:45.040]  Nope.
[17:45.420 --> 17:45.740]  Nope.
[17:46.660 --> 17:46.920]  Nope.
[17:46.920 --> 17:47.540]  Zip file.
[17:48.300 --> 17:57.220]  When you download a compressed zip file and you uncompress it, the created date will be different than the modified date.
[17:58.300 --> 17:58.600]  Alright?
[17:58.780 --> 18:01.640]  So, I looked at that and I said, that's kind of odd.
[18:01.740 --> 18:03.800]  And I looked it up and I was like, oh, that's why.
[18:03.980 --> 18:04.780]  It's because it came...
[18:04.780 --> 18:08.440]  So, basically what I did when I did the analysis, I found out the guy wasn't lying.
[18:08.560 --> 18:09.880]  And I went to the attorney, the guy's not lying.
[18:11.380 --> 18:13.960]  So, again, the prosecutor's not going to do that work.
[18:14.100 --> 18:15.980]  You've got to hire somebody to do that work and it ain't going to be cheap.
[18:16.960 --> 18:18.280]  I was also called...
[18:18.280 --> 18:19.300]  Same attorney called me up.
[18:19.360 --> 18:21.560]  He said, I got a guy, I don't know if this makes any sense.
[18:21.620 --> 18:22.720]  He's telling me...
[18:22.720 --> 18:25.100]  He was just arrested and...
[18:25.100 --> 18:25.580]  And it's...
[18:25.580 --> 18:26.740]  And it's LimeWire.
[18:27.280 --> 18:28.200]  LimeWire's not around anymore.
[18:28.300 --> 18:28.820]  It's FrostWire.
[18:29.000 --> 18:33.260]  He was just arrested and he's telling me he didn't know anything about this child porn on his system.
[18:35.020 --> 18:36.100]  Is that possible?
[18:36.280 --> 18:39.140]  Is it possible he downloaded this and didn't know?
[18:39.140 --> 18:40.700]  And I said, well, let me run a test.
[18:41.140 --> 18:44.220]  So, I went and I got LimeWire and installed it.
[18:44.360 --> 18:47.060]  And I did a search for commercials rated G.
[18:48.280 --> 18:50.740]  And I started that search engine.
[18:50.820 --> 18:52.320]  And all these things start popping up.
[18:52.400 --> 18:53.460]  Now, let me ask you a question.
[18:54.360 --> 19:02.660]  When someone has 20, 30, 40 files in front of them, and they want to copy them or download them, how do they do that?
[19:03.360 --> 19:04.420]  One at a time?
[19:04.660 --> 19:05.780]  Select them all.
[19:06.020 --> 19:07.040]  Select them all.
[19:07.040 --> 19:08.300]  You select them all, right?
[19:08.300 --> 19:09.420]  You select, you shift click.
[19:09.600 --> 19:10.340]  You select them all.
[19:10.500 --> 19:11.540]  And you download them.
[19:11.640 --> 19:17.520]  Now, with LimeWire or FrostWire, it might be three or four days before those downloads end up on your computer.
[19:18.400 --> 19:19.800]  Well, I did that on the test.
[19:20.000 --> 19:20.960]  I didn't download them.
[19:21.080 --> 19:23.360]  I did this commercial rated G and you can't see it there.
[19:23.460 --> 19:26.080]  It says, teen sex, very young girls orgy.
[19:27.360 --> 19:29.240]  Well, you can, but they back there can't.
[19:31.620 --> 19:33.820]  So, I ran this test and it showed up.
[19:34.060 --> 19:36.800]  Well, then I was like, alright, well, looks like it's possible to me.
[19:36.900 --> 19:41.440]  I closed everything down, re-ran the test, video recorded it, and sent it off to the attorney.
[19:42.080 --> 19:43.960]  This guy never gets back to me quickly.
[19:44.720 --> 19:45.420]  He's an attorney.
[19:45.540 --> 19:46.000]  He's a busy guy.
[19:46.420 --> 19:49.760]  Five minutes later, the subject was holy shit.
[19:51.420 --> 19:53.500]  In the body, it was, it's that easy?
[19:55.080 --> 19:56.080]  Alright, so there you go.
[19:56.220 --> 19:56.820]  Is it possible?
[19:57.040 --> 19:59.900]  I think we kind of covered, there's a possibility.
[20:00.800 --> 20:02.800]  Alright, we got something that's a possibility.
[20:03.680 --> 20:06.020]  Alright, so now I want to do a quick scenario-based exercise.
[20:08.980 --> 20:10.820]  Alright, the process, my process.
[20:11.100 --> 20:14.720]  And again, I'm one guy doing defense forensics in Wisconsin.
[20:14.980 --> 20:16.000]  I don't know how it is out here.
[20:16.120 --> 20:17.440]  I don't know how it is in a firm.
[20:17.600 --> 20:18.840]  But this is how it is for me.
[20:18.840 --> 20:20.100]  It starts with a phone call.
[20:20.480 --> 20:25.460]  And typically, there's an, if it's a CP case, there's an attorney on the other side apologizing to me.
[20:25.580 --> 20:26.320]  Well, I'm really sorry.
[20:26.420 --> 20:27.580]  I didn't want to bring you into this case.
[20:27.580 --> 20:29.540]  You know, it's a CP case.
[20:30.520 --> 20:30.920]  Alright.
[20:31.520 --> 20:33.880]  I determine whether or not I want to accept the job.
[20:33.980 --> 20:39.340]  And for me, because I have a primary job, I don't have to worry about the income.
[20:39.780 --> 20:40.880]  Which is really nice.
[20:40.920 --> 20:42.680]  Because I can say, don't have time.
[20:42.840 --> 20:44.000]  Sorry, find somebody else.
[20:44.860 --> 20:46.200]  Or I can accept the job.
[20:46.200 --> 20:49.080]  If I accept the job, typically they send me a case file.
[20:49.880 --> 20:51.820]  That case file is lots of reading.
[20:52.000 --> 20:57.040]  And I'm going to show you in another couple of screens, maybe the next screen, how many documents I have to read.
[20:57.240 --> 21:02.640]  If you're interested in computer forensics as a job, you better like reading reports.
[21:04.040 --> 21:06.000]  Because it's tons of reports.
[21:06.840 --> 21:10.440]  Then, I read those reports and I discuss the possibilities with the attorney.
[21:10.620 --> 21:12.640]  And this is very difficult, especially in CP.
[21:12.980 --> 21:14.580]  Especially when you're reading the reports.
[21:14.840 --> 21:15.880]  I don't know about you.
[21:16.020 --> 21:18.540]  Probably the average HOPE attendee doesn't trust the cops.
[21:19.100 --> 21:22.240]  I read those reports and I want to trust the cops.
[21:23.180 --> 21:26.100]  I don't anymore, but I want to trust them.
[21:26.240 --> 21:28.580]  I want to trust that what they're saying is factual.
[21:29.180 --> 21:31.780]  What I've learned is, well, I can't really trust that.
[21:31.840 --> 21:32.820]  I can't really trust that.
[21:32.860 --> 21:33.860]  I can't really trust that.
[21:34.880 --> 21:37.340]  And so I discuss the possibilities with the attorney.
[21:37.460 --> 21:38.780]  Do they have this guy dead to rights?
[21:38.920 --> 21:42.080]  Or is there something there that I can analyze and help them out?
[21:42.800 --> 21:44.480]  Then I have to conduct the exam.
[21:44.720 --> 21:46.080]  Now this may require travel.
