Don't Strive to be Mediocre!

Send us a text

Embark on a journey through both history and the cutting-edge world of digital forensics with us as we pay homage to the brilliant Dr. Gladys West, whose work underpins the GPS technology we take for granted today. In celebration of Black History Month, we draw inspiration from Dr. Martin Luther King Jr., discussing how we can all contribute to the fight against enduring societal challenges. Our conversation is a testament to the power of empathy and action in fostering societal change, spotlighting the often overlooked breadth of achievements by historical figures like Dr. West and Dr. King.

Unravel the complexities of iOS location and  Unified Log analysis through our educational talk on the recent breakthroughs highlighted by experts like Ian Whiffin and Lionel Notari. Discover the new feature from Magnet Axiom. The Animated Map Routes feature provides an additional facet for courtroom presentation. 

We wrap up with a deep appreciation for the significance of training and expertise in digital forensics, engaging with the thoughts presented by Shafik Punja in his 'Bullshit Hunting: Digital Forensics Edition' article. The discussion traverses the critical role of proper forensic training and tools, the ethical responsibilities that accompany our work, and the profound impact that our industry has on legal outcomes and lives. 


Notes-

The Cyber Social Hub- Daily Digital Investigator Episodes
https://podcast.cybersocialhub.com/

Belkasoft's Free Android Forensics Class
https://belkasoft.com/android-forensics-training

Apple Maps - Visited Location?
https://www.doubleblak.com/blogPost.php?k=mapssync

iOS Unified Logs - WiFi and AirPlane Mode
https://www.ios-unifiedlogs.com/post/ios-unified-logs-wifi-and-airplane-mode

Animated Map Routes in Magnet Axiom
https://www.youtube.com/watch?v=fyPrJKLhD9k

8 Log Files You Can Collect from iOS and Android Devices
https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/

Candidate Examiner's and Training Programs
https://www.bullshithunting.com/p/bullshit-hunting-digital-forensics

Sources of Error in Digital Forensics
https://www.sciencedirect.com/science/article/pii/S2666281724000027

Episode Transcript

Speaker 1 (00:16):
Welcome everybody.
It's Thursday, february 29th2024.
My name is AlexisBriggs-Brignoni and I'm a
company by my co-host, the onewoman digital forensics training
program, the one that's downwith the SOPs yeah, you know me,

(00:39):
I mean her.
The one that's unique like aviable bit hash Heather
Charpentier.
The music is higher up by ShaneIvers and can be found at
Silverman Soundcom.
And we start the show onceagain.
Hello, heather.

(00:59):
Hi how do you like that intro?

Speaker 2 (01:03):
Down with the SOPs.

Speaker 1 (01:05):
Yeah, you know me, at least I got the reference.
For a change.

Speaker 2 (01:11):
Yeah right, oh my gosh Well thank you everybody.

Speaker 1 (01:16):
I see people joining in from Instagram and people
joining in from YouTube and fromall places.
So again, we're really, we'rereally happy to see you.
I got Michael Tana's happy leapyear February 29th to all, so,
I agree, happy leap year foreverybody as well.
And what's going on, heather?
What happened this last coupleof weeks?

Speaker 2 (01:36):
Well, I guess I'm training and I'm down with the
SOPs the last couple of weeks.
You have to be yeah definitelyDoing a lot of work, and you
know same stuff.
I'm not writing any scriptsthis week, though.

Speaker 1 (01:57):
I'm disappointed and sad you need to pick it up.

Speaker 2 (02:00):
Yeah, I know right.

Speaker 1 (02:03):
Yeah, it's like any skill if you don't use it, you
lose it.

Speaker 2 (02:06):
How about you?
What's new?

Speaker 1 (02:09):
I have a little DFN light there on top of my head,
so the folks who are listeningis Neon Lysos, dfn obviously,
dita Forensics.
Now, right, we're on air.
Another neon sign underneathand you know maximum effort, so
that'll be a topic, a part ofthe topics that we'll discuss
today, so we have a good showfor everybody.

(02:30):
Obviously, we're still the lastday of February, so we're gonna
again share with you a coupleof thoughts for Black History
Month, and Heather's gonna bringus the first person that we're
gonna be celebrating with.

Speaker 2 (02:44):
Okay, so I chose to present Dr Gladys West as the
notable contributor to the field.
She is an Americanmathematician known for her work
contributing to the developmentof the global positioning
system, so GPS.
She was valedictorian of herhigh school graduating class,

(03:07):
received a full scholarship toVirginia State College, and she
earned her degree in mathematicsthere and later earned a
master's degree in mathematicsat the same school.
She was hired as amathematician by the US Naval
Proving Ground, a weaponslaboratory in Virginia, and she
was their fourth Black employee.

(03:27):
In 2018, west was formallyrecognized for her contribution
to the development of GPS by theVirginia General Assembly, and
that same year she was inductedinto the Air Force Air Force
Space and Missile Pioneers Hallof Fame and named one of the

(03:48):
British BroadcastingCorporations 100 Women of 2018.

Speaker 1 (03:53):
Nice.

Speaker 2 (03:54):
Yeah, so really inspiring, inspirational woman
who contributed to the field.

Speaker 1 (04:01):
Yeah, if we went for her, we would be all lost.
Yeah, definitely, some of usare lost, even with GPS but
that's another story.
I would definitely be lostwithout GPS, that is for sure.
And it's amazing, likesomething to take for granted
technology, but there's realpeople, human beings, that had
to come through a lot ofadversity to contribute and do

(04:24):
things.
So it's good to remember them.
So that's pretty cool.

Speaker 2 (04:26):
Actually too, before we switch.
I had, of course, I forgot toopen it while I was talking, but
I'm going to throw her pictureup on the screen here.

Speaker 1 (04:35):
Yeah, yeah, let's see her.

Speaker 2 (04:36):
So this is Dr Gladys West, who contributed to the GPS
.

Speaker 1 (04:41):
Awesomeness, awesomeness.
That's pretty cool, so I wantto.
We went to follow up with, forback history month, one of the
folks saying I can, maybe youcan put that picture up here for
the section In LinkedIn.

(05:02):
Obviously we're all celebratingand some examiners were
celebrating and one of theexaminers put a picture and
here's going to bring it out.
Still see Eldridge, reallycapable, awesome examiner and
she put a little note.
So different things that DrMatthew Newton King we should
know and some people don't knowabout, and she make a list of

(05:22):
some of those really importantones.
And we have this discussion andwe were agreeing that sometimes
our history classes are alittle bit faulty in certain
parts, right.
So that's why we have this typeof celebration, so we can be
more educated and what I wanted,and we're going to leave that
on the screen.
But I just wanted to mention acouple of things.
We talk about inspirationalpeople for Black History Month
or for whatever celebration itis, but I think it's also

(05:44):
worthwhile to remember thereasons we're celebrating these
individuals, specificallysomebody like Dr Martin Luther
King, right, and I would alsomake a couple of points in
regards to his life, philosophyand his message and how he
talked about the importance ofthe individual to address three
what he calls systemic evils,right.
Poverty, racism and militarism.

