Brett Shavers's Blog, page 11
July 14, 2017
Placing the Suspect Behind the Keyboard online course
My newest course is out and it is the best course you will find on the topic. More than 12 hours of investigative methods and effective techniques to build a case against criminals who use technology to commit crimes.
Learn the methods to track criminals online and in the real world
Learn the tricks of the trade (tradecraft) of covert communications and breaking those communications
Learn how to build a case that would not have been closed without this course
Learn the one thing I that will give you the tools to become not only a great forensicator, but someone that can place a suspect behind the keyboard
Placing the Suspect Behind the Keyboard was the first digital forensics book focusing on building a good case on criminals who use technology to commit crimes. This also the first course teaching that specific topic. My intention with this online course is to put you into the mindset of someone working toward identifying the suspect, gathering evidence on the suspect, and proving allegations against your suspect; in effect, placing the suspect behind the keyboard.
CURRENT PROMOTION July 14-21, 2017
Amazing Promo for the first 100 registrations only!
$799 $399 HALF PRICE, 1-year access to Placing the Suspect Behind the Keyboard
$59 FREE! Copy of * nominated Digital Forensics Book of the Year 2014
$59 FREE! Copy of * nominated Digital Forensics Book of the Year 2017.
$599 FREE! 1-year FREE access to the online X-Ways Forensics Practitioner’s Guide course
PROMO CODE: psbk-100
http://courses.dfironlinetraining.com/placing-the-suspect-behind-the-keyboard?pc=psbk-100
This is over $1,500 worth of digital forensics goodness for just $399, but only for the first 100 registrations or until July 21, whichever comes first.
The might be a different promo the following week, but it won't be as good as the first week.
Holistically, this course covers everything you need, whether working in the private or public sector. Investigative techniques are discussed for both sectors as many methods can be used in both case types. A few sections are LE-only simply because citizens cannot wiretap other citizens (as an example), however, you can see the differences between a method used by law enforcement and the private sector. Practically speaking however, the actual methods are the same. A forensic analysis of a flash drive in a criminal case is not different than in a civil case, nor are the methods to tie a person to a device different.
If your career has been like mine, most cases are fairly straightforward. Perhaps a suspect was already identified and most of the evidence already seized. In many cases, whether it is a criminal arrest or being hired as a private consultant, generally, you start with all you need to begin examining the media. But if your career is like mine, there have been a few cases where that is simply not the case. This course is not only for the easy cases, but especially for the tough ones.
This course is not just for the average case, but developed especially to address the difficult cases.
Cases where the suspect has not been identified. Cases where the electronic evidence has not been seized. Cases where there are many suspects. Cases where the evidence linking the suspect to the device or crime is weak at best. For those cases, you need to take extra measures, think out of the box, and use everything at your disposal. You have to work at putting the suspect behind the keyboard, because if you don’t, it won’t happen.
Don’t let your case go to the cold-case files. Solve it! This course shows you how to do it. The books detail even more on how to put cases together, especially the really difficult cases where you have little to go. As for incident response cases (breaches), this is not a course on mitigating a breach, or tracking hackers in cyberspace. Although, many of the methods will work for just that. Incident Response can benefit greatly for the sake of sometimes the suspect in a breach must be caught for a variety of reasons. This course and books brings it to you.
The Placing the Suspect Behind the Keyboard online course uses the same material as the 2-day workshop with the biggest difference being not working actual cases in class. As a side note, in a previous class, a suicide case was reopened as a potential homicide case based on course methods in the class! The methods are proven to work.
April 29, 2017
The 2 Worst Games to Play in #infosec
The “Hot Potato” Game
The goal of the Hot Potato Game is to simply pass off responsibility to the next person as soon as you can before something bad happens. When the responsibility lands in your lap again, you pass it to someone else as soon as you can. Eventually, someone gets caught holding the hot potato and they lose (and you win!!). A similar version of this game is “Musical Chairs” game or “Kicking the Can Down the Road” game. By the way, it sucks to lose this game.
I have seen this game played in both the government and the private sector. Any long-time government employee can point to dozens of managers who are experts at this game. I believe there are so many experts because it is rare for a government employee to actually suffer when losing this game, which only encourages more people to play and gain experience in tossing the hot potato to the next guy at the table.
In the private sector, losing this game is an entirely different matter, especially when PII or PHI has been stolen. When that happens, fingers get pointed awfully quick and the government comes in with a hammer to smash as many thumbs as they can find. Did I mention that losing this game sucks?
The “Are We There Yet” Game
The "Are We There Yet" game is another popular game played in both the public and private sector. This particular game is also known as “We’ll Cross that Bridge When We Come to It” game. In this game, you know bad things are coming one day, and you accept that being worry-free today is worth the stress of dealing with an incident tomorrow, because we all know that tomorrow never comes.