[21:46.720 --> 21:51.080]  The last case I did, I had to go down to the Department of Criminal Investigations in Madison.
[21:51.300 --> 21:53.500]  That adds six hours of work onto my job.
[21:53.980 --> 21:58.780]  And the way I charge, whether I'm driving in the car or I'm doing forensics, same price.
[21:58.980 --> 21:59.980]  It's an hour of my life.
[22:00.980 --> 22:05.600]  So that gets very... you should understand if you're innocent and you're involved in one of these crimes.
[22:05.800 --> 22:07.840]  Or you're being prosecuted for one of these crimes.
[22:08.200 --> 22:10.920]  It's going to get very expensive very quickly.
[22:11.500 --> 22:14.080]  They don't allow you to have the drive anymore.
[22:14.520 --> 22:17.000]  They used to... I used to have the attorney get a copy of the drive.
[22:17.160 --> 22:22.500]  And I would leave it at his office and I would conduct my analysis there.
[22:22.500 --> 22:23.580]  I would build a lab there.
[22:23.920 --> 22:24.680]  Conduct the analysis.
[22:24.920 --> 22:26.080]  Maybe that would take a few days.
[22:26.320 --> 22:28.320]  And then I'd take my equipment down and he'd get a report.
[22:28.620 --> 22:30.400]  Now I have to drive to the crime lab.
[22:31.020 --> 22:33.020]  And then, of course, you're going to render a conclusion.
[22:33.680 --> 22:38.420]  So let's look if you were in my classroom or you're involved in a case, what that might look like.
[22:39.520 --> 22:39.880]  Alright.
[22:40.120 --> 22:41.200]  Client file documents.
[22:42.240 --> 22:44.800]  You might get correspondence between attorneys.
[22:45.040 --> 22:45.620]  Letters and emails.
[22:45.620 --> 22:55.080]  Many times, especially with the CP cases, one attorney gets the job and then figures, I don't know enough about this, and gets another attorney.
[22:55.520 --> 22:57.520]  And maybe that attorney gets another attorney.
[22:57.720 --> 23:00.740]  So you end up with, or I end up with, this pile of paperwork.
[23:00.900 --> 23:03.160]  This attorney, then it went to this attorney, then it went to this attorney.
[23:03.660 --> 23:05.700]  Supplement demand for discovery and inspection.
[23:06.180 --> 23:09.540]  Notice of final pretrial conference and 12-person jury trial.
[23:09.600 --> 23:12.040]  I'm reading this because it's small and you in the back probably can't see it.
[23:12.800 --> 23:13.920]  Motion for discovery.
[23:14.140 --> 23:14.620]  Information.
[23:14.860 --> 23:16.500]  Request for substitution of judge.
[23:16.680 --> 23:17.760]  Criminal complaint and warrant.
[23:17.980 --> 23:19.220]  I use that one a lot.
[23:20.860 --> 23:21.700]  Search warrant.
[23:21.940 --> 23:22.940]  I use that one a lot.
[23:23.600 --> 23:24.780]  Affidavit for search warrant.
[23:25.200 --> 23:26.000]  Case reports.
[23:26.880 --> 23:29.740]  Investigative reports, which are type-recorded interviews.
[23:30.840 --> 23:31.320]  Stipulation.
[23:31.460 --> 23:31.840]  Oh, let's see.
[23:31.920 --> 23:33.400]  Search warrant with charge report.
[23:33.660 --> 23:35.000]  Stipulation and order on discovery.
[23:35.080 --> 23:37.960]  Order on discovery, criminal complaint and treatment evaluation.
[23:38.460 --> 23:40.600]  What do I want you to get out of all that?
[23:42.100 --> 23:43.320]  Well, that's one thing.
[23:43.460 --> 23:44.200]  It's a lot of reading.
[23:44.440 --> 23:47.020]  Number two, whether you're guilty or innocent...
[23:47.020 --> 23:48.140]  Yeah, it's going to cost you some money.
[23:48.620 --> 23:52.620]  Whether you're guilty or innocent, I'm going to know things about you I don't want to know about you.
[23:53.680 --> 23:55.640]  Your attorney's going to know things about you.
[23:55.800 --> 23:57.620]  You see that treatment evaluation?
[23:59.260 --> 24:03.500]  That's you went in to talk to somebody about your sexual habits.
[24:04.400 --> 24:05.380]  I'm not interested.
[24:06.080 --> 24:07.560]  But it's all in there.
[24:07.820 --> 24:17.320]  So understand, whether you're guilty or not guilty, all that stuff goes to your attorney, goes to the forensic examiner, etc., or may go to them.
[24:18.340 --> 24:23.360]  Another very interesting thing that I think you will find interesting is that investigative reports.
[24:23.420 --> 24:39.120]  I recently did a case where typed, the typed recorded interview, so you understand, the piece of paper I'm reading that has the words that were said, typed, said, the defendant said he liked young women.
[24:40.380 --> 24:44.620]  The actual recording said he liked young-looking women.
[24:45.040 --> 24:48.160]  I like young-looking women versus I like young women.
[24:48.360 --> 24:50.860]  There is a huge difference there.
[24:51.040 --> 24:56.300]  So if you're ever involved in a case, make sure, and this is why I can't trust it anymore.
[24:56.400 --> 24:58.800]  This is why I want to trust it, but I can't trust it.
[24:58.800 --> 25:04.100]  Make sure that you're reading everything that's typed and you're validating everything that's on the recording.
[25:04.480 --> 25:10.460]  Luckily, the attorney that read that document knew what was going on and read it and validated it.
[25:10.760 --> 25:11.040]  All right.
[25:11.320 --> 25:14.600]  So now we're going to get into an examination or prep for an examination.
[25:15.920 --> 25:20.320]  From all those documents, you can create an examination plan.
[25:20.520 --> 25:21.560]  I have to do this now.
[25:21.640 --> 25:26.620]  And those of you that are involved in forensics or have been watching any forensics talk, you might hear the term sniper forensics.
[25:27.460 --> 25:31.420]  It's almost imperative that you do that now, especially if you have to travel.
[25:31.540 --> 25:38.740]  If I have to go down to Madison to do an examination, I want to know everything that I'm going to go for at the time I'm going to go for it right away.
[25:40.280 --> 25:53.120]  So in our fictitious case here, the case is going to revolve around the program Frostwire, which is now the predecessor to Limewire or is after Limewire.
[25:53.220 --> 25:53.940]  It used to be Limewire.
[25:54.080 --> 25:55.160]  Now it's called Frostwire.
[25:56.160 --> 25:59.140]  We're going to know that there was more than one system investigated.
[25:59.660 --> 26:02.580]  So we need to know which one of the systems has the illegal content.
[26:02.580 --> 26:06.000]  I was worried when I went down to the Department of Criminal Investigations.
[26:06.220 --> 26:11.280]  They're going to have all these drives and I'm going to have to analyze every one of them to find the one I'm interested in.
[26:11.780 --> 26:15.660]  And I asked the examiner there, I said, can you tell me...
[26:15.660 --> 26:16.980]  because I didn't know if he could tell me or not.
[26:17.140 --> 26:20.220]  Can you tell me which one of these drives is the one that's on the criminal complaint?
[26:20.340 --> 26:21.200]  And he picked it up and handed me.
[26:21.240 --> 26:22.460]  I was like, that saved me half an hour.
[26:23.520 --> 26:24.860]  I'm interested in saving money.