(06:07):
And what he meant by that andkind of apply to the, you know,
to today, in 2024, you knowpoverty, homelessness, hunger,
malnutrition, illiteracy right.
Racism we can talk about thatas prejudice.
Antisemitism, sexism,homophobia, ageism right.
Militrarism we can talk aboutdomestic violence, rape,

(06:27):
terrorism right.
We all remember Dr King's I havea dream speech, really
inspiring, but most of us don'treally know anything more than
that.
Right.
And we also have to realize and, you know, look back at his
writings and his speeches andrecognize that for an ideal to
actually become reality, itrequires action.

(06:51):
Right, it requires individualintrospection and action.
It requires us to demand andask for elected leaders to
address these ills, right, andto really speak to our better
angels.
Right.
It requires us to do littleacts of kindness every day, to
put ourselves in the shoes orthe mindset of others.

(07:12):
Think how would somebody with adifferent background for me
would see this thing andappreciate the diversity of
experience, of thought, ofcolors, of mentality and value
them, because there's value inintegrating those and
recognizing that my viewpointdoesn't necessarily have to be
the best one at all times right.

(07:33):
Hopefully that makes sense andif we remember those things then
we can put a little grain ofsand in taking this experience,
this world, and leaving itbetter than how we found it.
And that's the parting thoughtfor this week on that.

Speaker 2 (07:49):
Very good.

Speaker 1 (07:50):
Actually, before we continue, I want to highlight,
you know, they said it's a leapyear.
So, kevin, being the smartKevin that he is, he's like more
, like leap.

Speaker 2 (08:01):
Oh yeah, there you go , yeah, yeah.

Speaker 1 (08:03):
So leap as in log events on property sparser, some
of the scripts that we manage,so more like leap year, am I
right?
So I liked it, I liked it.
I know it's like a dad joke,but I like it All right.

Speaker 2 (08:13):
That's good.

Speaker 1 (08:15):
Yeah, so, yeah.
So we celebrated that.
So what we got next?

Speaker 2 (08:18):
So I wanted to mention a new daily investigator
episode daily digitalinvestigator episode that's put
on by the Cyber Social Hub,which is Kevin DeLong, and he is
doing daily.
He's picking out daily articlesthat show up in his feed or
something that's interesting inthe field and he's highlighting

(08:41):
it and it's a really shortlisten Once a day, just a few
minutes, about an article oranother podcast or some kind of
research in the field.
So if anybody everybody gets achance to head on over to his
podcast, take a listen.
There's some really good,really good things he's talking
about on those daily Podcasts.

Speaker 1 (09:02):
Yeah, and on my drive to work I like to do that I put
a couple of podcasts Like in arow, like a little semi playlist
before I leave so you canlisten to him and then listen to
us or listen to something elseand you know, you get like a
little bit of an education asyou're driving.
Usually, as we're driving,we're not really, you know, just
driving right, so you can takeadvantage of that time, you know
.

Speaker 2 (09:21):
Those are perfect for my ride to work, because my
ride to work is only 15 minutes,so I can listen to one a day on
my way in there you go, boomyeah, you're done with the
podcast too, apparently.
Another thing going on isBelfast off's free Android class

(09:41):
opened up a few days ago on the26.
They've made a couple changesto the way they're handling it,
though.
They had such a large number ofregistrants that they're
rolling it out access to thecourse gradually.
So if you signed up andregistered for that that free
Android class with Belfast offand you haven't gotten your
entry key yet, it'll be here.

(10:03):
They said that everybody shouldhave their entry key, I believe
, within two weeks of the dateof registration.
So if you get a chance to takethat I know their iOS class was
really good and I'm lookingforward to Taking the Android
class and that'll be open forfree for a month.

Speaker 1 (10:20):
So yeah, no, that's awesome and I don't know if jury
jury's.
You know the founder of thecompany.
You know that you made anannouncement yet or not, but
they're gonna have like someConference coming in, like you
know, virtual conference and allthat.
So let's keep an eye out onthat and hopefully I'll be able
to present.
So I'll put in for that andfingers crossed.
So we'll see yeah, nice.

Speaker 2 (10:43):
Um, there was a blog that came out today to.
Ian Whiffen put a new locationblog, which I he's kind of like,
the locations King.
He has so many blogs onlocations and what they mean or
what they actually don't mean.
I'm gonna just share my screenhere for a second let's see.

(11:04):
So he did a blog on the mapsync.
So in iOS, the Apple Maps, themap sync database, and he had
some really interesting researchin here, some things that that
Came out exactly the way hethought it would.

(11:24):
The data in the database wasactually what do you expect it?
And then some that he didn'texpect, some timestamps that he
didn't expect.
So everybody gets a chance tohead on over and check out that
blog.
It's really good data and heactually details all of his
testing, as you can see here inthe database, and really lays it

(11:46):
all out for For you to see yeah, and I think, if I'm mistaken,
that database has some put-abufin it and some other things.

Speaker 1 (11:53):
So I'm gonna sit down with it and update some of my
parsers to make them, you know,based on this information,
making it even better.
And you, you have to be awareyou can't just say, well, I'm
just gonna wait for the tool tosupport it and then we'll see
what it is.
Sometimes, you know, a lot oftimes, even when the tool
supports it, if you don't takethe time to understand the
artifacts, whatever the tool isshowing you, you'll be clueless.

(12:14):
Let's, let's be real here.
So you need to understand thebackground of the output.
So, whatever output the toolgives you, you can interpret,
interpret it correctly forwhoever needs it.

Speaker 2 (12:25):
So right, and also these blogs about locations have
saved me quite a few times.
Locations don't always meanwhat you think they mean you.
Your first glance you're like,oh okay, so they, the device was
in this location.
And that is not always the case.
So if Locations are parsed by atool and you do that, check all

(12:46):
locations and send it out, it'sgonna be super confusing to
whoever your end user is, andIan really helps make sense of
which are the more trustedlocations that you can find in
an iOS device.

Speaker 1 (12:59):
Yeah again, and we talked about that last time and
we talk about tolerances lastepisode.
Well, same with data sources inmobile devices or any device.
Some are more accurate thanothers.
They're not.
They don't all have a hundredpercent accuracy and I think
people just assume that, right,yeah, and if that's not the case
, I even have memes about itwhich you could share another
time.
But you need to understand andhow accurate your data source is

(13:22):
, to put it in context, and ifyou don't do that, you you'll be
making some mistakes or not,given the service that it is
expected.
So if I follow, follow andfollow Ian and go to his blog
and and benefit one of my mainresources, so we'll check it out
.
Oh, and, as always, we'll putthose links in the show
description, so you don't haveto worry about writing that down

(13:44):
now definitely.
And so another blog post thatwas pretty neat came out this
week.
It's on iOS unified logs, andit's a blog by.
What's his name?
No, no, terry, right, I forgothis name, lionel notary, if I
know I'm mistaken, I'm prettysure right yeah, and it's pretty

(14:05):
good because what he does is hetalks about unified logs and he
shows some of the the messagesthat could be of relevance in
regards to Wi-Fi and Airplane.
More like Wi-Fi, there's aconnection with Wi-Fi.
It shows what to what itconnected.
The BS ID that was connectedwas airplane Mode on or off.