I have actually seen budgets with anticipated expenses planned for incidents that could be avoided with preparation and less money. I guess some organizations believe that if they don’t spend money now on preparation (defense), they may not need it for remediation after a breach, so it may make a better business decision. This game is also known as “Craps”.
When I consult for corporations and government entities, I always advise to not play these games (in a professional manner rather than saying 'don't play these games'). Fortunately, I find that many organizations are spending money now to prepare rather than hope for the best. The organizations that want to prepare are doing really good, taking advice, and in some cases, going beyond what is required. In technical terms, I call this a great job.
I have gotten to the point that when I hear a client choose to play either of these games, I don’t laugh out loud anymore, especially when I hear verbatim, “We’ll cross that bridge when we come to it”. When I hear that, I usually leave a half dozen business cards…
Hopefully you aren’t forced to play in these games and that when you say that you need money and time to prepare for unexpected breaches, you get it. This same thing applies to internal employee matters too. Any organization that haphazardly gives out electronic devices without any controls to employees….is an organization playing the hot potato game. I tend to believe that with so many attacks, so many breaches, and so many organizations frozen with Ransonware, organizations start to take notice. It's kind of like everyone in your neighborhood getting burglarized. You can choose to either hope your house is not burglarized or you can install an alarm, lock your doors and windows, and prepare just in case.
April 14, 2017
Forensic 4:cast awards.... VOTE FOR MY BOOK!! (pretty please)
I am humbled again as my book,.Hiding Behind the Keyboard, has been nominated for the Forensic 4:cast Digital Forensic Book of the Year. It would be my honor if you would vote for the book.
The two competing books are also great books, but this one is mine
April 12, 2017
The 2 Fastest and Least Expensive Ways to Learn X-Ways Forensics
My advice to X-Ways Forensics users is to stop thinking you can figure it out by yourself, even if you have been using X-Ways Forensics for any length of time. There are simply far too many nuances and hidden features that you are missing every time you try to figure it out or use on cases. If you really want to get down and dirty to learn X-Ways Forensics fast and cheap, here is the ONLY way to do it.
Buy the book (list price is $59.95)
Take the online class (regular price is $599.00)
But, wouldn't you rather want to learn how to use X-Ways Forensics saving even more money? If so, you want to sign up right now because right now is the biggest discount for the course while getting the most swag! Get up to 80% off the price PLUS a FREE copy of the book and if you act fast enough, be invited to even more FREE training!
If you register within the next 7 days (April 19), you can get the X-Ways Forensics Practitioner’s Guide online course at 50% off for only $299.
AND, if you register within the next 5 days (April 17), you will also receive a FREE COPY of the X-Ways Forensics Practitioner’s Guide book*!
Or better yet! Want more off the tuition? Retweet the below tweet before April 17 and get a promo code via a direct message for a total of 80% off the course for ONLY $119, plus receive a FREE COPY of the X-Ways Forensics Practitioner’s Guide*!
Get up to 80% OFF the online X-Ways Forensics Practitioner's Guide course PLUS a FREE copy of the book! https://t.co/jA28o8VirE #DFIR pic.twitter.com/PIULssoQFD
— X-Ways Guide (@XWaysGuide) April 12, 2017
If you do not receive your 80% promo link via Twitter DM, email at This email address is being protected from spambots. You need JavaScript enabled to view it.
How about even more! The first 20 registrations will be invited to a live, 2-hr online X-Ways Forensics course with me to demonstrate using X-Ways Forensics as a triage tool and for electronic discovery (this includes using the latest build of the Windows Forensic Environment – WinFE). These first 25 registations still receive over 12 hours of the online X-Ways Forensics Practitioner's course and a FREE COPY of the book!
The first 20 just filled up the live course, but the promo for up to 80% plus a FREE book is still good.
The course has never been discounted this deep, so this is the best time to take advantage of learning to how you can exploit X-Ways Forensics to its fullest potential, learning from your computer, on your own time, at the lowest price.
Since 2014, more than 2,000 students have registered and taken my online courses with 24/7 access.
“It has helped shed lights on things I have missed in the past.” -student
“I got to say I’m enjoying the videos.” – student
*For outside the USA, only a Kindle version is available as part of this promotion. Registrations within the USA can choose between print or Kindle.
If you are one of the first 20 to register, I will send an invite to the 2-hr online course after arranging a mutual time for the majority of the 20 students. I'll try to pick a time that fits all 20, but that may mean some may have to stay up late or get up early to make the course unless we all live in the same time zone.
If you do not have a Twitter account and want to take advantage of the additional price discount (80% off), if you have any other social media such as Facebook to spread the news, send me a screenshot (This email address is being protected from spambots. You need JavaScript enabled to view it.