[26:26.160 --> 26:31.400]  It will also tell you file names, paths, files created, last accessed, last written description and hash value.
[26:32.740 --> 26:34.760]  I don't tend to read the descriptions.
[26:35.320 --> 26:37.200]  I don't care what's in the file.
[26:37.600 --> 26:44.520]  From a forensic standpoint I'm there to see, was this file opened, can I tell when it was opened, etcetera.
[26:44.740 --> 26:46.240]  I don't care what's in the file.
[26:46.480 --> 26:51.900]  If you don't have a thick stomach, don't read the descriptions in these files.
[26:52.080 --> 26:56.880]  They are awful, what these people do to kids and what these videos are and what these images are.
[26:57.040 --> 26:58.580]  So I try not to read them.
[27:01.200 --> 27:10.620]  Alright, we have to talk a little bit about the law because in order to know what we have to go to and what we want to prove, we have to know what the law states.
[27:10.960 --> 27:12.980]  Again, none of us... well, some of you might be lawyers.
[27:13.040 --> 27:13.700]  I'm not a lawyer.
[27:14.840 --> 27:16.200]  Most likely you're not a lawyer.
[27:16.380 --> 27:29.040]  But Wisconsin law states that the person knows that he or she possesses, the person knows the character and content, the person knows or reasonably should know, whoever does any of the following with knowledge.
[27:29.340 --> 27:33.760]  So when I analyze these systems, I'm looking for knowledge.
[27:33.760 --> 27:36.600]  I have to have proof that this person knew that they did it.
[27:36.780 --> 27:39.440]  So that's what we're looking for when we go to analyze these systems.
[27:39.520 --> 27:40.960]  Now let's take a look at a typical case.
[27:41.780 --> 27:42.700]  Evaluating the case.
[27:43.020 --> 27:43.900]  We have a fact.
[27:44.200 --> 27:45.720]  Illegal content was on the drive.
[27:46.400 --> 27:47.260]  That's a fact.
[27:47.520 --> 27:48.700]  This is how it works.
[27:49.300 --> 27:52.160]  You get caught with illegal content... I'll take questions after if you don't mind.
[27:52.160 --> 27:54.880]  You get caught with illegal content on your drive.
[27:55.960 --> 27:59.900]  Typically, the police already have a hash value of the file that's on your drive.
[28:00.100 --> 28:04.660]  And that hash value goes back to a database, and that database is of illegal content.
[28:04.920 --> 28:06.620]  And they know it's illegal content.
[28:06.860 --> 28:08.920]  You're not going to argue that it's not illegal content.
[28:10.580 --> 28:13.600]  Can we prove if it was intentionally or unintentionally got there?
[28:13.740 --> 28:14.040]  How?
[28:14.040 --> 28:16.260]  You remember earlier the screen?
[28:16.940 --> 28:17.980]  It's possible.
[28:18.240 --> 28:20.540]  So now we have to know, how is that done?
[28:20.680 --> 28:21.440]  How did that happen?
[28:21.740 --> 28:25.040]  Can we prove that they intentionally did it or could it have been a mistake?
[28:25.400 --> 28:27.160]  I got a couple opinions here.
[28:27.660 --> 28:30.380]  The opinions are the prosecutor's opinions.
[28:30.820 --> 28:32.400]  Defendant knew the files existed.
[28:32.620 --> 28:33.780]  Defendant viewed the files.
[28:33.780 --> 28:43.080]  And the reason those are opinions is because when I get the criminal complaint, it basically lists typically ten files or under.
[28:44.000 --> 28:49.000]  These are the files, and these are the access dates, and that's it.
[28:49.360 --> 28:50.220]  No analysis.
[28:50.640 --> 28:52.820]  No we check this and this and this and this.
[28:53.000 --> 28:54.340]  That's what they prosecute on.
[28:54.420 --> 28:57.420]  Go get yourself an attorney and come back with something else.
[28:57.520 --> 29:01.480]  They may do an additional analysis, but they're going to prosecute on that one piece of paper.
[29:01.480 --> 29:07.500]  So we're going to look to see if there's evidence to substantiate these claims and how are we going to substantiate them.
[29:07.780 --> 29:08.000]  All right.
[29:08.500 --> 29:09.340]  Intentional download.
[29:09.740 --> 29:10.220]  Right?
[29:10.360 --> 29:13.100]  We saw that it's possible that it might not have been intentional.
[29:13.820 --> 29:26.600]  In every case I've done, there has been a long, in these long documents, there has been a statement from about, typically it's about the prosecutor's expert, and it says this.
[29:28.100 --> 29:40.160]  This person, I redacted the name, knows through training and experience that a digital file's name, a digital file's name, file name, does not in every case accurately identify its contents.
[29:40.660 --> 29:48.000]  And what they're trying to do, they've used hash values, and what they're trying to say is, we have this hash value, this hash value's on your computer.
[29:49.160 --> 29:51.580]  We don't care what the file name says it is.
[29:51.820 --> 29:54.320]  It's illegal content, because we have a hash value.
[29:54.480 --> 29:55.280]  And they're right.
[29:55.640 --> 29:57.420]  They've got a hash value of illegal content.
[29:57.600 --> 29:59.940]  They've proven in another jurisdiction that it's illegal.
[30:00.280 --> 30:01.420]  It's illegal content.
[30:02.340 --> 30:07.300]  What I like to do is say, all right, then I ought to be able to say the same thing.
[30:07.300 --> 30:17.060]  If there's a file name that blatantly is illegal content based upon the file name, it may not be illegal content.
[30:17.540 --> 30:20.320]  It may be two kittens.
[30:20.580 --> 30:21.420]  I don't know what it is.
[30:21.560 --> 30:22.500]  It's a file name.
[30:22.820 --> 30:23.380]  All right?
[30:23.620 --> 30:25.720]  So we can't use file names.
[30:25.820 --> 30:27.800]  Basically what I'm saying there is you can't use a file name.
[30:29.360 --> 30:30.740]  So we have a possibility.
[30:31.160 --> 30:36.140]  Is it possible that a legitimate search provided an illegal result?
[30:36.140 --> 30:38.180]  I want you to think about this.
[30:39.540 --> 30:49.200]  So I believe, in many cases, a search history will show intent.
[30:49.660 --> 30:53.780]  Now, there's cases where malware modified your search history.
[30:53.900 --> 30:55.900]  There's cases where somebody else was using the computer.
[30:56.020 --> 30:57.380]  Notice I didn't say the defendant.
[30:57.860 --> 30:58.580]  All right?
[30:58.800 --> 31:02.000]  But I believe, generally, search history will show intent.
[31:02.000 --> 31:08.820]  But, if you find the search term, falcon, was someone looking for the bird or the teen?
[31:10.200 --> 31:19.180]  So, is it possible that using search terms, general search terms, will provide illegal results?
[31:19.180 --> 31:21.580]  I think the answer is yes.
[31:22.200 --> 31:30.220]  If you were searching, a lot of young men in the audience, if you were searching for the word porn, might you end up with kiddie porn?
[31:31.360 --> 31:38.140]  But, if you were searching for terms specific to kiddie porn, you were probably looking for kiddie porn.
[31:38.760 --> 31:40.140]  And at that point, I'm done.
[31:40.300 --> 31:40.520]  Right?
[31:40.700 --> 31:42.400]  I might look and say, well, was it malware?
[31:42.560 --> 31:45.020]  Was the defendant logged on to another site?
[31:45.160 --> 31:46.220]  Was he logged into his email?