(14:25):
It also shows if you activatedit by using the control center
by swiping, you know, the screenor by hitting the back part.
So it shows how that shows inthe log is doing this testing.
He's looking at how the logrecords those activities as he's
doing them.
Okay, so for folks that are notaware of what the iOS unified

(14:45):
logs are, I'm gonna give a quickdescription.
This log format is utilizedacross all Apple devices.
Okay, you will find it in Macs.
You'll find it in app in iPad.
You'll find in iOS.
Okay, this log format.
It's binary format, so you can.
You can't just open it and lookat it.
I mean, you can and you canread a few things, but it will

(15:05):
make no sense, so you need touse Apple, a Mac computer, to be
able to go through it.
There's some parsers out thereand it's hit or miss because
there's a couple differentVersions of these logs and it's
called a bit over here hit ormiss to parse them outside of an
Apple machine, but for sure itcan be done.
I use use a Mac computer, whichI'll show you in a minute these

(15:28):
logs and With an extension ofdot trace v3 as in Victor, and
there's a whole bunch of themand it keeps track of that.
So I Again from.
We use this for a long time andif you take that individual log
Dot trace v3 file and try toopen it, it's gonna give you
some problems.
It's not gonna really workbecause there's other

(15:50):
considerations.
The log needs a time sinkinformation to make sure the
time Offsets are correct and itneeds other information.
So the best way that I thinkfrom iOS device iOS devices at
least that I think should bedone is by generating first
assist diagnose log.
Okay, when you generate that,one of the outputs will be a

(16:10):
compilation of all these logs ina really nice format that's
really easy to open with a Maccomputer.
I know this sounds a little bitesoteric but I'm gonna show you
right now.
So I'm a good friend of thepodcast and personal friend as
well.
Geraldine Balai she has a greatarticle in her in her in her

(16:34):
blog, where she talks about letme show you here you can see on
the screen.
The article is about how tolook at these Logs and look for
airdrop artifacts.
The point I want to show youthis is because, as part of
showing those airdrop artifacts,she gives a great explanation

(16:54):
on how to go about and Gettingthose logs and has you can see
there has the pictures like stepby step go to settings, go to
general privacy, and it tellsyou what to hit to then generate
the logs and then she tells youhow to pull them out of the
device.
Okay, so that's so.
Go check that out and we'll puther blog post on on the notes

(17:16):
for the show.
Okay, all right, so we got that.
Now what do we receive?
So I'm gonna now move over andopen Share my, my actual
desktops.
You, we can look at that realquick.
Let's share my screen here,screen number two Yep, there we
go.
So what you see here is a littlebit small, but don't worry,

(17:37):
what I want you to see is gonnabe large in a second.
You see that after you do yourextraction of the iOS six
diagnosed logs from the device,you can look in there and get
the system underscore logs, dot,log archive right, it looks
like a file, right.
It's not really a file and letme, let me show that to you.
It's really.
Let's open it with a newterminal.

(18:00):
There it's actually like a typeof directory and I don't sell a
bit small, but Maybe let's makeit larger so we can at least
see that part.
And it's just, this will takeliterally a second, so it's.
So I'm gonna show you what'sinside of it Much better.
So let's do an LS and make itminus L so we can see all the

(18:21):
metadata for those files.
What you see here is how thisdisease diagnosed process
collected all the logs.
These are all these logs here.
You can see them there, kindlike hex Named.
And then you see otherdirectories like persist,
signpost and special.
Let's go into, let's go intoone of those, because I

(18:42):
mentioned that these logs and intrace V3, right, so let's,
let's try the persist ones.
Let's do the same as one LS.
So look at what's inside thatdirectory and look at that
metadata and this looks a littlebit ugly.
Let's open the screen.
There we go.
So you see there the trace V3logs for that, for the persist

(19:03):
directory.
Previous log versions were notSplit in the end.
Directories like that they werelike they were called, I think,
log, persist, archive and thentrace V3 at the end.
So there's been changesthroughout the years.
All these logs are Accumulateor, you know, presented or
recorded.
I should say, okay, cool, so wehave them now.
What do we do with them?

(19:23):
Let's now Share the full screenagain so folks can see that.
And what you do is it's reallyeasy Just go toward that
directory where your stuff isand just double click on it and
you and this only works on a Maccomputer, I Mac OS Double click
on it and it will open theconsole.
Right, we're just going toclick on it, so right, which

(19:46):
obviously is opens as adifferent screen.
So let me go to that screen.

Speaker 2 (19:51):
And the console that I paint on the screen changing.

Speaker 1 (19:54):
Oh yeah no, I'm jumping and jumping back and
forth on on things.
Now Where's my console?
There we go, all right.
So I know it's a little bitsmall, but so it's pretty neat.
It has you on the left, topleft.
It's kind of blocked by alittle bit by the our logo, but
you can put their stuff to lookfor and then on the left under

(20:16):
showing here on the left bottomleft, you can select last day,
last hour, 30 minutes, fiveminutes, select all messages
first, so that way it kind ofpresents them all, loads them.
It takes a little bit of time.
This is not the fastest way oflooking at things For this for a
single reason that there's alot of data.
This only has data for two daysand it's about almost five
million lines of log For twodays and the data set that I

(20:39):
have.
So you, these logs could lookto be more, a couple of weeks,
right or more, so you canimagine how big that is.
So load all your messages andthen you can go up here and look
for things.
So in this case I selected theWi-Fi state, change that message
and you can see here in thecenter of the screen and if I go
down you can see.
Look, wi-fi state change is notconnected but connecting to

(21:00):
Dean Frankel.
That's an and the name of arouter.
Okay, just just one example.
You can and I recommend folksgo through it, see what you can
find.
See if you've like, like, likethe blog post that we're talking
about it.
See if you find certainindicators or processes that
talk about Artifacts that youmight not see anywhere else.
Right, it might be a log ofsomething that's ephemeral, that

(21:23):
in your full fast systemextraction from your device it
might not be recorded anywhereelse.
It might only be recorded inthese type of log files.
So pull them out and do sometesting and if you find
something that you think is ofvalue, do share with the
community, make a blog post.
You don't have a blog post.
You can, you know, contact me,contact Heather and we'll.
We'll find a way to make thatPublic for everybody.

(21:44):
We'll talk about it on the show, whatever it takes, so we can
all all grow with that so greatresource.
There's a whole bunch of thingsin these logs I wish we had.
We could do a whole episode onit.
So, yeah, so just just for theeverybody listening, just check,
check that out.

