DFIR Summit 2015

Windows 8 SRUM Forensics - SANS DFIR Summit 2015

by Yogesh Khatri, Assistant Professor, Champlain College

Windows 8 and Windows 10 has a newly added feature to track system resource usage, specifically process and network metrics over time. Process ...

[+] Show More

Now Playing

Windows 8 SRUM Forensics - SANS DFIR Summit 2015

by Yogesh Khatri, Assistant Professor, Champlain College Windows 8...

Now Playing

Musashi Forensics - SANS DFIR SUMMIT

Frank McClain, @littlemac042, Information Security Manager, DFIR Team...

Now Playing

TOR: The Dark Web - SANS DFIR SUMMIT

Lee Whitfield, @lee_whitfield, Director of Forensics, Digital Discovery...

Now Playing

Oh, Snap!: Snapshots and Re-creation Testing in VMs - SANS DFIR SUMMIT

David Cowen, @hecfblog, Partner, G-C Partners LLC This session...

Now Playing

A Case Study on Using Various Tools Throughout an Intrusion Investigation - SANS DFIR Summit

Ron Dormido, @rdormi, Senior Security Consultant, Verizon I Love It...

Now Playing

The Beauty and the Beast: Cyber Threat Intelligence Done Right...and Wrong - SANS DFIR SUMMIT

Robert M. Lee, @robertmlee, Co-Founder, Dragos Security LLC This...

Now Playing

Need for Speed: Malware Edition - SANS DFIR SUMMIT

Anuj Soni, @asoni, Booz Allen Hamilton This session features an array...

Now Playing

Crisis Communication for Incident Response - SANS DFIR Summit 2015

Scott J. Roberts, @sroberts Bad Guy Catcher, GitHub One of the parts...

Now Playing

Forensic Analysis of sUAS aka Drones - SANS DFIR Summit 2015

David Kovar, @dckovar, Senior Manager, Ernst & Young’s Advisory...

Now Playing

Windows Phone 8 Forensic Artifacts and Case Study - DFIR Summit 2015

Cindy Murphy, @cindymurph, Detective, City of Madison, WI Police...

Cindy Murphy, @cindymurph, Detective, City of Madison, WI Police Department

Due to the quick progression of mobile device technology, a need often arises for forensic examination of mobile devices that are ...not yet supported for data extraction and parsing by commercially available mobile forensic tools. This is particularly the case with less commercially popular (and therefore less supported) mobile operating systems such as Windows Phone 8. This case study will present the challenges that practitioners face with Window Phone 8 devices, practical solutions to those challenges, collaborative strategies that work in a jam, and presents from the practitioners perspective, useful artifact locations from Windows Phone 8 devices.

In February of 2013, a home invasion and sexual assault occurred in the City of Madison, Wisconsin. The home invasion involved a conspiracy, planned by a drug addicted escort who solicited the assistance of her drug dealer in order to rob the man she was temporarily staying with, targeting significant amounts of cash he stored in his home from his tattoo business. Unfortunately, the five people carrying out the armed robbery plan forced entry into the wrong half of the targeted duplex. During the course of the home invasion, a woman who was six months pregnant was sexually assaulted repeatedly in front of her husband by several of the assailants. A Nokia Lumia 520 cell phone running Windows Phone 8 was used extensively during the planning, and aftermath of the robbery. Attend this session to learn how advanced mobile forensics techniques on unsupported devices can take a case from few leads to six convictions based upon the successful examination of a single unsupported phone.

Cindy Murphy, Detective, City of Madison, WI Police Department
Detective Cindy Murphy works for the City of Madison, WI Police
Department and has been a Law Enforcement Officer since 1985.
She is a certified forensic examiner and has been involved in
computer forensics since 1999. She earned her Master’s degree
in Forensic Computing and Cyber Crime Investigation through
University College, Dublin in 2011. She has directly participated in the examination of many hundreds of hard drives, cell phones, and other items of digital evidence pursuant to criminal investigations including homicides, missing persons, computer intrusions, sexual assaults, child pornography, financial crimes, and various other crimes. She has testified as a computer forensics expert in state and federal court on numerous occasions, using her knowledge and skills to assist in the successful investigation and prosecution of criminal cases involving digital evidence. She is also a part time digital forensics instructor at Madison College, and a part time Advanced Mobile Device Forensics instructor for the SANS Institute.

For more information on the Advanced Smartphone Forensics course at SANS click here: http://www.sans.org/course/advanced-smartphone-mobile-device-forensics

[+] Show More

Now Playing

MIG: Mozilla’s Distributed Platform for Real-Time Forensics of Endpoints - SANS DFIR Summit 2015

Julien Vehent, Senior Operations Security Engineer, Mozilla MIG is a...