[31:46.400 --> 31:46.720]  Et cetera.
[31:47.160 --> 31:47.460]  All right.
[31:47.620 --> 31:49.840]  And then I get a hold of the attorney and say, I'm done with this one.
[31:49.900 --> 31:51.100]  I don't need to go any further.
[31:52.100 --> 31:54.980]  If I can't find search history, well, then we have to move on.
[31:55.700 --> 32:01.940]  So, if we find very specific search terms, looking for illegal content, barring malware, other user, et cetera, we might find intent.
[32:02.180 --> 32:03.700]  So, let's start there.
[32:05.660 --> 32:09.440]  But the Frost Wire program, search history, is not saved on exit.
[32:10.120 --> 32:12.880]  Well, that's problematic for us, if you're innocent.
[32:14.760 --> 32:16.500]  Was the system on when seized?
[32:16.500 --> 32:19.500]  So, now I have to go back to that list of documents.
[32:19.800 --> 32:24.180]  And I have to find out, when they seized this computer, was it on a state of on?
[32:24.840 --> 32:27.120]  Was the search history photograph, right?
[32:27.380 --> 32:40.300]  If they know, and they do, we're going to go confiscate this computer because we've searched the LimeWire network and found illegal content on that computer, then they ought to know they're going for LimeWire.
[32:40.480 --> 32:46.980]  And they ought to know, because they're supposed to be experts, LimeWire doesn't save its search history, and search history should show intent.
[32:47.300 --> 32:54.100]  So, before you shut the system down or hibernate it or unplug it, click, you know, take a picture of the search history.
[32:54.180 --> 32:56.100]  I'm going to be looking for that in their report.
[32:56.720 --> 32:58.040]  Was the RAM imaged?
[32:58.180 --> 33:00.340]  Anybody in here does computer forensics?
[33:00.760 --> 33:03.640]  You've probably heard about imaging the RAM, right?
[33:03.720 --> 33:04.520]  We've got to image the RAM.
[33:04.600 --> 33:07.960]  If the RAM was imaged, then I have what's up in the search history.
[33:08.740 --> 33:10.300]  Maybe the system was hibernated.
[33:10.480 --> 33:12.640]  In that case, I can look at the hibernation file.
[33:12.720 --> 33:15.360]  And I can, I might be able to extract the search history from there.
[33:15.360 --> 33:17.700]  And this is a needle in a haystack.
[33:18.320 --> 33:21.260]  Maybe the RAM was written to the page file at some point in time.
[33:21.460 --> 33:23.440]  I've never even done that analysis.
[33:24.520 --> 33:25.000]  Alright?
[33:25.160 --> 33:27.760]  So we have all these, all these possibilities.
[33:30.320 --> 33:31.500]  From the search warrant.
[33:31.760 --> 33:37.380]  As a result of the search warrant, several items of electronic storage, medical, or media equipment was located.
[33:37.380 --> 33:39.860]  But there's no mention of state, on or off.
[33:39.980 --> 33:42.220]  There's no mention of conducting a live analysis.
[33:42.520 --> 33:44.800]  In fact, I've talked to prosecutors in my area.
[33:44.940 --> 33:47.540]  And they wouldn't, they, they, they look at me and they say, live analysis?
[33:47.700 --> 33:48.060]  What's that?
[33:48.200 --> 33:48.900]  Image RAM?
[33:49.200 --> 33:50.560]  I've never seen that in a report.
[33:51.060 --> 33:54.240]  So in my area of the country, they're not doing that.
[33:54.720 --> 33:56.260]  I don't know if they're doing it out here.
[33:57.100 --> 34:04.260]  But now, potentially evidence that proves my client, the attorney's client, innocent, is gone.
[34:05.020 --> 34:07.000]  Because they didn't do the seizure properly.
[34:09.260 --> 34:13.100]  So we gotta think, alright, well, let's see if we can prove that the files were viewed.
[34:15.480 --> 34:19.560]  One of the things I'm gonna do is, how does the person typically view files?
[34:19.980 --> 34:20.380]  Right?
[34:20.580 --> 34:22.920]  I wanna look and say, how's this computer typically used?
[34:23.100 --> 34:30.960]  And, and we might look at the registry most recently used entries, or recent file list entries, to find out, alright, how do they open a JPEG?
[34:31.020 --> 34:32.920]  How do they open a MP3 file?
[34:32.920 --> 34:34.440]  How do they open an MP4 file?
[34:34.640 --> 34:36.280]  So we're gonna, we're gonna wanna know that.
[34:37.840 --> 34:43.480]  Possibility, from knowing that is, the file names exist in the registry, or the file names don't exist in the registry.
[34:43.600 --> 34:45.180]  We got, we got on or off there.
[34:45.320 --> 34:45.680]  Simple.
[34:46.420 --> 34:56.320]  If the illegal files that are on the criminal warrant are in the registry, barring someone else accessed the files, we're done.
[34:56.500 --> 34:56.600]  Right?
[34:56.720 --> 34:57.180]  There they are.
[34:57.940 --> 35:07.840]  If the file names aren't in the registry, the file names in question are not listed, they could have been accessed too long ago, or accessed in some other fashion, or not accessed.
[35:08.760 --> 35:13.200]  So we go into the registry, and we have a fact.
[35:13.340 --> 35:25.100]  After a Windows registry examination, it was found that the type and, the files of the type in question were recently accessed using typical Windows programs, but the files in question were not listed.
[35:25.340 --> 35:26.540]  So what does that tell us?
[35:26.740 --> 35:34.240]  That says, this is how he opens JPEGs, but the particular JPEGs that he's being prosecuted are, are not in there.
[35:34.800 --> 35:36.380]  We have a little bit more evidence.
[35:36.800 --> 35:40.340]  A search of the registry was performed, and none of the files in question were found.
[35:40.340 --> 35:43.340]  Well, now we, we know some things.
[35:44.220 --> 35:45.740]  We have some possibilities.
[35:46.900 --> 35:52.040]  The files in question were not recently accessed, not accessed at all, or accessed in some other manner.
[35:52.680 --> 35:54.360]  Now let's talk about probability.
[35:56.500 --> 36:00.560]  The probability is the files were not accessed recently or not accessed at all.
[36:00.720 --> 36:07.080]  How many normal users go out of their way to access certain content in an entirely different manner than all the other content on their system?
[36:07.080 --> 36:11.960]  I open cats with this program, but dog JPEGs I open with this program.
[36:13.460 --> 36:14.780]  It's not probable.
[36:16.180 --> 36:19.520]  So, we're getting closer to some answers here.
[36:21.660 --> 36:23.660]  So let's talk about FrostWire downloads.
[36:24.220 --> 36:31.660]  One of the things that you absolutely have to understand if you're going to get into computer forensics is, you have to know everything about everything, which isn't possible.
[36:32.160 --> 36:41.320]  So when you get a case, you're going to get a program, and if you aren't, if you don't know what that program is, or how it works, you have to hope and pray somebody's written a beautiful white paper.
[36:42.100 --> 36:46.340]  Otherwise, you have to do all the analysis, figure out how it works, where it saves things.
[36:47.280 --> 36:58.260]  Luckily, there are some FrostWire white papers out there, and we went out and read them, and we found that the download directory for FrostWire can be found in the directory for saving files entry in the frostwire.props file.
[36:58.260 --> 36:59.980]  Now we know, okay, good.
[37:00.080 --> 37:01.680]  We can find out what the download directory is.
