Skip to content

2022 HTCIA International Conference & Expo Sessions

Opening Session Virtual

9/27/2022 9:00 AM

Location
Virtual
Summary
Mobile Forensics Panel Alexis Brignoni, Geraldine Blay, Josh Hickman, Kevin Pagano

INsig2 invites you to OSINT training during the HTCIA International Conference & Expo!

9/27/2022 9:00 AM

Location
Studio 2B
Summary
Description This course focuses on the ability to gather information on people, groups, or companies only from the free online available sources. Participants will learn frameworks and basic procedures necessary to perform OSINT investigation. The course is hands-on and will teach a range of skills on how to prepare the workstation for investigation, staying anonymous, setting up false online identities, utilize different techniques for gathering intelligence, and performing blockchain transaction searches. The course is focused on giving a wide overview of what OSINT is and the relevance behind it. The class will show a number of different scenarios that will get the participants into the right mindset that will enable them to better understand the relevance of found data and make it actionable. An important part of the class will be emulating a mobile environment, using the virtual mobile OS for OSINT investigation, which will provide a different insight on how to obtain information. Trainers will show and explain techniques for getting information from open source resources, analyzing cryptocurrencies, and exploring blockchain based on real-case scenarios. With this course, participants will understand and practically apply various techniques to gather underlaying data and how to properly interpret it. To learn more and register go to https://www.insig2.com/en/events/open-source-intelligence-osint-htcia

Prioritizing time sensitive investigations with Rapid Digital Triage

9/27/2022 10:00 AM

Location
Virtual
Speakers
  • Alan McConnell - Head of Customer Success
    Prior to joining Cyacomb, Alan spent 15 years with Police Scotland (the UK’s 2nd largest force) where he became one of the unit’s leading digital forensics analysts. He also played an integral role in the design, testing and roll out of Cyacomb’s main tool, Cyacomb Examiner into UK policing through the UK Government’s Home Office. As Head of Customer Success at Cyacomb, Alan is passionate about enabling the successful deployment of Cyacomb’s suite of digital forensics tools and supporting CSAM and CT investigators. Alan is also Cyacomb’s principal trainer and leads Cyacomb’s training and support teams. Outside of work, Alan is a passionate rugby supporter (Ireland and Ulster), keen home brewer (and taster) of hoppy ales, avid Triumph motorcyclist, and collector of guitars.
Summary
How to leverage the benefits of block level hashing to expedite investigations and reduce digital forensic backlogs

Video Evidence: Why there is more to it than “just pressing play.”

9/27/2022 11:00 AM

Location
Virtual
Speakers
  • Blaine Davison - Technical Sales & Support
    Blaine is a retired Forensic Video Analyst and Digital Evidence Administrator from the Norman, Oklahoma Police Department. He joined the team at Amped Software in March, 2021 after over 23 years of commissioned service. He is also a LEVA certified Forensic Video Technician and served on the LEVA board of directors as President, Corporate Vice President and Webmaster. He also served for several years as a member of the video subcommittee of the Scientific Working Group for Digital Evidence (SWGDE).
Summary
While CCTV video and images are the most common and sought after forms of evidence in investigations, their reliability is often called into question. The conversion, interpretation, restoration, enhancement, analysis, and presentation of video must follow a forensic workflow to ensure not only reliability, but admissibility in court. This session will examine how Amped Software Solutions address these reliability and admissibility challenges by utilizing a ‘Camera to Court’ science-based workflow.

Limited scope or limited collection of Mobile Data

9/27/2022 12:00 PM

Location
Virtual
Speakers
  • Dave Good
    Dave is retired from the Bureau of Alcohol, Tobacco, Firearms, and Explosives, May 2022, Special Operations Division, Digital Forensics Branch. As a program manager he was responsible for the support of daily activities of field Special Agents in the areas of device collection and analysis, equipment/software updates, test and evaluation, analysis, testifying, and general program support, software licensing, vendor liaison, contracts, and hardware and software inventories, implementation of new program initiatives, deployment of services for large scale collections. Dave was also the Mobile Device Exploitation (MDX) Program Manager, responsible for daily processing of IOS and Android devices for exploitation. Services include Graykey, XRY, Cellebrite Premium, AWS Cellebrite Pathfinder and Social Media Warrant Returns.
Summary
Virtual Session

Chalk Talk - Taking the Expert out of Forensic Expert

9/27/2022 1:00 PM

Location
Virtual
Speakers
  • Anthony Knutson

Digital Evidence from Social Networking Sites & Smartphone Apps

9/27/2022 1:15 pm

Location
Virtual
Speakers
  • Julie Lewis
    Julie Lewis, President, CEO and Founder of Digital Mountain, has over 30 years of experience working in the high technology industry and has been a long-time user of social media. One of the key focus areas of her company is on social media investigations, preservations and monitoring. Prior to founding Digital Mountain, Julie worked at VERITAS Software with next-generation storage, security and search companies. At VERITAS, she managed operations for new product releases across sales, marketing, product management, legal, engineering and customer support. Before joining VERITAS, Julie worked in the venture capital and investment banking industries in both the Silicon Valley and Boston areas focusing on the Internet Infrastructure, security and software sectors. In addition, Julie worked for two of the Big 4 accounting firms doing financial and IT auditing, as well as M&A due diligence as a CPA. She also worked for Applied Magnetics, a publicly traded provider of disk and tape drive components. Julie earned an MBA under fellowship from the F.W. Olin Graduate School of Business at Babson College and a BA in both Business Economics and Sociology from the University of California at Santa Barbara. She is a member of the High Tech Crime Investigation Association (HTCIA), American Bar Association, Sedona Conference's Working Groups on E-mail Management and Archiving (WG1) and Data Security and Privacy Liability (WG11), Cloud Security Alliance and has received her EnCE (Encase Certification in Computer Forensics). Julie is founding Director of the Silicon Valley Chapter of Women in eDiscovery and co-author of “The Sedona Conference Primer on Social Media”.
Summary
According to Statista.com in 2020, the global social penetration rate reached 49 percent, with East Asia and North America having the highest penetration rate at 71 percent and 69 percent, respectively. Mobile device usage for social media has increased to 91% of social channel accesses in 2018 according to Marketing Profs. Many technology thought leaders believe social networking will displace traditional email as the leading communication medium. This presentation will provide a practical walkthrough of preservation of top social media sites and how to effectively utilize tools for evidentiary collection across the Web, PCs/desktops and smart devices. We will look at social media apps on smartphones and what digital evidence exists compared to what can be found on the cloud. We will also explore innovations in emoji/avatar Apps such as Bitmoji.

Digital Investigations with OSForensics

9/27/2022 2:00 PM

Location
Virtual
Speakers
  • Charles Giglia
    Charles M. Giglia has been in the field of computer forensics since 2000 concentrating primarily on the research and development of computer forensic investigative techniques and training curriculum. Charles has an undergraduate degree in mathematics from Canisius College and a graduate degree in forensic science from the University of New Haven. He currently serves as Vice President of Training for Digital Intelligence, Inc.

Abuse of Trust: Third-Party Application Use In Attacks and The Complications Around Investigations

9/27/2022 3:00 PM

Location
Virtual
Speakers
  • Nick Popovich
    Nick Popovich's passion is learning and exploring technology ecosystems, and trying to find ways to utilize systems in unexpected ways. His career has focused on adversarial threat simulation, offensive and defensive security, and advanced technical security assessments. Nick's mission is to help individuals and organizations involved with defensive security operations to have an opportunity to observe the mechanics and methods of the attackers they’re defending against, and to assist in realistically testing those defenses. He's a lifelong learner and loves finding new ways to get under the hood of systems and networks. He is a father of three and a husband to one.
Summary
Organizations have steadily transitioned to relying on third-party entities to provide many common services to employees. Examples include human resources services like benefits information and enrollment, or payroll. Other examples include surveys, corporate training, and travel and expenses. Most of the services send legitimate emails to users. This has trained the recipients to expect to receive emails from outside of their organization, and to follow hyperlinks within the emails, as a regular part of their workday. This talk is meant to highlight how end users have become desensitized to the ominous warning banners stop external emails, and can fall victim to phishing emails that abuse the trust in large, well-known organizations. We'll also showcase how command and control traffic (c2) can be masked by abusing the trust inherent in some third-party providers. The talk will run through examples of how threat actors can anonymously utilize built-in functionality to send phishing emails and establish c2, that originate from trusted, big-name, companies. We'll briefly delve into the complications that arise when performing post-breach investigation activity, when a third-party is used for malicious activity. The end-goal of this discussion that the risk is given more attention, and user awareness campaigns, technical email and network monitoring controls, and investigative processes can take these risks into account.