February 9, 2017
FREEZE! Busted by the Fridge.
The ways that tech influences writing fiction, making movies, and busting criminals.
One interesting investigation I had was that of a murder-for-hire in one city that the suspect used a Google search to find the victim’s home address in another city. Simple enough crime to plan. Google the name, find the address, do the hit. Except in this particular case, although the suspect Googled the correct name, there were two people with the same name in the same city and he picked the wrong one. I called this case my “Sarah Connor” case.
Fortunately, we intercepted the hit before it happened and prevented a random murder on the wrong person (as well as preventing the murder of the ‘right’ person). In a basic sense, the suspect used the technology of one of the most advanced computer systems in the world (Google….) to attempt a murder only to choose the wrong name in a Google search hit. This type of criminal incompetence and carelessness is commonplace. It is also the way that most get caught.
On the other end of the spectrum, we have Hollywood’s version of high tech crime fighting. Minority Report with Tom Cruise showed us that not only can crimes be solved with technology, but that crimes can also be prevented with technology. As for the technology used in the movie, it could have only been more accurate had a predictive analysis computer system been used in place of the fortune-telling humans (“Precogs”) in a big bathtub.
In a turn-key surveillance system, no person is anonymous. Whether it is a private business or government agency, no one is immune from potentially being watched, tracked, or reported. Private businesses use facial recognition for both improving customer service by detecting your mood through facial expressions as well as preventing crime.
“…faces of individuals caught on camera are converted into a biometric template and cross-referenced with a database for a possible match with past shoplifters or known criminals.” https://www.theguardian.com/cities/2016/mar/03/revealed-facial-recognition-software-infiltrating-cities-saks-toronto
Criminals who try to avoid using technology are severely limited on the type of crimes they can commit. That’s a good thing. A drug dealer without a cell phone is like a taxi cab driver without a taxi. It is part of the business and can be tracked, traced, monitored, intercepted, and forensically examined. Technology is a natural and required part of any criminal’s operations. Criminals not using technology are ineffective as criminals, for the most part.
January 4, 2017
Want to know how to break into DF/IR?
I see the digital forensics training market reaching a saturation point in some aspects. Most, if not all, forensic software companies provide training, govt agencies provide internal training, individuals provide training, every college looking for a new revenue stream is adding forensic programs for training, and a new forensics book comes out every few weeks or so. Add that to those who can teach themselves and you have DF/IR training market that is fat. By the way, if you can teach yourself forensics by gobbling up every crumb you can find, you will have a long career in this field.
There have been a lot of blog posts, articles, forums, and opinions posted online about how to break into the field of DF/IR. Here are a few decent links, and of course, a Google search will find dozens more. You will see by the dates that it has been years of the same question being asked...
https://digital-forensics.sans.org/blog/2010/08/20/getting-started-digital-forensics-what-takes/
http://www.techrepublic.com/blog/it-security/breaking-into-the-digital-forensics-field-melia-kelleys-path/
https://www.reddit.com/r/computerforensics/comments/1o2s5x/looking_to_get_into_computer_forensics/
http://www.techexams.net/forums/jobs-degrees/99839-looking-enter-into-digital-forensics-field-need-advice.html
http://smarterforensics.com/2016/08/so-you-want-to-break-into-the-field-of-digital-forensics/
https://www.thebalance.com/how-to-become-a-digital-forensic-examiner-974633
https://articles.forensicfocus.com/2011/10/07/advice-for-digital-forensics-job-seekers/
The common theme is asking, "How do I get into digital forensics?" when the better questions to ask are, "Which college program will work best for me?", "Which discplines in DF/IR should I focus on?", "Which programming languages are relevant?", "Which software should I learn?", "What are hiring managers looking for?".
You won’t usually find this topic constantly being brought up in other career fields. For example, if someone wants to become a doctor, there isn’t much to the answer other than, “go to a medical school.” If someone wants to become a lawyer, the answer is typically, “to go a law school.”
...December 21, 2016
Reminder for the last discount for the X-Ways Forensics Practitioner’s Guide Online and On demand course.
If you were thinking of doing it, this is the best time since the $599 online course will only be at a discount of 60% for less than two weeks (until Dec 31, 2016) for only $235. PLUS, registering before December 31, 2016 gets you a print copy of the book, the X-Ways Forensics Practitioner’s Guide shipped to you. Unfortunately, the book is only included for US/Canada registrants since shipping a book outside the USA or Canada costs more than the book. Shipping to some countries costs more than the entire X-Ways online course costs. I’m happy to ship a copy, but the shipping fees must be added. Best bet is to order a book online that delivers locally without extreme duty fees.