[37:01.760 --> 37:02.900]  Well, why would we want to do that?
[37:03.320 --> 37:04.640]  Because we have a possibility.
[37:05.540 --> 37:16.100]  If the files are located in the default download directory for FrostWire, and the files were downloaded in mass, remember our shift click, or a highlight everything and download it?
[37:16.980 --> 37:18.420]  They may never have been viewed.
[37:19.280 --> 37:20.820]  Do I really only have ten minutes?
[37:21.960 --> 37:23.820]  I was going to say, I mean, there's nobody after me.
[37:26.380 --> 37:27.760]  You guys want to stay.
[37:28.340 --> 37:28.760]  All right.
[37:29.600 --> 37:31.220]  So, so how do we determine this?
[37:31.440 --> 37:36.800]  Well, we might have to look at the created access to written timestamps, the registry entries, recent files, link files, et cetera.
[37:37.020 --> 37:38.800]  We've got a lot of evidence that we can look at.
[37:38.900 --> 37:40.600]  So let's take a look at that evidence.
[37:41.680 --> 37:43.340]  Now this is what I get from them.
[37:43.520 --> 37:45.160]  You're only going to see two files.
[37:45.300 --> 37:47.860]  So you understand there's only, I can't scroll it down.
[37:47.980 --> 37:48.520]  Two files.
[37:48.520 --> 37:54.000]  What I get typically is ten files, and they have the created access to written timestamps.
[37:54.760 --> 37:56.120]  Now that doesn't tell you a lot.
[37:56.220 --> 37:57.840]  When you look at that, it's hard to see.
[37:57.980 --> 38:03.800]  But if I change the way that is, you'll see the file created and the file access.
[38:03.920 --> 38:06.080]  Now I want you to look at the file access time there.
[38:06.280 --> 38:09.580]  The file access time is one second away from each other.
[38:09.840 --> 38:14.700]  Now when you're looking at two files, and I did it large so you can see it, that's not a big deal.
[38:14.700 --> 38:24.880]  But if you were looking at 50 or 100 files, how is it possible to open one up, view it, close it, and open another one up?
[38:25.000 --> 38:27.280]  And view it and close it and do that 50 times.
[38:27.420 --> 38:28.820]  Anybody in here think they can do that?
[38:29.840 --> 38:30.360]  Antivirus?
[38:31.100 --> 38:31.620]  Yep.
[38:31.820 --> 38:32.540]  There you go.
[38:32.680 --> 38:33.800]  If you want a t-shirt.
[38:34.240 --> 38:34.880]  What size?
[38:35.600 --> 38:36.120]  Medium.
[38:36.120 --> 38:36.580]  Medium.
[38:36.580 --> 38:36.700]  Medium.
[38:36.820 --> 38:38.240]  I think the only medium I got.
[38:38.400 --> 38:38.480]  Medium.
[38:40.920 --> 38:43.240]  If he wants to be a medium, he can be a medium.
[38:43.960 --> 38:44.860]  He'll have muscles.
[38:45.100 --> 38:45.280]  Alright.
[38:47.460 --> 38:47.860]  Probability.
[38:48.720 --> 38:49.780]  Rule number five.
[38:50.160 --> 38:53.980]  Now this is out of the rule time for NTFS file systems.
[38:54.160 --> 38:56.660]  By the way, this is only good for Windows XP.
[38:57.980 --> 38:58.780]  Windows 7...
[38:58.780 --> 38:59.780]  Well, let me ask you this.
[38:59.780 --> 39:03.400]  What does it tell you?
[39:03.500 --> 39:06.440]  What does a file date time stamp tell you?
[39:08.420 --> 39:09.280]  Not much.
[39:09.460 --> 39:10.160]  How it's saved.
[39:10.360 --> 39:11.660]  Neither is the answer I want to hear.
[39:15.590 --> 39:16.610]  How to manipulate the file.
[39:16.610 --> 39:17.710]  The word that...
[39:17.710 --> 39:19.210]  And what, you get extra large?
[39:21.290 --> 39:21.750]  Sorry.
[39:22.710 --> 39:23.610]  Squeeze into it.
[39:23.730 --> 39:24.570]  You'll be like this guy.
[39:26.290 --> 39:28.470]  The correct answer is it depends.
[39:28.790 --> 39:29.950]  What is the operating system?
[39:30.090 --> 39:31.290]  What are the default settings?
[39:31.290 --> 39:34.530]  You know, it depends on what an access date time stamp is.
[39:34.610 --> 39:38.290]  So in my presentation, we're going with an average user with a default system.
[39:38.430 --> 39:40.010]  And this happens to be Windows XP.
[39:41.270 --> 39:50.670]  If an image video file with a folder with close access times, and no other images have similar access times on the concerned image video, files are likely to be accessed or opened by a previewing tool.
[39:51.050 --> 39:53.490]  Example, Windows Explorer for thumbnail for previewing.
[39:53.610 --> 39:54.930]  So now we have an answer.
[39:55.130 --> 39:55.370]  Why?
[39:55.530 --> 39:57.270]  Oh, the prosecution would say he accessed them.
[39:57.430 --> 40:00.530]  The access times are different from the modified and created.
[40:00.530 --> 40:02.630]  And now we see, well, wait a minute.
[40:02.850 --> 40:03.950]  They're a second apart.
[40:04.170 --> 40:06.250]  And whoever said ant, somebody say antivirus.
[40:06.410 --> 40:10.930]  I've done cases where the entire drive was minutes apart.
[40:11.150 --> 40:15.350]  And antivirus has to access the file to see if there's malware in it.
[40:15.590 --> 40:17.630]  So the access date doesn't mean anything then.
[40:18.810 --> 40:19.450]  All right.
[40:19.770 --> 40:20.730]  So a fact.
[40:21.090 --> 40:28.570]  The examination of the system found a ThumbsDB file located in the directory in question, supporting the uses of Windows Explorer accessing the files.
[40:28.630 --> 40:29.390]  We've got another fact.
[40:29.570 --> 40:30.850]  But let's go on from that.
[40:31.370 --> 40:33.130]  What about Filmstrip View?
[40:33.570 --> 40:33.870]  Right?
[40:33.990 --> 40:35.570]  Because I've got to think like the prosecution.
[40:37.730 --> 40:44.430]  Subdirectories created by a user do not contain Filmstrip View menu choice in the view menu of each folder by default.
[40:44.430 --> 40:47.110]  So you have to understand, you know, everybody knows Filmstrip View, right?
[40:47.290 --> 40:48.890]  A little icon down here, big picture.
[40:49.030 --> 40:50.470]  Well, maybe that's how he did it.
[40:51.270 --> 40:52.710]  So I analyzed the system.
[40:52.890 --> 40:56.650]  Well, Filmstrip View isn't in a default.
[40:56.990 --> 40:58.450]  It's only in default directories.
[40:58.490 --> 40:59.610]  This isn't a default directory.
[40:59.710 --> 41:02.210]  Therefore, Filmstrip View won't be there by default.
[41:02.210 --> 41:03.730]  I should look to see if it was there.
[41:04.110 --> 41:05.270]  So it can be added.
[41:06.090 --> 41:07.270]  Let's go see if it was added.
[41:08.850 --> 41:09.250]  Fact.
[41:09.430 --> 41:12.390]  Folder type photo album was not found in the HKU registry keys.
[41:12.970 --> 41:17.550]  So now we say, all right, well, we don't have to go any further with Filmstrip View because it wasn't in there.