OSINT Investigations: Managing Threats from Digital Marketplaces

9/27/2022 4:00 PM

Location
Virtual
Speakers
  • Brandon Wilkins - Customer Success Manager
    Brandon is an OSINT specialist and an experienced trainer. As a key member of Skopenow's Customer Success team, Brandon ensures that Skopenow's customers know how to utilize Skopenow to its limits to obtain actionable intelligence every time.
Summary
Digital marketplaces, like Amazon and eBay, connect buyers and sellers of goods and services worldwide. At an annual value of roughly $2 trillion, the majority of transactions on digital marketplaces are legitimate, however, a small minority facilitates criminality, including tax avoidance and the trade of stolen items, counterfeit goods, wildlife, illicit drugs, and illegal weapons. In this session, Skopenow’s Brandon Wilkins breaks down how investigators can approach OSINT Investigations on Digital Marketplaces to legally and ethically combat this criminality.

Registration

9/28/2022 7:00 AM

Location
Seminole

Breakfast & Exhibit Hall

9/28/2022 8:00 AM

Location
Seminole Ballroom

Opening Remarks

9/28/2022 8:30 AM

Location
Seminole Ballroom I
Speakers
  • Warren Kruse - President
    Chambers and Partners Ranked eDiscovery Expert, five years in a row (2018-2022). Warren has experience working in law enforcement and as a consultant, supporting law firms and corporations globally with incident response, computer forensics and Electronic Discovery. He is a co author of Computer Forensics: Incident Response Essentials. Warren was ranked as a top Professional Adviser in the 2018, 2019 and 2020 Chambers Litigation Support guide: https://www.chambersandpartners.com/guide/professional-advisers-litigation-support/58 Highlights: - Served as the expert for AMD in AMD vs. Intel antitrust litigation. - Testified as a Computer Forensic Expert for the US Securities and Exchange Commission (SEC) on in the SEC vs. vFinance Investment Inc. matter. -Named an independent Court expert in the NetJapan, Inc., et al. v. StorageCraft Technology Corporation matter. - Led a team of computer forensic experts in a three year engagement in support of a fraud investigation task force at the world’s largest international cooperative organization. - Conducted the computer and network forensics in the billion dollar "Comtraid" theft of Intellectual Property and Trade Secrets, for which he received the High Tech Crime Investigation Association’s Case of the Year Award. - Led the investigation in a reported intrusion and reported theft of over 55,000 customer records - Conducted forensics in support of several Foreign Corrupt Practice Act (FCPA) investigations in Saudi Arabia, Cairo, Japan and Hong Kong. - Conducted ITC investigations in Japan. - Expert witness in the case In re Tyson Foods, Inc. Fair Labor Standards Act Litigation, MDL Warren is a frequent lecturer on computer forensics, incident response, and cybercrime. He has lectured internationally for groups including: SANS, MIS Institute, Certified Fraud Examiners, ISSA, HTCIA, IR Italy, etc.
Summary
Honor Guard, Police Chief

Keynote Speaker - Sword and Shield: A Cyber Warrior's Perspective from the Trenches of Government and the Private Sector

9/28/2022 9:30 AM

Location
Seminole Ballroom I
Speakers
  • David Lacquement - General
    MG (Ret) David Lacquement is Arete’s Senior Vice President for Government Relations and Operational Intelligence Sharing. Prior to this he served as the Deputy Assistant Secretary of the Treasury for Cybersecurity and Critical Infrastructure Protection, where he led a team focused on safeguarding the private financial services sector from cyber threats that could impact U.S. national and economic security. He has also led a team at Booz Allen Hamilton, that supported U.S. Cyber Command with technical and operational planning cyber support. MG (Ret) served in the U.S Army for over three decades as an intelligence officer retiring as the Director of Operations, J-3, USCYBERCOM. As the first Director of Operations, he played a lead role in the framing and establishment of the Command and was responsible for directing the operations and defense of all Department of Defense’s networks, and for the planning and executing of offensive cyber operations for the Department of Defense. His military assignments included tours as Commanding General of the U.S. Army Intelligence and Security Command at Fort Belvoir, Virginia; Chief of Staff for Intelligence, C-2, Multi-National Force-Iraq supporting OPERATION IRAQI FREEDOM during the surge, Assistant Chief of Staff for Intelligence, J-2, United States Southern Command, Miami, Florida, and Assistant Chief of Staff for Operations, G-3, U.S. Army Intelligence and Security Command, Fort Belvoir, MG (Ret) Lacquement holds Masters Degrees from National Intelligence University, U.S. Army Command & General Staff College, School of Advanced Military Studies, and the National Defense University. He completed his undergraduate studies and graduated from Western Maryland College (now, McDaniel College).
Summary
General Lacquement will speak on the importance of operational collaboration and his experiences collaborating in complex intelligences environments from Iraq to Kosovo and about his experiences in the build of DoD’s cyber capabilities and Treasury’s Office of Cybersecurity and Critical infrastructure Protection.

Chalk Talk - Date and Time Artifacts

9/28/2022 10:30 AM

Location
Seminole Ballroom I
Speakers
  • Frank Amat
Summary
Chalk Talk Winner

FAKE News: Don't believe what you see until you validate it

9/28/2022 11:00 AM

Location
Seminole Ballroom I
Speakers
  • Heather Mahalik - Author, Cellebrite, SANS
    https://www.linkedin.com/in/heather-mahalik-3615535/
Summary
Forensic artifacts can be misleading if they are not properly understood by the examiner. Trusting the data requires more than what is presented by a tool. When the case stands on the validity of an artifact, validation is a must. This talk will cover different case scenarios where the artifacts can be misleading and how the truth can be uncovered. Tips for successful validation will be provided to ensure you are not simply going with a theory and assuming the data supports it, but letting the data speak the truth on what happened, where it happened and how it happened.

Anatomy of a Business Email Compromise Investigation

9/28/2022 11:00 AM

Location
Studio 2B
Speakers
  • Steve Gemperle - Forensic Consultant
    Forensic Consultant with Magnet Forensics. Retired United States Secret Service Senior Special Agent with a demonstrated history of working in the law enforcement industry. Skilled in Computer Forensics, Incident Response, Homeland Security, Firearms Instruction, and Physical Security. Strong computer forensic and protective services professional with a Master of Business Administration - MBA focused in Finance/Marketing from Texas State University and a Bachelor's degree in Marketing from TCU.
Summary
A walk-through of how to conduct a Business Email Compromise (BEC) investigation. We will discuss how to investigate a Business Email Compromise, from how and what logs to pull (or ask to be pulled), timely steps to take to stop money transfers, different techniques to attempt to recover money sent and finally recommendations for securing systems and implementing policies to prevent BEC events.

Blockchain Basics: Understanding Cryptocurrency Fundamentals

9/28/2022 11:00 AM

Location
Studio 2C
Speakers
  • Teagan Kavanagh - Digital Forensic Examiner
    Teagan brings seven years of former law enforcement experience to Ace Computers and Defense Forensic, where he now works as a digital forensic examiner. The majority of his time in law enforcement was spent as a detective investigating financial crime, identity theft, and internet crimes. Over the last five years, Teagan has become a subject matter expert in cryptocurrency and digital forensic investigations.
Summary
During this introductory presentation we will explore basic blockchain concepts such as consensus mechanisms, block creation, and what terms like 'nonce' and 'RBF' mean. Knowledge of these underlying fundamentals will help investigators to better understand how a blockchain works and the data that is recorded with each transaction.

Social Engineering & Tor "How people truly manipulate through neuroscience & how to use it in your investigations"

9/28/2022 11:00 AM

Location
Hollywood East
Speakers
  • John Pizzuro - President JP Consulting & Speaking
    Before creating his own consulting & speaking business John spent 22 out of his 25 years investigating, managing, and leading complex investigations such as Terrorism, Cartels, Organized Crime, Corruption, Fraud, Cyber, Child Exploitation & Child Trafficking. John's approach always has been on making the impossible, possible. John has a penchant for vision and strategy and finding solutions.
Summary
Technology is a given and a constant. Sometimes we lack the ability to apply a technological solution. Anonymizing Apps, VPN’s, Tor and End to End encryption are challenges we all face. What if I told you there is a non-technical way to identify, engage and lure criminals out of the shadows? Sophisticated criminals and others have used social engineering to victimize their prey for decades. Today social engineering has been more constant and creative as we try to prevent intrusions. This presentation will explain the why and how. We will delve into the neuroscience and the impact of technology and how it makes even the most cautious susceptible. This presentation will also give investigators the ability to utilize these techniques to catch.