Speaker 2 (22:01):
Very cool.
So Today, I think like like 15or 16 hours ago, axiom magnet
axiom Started supportinganimated map routes.
I was scrambling today to findsome test data so I could show
you guys what it looks likebreaking breaking news.

Speaker 1 (22:21):
Breaking news you go, you heard.
You heard it here first.

Speaker 2 (22:26):
Um, and I got.
I got some data process, so I'mgonna just share it up on the
screen and then they have aYouTube video showing this as
well.
You just pop it up here, allright?
So when you Process your casein magnet axiom, I have it

(22:48):
filtered to just the cachelocations.
There's a new option over herewhere you have the column view
called route view.
If you Switch your view toroute view, it will bring you to
this world map and you can usethese route settings over here

(23:08):
to choose what you want to show.
It has support for Apple Mapssearches, apple Maps trips,
cache locations any locationsthat are are found in your iOS
or or Android Extractions.
I chose the cache locations hereand then you narrow it to a
date and time.
I chose a date and time andthen you calculate routes and

(23:33):
the tool.
The tool will find whateverroutes you have that you In that
specified date and time.
I had three for the date andtime that I chose and I'm just
gonna show one.
So it's a really short routethat I found, but it has this
animated map and that's it'straveling right now at the one
time speed 10 times speed andThen there's a hundred times

(23:58):
speed, which is crazy fast.
But it also has a recordfeature to record those in an
animated map routes.
I thought this was pretty cooladdition to the axiom you Cool.

Speaker 1 (24:10):
Oh yeah, I mean you see the little Little pin ten a
semi Google like the Google maplooking pin moving around the
road or I guess whatever thegeolocation points are right and
it kind of moves back and forththrough that route, which is
pretty neat.
I mean, again, it speaks tobeing able to illustrate this at
a court or whatever stakeholderneeds it and you have that

(24:31):
visual representation Of howthat moves.
I guess I mean, does that need?
Does that need internet to work, or how's that?

Speaker 2 (24:39):
Oh, yes, so you have to be able to connect to the,
the world maps that the.
If you have an internetconnected computer, it'll work
right away for you.
If you want to use it on asandbox machine, you have to set
up an offline map.
It's a server, so you downloadI forget the name of it now but
you download a file and set upan offline map server and you're

(25:02):
able to use it offline as well.
I have not.
I've not tested that featureout yet, because I heard about
it just today.
So I will, I will and I'llreport back.

Speaker 1 (25:12):
No, absolutely, and that's important because I some
of our last by policy.
We can't have internetconnection in our or our
forensic networks, right, right,but there's that alternative.
Get that a map server, set itup and you're good to go.
So it's another, a great option.
I like this, not only for thevisual, but like the broader,
the broader field Perspective,how tool makers are now

(25:33):
competing also on features.
Right, look, we have, we'llhave the same data.
But look, I presented in oneway, another presents is a
different way, or we make someconclusions based on this data
that another vendor doesn't have.
So it's good, it's good to knowand be aware what those
capabilities are, because aparticular case might require a
step on map feature and Actuallymust, as of now is the one that

(25:54):
has it right and excellentaddition for courtroom testimony
purpose is right an exhibit so.
Super awesome.

Speaker 2 (26:05):
Stop sharing my screen here.
Speaking of log files to ChrisVance, actually At from magnet,
he presented at the 2024 magnetvirtual summit and in a mobile
unpacked episode which you canfind right online, recently

(26:27):
about locations that examinerscan find types of logging data.
So the mobile unpacked episodeis 14 if you're looking for it,
and it's titled logging la vidaloca.
Crafty little name.
Oh, that's, that's, that's so,that's so, chris, that's all him
on the website You'll find acheat sheet, so a quick

(26:50):
reference guide, and that is aquick reference to where you'll
find all the log files.
He outlines five log files fromiOS device and three from
Android and It'll tell you thelocations of the log files and
different ways to collect themare included on that cheat sheet
and We'll have the link to thatafter the show.

(27:11):
But here it is for now.

Speaker 1 (27:13):
Yeah, no, it's.
I mean, I love Chris.
I remember we we some years agowe gave a joint presentation or
talk at a sans differ summitand we were talking about
Talking about deleted sources ofdata.
If you delete certain thesources of data, how can you get
that data from somewhere else?
And we went up there.
He decided to make it soundlike we're in a funeral, like

(27:35):
we're here to remember to departit sources of data.
You know and that the kind ofthat type of spiel.
So, and he came with that outon the fly before we went up on
the stage.

Speaker 2 (27:47):
It came up pretty good.

Speaker 1 (27:48):
No, it came up pretty good and, and you know, I mean
I mean so many years ago, ofquite a few years ago, and
that's been part of Some of thestuff that we now that I feel
focused on moving forward.
I did with him is looking forthose data sources and we're
they're deleted.
But if you don't know the datasources to begin with, you
cannot find him if they'redeleted or not, or they exist.

(28:09):
So folks do check out Chris.
Chris's a blog on that, onthose topics and, again, really
legit guy.
So go check it out, you'llbenefit.
All right, is it?
Is it my soapbox time yet, ornot yet?
Yes, all right, everybody so.

Speaker 2 (28:27):
I've been.

Speaker 1 (28:28):
I've been waiting for the last 28 minutes for this
part of the show, all right.
Oh, the Jardine says that shestill referenced that
presentation from the deletedartifacts, so I'm happy that
still serves a purpose, allright.
So my soapbox moment doesn't asa new what, what did I call it
a segment?
our new segments here we don'tdo every show where I'm gonna

(28:51):
tell people what grinds my gearsright.
And this week it was I.
We read and, and and Heatherreally pointed that article to
me a great article by ShafiqPunjab.
Shafiq, again I, reallywell-known Canadian examiner.
I before you know, likeold-school examiner, the good
ones I know him from notpersonally, but interacted with

(29:11):
him online for many years nowand he did an excellent article
where he talks about, and I willsay this it's called the, the
blog.
I'm sorry, not the blog, butthe, yeah, the blog where it's
published.
It's called bullshittinghunting, right, and he talks
about how he was brought in by,I think, the prosecutors to

(29:35):
Examine the testimony that wasgiven in the case by a detective
in regards to the forensicsdone in that particular case,
right, and what he does is the Bof the article.
He goes and explains well, thisis digital forensics, this is
what we do, the lo card, aprinciple about.
You know every, every exchange,these are trace or something
like that, and, yes, you knowthat by memory, right, and

(30:00):
explains what these areforensics is right.
And then he says that, eventhough you know, he starts
Dalling down the testimony andhe describes how this detective
went into it and first of all,he did not do the extraction,
right, that extraction of thatdevice.
It was a mobile device.
He did not Generate it but hereceived it, he was to process