[41:17.730 --> 41:19.190]  He didn't have Filmstrip View in that.
[41:19.370 --> 41:20.110]  We got a fact.
[41:21.610 --> 41:22.010]  Possibility.
[41:22.230 --> 41:25.110]  The user viewed the images by looking at the thumbnail views.
[41:28.470 --> 41:28.870]  Okay?
[41:29.090 --> 41:30.090]  Hey, it's a possibility.
[41:30.870 --> 41:32.290]  Let's look at the reality of that.
[41:33.010 --> 41:38.870]  If there were 5,000 images in a folder, what's the possibility that the 10 illegal ones were viewed through thumbnail images?
[41:40.550 --> 41:42.830]  Two thousandths of a percent, if you can do the math.
[41:43.990 --> 41:44.450]  All right?
[41:44.550 --> 41:45.790]  And I've come up with that.
[41:45.890 --> 41:54.870]  For those of you that think, well, if I'm out surfing porn and I end up with two images and I got 10,000 on my computer, nobody would ever prosecute me for those two images.
[41:55.190 --> 41:55.950]  Think again.
[41:59.200 --> 41:59.680]  All right.
[41:59.680 --> 42:00.520]  The evidence as a whole.
[42:00.680 --> 42:01.080]  Possibility.
[42:01.160 --> 42:08.060]  The possibility that the search history would show intent, but because of the way the program works or the seizure of the evidence, we can't provide a conclusion.
[42:10.520 --> 42:10.920]  Probability.
[42:11.180 --> 42:22.980]  Because of the lack of the file names in the registry and likely that the files were not accessed recently or accessed at all, the files could not have been clearly viewed through thumbnail images and it's unlikely that they were purposely viewed at all.
[42:23.180 --> 42:24.880]  We're looking at two thousandths of a percent.
[42:26.060 --> 42:26.620]  Fact.
[42:27.040 --> 42:34.700]  The evidence of the ThumbsDB file supports the access times modification by the Windows Explorer, the lack of the folder type photo album in the HKU registry.
[42:35.040 --> 42:38.660]  The conclusion is that the files were not clearly viewed through Windows Explorer.
[42:40.720 --> 42:43.040]  In my expert opinion, blah, blah, blah.
[42:43.740 --> 42:48.280]  So that's typically how a case will... how I'll handle a case.
[42:50.000 --> 42:50.640]  All right.
[42:50.640 --> 42:52.580]  Let's talk about the cost of evidence.
[42:53.200 --> 42:54.680]  I'm in a cheap area of the country.
[42:55.140 --> 42:56.560]  You're going to get in trouble.
[42:57.240 --> 43:00.320]  The attorney I work for says, yeah, it's not bad to do it here.
[43:01.060 --> 43:07.120]  Typical case in my area of the country, little old Green Bay, Wisconsin, about $25,000 if it goes to court.
[43:09.220 --> 43:12.700]  Expect two to four times that in other areas of the country, $50,000 to $100,000.
[43:12.960 --> 43:15.280]  Some cases have exceeded $250,000.
[43:15.840 --> 43:18.780]  There are people's lives that are ruined that are innocent.
[43:19.040 --> 43:21.460]  And there is no way for them to recoup that money.
[43:21.780 --> 43:25.380]  Which is why two years ago, I said, we need a computer crime innocence project.
[43:27.100 --> 43:28.720]  That's not the only thing you're going to pay with.
[43:28.840 --> 43:29.080]  Time.
[43:29.240 --> 43:31.480]  Recent case I was involved with spanned one and a half years.
[43:31.660 --> 43:32.360]  Think about that.
[43:32.540 --> 43:35.620]  You're innocent, and this is over your head for a year and a half.
[43:35.860 --> 43:37.160]  Or you're kind of guilty.
[43:38.220 --> 43:40.500]  Others I've been involved with have spanned three years.
[43:40.660 --> 43:50.420]  The Julia Merrill case, for those of you that are familiar with that, this was a school teacher that had porn pop-ups show up on her screen, and she was prosecuted and convicted.
[43:52.580 --> 43:54.460]  Her case lasted four years.
[43:55.440 --> 44:10.440]  Until finally some forensic experts came to her defense and said, this... believe it or not, the program that the officer used to analyze the computer, the company that wrote that program said, that program's not used for that.
[44:10.440 --> 44:13.080]  They still prosecuted her.
[44:14.380 --> 44:14.980]  All right.
[44:15.300 --> 44:16.500]  Your reputation is shot.
[44:16.700 --> 44:19.740]  Even if you're innocent, the damage to your reputation can be immeasurable.
[44:20.000 --> 44:25.860]  Again, this is one of those crimes nobody wants to deal with from a CP standpoint.
[44:27.180 --> 44:32.520]  You're guilty until proven innocent, and sometimes people will just say, well, we never know.
[44:33.260 --> 44:34.640]  A kind of guilty and plea.
[44:34.640 --> 44:35.780]  So you're kind of guilty.
[44:36.980 --> 44:40.060]  You've searched... you searched the Internet for porn and you found some.
[44:40.540 --> 44:43.840]  And you don't realize that you now have illegal content on your drive.
[44:44.360 --> 44:46.960]  And someone finds the illegal content on a drive.
[44:47.200 --> 44:55.860]  Now, I doubt anybody in here would bring their computer to Best Buy to have Geek Squad fix it, but if you did and they saw illegal content, they're not calling you to pick up your computer.
[44:55.860 --> 44:57.180]  They're calling the police.
[44:58.080 --> 44:58.580]  All right.
[44:59.900 --> 45:03.240]  Prison time, probation, fine, sex offender registry list.
[45:03.560 --> 45:05.140]  Your life as you know it is over.
[45:08.100 --> 45:08.640]  I'm done.
[45:08.820 --> 45:09.820]  I want to thank my college.
[45:10.040 --> 45:11.120]  They helped send me out here.
[45:11.240 --> 45:12.140]  So I really appreciate that.
[45:12.260 --> 45:14.080]  I want to thank the HOPE Selection Committee.
[45:14.240 --> 45:15.380]  And I want to thank everybody.
[45:15.480 --> 45:16.240]  I can't believe...
[45:16.240 --> 45:17.520]  I love it that the room is full.
[45:18.160 --> 45:20.220]  Stayed out till midnight to listen to me speak.
[45:20.220 --> 45:24.060]  And there's some contact information.
[45:24.060 --> 45:24.960]  And I'll take questions.
[45:25.700 --> 45:26.060]  Yes, sir.
[45:33.660 --> 45:34.820]  I have not.
[45:35.140 --> 45:35.660]  Nope.
[45:35.780 --> 45:41.700]  The question was, have I ever encountered a CP honeypot where there would be hashed values with collisions?
[45:41.880 --> 45:42.560]  And they...
[45:43.620 --> 45:44.640]  No, I have not.
[45:45.100 --> 45:46.980]  They will not release that database.
[45:46.980 --> 45:49.720]  So for anybody to build that, it would have to be the government.
[45:50.160 --> 45:56.140]  And the government, I can't believe, would want to build non-CP files that have the hash values.
[45:56.220 --> 45:57.920]  Because it wouldn't do them any good in a prosecution.
[46:03.120 --> 46:04.100]  That's very good.
[46:04.620 --> 46:14.420]  The criminal examiner that finds that file will view that file because they type up the description and they would know now it's a hash collision.
[46:14.560 --> 46:16.980]  So you shouldn't have anything to worry about.