Lunch & Exhibit Hall

9/28/202212:00 PM

Location
Seminole
Summary
Awards Lunch

Not Your Father's Forensics

9/28/2022 1:30 PM

Location
Seminole Ballroom I
Speakers
  • Bobby Kruse - President
    Chambers and Partners Ranked eDiscovery Expert, five years in a row (2018-2022). Warren has experience working in law enforcement and as a consultant, supporting law firms and corporations globally with incident response, computer forensics and Electronic Discovery. He is a co author of Computer Forensics: Incident Response Essentials. Warren was ranked as a top Professional Adviser in the 2018, 2019 and 2020 Chambers Litigation Support guide: https://www.chambersandpartners.com/guide/professional-advisers-litigation-support/58 Highlights: - Served as the expert for AMD in AMD vs. Intel antitrust litigation. - Testified as a Computer Forensic Expert for the US Securities and Exchange Commission (SEC) on in the SEC vs. vFinance Investment Inc. matter. -Named an independent Court expert in the NetJapan, Inc., et al. v. StorageCraft Technology Corporation matter. - Led a team of computer forensic experts in a three year engagement in support of a fraud investigation task force at the world’s largest international cooperative organization. - Conducted the computer and network forensics in the billion dollar "Comtraid" theft of Intellectual Property and Trade Secrets, for which he received the High Tech Crime Investigation Association’s Case of the Year Award. - Led the investigation in a reported intrusion and reported theft of over 55,000 customer records - Conducted forensics in support of several Foreign Corrupt Practice Act (FCPA) investigations in Saudi Arabia, Cairo, Japan and Hong Kong. - Conducted ITC investigations in Japan. - Expert witness in the case In re Tyson Foods, Inc. Fair Labor Standards Act Litigation, MDL Warren is a frequent lecturer on computer forensics, incident response, and cybercrime. He has lectured internationally for groups including: SANS, MIS Institute, Certified Fraud Examiners, ISSA, HTCIA, IR Italy, etc.
  • Warren Kruse - President
    Chambers and Partners Ranked eDiscovery Expert, five years in a row (2018-2022). Warren has experience working in law enforcement and as a consultant, supporting law firms and corporations globally with incident response, computer forensics and Electronic Discovery. He is a co author of Computer Forensics: Incident Response Essentials. Warren was ranked as a top Professional Adviser in the 2018, 2019 and 2020 Chambers Litigation Support guide: https://www.chambersandpartners.com/guide/professional-advisers-litigation-support/58 Highlights: - Served as the expert for AMD in AMD vs. Intel antitrust litigation. - Testified as a Computer Forensic Expert for the US Securities and Exchange Commission (SEC) on in the SEC vs. vFinance Investment Inc. matter. -Named an independent Court expert in the NetJapan, Inc., et al. v. StorageCraft Technology Corporation matter. - Led a team of computer forensic experts in a three year engagement in support of a fraud investigation task force at the world’s largest international cooperative organization. - Conducted the computer and network forensics in the billion dollar "Comtraid" theft of Intellectual Property and Trade Secrets, for which he received the High Tech Crime Investigation Association’s Case of the Year Award. - Led the investigation in a reported intrusion and reported theft of over 55,000 customer records - Conducted forensics in support of several Foreign Corrupt Practice Act (FCPA) investigations in Saudi Arabia, Cairo, Japan and Hong Kong. - Conducted ITC investigations in Japan. - Expert witness in the case In re Tyson Foods, Inc. Fair Labor Standards Act Litigation, MDL Warren is a frequent lecturer on computer forensics, incident response, and cybercrime. He has lectured internationally for groups including: SANS, MIS Institute, Certified Fraud Examiners, ISSA, HTCIA, IR Italy, etc.
Summary
A quick look at corporate investigations the way they used to be in the early 2000’s. Today, data forensic investigations are being done globally in most corporations, using many tools you are familiar with. We will discuss potentially adding tools for contextual analytics, communication analytics, and using concept searching tools for investigations.

How Artificial Intelligence can be a game changer for law enforcement

9/28/2022 1:30 PM

Location
Studio 2B
Speakers
  • Rameez Meerasahib - Global CTO
    Rameez MeeraSahib is the Global CTO for Data Analytics and Artificial Intelligence products at Micro Focus. In this role, he leads the development of new solutions and market offerings based on the Micro Focus Artificial Intelligence platform - IDOL as well as provides technology, strategy, and thought leadership for data analytics and AI use cases. Rameez brings more than 20 years of expertise in data analytics, machine learning, and the AI software industry. Under his leadership, Micro Focus translates complex customer business problems into effective software solutions by leveraging data, advanced analytics, and machine learning technologies. His solution engineering, market, and product expertise spread across large-scale business intelligence systems, enterprise data warehouses, data products, real-time analytics, machine learning, IIoT (Industrial Internet of Things), artificial intelligence, and prescriptive and predictive analytics. Rameez joined Micro Focus as part of the spin-merge with the Hewlett Packard Enterprise software business. Previously, he led global corporate strategy for Thomson Reuters. Earlier in his career, Rameez held leadership positions in software engineering, business strategy, product management, and technology consulting at HP, GlaxoSmithKline, Autonomy Corporation, and Wipro Technologies. Rameez graduated with a Bachelor of Engineering in Electronics and Telecommunication from MS University, India. He also holds an M.B.A from the Fuqua School of Business at Duke University, USA.
Summary
Law enforcement can utilize artificial intelligence to assist investigators sift through the mountains of data and put the most relevant information in front of them, saving time and resources. We will talk about IDOL, an extremely powerful AI / ML analytics tool and some success cases from law enforcement agencies worldwide. We will also discuss how law enforcement can benefit from having Artificial Intelligence running in the background of their Real Time Crime Centers.

Documenting Digital Evidence with Screenshots

9/28/2022 1:30 PM

Location
Studio 2C
Speakers
  • Richard Frawley
Summary
Join Rich Frawley, Director of Digital Forensics Training at ADF Solutions, as he discusses the current state of acquiring data from mobile devices and how to properly document screenshots when acquiring application or device-specific data. Investigators and examiners will walk away knowing screenshot basics, when screenshots should be employed, best practices, chain of custody, and how to make sure your evidence is reliable. This is a beginner-level session good for front-line investigators, examiners, prosecutors, and anyone involved in the processing and reporting of mobile evidence.

Break and Exhibit Hall

9/28/2022 2:30 PM

Location
Seminole Ballroom

Hansken: how to handle big data in Digital Forensic investigations

9/28/2022 3:00 PM

Location
Seminole Ballroom I
Speakers
  • Kristien Siemons - Community Manager
    Kristien Siemons is part of the Netherlands Forensic Institute and concerned with the development of the Hansken Platform. As Community Manager, she is involved in all-round processes, like the necessary software development, the connection with users and important stakeholders, and identifying new needs and future developments, so that the platform remains innovative and able to fight crime.
Summary
Do you work cases containing large volumes of data? And do you want to benefit from good software and international knowledge how to handle this data? Learn more about Hansken: a platform that is specifically developed for digital forensic investigations that contain of hundreds of Terabytes of data. Investigations conducted by law enforcement and intelligence agencies, concerning e.g., drugs, child abuse, domestic violence, murder, theft, fraud and more. Hansken is also used by courts of law as an e-disclosure application, enabling legal defense counsel to review digital evidence. But Hansken is more than just a tool: Hansken members share forensic knowledge and collaborate on UI development, backend development and plug-ins, which are made available in a shared Hansken app store and can be used directly in ongoing cases by all members. The international Hansken Community is for and by law enforcement and intelligence agencies, and is therefore a nonprofit collaboration, organized by the Netherlands Forensic Institute (NFI) in The Hague. Join this presentation to learn more about the how and what of Hansken. How do you use it? What are the benefits? What makes the platform a solution to what challenges? And above all: grab the opportunity to experience the way Hansken works yourself.

Crime Scenes to Courtroom – Processing, Investigating and Presenting Digital Evidence From All Sources To Show The Big Picture In A Holistic View

9/28/2022 3:00 PM

Location
Studio 2B
Speakers
  • Scott Johnson
    Scott served 25 years with the New Jersey State Police where he was among the first members of the new High Technology Crimes Unit, eventually moving on to establish a dedicated Cyber Crime unit focused on fraud and information security related crimes. He retired as a Lieutenant detailed to the FBI as the Deputy Laboratory Directory for the New Jersey Regional Computer Forensics Laboratory. Following retirement, he was hired to establish a digital forensics laboratory for a large accounting firm, served as Director for Incident Response and Investigations at Prudential Financial and then transitioned to Nuix USG as a Principal Solutions Consultant, where he remains today.
Summary
Investigators face increasing pressure from the challenges the diverse range of digital devices presents. In addition to laptops, computers and mobile devices, today’s sources of digital evidence include network shares, Cloud Storage, IoT and more. Traditional digital forensic workflows prevent investigators from efficiently dealing with Big Data challenges. Critical evidence is often spread across multiple evidence sources and investigation must be multi-dimensional, encompassing multiple people, objects, locations and events. Join us to learn more efficient workflows that harness the value of big data, rather than becoming swamped by it.