(30:21):
it and when asked, hehighlighted his article that the
detective mentioned that he hadan eight hour, eight hour law
enforcement class on Facebook,phones and stuff like that.
And if your testimony is, andstuff and like that and whatnot,
that that is a problem, right,yeah, I don't think stuff like

(30:41):
that, I mean I guess it covers alot but at the same time it's
not covering anything.
Yeah, stuff like that is not athing.
And you know he was saying thatcelebrate was used and that he
plugged the phone and hedownloaded things from the
memory of the phone.
Right, and he goes into greatdetail explaining.
Well, if you're an examiner,you know that words have Meaning

(31:04):
.
Right, it sounds silly but itdoes.
You don't extract the memory ofthe phone, because what are you
do?
Why are you talking aboutmemory?
Is it RAM memory, like there's,maybe what?
Obviously, what he wasreferring to was the storage he
downloaded.
You know the whatever's in thestorage of the device, right?
So the point and this is thepart that, again, at the end of

(31:26):
the article he goes through allthe detective's testimony, some
parts of it, making somecritiques on that.
To make a bigger point, whichis the point that I agree with
him and I'm gonna now do mysoapbox moment on.
This is happening so too muchlately.
I seen it in many, many placeswhere we got folks that come in,

(31:47):
they take, you know a class andthey put them up to testify and
and you know they, they, theymodel through it, right, and and
that's a problem, that that isa problem Um, the, the folks
that are, you know, theprosecutors to juries, the, the
victims of these crimes, expectmore from us, right, and I think

(32:09):
there's a problem, and thefirst one I'm gonna make with
that is that how do these peopleget in that position?
Right, how do you get a personthat's only taking an eight hour
, eight hour course or a weekcourse, and all of a sudden
they're dumping phones andpresenting them the extraction
and the, the analysis at courtwith a week long class?
How do they get there?
Right, they didn't get there bythemselves, right?

(32:31):
There is a problem with theprocess in our agencies on how
we are staffing these positionsright, and Just because you have
a backlog, just because youhave some empty chairs and you
need to put butts on the chairs,does not justify not really
doing it in a way that isPreserves the evidence, the

(32:53):
digital evidence and I said itin many means as I said before,
I, I believe is the mostimportant part of the case Is
the most important part is isthe?
Is the?
Is the witness?
That cannot, you know, make amistake if properly interpret it
.
Alright.
So there's a problem with howwe're staffing those positions
and when we start positions, wehave two options, right, we

(33:13):
either Hire people that havedegrees Right, that's one way we
staff any position in anycorporation.
Company is a structure you knowPlace, right, you get a person,
and, and why do we do that?
Because we expect those peopleto know certain things, because
they have a degree Okay, abaseline of knowledge, cool.
Or we take somebody frominternally and we training,

(33:36):
train them Sorry, give me sometraining to the level that what
you would expect a proper personbeing educated with a graduate
would be something sensor right,yeah and and the thing is that
if you don't expect that levelof expertise from the people
that you bring him up, you gonnahave a problem.

(33:57):
if you don't not make sure thatthey have a training program
that's more than eight hours ora week To be able to do this job
, you gonna have problems.
Alright, I'm taking a courseand you're good to go.
That's the thing I guess thementality is.
And now I'm getting, I'mgetting warmed up.
Let's say I'm a manager and I'mworking to say why color crimes

(34:19):
and not a unit?
And I said you know what I need?
Bodies, major crimes.
Another unit has plenty ofbodies.
And I talked to the lieutenantor I talked to the captain and
we're like you know what?
We're still assign some peoplefrom that unit to this unit
because it's more neat.
And they, what did they do?
They move and that's fine.
You can have somebody that'sinvestigated experience, move to
my, to my unit or to my squador whatever, and we train them

(34:41):
for a few weeks, we pair themwith a mentor and they're good
to go right.
That model, which is the modelwe've used to move people around
for years and ages and decadesand from from forever, does not
work for digital forensics.
You can't take somebody fromthe road or from whatever other
unit and simply sit them in thelab and say take a week long
class and pair up with somebodyhere and you're gonna be gonna

(35:05):
do forensics.
It's.
You cannot transmit that.
The knowledge that you comefrom being on the road or from
being on another investigativeunit is valuable knowledge.
To get me wrong, are you gonnause it in your forensics?
Absolutely, but it's notdigital forensics.
It's not transferable, as I waslooking for.
It's not transferable directlyto the scientific portion of the

(35:25):
job.
Right, and?
And we have this mentality ofhow we move people around that
doesn't apply to the lab, to theforensic process.
I mean, am I wrong on this,heather?

Speaker 2 (35:36):
No, you're absolutely right.
I think so.
The testifying part is the partthat's crazy to me, right, when
people testify to digitalforensics, they need to know the
process inside and out.
They need to know the technicalterms and the concepts behind
them, and the statement thatI've heard so many times it
drives me, not every single timeis I'm not an expert, I'm just

(35:57):
the operator for the tools likePA or Magnet axiom, right, I
don't know what all this means.
I'm just the operator.
I hit the button.
I don't determine what all thismeans.
Yes, you do, so you are theexpert.
If you are working in thedigital forensics lab In law
enforcement, you're often theonly in the last person that

(36:19):
will be analyzing that item ofevidence.
You hit the button and it goesoff to a prosecutor's office and
they need you to be able tointerpret that data.
You're all the prosecutor hasand the victims in the case.
They're depending on you and ifyou are just the operator and
not the expert, who's the expert?

Speaker 1 (36:37):
Well, I mean, the term operator is a term that
doesn't exist.
I mean, maybe if you're in SWAT, right, in SWAT team, you're an
operator.
I guess, right, but I mean, Idon't know where the people are
getting this idea.
There's no such thing as anoperator in digital forensics.
Either either you have yourtrained to deal with the
evidence in a certain way oryou're not Right.
Yes, and I do understand thatyou have different levels of

(37:00):
training, because maybe you cantrain somebody to make copies,
and that's OK.
Right, but when we starttalking about what the data
means, there is no.
There is no in between here.
Right, either you're qualifiedor not, and when you go to court
, they're going to qualify youor not.
If you're not qualified, you'renot qualified, you will not be
able to give opinions.

