Digital Forensics And Stress: Understanding Your Body’s Signals

The following transcript was generated by AI and may contain inaccuracies.

Paul: Welcome to Forensic Focus, the podcast where we explore the critical issues shaping the world of digital forensics and those who work within it. I am your host, Paul Golden, and in today’s episode, we are going to shine a spotlight on the growing area of concern in our profession: mental health and wellbeing.

Those of us who spent time working in digital forensics understand the toll this work can take. Exposure to traumatic material, high case loads, relentless deadlines, and the weight of responsibility all contribute to chronic stress, burnout, and sometimes long-term psychological harm. In this episode, we’ll be exploring an innovative way to address those challenges head on.

Joining me are two exceptional guests, Dr. Zoe Billings and Mark Pannone. Co-founders of Adapt & Evolve with unique and complementary backgrounds. Zoe, as a biologist and former senior investigator in road traffic fatalities, and Mark as a former assistant Chief Constable, strategic commander and crisis negotiator.

They have combined decades of frontline and leadership experience to create a service dedicated to enhancing resilience, performance and wellbeing in high pressure professions. Together we’ll discuss the origins of Adapt & Evolve, their approach to stress, decision making and team performance, and why services like this could be vital to supporting the long-term mental health of digital forensic investigators.

This is more than a conversation about coping. It’s a conversation about evolving and adapting and finding sustainable ways to thrive in one of the most psychologically demanding roles in law enforcement. Welcome to the podcast Zoe and Mark. We’re really pleased to have you here.

Mark: Thank you. Hi.

Paul: Hi, Paul. Thank you for having us. Thanks for joining. Zoe, would you like to begin?

Zoe: Yes. So Mark, in 2019, I noticed in North Yorkshire Police where I was working that we’d got a reasonably sized occupational health department. There was a lot of work going on there to reduce stress and look after people.

But despite their best efforts, we still had people off on long-term sick. We had performance issues and some retention issues in certain areas. My background, as you said, doctor of biology – did my PhD at the University of York and I’ve tutored A-level for over 25 years.

I looked at the wellbeing provision and it focused solely around the mental health aspect, which was great – there was provision for it. But I equate it that if you teach people to recognize there’s something wrong when they recognize it as a mental health concern, you’re effectively teaching them to recognize that there’s a problem with their car when the engine seizes. And that’s too far down the line.

By that time, you’ve got to go off work, you’ve got to get your car towed, that sort of thing. I look at the biological aspects of stress because stress starts to manifest itself in the body physically whilst your brain is still saying, “I’m fine,” and it’s still pretending to carry on because from an evolutionary perspective, that’s what we’re programmed to do.

It’s not our fault – that’s hardwired in. So by looking at the biological aspects of stress, that’s the biological version of teaching you what the dashboard warning lights on your car mean. So when they come on, you can take action, get it resolved, and then your car keeps working and you keep going, and hopefully you’d never get to that point where your engine seizes.

So the biological aspects of stress – the biological wellbeing that we deliver – is effectively early intervention and prevention for stress. It stops people hopefully getting to the point where they are affected by the mental health aspects of stress, by teaching them to recognize it at the earliest opportunity, and really crucially how to then mitigate it and how to deal with it with a really comprehensive toolkit.

Paul: I think you’ve beautifully put together something here, which I quite often talk about and which I’ve talked about in the past, and that’s approaching this from a preventative point of view as opposed to a reactive point of view. You obviously identified within your force that there was no psychoeducation, for example, around the stresses that you could become susceptible to. And that’s where you come from.

Zoe: Absolutely. And I was brave slash daring enough to deliver it to our occupational health department. That could have gone one or two ways, but they took it really well. And there was that sort of recognition and that light bulb moment for them that we’ve never thought about it that way. So it got their endorsement and then the assistant chief constable saw it, which Mark could probably fill you in on what they thought.

Paul: So what did the assistant chief think, Mark?

Mark: I joined North Yorkshire Police during COVID. And it was then that I met Zoe – had the pleasure of meeting Zoe. And I was so impressed with it that I actually mandated it for those departments that were really struggling with stress that I was responsible for.

So the digital forensics unit was one of those departments. They were going through the UKAS accreditation challenges at the time, and we had a high sickness challenge within that department. DFU was one – some of the departments that were quite highly stressed, high sickness, not great performance necessarily – got them to listen to Zoe, mandated them to hear what she had to say about how to identify stress within yourself.