Application of Machine Learning and Artificial Intelligence in Digital Forenscis

9/28/2022 3:00 PM

Location
Studio 2C
Speakers
  • Krešimir Hausknecht
    Krešimir is the head of Digital Forensics Department in INsig2, privately held company from Croatia. He has extensive experience in both public and private sector where he has contributed to various programmes and clients. Main tasks involve team and project management, working on cases and being a professional trainer in the field of digital forensics. He is an expert in live data forensics, malware and mobile forensics, open source intelligence and cryptocurrency investigations and has held over 1000 hours of trainings all over the globe on these subjects. In addition, he also teaches digital forensics classes on Zagreb university of applied science in Croatia.
Summary
o AI and ML are expressions that can be found on most of new software that is coming out but most of the people don’t really know what is it? In reality, companies will widely use these expressions as soon as they have a for or if loop in their software while in reality there will be no benefits for the user. Some of the companies and the community are actually doing a lot of progress in this area and digital forensic software is being “upgraded” too. This lecture will cover some of the new options and possibilities that forensic software has gained through the usage of this technologies.

Where did this come from???? Revealing the sending phone number of an unidentified AirDrop file.

9/28/2022 3:00 PM

Location
Hollywood East
Speakers
  • Brandon Epstein - Chief Forensic Officer - Medex Forensics
    Brandon Epstein has served in law enforcement since 2007 and has been a digital forensic examiner since 2014. Brandon holds a Master of Science degree in Recording Arts – Emphasis Media Forensics and is a Certified Forensic Video Analyst (CFVA) and Certified Forensic Video Examiner (CFVE). He is the chair of the Scientific Working Group on Digital Evidence and is a member of the IAI’s Forensic Video Certification board, IACP Cybercrime and Digital Evidence committee, the American Academy of Forensic Science, and the NIST/OSAC Video/Imaging Technology and Analysis Subcommittee. Brandon is an adjunct professor in the New Jersey Institute of Technology’s Forensic Science Program and regularly provides digital forensic instruction to local, state, and federal law enforcement officers nationwide and internationally.
Summary
Presenters: Brandon Epstein and Detective Benjamin Klein While a convenient and efficient method of transferring files, Apple's AirDrop feature has recently been used to share unwelcomed images of nudity aka 'cyber flashing' as well as generalized threats to the public. Since AirDrop does not rely on a network provider, phone number, or email address for transmission to nearby devices, the identification of an unknown sender is problematic. The receiving device may only see the user defined friendly name of the transmitter and there is no record of the transmission by any provider. This presentation will discuss a novel method to identify the phone number of an AirDrop sending device using logs found on the receiving device.

Break and Exhibit Hall

9/28/2022 4:00 PM

Location
Seminole Ballroom

Cancelled

9/28/2022 4:15 PM

Location
Seminole Ballroom I

When the Phone is All You Have

9/28/2022 4:15 PM

Location
Studio 2C
Speakers
  • Amanda Mahan - Director of Training
    Amanda joined the Oxygen Forensics, Inc. Training team in 2018 and is currently the Director of Training. Before her Oxygen career, Amanda specialized in mobile forensics and data analysis for Autauga County Sheriff’s Office in Prattville, Alabama. In that role, Amanda built extensive experience and a successful conviction record as an online undercover investigator. She also orchestrated law enforcement and Board of Education collaboration in an effort to educate children against potential online threats. She was a Board Member of Central Alabama Crime Stoppers, and a previous ICAC Task Force member who worked alongside the Alabama Law Enforcement Agency, FBI, Alabama Attorney General’s Office, and HSI. Amanda’s knowledge quest includes participation in training events with the National White Collar Crime Center, the National Computer Forensic Institute, and the International Association of Computer Investigative Specialists. She is a graduate of Troy University with a Bachelor in Science in Criminal Justice with a concentration in Digital Forensics.
Summary
'Pick the scenario. You have to prove or disprove something and your proof is locked away in a phone. The phone is encrypted and locked when you power it on. What to do? Try an exploit? Brute force the lock? Gather good intel about the owner. Maybe create a custom dictionary attack profile with which to attack that lock? This module demonstrates leveraging multiple technologies and attack vectors against locked devices. Just because the sign says go away doesn’t mean we give up.'

Examining the Link Between Corruption and Cybercrime

9/28/2022 4:15 PM

Location
Hollywood East
Speakers
  • Jason Jordaan
    South Africa, Digital Forensics, Incident Response, and Cyber Crime Investigation Specialist I am a passionate Digital Forensics, Incident Response, eDiscovery, and Cyber Crime Investigation professional that strongly believes in finding the facts and solving problems, that often have a very real human cost. I served for 18 years in law enforcement as a detective and digital forensics examiner, before moving into the private sector, which has allowed me to continue making a difference in a bigger operational area.
Summary
May cybercrime are made possible through the use of social engineering techniques focused on deception and abuse of trust, and provide a foothold for most cybercriminals to gain access. But there are cases where organized cybercrime groups need more than a trusting employee that they can deceive. Sometimes they need an insider to help facilitate their crimes from within an organization. The presentation will examine the role that corruption plays in cybercrime, where external organized crime groups identify and target insiders within a target organization, and through acts of corruption, turn them against their own. This will be explored through a case study involving a large hack targeting government institutions.

The New Face of Fraud - The Challenges of Pandemic Fraud Investigations

9/28/2022 4:15 PM

Location
Studio 2B
Speakers
  • Scott Johnson - Principal Solutions Consultant
    Scott served 25 years with the New Jersey State Police where he was among the first members of the new High Technology Crimes Unit, eventually moving on to establish a dedicated Cyber Crime unit focused on fraud and information security related crimes. He retired as a Lieutenant detailed to the FBI as the Deputy Laboratory Directory for the New Jersey Regional Computer Forensics Laboratory. Following retirement, he was hired to establish a digital forensics laboratory for a large accounting firm, served as Director for Incident Response and Investigations at Prudential Financial and then transitioned to Nuix USG as a Principal Solutions Consultant, where he remains today.
Summary
51% of organizations have uncovered more fraud since the onset of the pandemic. 71% expect the level of fraud impacting their organizations to increase over the next year. 38% of organizations increased their budget for anti-fraud technology fiscal year 2021, making this the most common area for increased investment within anti-fraud programs. More than 80% of organizations have already implemented one or more changes to their anti-fraud programs in response to the pandemic. Every organization will be impacted by fraud, join us to learn to recognize and fight the pandemic of fraud head on and improve profitability, minimize fraud damages and identify, investigate, assess and recoup losses.

Exhibitor Reception - The Nerds

9/28/2022 5:30 PM

Location
Seminole Ballroom
Summary
Featuring The Nerds

Registration

9/29/2022 7:00 AM

Location
Seminole

Breakfast & Exhibit Hall

9/29/2022 8:00 PM

Location
Seminole Ballroom

Keynote: The Unexplored Continent of Industrial Forensics

9/29/2022 9:00 AM

Location
Seminole Ballroom I
Speakers
  • Lesley Carhart - Director of Incident Response
    Lesley Carhart is the Director of Incident Response for North America at the industrial cybersecurity company Dragos, Inc., leading response to and proactively hunting for threats in customers’ ICS environments. Prior to joining Dragos, Lesley was the incident response team lead at Motorola Solutions. Following four years as a Principal Incident Responder for Dragos, Lesley now manages a team of incident response and digital forensics professionals across North America who perform investigations of commodity, targeted, and insider threat cases in industrial networks. Lesley is also a certified instructor and curriculum developer for Dragos’ incident response and threat hunting courses. Lesley is honored to be retired from the United States Air Force Reserves, and to have received recognition such as “DEF CON Hacker of the Year”, “SANS Difference Maker”, and “Power Player” from SC Magazine.
Summary
Industrial cybersecurity has gained attention in the past decade as incidents have impacted critical infrastructure across the world. We're starting to think about the fundamentals of security in these long-ignored environments, but digital forensics in these environments is another gap to close. Lesley will discuss the growing differences between traditional DFIR and OT forensics skillsets, and where help and study is needed.

Chalk Talk - An investigation on data validity of vulnerable higher education services

9/29/2022 10:00 AM

Location
Seminole Ballroom I
Speakers
  • Nicholas Dubois
Summary
2nd Place Winner

How Many Android Phones Does it Take to Fly a Drone?

9/29/2022 10:30 AM

Location
Seminole Ballroom I
Speakers
  • Robert Schmicker - Co-Founder and CSO
    Robert Schmicker is Co-Founder and CSO of Raven Works LLC, specializing in reverse engineering, forensic examination, and exploit development/modification of mobile and embedded systems. Robert applies his expertise to develop boutique embedded system and UAS solutions for various national defense customers. Prior to Raven Works, Robert was a senior cybersecurity engineer at The MITRE Corporation reverse engineering and decrypting mobile chat application data, providing cyber operation support, aiding law enforcement and seizure of cryptocurrency. Robert holds a Masters degree from Johns Hopkins in Cybersecurity and a Bachelors in Computer Science from the University of New Haven. Robert has presented at DFRWS and AAFS.
Summary
DJI continues to dominate the drone market by producing drones accessible worldwide and easy to fly. Their prevalence and flight characteristics have allowed users to become creative with their use cases, creating a treasure trove of forensic data. However, DJI prefers to keep their drone ecosystem closely held by employing proprietary file formats, software/user data encryption, and withholding tooling capable of data analysis. This has driven the need for researchers and forensic examiners to create their own tooling capable of demystifying DJI’s data. This presentation covers topics related to accessing, parsing, and examining modern DJI drone data, evaluating the forensic investigation outcomes using both open source and advanced tooling.