(37:21):
Right, and well, I'm an, you'reon, or I'm an operator, and it
will be like you're a what Right?
You're a doctor, you operate,you cut people open.
I mean, come on.
And look, and now I'm going toreally go off and a limb here,
but when I really bothers me,because I think it speaks to the

(37:42):
point of folks not wanting totake a, not being responsible
and be accountable for the workthey do, all right, well, I'm
not an operator, it's like I'mhere to do the minimum necessary
, right?
Is that the attitude we want inour labs?
That the attitude we want?
Dealing with the evidence thatcould set somebody that's
accused free, right?
Or give, make a victim whole inthat sense, right, give them

(38:03):
the justice they deserve, right.
Well, I'm here to do, I'm hereto do the least I could do.
I'm the minimum commondenominator here and that's
what's expected of me andthey're proud of it.
And I want to, you know,philosophically, smack him in
the face, of course, because wedon't, we don't condone violence
here.
We're, we're non-aggression,like MLK, right, in this podcast
, at least you know you thinkyou're being smart and being all

(38:28):
wise.
Have I told me this?
You just tell me you'remediocre and that you're proud
of being mediocre, right, and ifyou're a new examiner, come
into the field and the folksthat are not everybody, but you
have folks around you.
That attitude, don't copy thatattitude, right, they're not the
best role models, right, we'rehere to do the best work that we

(38:49):
can do, right, and you know wegot folks in the chat even
saying we have the same attitudein corporate companies, right,
and and interests that come inand we can talk about.
We talk in other episodes aboutgenerational gaps and all that,
but I think it speaks to thefact that that people, folks,
you know, some folks don't wantto do the work.
They want to get paid and notput their best or their maximum

(39:13):
effort, as I have here behind mein the in the lighted marquee
Right, and obviously a phrasethat I like from that book is
another story Put that maximumeffort if you are in, if you're
like well, you know what, I wason the road, I'd rather be in
the lab and tired of being onthe road.
Don't come to the lab justbecause you don't want to be on
the road.
Right, come to the lab becauseyou want to actually do the job,

(39:34):
you actually want to learn, youwant to grow, you want to give
justice to the victims.
If not, then you're not.
What are you doing, right?
I thanks for putting all thefolks in the chat and I suppose
yeah.
No, and we got folks saying youknow about that.
Training is also, you know,giving the expert testimony part
.
Like I mentioned before, thetool.
You can press the buttons, thetool will give you an output.

(39:55):
But if you don't understandwhat's behind that output, if
you didn't go and look at Ian'sblog and understand what map
syncs at map sync is actuallyrecording whatever you're seeing
on the map You're going to,you're going to say something
that's totally wrong.
Ok, if you take some of yourlocation points, are not aware
of the accuracy level of thatdata, you're going to say that

(40:16):
something that's totally wrong.
Or like Shafiq saying in thisarticle and this is the point
and I didn't give you I think Ididn't give you that part to
show on the screen, but I'mgoing to read it he said at the
end of the article Therefore, itis critical and incumbent upon
law enforcement agencies toensure their members that are

(40:36):
involved in any manner of due toforensics be trained to an
appropriate standard ofpractical knowledge so they can
act as proficient witnesses whenrequired to testify.
Equally, prosecutors too must beaware of the level of knowledge
, skill and limitations of thepolice witnesses, and I think

(41:00):
they're really encompasses.
He did a great article on that,because that's been bothering
me for a few months now.
This is a senior tool often andI'm not saying that I'm perfect
, that's not the point rightbecause we all have a, we all
have our growth, we all growright and different levels of
growth, and we move forward withthis growth mindset that you
know, me and Heather.
We've been talking about thatconcept for some time now, but

(41:22):
we expect more from you.
The public expects more fromyou.
The citizens expect more fromyou.
You should expect more fromyourself.
If you're listening to thisright, and then let's do it.
Put that maximum effort, comeon.

Speaker 2 (41:34):
It's funny you say mediocre, because that makes me
think of an old criminal justiceprofessor that I had when I was
doing my associate's degree.
I was in for police science andhe's that's the class.
If you're getting sees, you'rea mediocre student, and mediocre
students will become mediocre,mediocre cops.
We don't need any mediocre cops, so you should change your

(41:58):
major now, and I couldn't agreemore.

Speaker 1 (42:03):
No, and that's how it is.
And obviously, just having adegree and make sure this people
understand this just becauseyou have a degree doesn't mean
that you know everything or thatyou're qualified.
It doesn't mean that becausepeople, some people go path to
college, but college didn't passthrough them.

Speaker 2 (42:18):
Yeah, or college wasn't exactly the university
that's doing enough to preparethe students for the digital
forensic job they're about totake?

Speaker 1 (42:27):
Absolutely.

Speaker 2 (42:28):
I think there are a lot of that.

Speaker 1 (42:31):
Oh yeah, I mean it becomes.
I mean, some of the pomamels orthey're just, they're there to
make money, not to reallyeducate you, so that's you know.
That's another topic, but stillreally relevant.
Now that's again that speaks tomanagement.
How are we putting those botsin those chairs right?
Even if they're coming from adegree and we speak some
baseline, we need to make surethat we're able to guide them to

(42:52):
a kind of a certificationprocess, if internal or external
.
What I mean by that is you cansay, well, some agencies say,
well, we're going to send ourfolks to ISIS, right, and
they're going to take the BCFEin ISIS and they have to pass it
.
And ISIS is no joke, right,it's no joke.
Again, it's not everything youneed to know, but it's a big
thing to get right.
So those agencies decide thatexternal entity based on the

(43:17):
standards, which are pretty highstandards I mean, heather,
ourselves, were both certifiedby ISIS.
We teach for ISIS, right, so webelieve in their mission as a
nonprofit and they have goodcontent, ok, they get certified
and they can go to court and say, well, yes, I am certified as a
computer forensic examiner byon ISIS and you have that
backing, right.
But that means accountability.

(43:37):
If your employee sent anddoesn't just decides to spend
those two weeks chilling out ofthe pool and not learning, you
know, I mean, and coming backand telling you well, I just
press buttons on the computer.
There needs to be some responseto that, some accountability,
some consequences.
That's the way I'm looking for.
Some consequences, right, guesswhat?

(43:58):
Well, you're going back to theroad or you're going back to
wherever you came from, becausethis just some requirements, all
right, and you'll be surprisedof people that go to these
courses and it's like a vacation.
They don't go there to learnanything, which, again, really
goes my gears, right.
So there's different ways ofhow we go about as managers, how
putting those butts in thosechairs.
And, again, accountability, andhas to be part of this process,

(44:21):
right, those consequences youknow we got.
If you make a good job, you gettrained, you'll have a
fulfilling job, you'll be ableto really put an input in the
cases that are coming throughyour AOR or area of
responsibility.
Right, and you'll make adifference in the lives of
people.
That's what motivates us, right, and we get paid right because
that's our job.
Right, but if you don't havethat, then you don't need to be
here.
Right, training did our friends?

(44:43):
Training is freaking expensive,okay.
And if you're law enforcement,like ourselves, our resources
that come from hard workingcitizens, okay.
And if you'd go through it tonot do anything good with it,
you're stealing from our pocketsin a sense, right, I'm not
telling you, not literallydirectly, but you know what I
mean right, because we're notmaking good use of those
resources.
All right.