[46:17.360 --> 46:29.380]  If they're not doing their job, if their in-case program is looking at the hash database and it's got a built-in description and they never view it, you would have to then have somebody view it.
[46:29.460 --> 46:30.900]  And that brings something up.
[46:31.040 --> 46:32.200]  I don't view the images.
[46:33.640 --> 46:35.100]  That's somebody else's job.
[46:35.320 --> 46:39.360]  So if there was a hash collision, well, now that's something more for me to think about.
[46:48.560 --> 46:53.160]  In my state it happened probably, it was the last hope.
[46:53.260 --> 46:53.720]  It's federal.
[46:54.200 --> 46:54.640]  What's that?
[46:54.740 --> 46:56.060]  Adam Walsh Child Protection Act.
[46:56.260 --> 46:58.420]  The Adam Walsh Child Protection Act did that?
[46:58.800 --> 46:59.140]  Yeah.
[46:59.600 --> 47:00.820]  Is that two years ago?
[47:01.100 --> 47:03.180]  More like four and a half or five years ago.
[47:03.300 --> 47:06.100]  Five years ago I was getting drives in the state of Wisconsin.
[47:06.240 --> 47:06.400]  Okay.
[47:06.400 --> 47:07.780]  So in the state...
[47:07.780 --> 47:15.020]  In federal cases, no matter what the rule about experts says, you're not going to get the drive.
[47:15.180 --> 47:15.940]  Not anymore.
[47:16.160 --> 47:16.520]  Not anymore.
[47:16.640 --> 47:17.400]  So much for equal protection.
[47:17.580 --> 47:17.980]  Yeah, yeah.
[47:18.080 --> 47:18.700]  Is it only for CP?
[47:19.340 --> 47:21.220]  Well, right now it's only for CP.
[47:22.140 --> 47:24.340]  The reason for it is they don't want...
[47:25.340 --> 47:25.780]  They're...
[47:26.300 --> 47:27.980]  I was just called to testify.
[47:28.500 --> 47:30.080]  And I used...
[47:30.080 --> 47:46.720]  I looked at the prosecutor's, or I should say the examiner's report, and the examiner's report said, we can't conduct an analysis at the home of the defendant because we need special equipment to analyze the computer.
[47:46.960 --> 47:57.080]  So I took all the quotes that said the police aren't going to do an analysis at their home, and I gave them to the attorney to tell to the judge, I can't do it at the crime lab.
[47:57.240 --> 47:58.520]  I've got to do it in my lab.
[47:58.860 --> 48:00.120]  And the judge wouldn't hear it.
[48:00.120 --> 48:02.160]  In fact, they held the...
[48:05.720 --> 48:06.940]  I can't remember what it's called.
[48:08.040 --> 48:12.600]  And I was ready to testify and ready to be called, and he said, no, we're not doing it.
[48:12.660 --> 48:15.560]  And he told the prosecutor, you will give them everything they need.
[48:15.680 --> 48:20.880]  And he told the attorney, you and your expert will do everything you need at the Department of Criminal Investigation.
[48:21.060 --> 48:22.080]  So I had to do it there.
[48:22.860 --> 48:23.180]  Yes, sir?
[48:23.360 --> 48:25.600]  How often do you have federal cases versus state?
[48:25.600 --> 48:27.080]  I have never had a federal case.
[48:27.300 --> 48:28.100]  I am told...
[48:28.100 --> 48:29.940]  When I went down to the crime lab, I was nervous.
[48:30.120 --> 48:31.240]  I'm going to admit it to you.
[48:31.480 --> 48:35.340]  I told the attorney, I said, I've never done an analysis at the Department of Criminal Investigation.
[48:35.360 --> 48:36.720]  I've got no idea what's going to happen.
[48:37.140 --> 48:39.660]  Well, I showed up, and I was like, is this guy going to be behind me?
[48:40.320 --> 48:40.700]  You know?
[48:40.840 --> 48:43.220]  Am I going to have to sit there and worry about every key I type?
[48:45.060 --> 48:48.240]  And he set up the room for me and said, is that chair okay?
[48:48.280 --> 48:49.560]  Would you like a more comfortable chair?
[48:49.640 --> 48:52.760]  I was like, oh, this is nothing like what I thought it was going to be.
[48:52.980 --> 48:54.740]  I said, you're not going to stay in here with me?
[48:54.740 --> 48:55.340]  And then he said, no.
[48:55.600 --> 48:59.280]  But if it was a federal crime, the FBI would be sitting behind you, so...
[48:59.280 --> 48:59.980]  Well, actually, they wouldn't.
[49:00.080 --> 49:01.300]  They'd be sitting in the next room.
[49:01.500 --> 49:02.060]  Oh, really?
[49:02.180 --> 49:05.260]  And if you were with the attorney, they wouldn't be allowed to listen to your...
[49:05.260 --> 49:05.880]  Conversations?
[49:06.000 --> 49:06.620]  ...to your conversations.
[49:06.820 --> 49:10.380]  I've worked on 90% federal cases and a lot of child-born cases.
[49:10.860 --> 49:14.960]  And it's really pathetic, the current state of...
[49:14.960 --> 49:15.380]  Their analysis?
[49:15.380 --> 49:16.500]  ...being able to run a defense.
[49:16.680 --> 49:18.280]  No, the policing is usually pretty good.
[49:18.380 --> 49:18.580]  Is it?
[49:19.220 --> 49:21.960]  But I've only testified once in all of these cases.
[49:21.960 --> 49:27.400]  And I was disqualified as an expert in child pornography because I've received no formal training in the subject.
[49:29.860 --> 49:30.820]  That's interesting.
[49:30.960 --> 49:34.820]  As it turns out, Pervert University wasn't offering the course that year.
[49:35.760 --> 49:38.280]  And no one can get formal training in the subject.
[49:38.280 --> 49:49.760]  So we've created a class of forbidden knowledge here where you can't do research in questions like, is viewing child porn a gateway to abusing actual children, for example?
[49:50.400 --> 49:50.780]  Thank you.
[49:52.200 --> 49:53.380]  Just one observation.
[49:53.880 --> 49:56.640]  You mentioned earlier about the file name coming out.
[49:56.800 --> 49:57.040]  It's weird.
[49:57.320 --> 50:08.260]  On file sharing service eDonkey, when you run a search, it actually pulls through the metadata of the posts of the shared files, not the actual file name.
[50:08.500 --> 50:21.740]  So unless you right-click on the tab and see the file name that will be downloaded, that's why you're going to wind up potentially with a more explicit file name downloaded than you would see in your search results.
[50:21.900 --> 50:22.540]  Ah, okay.
[50:22.620 --> 50:29.040]  Because you'd have to actually right-click on the properties of the share to actually see what file's going to come down.
[50:29.360 --> 50:31.160]  And what average user's going to do that?
[50:32.320 --> 50:33.220]  Very few.
[50:33.380 --> 50:34.020]  They won't, yeah?
[50:34.520 --> 50:35.160]  Yes, sir?
[50:36.300 --> 50:42.180]  Yeah, so my question is, you talk about whatever you investigate is based on the average user.
[50:42.380 --> 50:46.900]  So you're saying that the person who's not the average user is trying to hide it or get away with it?
[50:46.920 --> 50:52.520]  No, what I was saying is the case I was going through on the screen is going to be based on the average user.
[50:52.620 --> 51:01.260]  Because if I come out here and I say, this is how this is, there are probably 20 people in the audience that could say, yeah, but what about if they did full disk encryption?