You have hundreds of photographs and hours of video, now what? – Law Enforcement Media Analysis

9/29/2022 10:30 AM

Location
Studio 2B
Speakers
  • Michael Ciesliga
    Michael Ciesliga is the Sales Director in North and South America for Micro Focus LEMA (Law Enforcement Media Analysis), one of the leading AI technology platforms in the world. Prior to joining Micro Focus, Michael was a police officer for 15 years, 12 of which were spent working local, regional and international drug trafficking and money laundering investigations. Michael was assigned to an International Investigation Team while assigned to the Drug Enforcement Administration as a Task Force Officer. Michael worked closely with the Special Operations Division and law enforcement counterparts from Guatemala, Mexico, Colombia, Panama, Ecuador, the Netherlands, Italy, Poland and Australia. Michael is also certified as an Expert Witness in drug trafficking in multiple courts of law. In addition to being the Sales Leader for LEMA, Michael also assists Micro Focus’s Research and Development team to help create the next generation of law enforcement investigative software, using Micro Focus’s cutting edge AI and ML analytic tool, IDOL. Michael holds a Bachelors Degree in Criminal Justice from Adrian College, where he played NCAA Division III football.
Summary
Law Enforcement Media Analysis – the first and only software in the world that can offer three unique analytics, Face Recognition, ALPR and Object Recognition, at the same time. We will discuss methods for collecting digital evidence using various investigative techniques. We will also discuss how LEMA can help investigators speed up investigations, using less resources, leading to solving more crimes more efficiently.

The Power of EnCase

9/29/2022 10:30 AM

Location
Studio 2C
Speakers
  • Victor De La Pena
    As part of the OpenText Solutions Consulting team, Victor is a key contributor to helping digital forensics customers solve real-world digital forensic investigation problems. Victor engages with customers and prospects to understand their current architectural landscape, processes, environments and ecosystems. He helps customers understand how and why the capabilities offered by EnCase Forensic, EnCase Mobile Investigator and Tableau Forensic solutions will help them conduct more reliable and efficient investigations. Prior to joining the OpenText SC team, Victor worked at the Customer Support Help Desk, in Systems Administration and in Technical Support. This experience helps Victor bring a deep, hands-on understanding of the challenges customers face to his solutions consultant role. When Victor is not helping solve customer problems, he is actively involved in after-school activities with his kids. Victor’s idea of a perfect evening is enjoying a nice surf and turf meal and kicking back with a glass of whiskey and a cigar by an open fire.
Summary
As the number of devices and the amount of information on those devices increases, digital forensic investigators are overwhelmed with the places the need to search for evidence. This is resulting in increased case backlogs and strain on both corporate and law enforcement investigation resources. Learn how EnCase digital forensic investigation solutions help examiners get to the truth faster and more reliably.

International Computer Tech Support Fraud Investigation

9/29/2022 10:30 AM

Location
Seminole Ballroom I
Speakers
  • Russel Chubon
    Task Force Agent Russell Chubon has more than 25 years of experience as police officer and detective and joined the Santa Clara County District Attorney’s Office as a senior detective. He is assigned to the REACT Task Force located in the San Francisco Bay Area which specializes in investigating complex technology and internet-based crimes. Detective Chubon holds a master’s degree in criminal justice from San Jose State University and is a United States Air Force veteran as an aircrew member on C141 Starlifter and KC10 Extender aircraft.

Lunch Buffet

9/29/2022 11:15 AM

Location
Seminole
Summary
Whose Slide is it Anyway?

Chromebook Forensics

9/29/2022 1:00 PM

Location
Seminole Ballroom I
Speakers
  • Jessica Hyde - Founder/Owner - Hexordia

Forensic Investigations in Zero Trust Environments

9/29/2022 1:00 PM

Location
Studio 2B
Speakers
  • Justin Tolman - Forensic Subject Matter Expert
    Justin Tolman is the Forensic Subject Matter Expert at Exterro. He was formerly the Director of Training for North America at AccessData prior to and after the acquisition by Exterro. Justin has been developing written and video programs and training AccessData clients worldwide for almost 6 years. He also consults with clients on investigations and problems related to forensic issues and procedures. In his new role, Justin will be creating content related to forensic processes, technologies, and workflows, including those related to Forensic Toolkit (FTK). He will also interface with forensic professionals’ industry-wide to produce better tools and workflows that will help investigators be more successful in their work. Prior to working for AccessData, Justin worked as a Computer Forensic Specialist for the state of Ohio’s Bureau of Criminal Investigations. Justin has a master’s degree in Cyber Forensics from Purdue University and a bachelor’s degree in Computer Information Technology from Brigham Young University—Idaho.
Summary
Is your organization moving into a Zero Trust approach for data security? Already there? Conducting forensic investigations in Zero Trust environments can introduce new obstacles to your workflows. These obstacles can be especially difficult when the IT department and Forensic Departments are not on the same page. This presentation will cover what Zero Trust is, and possible solutions to conducting investigations in Zero Trust architecture.

Superhuman Computer Vision – Optimizing AI

9/29/2022 1:00 PM

Location
Studio 2C
Speakers
  • Bob Brown - CEO
Summary
Computer Vision (CV), Artificial Intelligence (AI), and deep learning promise to revolutionize automation in scores of industries and applications. There are hundreds of video analytics companies focused on training AI to interpreting video to drive vehicles, deliver security, empower robotics, and better understand the real-world around us. The problem is poor visibility creates poor imagery. A major problem of AI systems trained on pristine imagery are errors due to the inability to interpret real-world, unconstrained environments where video is less than perfect. According to IEEE, “To half the error rate, you can expect to need more than 500 times the computational resources.”1 ProHawk contends this promise to revolutionize automation cannot be achieved if the quality of the video and images are poor.

Break and Exhibit Hall

9/29/2022 1:00 PM

Location
Seminole

FinOSINT - Financial Open Source Intelligence

9/29/2022 1:00 PM

Location
Hollywood East
Speakers
  • Cynthia Hetherington - Founder and President
    Cynthia Hetherington, MLS, MSM, CFE, CII is the founder and president of Hetherington Group, a cyber investigations consulting, publishing, and training firm. With over two decades of expertise, Ms. Hetherington is a leader in due diligence, corporate intelligence, and cyber investigations. She is the author of three books on conducting cyber investigations and annually trains over 7,200 investigators, security professionals, attorneys, accountants, auditors, military intelligence professionals, and federal, state, and local agencies on best practices. She shares her expertise in this increasingly data-intensive, cyber focused-world through the publication of an industry newsletter, an online blog, and by hosting the annual OSMOSIS Conference. Ms. Hetherington leads national and international investigations in corporate due diligence and fraud, personal asset recovery, and background checks. With a specialization in the financial, pharmaceutical, and telecommunications industries, her cyber investigations have recovered millions of dollars in high profile corruption cases—assisting on the investigations of the top two Ponzi cases in United States history. Ms. Hetherington shares her experiences and expertise as a keynote speaker and contributor at women-focused technology events and conferences across the U.S. She is an active member in the Women in Security Forum, the Women’s President Organization, and collaborates with The National Center for Women and Information Technology on drawing young girls into the field. Ms. Hetherington serves as a lecturer and mentor to CybHER.org and RocketGirls at CyberSpace Camps held at the Kennedy Space Center. In 2021, Ontic Center for Protective Intelligence honored Ms. Hetherington with the Protective Intelligence Pioneer Award. In 2019, she was honored with the Enterprising Woman of the Year Award by Enterprising Women Magazine and the CybHER Warrior Award by Dakota State University Madison Cyber Labs. Also in 2019, she was shortlisted for the coveted Women in IT New York’s Entrepreneur of the Year Award and named a finalist in the esteemed Ernst & Young LLP New Jersey Entrepreneur of the Year Awards. Ms. Hetherington is a recipient of the Association of Certified Fraud Examiners’ James Baker Speaker of the Year Award.
Summary
Open source intelligence is a well-covered area of expertise that covers any and many areas of content. Building on these skills, the instructor will focus on financial intelligence research practices. Finding data related to transactional information, crypto currency markets, and any opportunity to track down fraudulent operations through the surface to dark web. Learning objectives: (1) Define FinOSINT, (2) Identify marketplaces online that financial information may be located in open sources, (3) Identify resources used specific to online asset investigations.