(45:04):
So I think we need to startcreating that culture or
cultural approach as examinersacross the board.
Right, that when, when we, asexaminer, think what is an
examiner?
That every one of us here inthe that are listening in our
labs, that we are clear in whatthat means and we Expect that

(45:26):
from other examiners.
Does that make sense?
Heather the cold I'm lookingfor a word and I cannot find it
right now, but that that like alike that, I guess, like the
corporate culture of the field,of the Utah forensics field.
Right, that we have anexpectations.
The citizens have expectations.
Management to have anexpectation.
You should have an expectation,or yourself and the folks that

(45:47):
work with your colleagues, wehave an expectation of you as
well, and we should help eachother to that high standard.
Hopefully, that is more clearnow.

Speaker 2 (45:56):
It is very clear.
I Couldn't agree more.
I mean.
Just one other point on whatyou were you were talking about
with the training.
The training needs to start atthe fundamentals too.

Speaker 1 (46:08):
So I know.

Speaker 2 (46:08):
I know there's all of the, the tool trainings and
learning the tool is excellent,but the fundamentals of
forensics should be the veryfirst class, in my opinion.
Go learn about the ones andzeros and then come back and be
paired with somebody for someon-the-job training and go to
those tool specific trainings,but the, the fundamentals, have

(46:29):
to be learned first.
If you don't have that, thetool training is not gonna make
as much sense.

Speaker 1 (46:34):
Well, and how do you know the tool is right?
Because the tool could be wrong, right?
Yeah if you don't have thefundamentals, the tool might
spit some nonsense and you'll belike, hey, great, here you go
and you just gonna just gonnalet it go right on the
fundamentals.
Teach you to to.
The validation process needsthose fundamentals, right?
Oh, I gotta read this.

(46:55):
Thanks for bringing it up.
Michael is saying is operatorpart of the Dabber standard for
the FI's, testifying that court?
And if you're not in thisbusiness as a person that
testifies and knows what, beingqualified as an expert, you
might not get the joke.
But I do get the joke and Ilike it and obviously obviously
it's not yeah, but um, yeah.

(47:16):
So the fundamentals areimportant, and especially in not
only because the tool could bewrong.
They could be things.
The tool does not pick up rightand if you don't understand a
basic of fundamentals andthere's something that Geraldine
, again, I know she's listeningand we work together a whole
bunch of cases when Prodobovcame out, we didn't know how to
really understand it.
And she has the fundamentals,she knows how to look at hex,
she knows how to Bite sweep andshe knows how to identify Time

(47:38):
stamps and convert them.
And she started building thatProdobov data and and we able to
get what we needed right.
Fundamentals are important.
If you don't think they'reimportant, again, you might not
be at the right place.
You might not be cut out tothis job and there's no shame on
that, right, I'm not cut out tobe a lawyer or a medical doctor
, and that's not against me.

(47:59):
Do you want me to be yourmedical doctor?
I hope not.
Yeah, absolutely not I.
Might be your gym trainer I cando that, right?
Not a doctor or your lawyer.
You're gonna go to jail.
But if you have, you have me asa lawyer.
But there's no shame in sayingyou know what.
I don't have a Passion for thisfield.

(48:20):
I don't really feel likelearning these things.
I don't belong here, and that'sokay.
You find where you belong andwe'll support you on that, and
that's, that's okay.

Speaker 2 (48:28):
Actually, too.
I mean coming in.
Whether you're just graduatedcollege and you're coming in as
a digital forensic examiner orcoming in as a sworn member,
you're going to be learning forthe rest of your career.
So if you thought school wasover, no school.
School has just begun and itwill be class after class and

(48:49):
self-learning, and You're nevergoing to stop with the education
if you come into this field.

Speaker 1 (48:55):
Oh, absolutely.
And you have to be honest withyourself, right?
If you're not honest withyourself in regards to what the
job requires, you're not gonnabe honest with the cases.
What I mean by that is youmight come to a new piece of
information from Ian's blog orfrom somebody that's really you
know High-speed, because that'sall they do in their daily job,
like really knowledgeable people, and you might have to go back

(49:16):
and look at an old case and say,you know, or a case that's I'm
going to figure out.
You know what this newknowledge applies to my case?
I need to apply it.
I can't just sit down and say,well, I'll give it a slide.
You know I don't want to rockthe boat, no, you did.
This job requires dedication,requires property and honesty.
I mean, I guess all love forsome jobs require that, true,
but but these are forensics ispretty clear.

(49:37):
Caught on that clear cut rightas the information comes in.
You might have to revisit allcases, and that's a good thing.
You might have to go and makesure your conclusions are
correct at all times, and that'san always ongoing process.
It like like Heather's saying,it's never gonna end.
So any of you retire, theyounger folks will pick up that
mantle, will pick up the torchand we'll keep moving forward.

(49:59):
Right, it never ends.
Oh, my goodness, thank you forletting me get out of my chest.
I feel like a waste beinglifted.

Speaker 2 (50:07):
I was waiting to see if you had anything else there
for a second.
I mean, look, if you push me alittle bit, I bet I do.

Speaker 1 (50:14):
Let's save it for the next episode, I guess.

Speaker 2 (50:19):
So another topic that we had for this week is sources
of error in digital forensics.
There was an article by sciencedirect that talks about the air
, the sources of error indigital forensics.
So it kind of says, like theoccurrence of errors in forensic
practice is inevitable, whichwhich of course it is, and we

(50:42):
may not feel uncomfortable withthat idea.
But it's a truth that therewill be errors throughout the
process.
But in digital forensics, inthe field, digital forensics in
particular, on those errors canhave great repercussions, right.
So yeah.

Speaker 1 (51:00):
I'll let you go and I'll chime in so oh, yeah, no,
yeah, you know, you know, youknow I.
I Call it biting on the bit.
Is that what it is?
Yeah, jumping at the bit.

Speaker 2 (51:10):
Thank, you, so look again.

Speaker 1 (51:13):
I'm a, you know I'm, I'm from Puerto Rico, so I'm
still, even though I've beenhere for so many years, I'm
still learning all these phrases, right, chomping at the bit.
Yeah, look.
So the article is by dr Orzman.
He's well known the field,right?
He's been around forever.
Academic love, you know, with,with a capital, a, all right.
So so read this, right.

(51:33):
I like it because it's ataxonomy of what be, could be
problems when you're within yourprocess.
And this type of academicexercise is super important
because if you're not aware ofthe categories of Problems or
errors and he has the whole list, I wish I could I could you
know, go on and read them all.

(51:53):
But he defines what's an error.
Why is it important?
How do you attribute it?
The castle factors is theproblem in the source?
Is the interpretation, theforms of error, a random error,
systematic error, a negligenterror, right, and they had.
You map those errors, how theyapply to your forensic process.
How do I then?
How do I identify it, how youmanage it, how to mitigate it,

(52:15):
how you prepare for it, becausecommitting errors or mistakes,
based on that taxonomy that heexplains, it's unavoidable.
Your, your brain is gonna growright and grow in the sense that
you will be able, now that youhave that knowledge, to identify
them and mitigate him beforethey happen.
Or, if they happen, you're ableto solve them in a way that
does not impact your case.