Register with the 60% discount using this URL: http://bit.ly/xwfpromo
Just a few notes on the online XWF course based on emails I have received:
Time limit: You have a year to view the course as often as you want.
Software: Not included. You don’t need it for the course, but I think you’ll want to have a license. If you want to know how XWF compares to other tools, you can get 12 hours of instruction showing how it works and much of what it can do. Once you start using XWF, you’ll begin to see that it can do a lot more than what the manual or any course can teach.
...December 17, 2016
Brett's opinion on writing a DFIR book
Let me disclaim a bit. I don’t know everything about writing or publishing. All I know is what I have done. With that, I have been asked about writing books (computer/digital forensics topics) over the past few years. Let me give my experience to anyone considering writing a forensic book.
To start, I have written three books so far, meaning that I am writing more. Two of the three published books have had co-authors.
December 16, 2016
The most important tool in DFIR that you must have...
One of the workstations I have ranks up there in the clouds insofar as hardware. You name it, this machine has it. Lots of it. Crammed into a huge case with lots of lights and liquid cooling hosing. I call it the “Monster”. No matter what I throw at it, it chews it up, spits it out, and smiles asking for more. Seriously. It’s a dream machine of a forensic workstation.
One thing about it however is that no matter how fast it is, or how cool it looks, it doesn’t really do forensics. You see, I have this other little computer (laptop). It’s really really small and light. No CD/DVD drive, one USB port, and stuffed with high-speed hardware, but not that you can stuff that much in such a small laptop. I call this one my “Little Baby”.
When I go somewhere, I take my Little Baby. It does everything I need for the most part. I would not want to try to index a terabyte or more to index, or try to do any serious processing with it. However, this Little Baby does forensics work. I've done forensic work in the offices of lawyers, in front of judges, and in court. Each time using my Little Baby (I have a few, but they are all my Little Babies).
I mean this in the manner that it’s not the machine (such as my Monster or Little Baby), but the examiner, that does the forensic work. If you forego “processing” and “indexing”, the forensic machine comparisons in speed become irrelevant and everything comes down to the examiner. I mean everything. The best examiner can use X-Ways or Encase or FTK or any open source forensic tool on practically ANY computer when it comes down to deep-diving into electronic evidence. The machine allows the examiner to use a software to access the media. That’s it. A million gigs of RAM won’t let you examine the registry any faster than 4GB will. Your eyes and the stuff between your ears will get the job done.
When I teach forensics, one of the things I try to get across is that it is the person that gets the job done. Flashing lights are cool on a computer, but if the examiner doesn’t know how (or where) to find evidence on a hard drive, then the flashing lights are not going to help. If the examiner does not have critical thinking skills to investigate (or now commonly being described as "hunting") threats or evidence, then the tools are useless.
...November 5, 2016
Learn by drawing out the experiences of others
I have taught digital forensics at the University of Washington (on and off) for the better part of a decade. I have also been a guest speaker at several universities for longer than that. One thing that I learned from the continuing education courses is that most of the students are already working adults with many already working in the IT industry, and I take advantage of their experience by incorporating it into the classroom.
For example, I have had attorneys (prosecutors, public defenders, and civil attorneys), police officers, federal agents, software developers (some were founding members of commonly used software), and a few ‘white hat’ hackers in my courses. Students who did not fit in any of those categories sat right next to them.
Can you imagine what you can learn being a student sitting next to the developer of a major Microsoft program for 10 weeks? Or next to a federal agent who was involved in well-known national security investigations? Or a homicide detective of a large police department?
That was the benefit to the students: being able to absorb information from fellow students with years, if not decades, of experience. On the first day of every course, I stress this to the students. Take advantage of the 10-minute breaks, not by checking your email, but by talking. Those 10-minutes breaks produce more relevant information than can be gained from a Google search, because you can talk to the people who have done it, do it every day, and want to share. Rather than 'read' about a case, speak directly with someone who does those cases.
As for me, you better believe I took advantage of the students with experience, all for the betterment of the courses and myself. In my prior law enforcement career as a city cop, I was a detective that worked undercover and was assigned to state, local, and federal task forces as well as investigated cyber-related crimes that spanned the planet. I also investigated multi-national organized crime groups (drug trafficking organizations, gun trafficking, outlaw motocycle gangs, street gangs, human trafficking, counterfeit goods, etc…), terrorist cells in the United States, along with a few other crimes that took me across several states.
I give my brief background not to brag, but to show that even with my experience, I gained something from every class from nearly every person and I asked for it directly. When I found that I had a software developer from a major software company in class, who worked on a program that I use daily…I used him for discussions in class on incorporating that program into forensic analysis reporting and visualization. Every student in the course may not have recognized the value of speaking with someone instrumental in that one program, but we all learned new ways to use something in forensics that we would not have learned otherwise.
...