The Signal: Investigations into Metadata to Catch Villains

9/29/2022 2:30 PM

Location
Seminole Ballroom I
Speakers
  • Jesse Spangenberger - Senior Security Developer
    Jesse Spangenberger has 20 years of information technology experience expanding government, military and civilian work; 20 years of military experience; and Iraq and Afgan war veteran. Currently, he works for Arctic Wolf Labs developing and implementing network detections across a wide range of complex environments. Jesse holds degrees in Cyber Security, Electronic Repair, and a Master's in Digital Forensics Science from Champlain College.
Summary
Metadata the sidekick of any investigation. It is hidden data surrounding any file within any electronics system. Every file people engage with today contains metadata that can be used to enhance investigation. The BTK Killer is probably the most famous case today involving metadata but also cases dealing with contracts and police warrantless searches involve the usage of the data. A dive into Duke Thomas, a.k.a The Signal–a fictional character in the DC Universe trained by Batman and an interest in investigations–will lead down a winding road of understanding an unknown hero and unsung power of metadata. Thomas joined the Batman family during DC Rebirth and remains Gotham’s daylight protector mirroring Batman’s as the Gotham’s nighttime protector. Thomas’ powers of will describe metadata, changing of the data, and following the data. The Signal is the embodiment of metadata and learning how to use this sidekick can greatly help solve the mystery we face in our investigations.

Digital forensics for video files: Identifying the source of unknown video files and new approaches to authentication

9/29/2022 2:30 PM

Location
Studio 2C
Speakers
  • Bertram Lyons
    Bertram Lyons has over 20 years of experience in digital assets and data, specializing in the acquisition, management, and preservations of evidential, documentary, research, and other critical data types. Bert’s extensive experience include previous roles at the Library of Congress as well as projects for organizations including the FBI, Smithsonian Institute, HBO, Paramount Pictures, Facebook and Spotify. Bert is an Associate Member of the American Academy of Forensic Sciences (AAFS) and an active member of the Scientific Working Group on Digital Evidence (SWGDE). He has received certification from the Academy of Certified Archivists and is a graduate of the Archives Leadership Institute. He holds an MA in museum studies with a focus in American studies and archival theory from the University of Kansas.
  • Brandon Epstein - Adjunct Professor
    Brandon Epstein has served in law enforcement since 2007 and has been a digital forensic examiner since 2014. Brandon holds a Master of Science degree in Recording Arts – Emphasis Media Forensics and is a Certified Forensic Video Analyst (CFVA) and Certified Forensic Video Examiner (CFVE). He is the chair of the Scientific Working Group on Digital Evidence and is a member of the IAI’s Forensic Video Certification board, IACP Cybercrime and Digital Evidence committee, the American Academy of Forensic Science, and the NIST/OSAC Video/Imaging Technology and Analysis Subcommittee. Brandon is an adjunct professor in the New Jersey Institute of Technology’s Forensic Science Program and regularly provides digital forensic instruction to local, state, and federal law enforcement officers nationwide and internationally.

Performing Digital Investigations in the Cloud

9/29/2022 2:30 PM

Location
Hollywood East
Speakers
  • Thomas Yohannan - VP, Enterprise Client Relations
    Risk [Cyberinsurance | Security | Forensics | Law] I live where technology meets business and law. As an attorney with sales & technical partnerships skills, I focus on security, forensics and law (with a pinch of cyberinsurance). My passion for bringing products & services to market through a mix of strategy, research analysis and an understanding of risk and regulatory frameworks for high touch verticals helps enterprises companies succeed. From early stage tech firms (Cvent), to international leaders (UBS & Goldman Sachs) and industry giants (Cisco & Aon), I have been fortunate to spend my career crafting messages and growing bottom lines for some of the world's best IT solutions corporations. Education: USC J.D. | NYU M.B.A | Binghamton Univ. B.A.
Summary
'The workshop will encompass how to perform remote forensic collections from an on-premise device to a cloud platform. 1. How cloud platforms like Azure and AWS offer examiners new platforms and tools to leverage in their investigations 2. What forensic tasks are well-suited performing in the cloud, and which ones are still best performed on-premise 3. What legal or security challenges you should be aware of when performing investigations that involve data residing on-premise and the cloud.'

Eliminate backlogs and solve cases faster with Detego’s Unified Investigations Platform

9/29/2022 2:30 PM

Location
Studio 2B
Speakers
  • Andy Lister - Managing Director
    Andy Lister had a military career spanning nearly 20 years, including 10 years in UK Special Forces. He has vast experience of the full spectrum of direct and sensitive operations. He has been commended by SO15 Command, and other agencies, for his contribution to counter-terror policing and Sensitive Site Exploitation (SSE) development. He spent the last four years in his government role as the organisational lead for Digital Media Exploitation (DOMEX) capability including conventional overt and covert forensics. Nearing a further decade of commercial experience, Andy rapidly moved from special projects to Business Development Director and is now leading the great team at Detego Global as Managing Director.
  • CJ Hamidi - Director of Business Development
    C.J Hamidi, Director of Business Development for Detego in North America, has over two decades of experience in delivering tailored software solutions for customers in the law enforcement, military and corporate spheres. CJ works closely with customers to understand their pain-points and with Detego's team to deliver unique solutions that help address them.
  • Mike Bates - Sales Engineer
    Mike Bates is Detego Global's Sales Engineer for North America. Bringing close to 30 years of experience in law enforcement, his last post was as a Sergeant supervising a detective unit. Mike headed a team of investigators carrying out digital forensics investigations to uncover evidence in order to solve homicide investigations. Following his retirement, Mike ran his own Digital Forensics company before joining Detego Global.
Summary
Digital investigations shouldn’t be overwhelming! Join our presentation to explore how you can use Detego’s intuitive technology to rapidly acquire, analyze and report on critical data from 1,000s of devices and apps.See how you can leverage AI-driven analytics and workflow automation to reduce the strain on your teams and solve cases faster. Discover why Detego is the trusted choice for investigators in the law enforcement, military and corporate spheres.

Break and Exhibit Hall

9/29/2022 3:30 PM

Trickle Down Effect

9/29/2022 4:00 PM

Location
Seminole Ballroom I
Speakers
  • Devon Ackerman - Regional Managing Director
    Devon Ackerman is Kroll Cyber's North America Practice Lead and Head of Incident Response services. His background is as a hands-on digital forensic and incident response investigator engaged by Clients and Law Firms globally to consult on matters ranging from corporate espionage to network intrusions to ransomware to data breaches. He draws extensive experience in the investigation and remediation of cyber-related threats, trends and tactics from his prior career with the FBI, but also from involvement in Kroll's nearly 3,000 annual investigations. Devon founded and manages AboutDFIR.com, one of the internet's leading Digital Forensic and Incident Response repositories of related knowledge and information sharing.
Summary
Walks an audience through threat actor tactics and the trickle down effect of APT and skilled groups down to the Organized Crime groups and the mass scale executions.

When the Phone Just Isn't Cutting It

9/29/2022 4:00 PM

Location
Studio 2B
Speakers
  • Amanda Mahan - Director of Training
    Amanda joined the Oxygen Forensics, Inc. Training team in 2018 and is currently the Director of Training. Before her Oxygen career, Amanda specialized in mobile forensics and data analysis for Autauga County Sheriff’s Office in Prattville, Alabama. In that role, Amanda built extensive experience and a successful conviction record as an online undercover investigator. She also orchestrated law enforcement and Board of Education collaboration in an effort to educate children against potential online threats. She was a Board Member of Central Alabama Crime Stoppers, and a previous ICAC Task Force member who worked alongside the Alabama Law Enforcement Agency, FBI, Alabama Attorney General’s Office, and HSI. Amanda’s knowledge quest includes participation in training events with the National White Collar Crime Center, the National Computer Forensic Institute, and the International Association of Computer Investigative Specialists. She is a graduate of Troy University with a Bachelor in Science in Criminal Justice with a concentration in Digital Forensics.
Summary
Despite a valiant effort, the phone is still locked or under attack, but you need information now. Time to escalate. In this session, we’ll go over how to acquire computer and cloud account data to gather the necessary evidence.

Collection and Analysis of Network Traffic from Mobile Apps and Websites

9/29/2022 4:00 PM

Location
Studio 2C
Speakers
  • Matt Danner - Founder
    Matt Danner is the Founder of Monolith Forensics and the creator/developer of Monolith, a case and evidence management platform for digital forensics teams. Prior to Monolith, Matt spent 10 years as a digital forensics professional and has worked for various public and private organizations.
Summary
Ever wondered what data is being sent and received by the mobile and website applications you use? We are going to cover the tools and techniques to employ when capturing and reviewing HTTP traffic sent and received by mobile applications (iOS & Android) and web applications. Topics will include HTTP and HTTPS basics, a review of API frameworks such as GraphQL and REST, an explanation of SSL and TLS proxy bypass, and little reverse engineering of mobile applications.