(52:35):
It's not make sense.
So this type of academicarticle you may be like also a
little bit some a bit of a dryreading, which actually his
article is not.
It's not dry reading at all,it's a really accessible article
.
But you might come across someother academic articles a little
bit dry, go through many ways.
Right, be on, be on the lookoutfor those, be part of the
community, because that willgive you a special, a special, I

(52:58):
guess the word but awarenessaround you of the what you're
doing Right, and then you areaware of what those problems.
If you don't take the time tofigure out the type of errors
that could come up when theyhappen, you won't recognize them
, you won't be able to pinpointthem out, and I don't want the
defense attorney to pinpoint itto me understand, because that's
gonna suck.

Speaker 2 (53:19):
Right.

Speaker 1 (53:20):
And I got that stuck in me as an as an expert for the
prosecution right.
But if you're an expert not inthe law enforcement field but in
corporate or whatever right,you don't want to be, you know,
confronted with an error thatyou could have taken care of if
you Would have been aware of itright.
So it's a great article and Ithink it's worthwhile to take
time and and to study that.

Speaker 2 (53:39):
Yeah, and I mean just some of the points that are in
the article.
So the the people make errorspoint is is great, but on the
law enforcement side of thingsit could mean a wrongful
conviction or a suspect thatwalks free.
So knowing how to handle thoseerrors super important.
And then he has a part wherethe tools make errors.

(54:01):
It's our job to ensure thatthese errors are caught and that
we can rectify them.
We validate the data and thenthe misinterpretation of data.
That comes back into what wewere just talking about.
So prior prior training andtesting is mandatory when it
Misinterpretation of data, withinterpretation of data in

(54:21):
digital forensics is is comes tolight.
So yeah, it's a great article.

Speaker 1 (54:27):
No, the one that scares me a lot is errors in the
source itself.
Right?
Yeah, because you can go andextract some logs from a
location and the time standsmight be wrong.
Did I take time to validatethat?
The clocks on these companies,an example?
Right?
That the clocks on thesesystems that I'm extracting is
correct?
Right, is it?
Is it?
Is it properly timed?
Right, because then if I justdon't do that and take it at

(54:49):
face value, I will have aproblem, because the problem is
on the actual recording levelfrom the beginning, right?
So, again, that taxonomy ofpossible errors, how to mitigate
them, worth your time to checkout.

Speaker 2 (55:03):
Yeah, and I don't think that the article talks
about this.
But when it comes to themisinterpretation of data
specifically, watch foroverconfidence, right?
You see?
You see, an artifact is like.
I know what that means just bylooking at it.
You don't necessarily know whatit means just by looking at it.
You have just go look at Ianwith and new blog, right?
I mean he found some things thathe thought were one way and

(55:25):
they're not.
So watch that over confidence,that that can definitely get you
in trouble if you're on the onthe stand with too much
confidence in something that maybe misinterpreted.

Speaker 1 (55:35):
Well, I mean, and you can be used to an art, an
artifact, to behaves a certainway at all times, and then a new
update comes up and it changes.
And again a bread, another,again good friend of the podcast
and friend of personal friendas well he says refusal to
accept, admit and correct errorsor mistakes make for, makes for
a short career, and he couldn'tbe any more correct.

(55:58):
And this is the thing.
Our egos get in the way andthat's the problem.
Right, we need to be reallycheck ourselves because
sometimes we, we, we resistbeing corrected and that's a
normal human, you know, issuethat we have right, we, we don't
want to be called out, we don'twant to be incorrect, but, you
know, we need to be humble aswell, be be open to criticism

(56:21):
and and I say criticism in the,in a constructive way.
That's why the forensic processwe have quality assurance
methodologies, right, we havepeer reviews, and you have to be
open to that.
You have to be naked, notliterally, right, but
emotionally naked, like you like.
Look, I'm here, this is what Idid.
I will be criticized, I'm notgonna take it personal.
I'm here to learn from thosecriticisms and grow right.

(56:45):
And If there's a mistake.
You need to learn, correct andgrow like, like, like bread is
saying so.
I think our field, all this, iscodified.
We need to make sure we applyit and, and, and you know, live
and walk our talk anotherexpression I learned not too
long ago.

Speaker 2 (57:04):
So Everybody's favorite time.
It is the meme of the week,yeah.

Speaker 1 (57:11):
That's, that's my favorite time.

Speaker 2 (57:13):
Let me share my screen here.
Ah, there we go.
So the meme of the week thisweek says I think I forgot
something.
The third-party tool says ifyou forgot that, it wasn't
important.
And he says yeah, you're right.
And then there's a picture of aKid with a soccer ball out in

(57:36):
the rain.
His parents forgot to pick himup, it looks like.
And evidence in unsupportedapps.

Speaker 1 (57:43):
It's a tough one to describe verbally, so I'll prop
on you for trying.
That was pretty good and I lovethis because you know it speaks
to the classic.
You know also have kids like,yeah, it's fine, the kid is
waiting for you to pick him upand it's a night at the soccer
games.
Poor kid is wet.
That poor kid is your evidence,your main evidence.
You're smoking gun.

(58:03):
You're like, oh well, if thetools and show it to me, it
doesn't exist.
Right, right and and again.
That really I think it's and youknow Heather Heather's in
charge of picking the meme ofthe week right, and I think she
picked a really good one,because it really kind of make
goals takes us back for circle,right to what we're discussing
right, or all that we discussedtoday in regards to how we come

(58:25):
into the field, how we managethat, how we make sure people
are trained, what our attitudeshould be and how we work with
our tools, dealing with errors,and all that.
It all comes for a circle in usbeing aware that we need to go
always that step, extra step.
That's needed, because an extrastep will always be needed in
your analysis, in your view ofthe data and how you present it

(58:45):
and even how you speak about it.
Right, we need to get thatextra step.
We don't want to Leave ourevidence or our victims out in
the rain right waiting for usand we're not picking them up
right.
So you know, good, good pickfor me another week.
So I appreciate that.
All right.
So again I mean thank youeverybody for being with us here

(59:08):
.
I appreciate all the folks thatrolled in for the discussion,
for the comments.
We love your comments.
Again, it's a community and weboth each other with them.
Michael is seeing thanks forthe post that we're putting out
and thanks to him and everybodythat also is part of the
community in LinkedIn and Againreach out to us.
He does up on the DTAR Francisnow podcast LinkedIn page with

(59:31):
suggestions, with questions,topics that you might want us to
hear from us discuss, and We'lltry to bring those to you.

Speaker 2 (59:37):
Yeah.

Speaker 1 (59:38):
Thank you.
Anything else for the good ofthe order, heather.

Speaker 2 (59:40):
That's it.
Thank you very much, everybody.

Speaker 1 (59:43):
All right.
Well, we'll see each other in acouple of weeks.

Speaker 2 (59:46):
Yep, see you in two weeks.

Speaker 1 (59:48):
Take care everybody.
Bye, bye you.