[51:01.460 --> 51:05.000]  What about if there's too many variables for me to give a talk?
[51:05.340 --> 51:08.820]  So that's why the case I was talking about there, that's what I was talking about.
[51:08.820 --> 51:09.460]  But you analyze everything?
[51:09.460 --> 51:10.620]  I analyze anything, yeah.
[51:10.920 --> 51:11.160]  Okay, thanks.
[51:11.520 --> 51:17.940]  By the way, one comment about access times, which is that a lot of the peer-to-peer file sharing programs update the access times also.
[51:18.060 --> 51:18.900]  When they download the file?
[51:18.940 --> 51:20.260]  Because they serve out the file.
[51:20.440 --> 51:20.600]  No.
[51:20.720 --> 51:23.200]  In the process of downloading, they're also serving it.
[51:23.280 --> 51:25.640]  So you might end up getting charged with distribution.
[51:26.020 --> 51:26.420]  Yep.
[51:26.420 --> 51:29.280]  As a consequence, as a side effect of downloading.
[51:29.700 --> 51:29.740]  Yeah.
[51:31.400 --> 51:35.080]  So the talk about hashes is surprising to me.
[51:35.780 --> 51:44.040]  Is that something that's only being done by the police in the cases where the file sharing service actually uses hashes on the back end in some way?
[51:44.280 --> 51:47.560]  Or is that just their way of identifying problem files?
[51:47.940 --> 51:54.200]  Because if so, I mean, it seems like it's trivially easy to modify one byte in a file and completely change its hash.
[51:54.200 --> 51:54.720]  Right.
[51:54.900 --> 51:55.400]  The database.
[51:56.040 --> 51:58.100]  And I hear it on both ends.
[51:58.360 --> 52:06.760]  So I've heard a lot of people tell me that the criminal database of child pornography hashes is not up to date.
[52:06.920 --> 52:07.800]  It's not very good.
[52:08.100 --> 52:11.240]  But I see it in the reports that they're using the hash database.
[52:11.880 --> 52:20.940]  And in fact, they'll take other files and they're going to send other files to the whatever lab to have them reanalyzed and added to the hash database.
[52:25.800 --> 52:32.300]  I had a quick question regarding, actually, the thing you said a second ago was via the encryption.
[52:33.480 --> 52:49.400]  So it was something that I was just... it was in the news a few months back about the case where the person was held in contempt of court or whatever for not giving up the password to his true encrypted hard drive.
[52:50.580 --> 52:57.920]  I just was trying to figure out, like, I'm... my knowledge of the law wasn't... is obviously not nearly good at all.
[52:58.040 --> 52:58.980]  I'm not... I never cited the law.
[52:59.180 --> 53:09.220]  But I mean, does that mean that if I do encrypt my hard drive or someone else encrypts their hard drive that we could be held in contempt of court until we give it up?
[53:09.220 --> 53:10.420]  I'm not a lawyer.
[53:10.700 --> 53:11.220]  Okay.
[53:11.980 --> 53:12.700]  Fair enough.
[53:13.040 --> 53:13.760]  Can't help you.
[53:14.040 --> 53:17.640]  There was a talk earlier, though, that you would have wanted to be at.
[53:18.080 --> 53:19.560]  He kind of covered that stuff.
[53:20.780 --> 53:23.220]  There was an earlier question about hashing.
[53:23.360 --> 53:31.660]  And I was wondering if any sort of perceptual hashing is used similar to Shazam or the way YouTube detects copyrighted videos.
[53:31.660 --> 53:34.520]  Or if it's just purely a, you know...
[53:34.520 --> 53:35.320]  Surely...
[53:35.320 --> 53:38.280]  For me, it's an MD5 hash or a SHA-1 hash.
[53:38.420 --> 53:38.560]  Okay.
[53:38.740 --> 53:45.960]  Do you suspect that they will be moving to... or at least police or prosecutors will be moving to that sort of system anytime?
[53:46.360 --> 53:46.840]  I'm just curious.
[53:46.980 --> 53:48.940]  They move fairly slow, so I doubt it.
[53:49.100 --> 53:49.980]  Do you have information on that?
[53:50.080 --> 53:51.500]  Well, I can tell you about the hash database.
[53:51.800 --> 53:58.180]  The National Center for Missing and Exploited Children, NCMEC, is the designated reporting agency for child porn.
[53:58.380 --> 54:00.220]  And they have a known victim database.
[54:00.220 --> 54:06.940]  Some of these images, the victims in it are five years old, and they're now grandmothers.
[54:07.220 --> 54:09.700]  And they wish this whole thing would disappear.
[54:10.180 --> 54:14.560]  Because the harm is actually caused when they're told that their image has surfaced once again.
[54:14.780 --> 54:18.220]  It's not caused by the viewing of the image, but by pointing it out to them.
[54:18.760 --> 54:27.680]  So, you know, this is shared between Interpol and NCMEC, and it's generally distributed among police agencies worldwide.
[54:28.080 --> 54:29.440]  So, you know...
[54:29.440 --> 54:30.380]  Stop.
[54:30.640 --> 54:30.960]  Thank you.
[54:31.660 --> 54:32.780]  Let them talk.
[54:33.260 --> 54:34.020]  One more.
[54:34.260 --> 54:34.680]  Go ahead.
[54:34.960 --> 54:35.340]  Nobody's...
[54:35.340 --> 54:36.080]  Yeah, they can run out.
[54:36.160 --> 54:36.940]  There's nobody after me.
[54:37.640 --> 54:46.720]  How do you protect yourself from sort of follow-on prosecution because in the case where you were emulating a search?
[54:47.420 --> 54:49.480]  If you got any of that, now it's on your computer.
[54:50.040 --> 54:59.760]  How do you get yourself into a safe zone that says, hang on, this is legitimate defense research and you shouldn't be prosecuted for doing your job in this case?
[54:59.760 --> 55:00.820]  You have to prove...
[55:01.360 --> 55:02.660]  And what a great question.
[55:02.940 --> 55:10.100]  And two years ago, I worked with the EFF and my college to conduct malware research that...
[55:10.640 --> 55:20.460]  What I wanted to prove or what I wanted to do is I wanted to write a white paper and do a presentation on how you would prove malware downloaded illegal content to your drive.
[55:20.480 --> 55:29.060]  I didn't need it to download illegal content, but I told my college, if I infect this system, there's the potential that it downloads illegal content.
[55:30.060 --> 55:39.540]  And I need attorneys at the college to know that and we have to come up with a method to make sure that I don't get prosecuted and it's taken care of.
[55:40.080 --> 55:44.800]  And what the EFF attorney said is, well, that gets into that knowingly.
[55:45.000 --> 55:51.800]  So you have to be able to prove that you didn't knowingly download it and you didn't knowingly view it.
[55:51.800 --> 56:06.900]  Now, I can do that forensically, but just imagine having to get an analyst that's going to prove that when the prosecutor's expert is going to just go off file time date stamps.
[56:07.080 --> 56:09.100]  So I don't think there's anything that you can do.
[56:11.580 --> 56:12.080]  Sorry.
[56:12.380 --> 56:12.640]  Sorry.
[56:12.800 --> 56:13.080]  We're done?
[56:13.360 --> 56:13.560]  Yeah.
[56:13.720 --> 56:13.940]  All right.
[56:14.280 --> 56:14.740]  Thanks.
[56:14.940 --> 56:15.760]  Thanks, everybody.
[56:15.760 --> 56:15.860]  Thank you, everybody.