Cryptocurrency and OSINT

9/29/2022 4:00 PM

Location
Hollywood East
Speakers
  • Anthony Reyes - Managing Director
    Anthony is a former Detective of the New York City Police Department (NYPD) Computer Crimes Unit. He responded to and led investigations on numerous complex cases on behalf of the NYPD. Anthony's specific areas of focus include Cybersecurity risk management assessments and audits, incident response, digital forensics, cyber terrorism, data encryption, malware detection, cybersecurity, intellectual property theft, and financial crimes. He assisted in one of the largest intellectual property theft cases committed by foreign nationals in U.S. history.
Summary
Cryptocurrency and OSINT How to enhance your cryptocurrency and other investigations with OSINT.

Jam Session/Hackeroke

9/29/2022 6:00 PM

Location
Backstage Cafe

Registration

9/30/2022 7:00 AM

Location
Seminole

Breakfast & Exhibit Hall

9/30/2022 8:00 AM

Location
Seminole Ballroom

What Google knows about you

9/30/2022 9:00 AM

Location
Seminole Ballroom I
Speakers
  • Danielle Ponce de Leon
  • Jessica Hyde - Founder
    Jessica is the founder of Hexordia and Adjunct Professor at GMU. She’s involved in community efforts including HTCIA, Marine Corps Cyber Auxiliary, DFIR Review, Cyber Sleuths Lab, SWGDE, OSAC, & FSI: Digital Investigations. Previous employment includes Magnet Forensics, Basis Technology, EY, American Systems, and proud veteran of the Marine Corps.
  • Romy Haas - Crime Analysts
    Romy Haas and Danielle Ponce de Leon are crime analysts at the Homicide Bureau on a large Southern California based law enforcement agency, and have over 30 years of service combined. For over ten years each, Romy and Danielle have provided investigative support in hundreds of homicide, missing person, and fugitive apprehension cases. Their work for Homicide Bureau allowed them to develop an expertise in the areas cell phone activity analysis and mapping, social media, and Google data analysis. They have testified as expert witnesses in over 60 murder trials and preliminary hearings. They introduced the Google reverse location search warrant their Homicide Bureau, and work tirelessly to keep the bureau up-to-date on ever changing digital evidence technology. Romy and Danielle have taught classes on digital evidence for detectives, and have presented at trainings and international conferences for crime analysts and homicide detectives on cell phone analysis, Google data analysis, and courtroom testimony. They have each received several awards and commendations for their hard work and dedication. Recently, Romy and Danielle have started their own law enforcement training company, R & D Investigative Support. At this time, they offer an 8-hour Google for Law Enforcement class. They will be offering a Cell Phone Investigations training in the near future.

Law Enforcement Investigations Analysis

9/30/2022 9:00 AM

Location
Studio 2B
Speakers
  • Michael Ciesliga - Sales Director
    Michael Ciesliga is the Sales Director in North and South America for Micro Focus LEMA (Law Enforcement Media Analysis), one of the leading AI technology platforms in the world. Prior to joining Micro Focus, Michael was a police officer for 15 years, 12 of which were spent working local, regional and international drug trafficking and money laundering investigations. Michael was assigned to an International Investigation Team while assigned to the Drug Enforcement Administration as a Task Force Officer. Michael worked closely with the Special Operations Division and law enforcement counterparts from Guatemala, Mexico, Colombia, Panama, Ecuador, the Netherlands, Italy, Poland and Australia. Michael is also certified as an Expert Witness in drug trafficking in multiple courts of law. In addition to being the Sales Leader for LEMA, Michael also assists Micro Focus’s Research and Development team to help create the next generation of law enforcement investigative software, using Micro Focus’s cutting edge AI and ML analytic tool, IDOL. Michael holds a Bachelors Degree in Criminal Justice from Adrian College, where he played NCAA Division III football.
Summary
- Introduction to LEIA o Based on IDOL - Link Investigations through all forms of Media o Pictures o Videos o Text - I2 Chart linking - For Investigators and Analysists

Investigation of Cyber Attacks Leveraging “False Flags”

9/30/2022 9:00 AM

Location
Studio 2C
Speakers
  • Christian Lees - Chief Technology Officer
    Chief Technology Officer (CTO) of Resecurity, Inc. Lees brings over 35 years of experience in the cybersecurity and information technology (IT) industry, with a proven track record of building technology for vulnerability assessment, intrusion detection, network security and DDoS mitigation at Trustwave, Level 3, MCI and IBM. Before joining Resecurity, Lees served as the CTO for InfoArmor, Inc. (acquired by AllState) for 12 years and most recently served as the CTO for Vigilante ATI (acquired by ZeroFox).
  • Selene Giupponi - Managing Director
    Selene holds a University Degree in Computer Engineering (University of Rome "La Sapienza", 2008), then she post-graduated in Computer Forensics & Digital Investigations (University of Camerino, 2009) along with the Ministry of Interiors (Italian Postal and Communications Police). Since 2008 she is a member of the Engineers Association in the Latina Province, and in 2009 she became member of its ICT Board of Directors. In 2012 she was among the core founders the Security Brokers. She operates as Witness Expert for the Digital & Mobile Forensics subject since 2008 (Technical Assessor at Civil Court and Criminal Court), working on domestic and international cases, and investigations.
Summary
'APT groups and advanced cybercriminals are widely leveraging “false flags” to complicate further attribution research and DFIR analysis by information security specialists. Investigation of such incidents require specific attention to aspects which may affect the collection of digital evidences and further conclusions in the result of their analysis. The presentation will cover past incidents involving such tactics, and experience of successful investigation shared with law enforcement organizations. Agenda: Introduction into “False Flags” (Why, How, For What) Examples of APT Campaigns leveraging “False Flags” Aspects to consider – TTPs, Origin of Attacks, “Legend”, Artifacts Geopolitical Elements (which may drive “False Flags”)'

Surviving a Ransomware Attack

9/30/2022 9:00 AM

Location
Hollywood East
Speakers
  • Ilia Lvovsky - Senior Computer Forensics Investigator
    Data Recovery and Digital Forensics specialist with over 15 years of experience in private and federal sectors. Sr. Specialist, Digital Forensics at Bell Canada, full-time digital forensics Instructor with BCIT – Digital Forensics and Cyber Security program and President of HTCIA West Canada chapter. Ilia took part in large-scale investigations and joint operations on the federal level as part of the Canada Revenue criminal investigations division and worked with private clients from around the globe. Specializes in civil and criminal digital forensics investigations, data recovery and extraction from severely failed digital devices.

Break and Exhibit Hall

9/30/2022 10:00 AM

Location
Seminole Ballroom

Systematic Approaches to Ransomware Investigations

9/30/2022 10:30 AM

Location
Seminole Ballroom I
Speakers
  • Brian Carrier - CTO
    As CTO at BasisTech, Brian Carrier leads the Cyber Triage digital forensics team, which builds software for incident response, digital forensics, and custom mission needs. He is the author of the book, File System Forensic Analysis—used as a textbook in many college-level forensics classes—and developer of several open-source digital forensics analysis tools, including The Sleuth Kit and Autopsy. Brian is an active practitioner in the field of digital forensics and continues to develop new techniques for incident response and forensics. He implements his broad and deep practical experience in open source software, which makes that knowledge available to incident response and law enforcement professionals, saving them time in the field. Brian has a Ph.D. in computer science from Purdue University and worked previously for @stake as a research scientist and the technical lead for their digital forensics lab and incident response team. Brian is the chairperson for the Open Source Digital Forensics Conference (OSDFCon). Besides OSDFCon, Brian has spoken at conferences including DOD Cyber Crime Conference (as keynote speaker), High Tech Crime Investigators Association (HTCIA), Digital Forensics Research Workshop (DFRWS), American Academy of Forensic Sciences (AAFS), National Cyber Crime Conference (NCCC), and Techno Security.
Summary
Ransomware investigations have become common for many organizations, but the variations in each malware family can still cause headaches and stress. In this talk, we will cover ransomware basics and two frameworks to help your DFIR investigation. One framework focuses on the essential DFIR characteristics of ransomware executables, things like if it can self propagate and automatically exfiltrate. We’ll review 5 recent malware families and their capabilities. The other focuses on system roles and steps that occur in an attack. By using the roles, such as the node that propagates the ransomware, you can help identify if you’ve fully investigated the incident. This talk is for responders who are new to ransomware and those who have seen too many networks that were taken down.

Merging into the Fast Lane with Vehicle and Mobile Data

9/30/2022 10:30 AM

Location
Studio 2B
Speakers
  • Kim Bradley - Forensic Consultant
    Kim Bradley retired from the Commonwealth of Kentucky where she worked the last nine years of her career as a Forensic Computer Examiner with the Kentucky State Police (KSP). Her state service before moving into digital forensics included positions in software development and database management. In addition to holding several certifications, Kim has degrees in Early Childhood Education, Computer Science and a Master of Science degree in Digital Forensic Science from Champlain College.
Summary
Analyzing similar artifacts from multiple evidence sources can be daunting and overwhelming. Mobile devices and vehicle extractions from the same case can be perplexing, often due to analogous data located (or not located) on both devices. Examiners are left with the arduous task of combing through this information to find artifacts of evidentiary value. In this session, we will navigate through the mobile and vehicle data to correlate contacts, look at event and geolocation data to determine timelines, level of involvement and locations of interest. Join me to learn how to shift your vehicle and mobile device examinations into the next gear!

The Key to Collecting Forensic Images

9/30/2022 10:30 AM

Location
Studio 2C
Speakers
  • Victor De La Pena
Summary
The increasing diversity, size and sophistication of digital media complicates evidence collection. Investigators need to be able to quickly image suspect devices, improve their efficiency and ensure forensic integrity. Learn about the new capabilities Tableau Forensic delivers in providing cost-effective, reliable, portable standalone forensic imaging of physical media for digital forensic investigations.

Forensic Analyses of Audio and Video Evidence

9/30/2022 10:30 AM

Location
Hollywood East
Speakers
  • Herbert Joe
    Managing Partner Herbert Joe, M.A., J.D., LL.M., B.C.F.E., C.F.C., D.A.B.F.E., D.A.B.L.E.E., F.A.C.F.E. Attorney Joe has 5 degrees, including 3 science degrees (B.S., M.A., M.S.) and 2 law degrees (J.D., LL.M.). His 34-year involvement in the area of forensic audio/video includes expert testimony in state and Federal courts in civil and criminal cases throughout the U.S., as well as overseas, giving regional, national and international (many CLE-approved) presentations, conducting research and authoring peer-reviewed publications and being interviewed or consulted with by various news and entertainment entities domestically and overseas.
Summary
Audio, acoustics, voice and video evidence are common in civil and criminal litigation. Such evidence is often extracted from computer or mobile devices. All parties must at least be generally familiar with what can (and cannot) be done forensically and legally with such evidence, e.g., forensic authenticity analyses, digital signal processing (enhancement), etc. Learn generally what can and cannot be done, whether you're the proponent or opponent of the evidence, and whether a case needs a consulting, rebuttal or testifying expert witness.

Lunch & Exhibit Hall

9/30/2022 11:15 AM

Location
Seminole Ballroom
Summary
DFIR Rock Trivia

IBD

9/30/2022 12:00 PM

Location
Immokalee Studio A

Applying Machine Learning to Challenging Digital Forensics Problems

9/30/2022 1:00 PM

Location
Seminole Ballroom I
Speakers
  • Chester Hosmer - Assistant Professor of Practice
    Chet serves as an Assistant Professor of Practice at the University of Arizona in the Cyber Operations program where he is teaching and researching the application of Python and Machine Learning to advanced digital investigation challenges. Chet is also the founder of Python Forensics, Inc. a non-profit organization focused on the collaborative development of open-source investigative technologies using Python and other popular scripting languages. Chet has made numerous appearances to discuss emerging cyber threats including NPR, ABC News, Forbes, IEEE, The New York Times, The Washington Post, Government Computer News, Salon.com and Wired Magazine. He has 7 published books with Elsevier and Apress.
Summary
Machine Learning offers great promise when applied to digital forensics. The question is how can we apply Machine Learning to digital forensics to: identify key evidence, uncover correlations, expose behaviors, categorize when/where/how, pinpoint aberrant activities, and even recognize anti-forensics techniques. This is not a theoretical lecture, rather real examples of the application of Machine Learning applied to digital forensics challenges will be discussed and demonstrated. The demonstrations are based on the application of Python and key Python ML libraries. All examples will be provided to the attendees of the presentation.

Forensic Review In the Cloud

9/30/2022 1:00 PM

Location
Studio 2B
Speakers
  • Justin Tolman - Forensic Subject Matter Expert
    Justin Tolman is the Forensic Subject Matter Expert at Exterro. He was formerly the Director of Training for North America at AccessData prior to and after the acquisition by Exterro. Justin has been developing written and video programs and training AccessData clients worldwide for almost 6 years. He also consults with clients on investigations and problems related to forensic issues and procedures. In his new role, Justin will be creating content related to forensic processes, technologies, and workflows, including those related to Forensic Toolkit (FTK). He will also interface with forensic professionals’ industry-wide to produce better tools and workflows that will help investigators be more successful in their work. Prior to working for AccessData, Justin worked as a Computer Forensic Specialist for the state of Ohio’s Bureau of Criminal Investigations. Justin has a master’s degree in Cyber Forensics from Purdue University and a bachelor’s degree in Computer Information Technology from Brigham Young University—Idaho.
Summary
Description: We can't hire our way out of backlog. Whether you are an IT Security professional at a big corporation, or an investigator in Law Enforcement, you need more efficient solutions and workflows to allow you to increase the speed to case closure, while still maintaining (or even increasing!) the quality of your final result. This presentation will detail forensics in the cloud and how it can help both corporate and law enforcement investigations in closing cases quicker.

What are the modern methods of attack and how to fight against them using the role based approach in digital forensic education

9/30/2022 1:00 PM

Location
Studio 2C
Speakers
  • Savina Gruičić
    Savina graduated from the Faculty of Electrical Engineering and Computing, University of Zagreb, where she obtained a bachelor's and master's degree in Information and Communication Technology, Information Processing profile. Savina works in INsig2 as a senior consultant in the digital forensics department and is a certified EnCase, Oxygen, MCFE, CHFI, and CCME examiner, where she is primarily responsible for forensic training and client education and also for support during demanding and complicated investigations. Savina was involved in equipping and setting up several digital forensics laboratories. She has excellent knowledge of forensic tools and great experience with consulting in digital forensics investigations.
Summary
The lecture will cover some of the modern attack methods and case examples. The brief introduction into the wide area of digital forensics investigations will give an overview of how many specialized fields and aspects within digital forensics exist and highlight the importance of expert knowledge in each. The key factor in being up to date and keeping up with the technology advancements is continuous education. During the presentation, the participants will be given an overview of the existing and recommended specialized training courses for each job role involved in digital forensics investigations.

Shine a Light on the Dark Web

9/30/2022 1:00 PM

Location
Hollywood East
Speakers
  • Keven Hendricks - Detective
    Keven Hendricks is the founder of the Ubivis Project (UbivisProject.org / StopDarkwebDrugs.com). Serving in law enforcement since 2007, Keven has been on the front line of combating cybercrime since 2014, being a member of an Internet Crimes Against Children FBI Task Force from 2014 to 2018, and a member of a DEA cybercrimes Task Force from 2018 to 2021. He is a published author with the FBI Law Enforcement Bulletin on VoIP investigations as well as an instructor on dark web and cyber crimes for Street Cop Training and Federal Resources. He is an 3CE and 3CI by the NW3C, CCI by the Blockchain Intelligence Group, and is recognized as a Subject Matter Expert in the field through the CSIAC and previously presented at OSMOSISCon 2021
Summary
This presentation will deal with the ever changing landscape of the dark web: from terrorism, to fraud, to narcotics. It will show attendees how cases can properly be investigated on the dark web, dealing with the established dark nets like TOR and I2P, as well as the up and coming ZeroNet. Attendees will learn best practices for preserving evidence, as well as techniques to help bring the suspect out from behind the veil of the dark web and correlate a real world user. From cryptocurrency transactions, to end-to-end encryption messaging apps, everything will be covered in this presentation.

Break and Exhibit Hall

9/30/2022 2:00 PM

Location
Seminole Ballroom

Uncovering the Artifact - Where it came from and why it's useful.

9/30/2022 2:30 PM

Location
Studio 2B
Speakers
  • Richard Frawley
    Richard Frawley is the Director of Training with ADF Solutions and is responsible for all training content globally. Richard started with ADF in 2016 as a Digital Forensic Specialist and quickly took charge of creating the content to build confidence in the use of the ADF suite of tools. Richard has successfully transformed the in-person classes of old to a dynamic online and virtual experience. Richard spent 22 years in Law Enforcement as a a Certified Forensic Computer Examiner and Cybercrime investigator before retiring and joining ADF Solutions
Summary
'When conducting a triage on scene or an early case assessment on a digital device there are plenty of artifacts that can help you put together enough Probable Cause to make a decision. What is an artifact, where do they come from, and why are they important? We will dig deeper into triage and explain artifacts such as user accounts, USB history, user logins, recent files, web history and downloads, where they came from, and how you can employ the results in your investigation. As an ICAC investigator on scene you will learn to understand specific artifacts, explain where they came from, and use the information to come to solid decisions when interpreting data from a digital device.'

Academic Student Outreach Subcommittee (ASOS) Meeting

9/30/2022 2:30 PM

Location
Studio 2C
Summary
Join the Academic Student Outreach Subcommittee to discuss your ideas of how HTCIA can be more inclusive and better support our student and academic members and prospective members. Meeting is open to all. Please bring your ideas and thoughts.

Coming Soon

9/30/2022 2:30 PM

Location
Hollywood East
Powered By GrowthZone