On the back of that I saw an improvement in both the performance and also the approach – the sort of like the feel, the culture within those teams and the self support that then went on and the self challenge within those individuals was fantastic. Because they were talking now a new language of prevention, like you say Paul, rather than individuals who, when they go pop, having to leave the organization, leave the department and deal with the unnecessary harms that could have been prevented with a more improved, resilient-based approach, a trauma informed approach.

So basically I loved what Zoe did. And then on the back of that, when I retired I then started working with Zoe. And now we go around the world. We’ve worked with the FBI – obviously we went out with yourself, Paul, in Munich last month and work with organizations throughout the UK teaching them how to identify stress within themselves.

How teams can then work to support each other. And then importantly, identify what the problems are within an organization that’s actually stopping you from thriving as an employee and how you can help yourself and your family. As importantly, look after each other, monitor each other and check each other out to make sure that things are on an even keel. And if they’re not, giving them tools, techniques, tricks to actually keep themselves in that good place rather than dealing with the adverse effects of poor decision making and poor stress management if they didn’t know this language. It really works and that’s why I’m really passionate about it.

Paul: You’ve touched on a couple of things there, Mark, which I’d like to expand on. Firstly, as a senior leader, you saw the problem.

Mark: I did. And I think the problem is with police leadership – you get to a chief officer rank, senior officer, superintendent and above, and then chief officer. You are under a lot of performance pressures. You either impose those pressures as a senior leader on others, and you’re also subject to them yourself, wherever they come from – a police and crime commissioner, from government, from your own chief constable, whatever. And that is stressful. That is difficult for anyone.

But we put no effort in teaching people how to be resilient, how to look after themselves, how to identify if things are going wrong. And it’s virtually criminally negligent, I think, that as an organization like the police, that puts people into very difficult situations, which are very hard to deal with by anyone’s standards, and not really giving people the tools on how to manage themselves both psychologically and physically.

Then it’s a case of – why do we do this? If you’re lucky, you will survive and get to the end of your career and you’ll take a pension and you’ll say “Thank God for that, I managed to escape.” Other people aren’t so lucky, and there were many people who could have continued with really impressive careers without going pop if they’d had the tools to manage themselves. And it’s those tools that we provide people with so that they can be really the best performing and most resilient that they can be. Because unfortunately, that’s what is not currently taught within policing or many other organizations I’ve seen. And that’s the gap that we hopefully fill.

Paul: I have to say as a senior leader, having spoken to many DFI around the country, do you know how rare you are?

Mark: I think the problem is that digital forensic investigators have a niche role that no one really understands. And as a leader, you want to pretend you understand everything. But because it’s such a specialist area, it’s “oh God, I really don’t understand that. I know they do great stuff and they solve loads of problems for us. But ’cause I don’t really understand it, I don’t really understand what UKAS do and I don’t really understand the ISO – I’ll just crack on and speak to the boss and hopefully everything’s going fine.”

The trouble is that digital forensic investigators are a certain type of person. There are some amazing approaches that digital forensic investigators take. And there’s a mindset and there’s a culture within DFI. The trouble is there are some problems that I have seen consistently across different digital forensic units.

And sometimes it’s about people feeling that they’ve got a voice. And I think one of the most stressful things for a lot of digital forensic investigators may not actually be the material they’re looking at – it may be – but it may actually be the fact that they feel that they don’t have a voice, they are not listened to. They’re not necessarily seen as part of the investigative framework team – part of the team.

And quite often we’ve seen this ourselves – the frustration caused by not even being notified of results in court that they were absolutely key in and pivotal in getting. That’s very stressful and it makes people feel not as valued, not having as much worth as maybe they should have. So I think we really need to recognize the type of people that work in DFI and what drives them, what motivates them and what they need.

And that’s why we go into some detail trying to really analyze what it is that the stresses are for them. And not make assumptions about what’s stressing people out, but by giving people the tools to be able to articulate, “oh, that thing is, yeah, that and that” – is it about the workplace? Is it about the kit and technology? Is it about the people you’re working with? Digging into it further, we can really help them articulate what actually is causing them problems and helping them on that journey, and then help them to address those stresses themselves.

Paul: I completely agree. It’s not just one thing that stresses DFI out. It’s not just the traumatic material. You’ve got organizational pressures, you’ve got deadlines to meet, you’ve got pressures coming in from the CPS and it all adds up. It all has a massive effect on the mental health and wellbeing of DFI who are out there at the coal face. So let’s talk about – can we talk about the proactive approach that you guys use to try and lessen the effect of the stresses borne by DFI?

Zoe: So if I kick off Mark with a bit about more about the biological wellbeing – DFI, police as a whole, law enforcement as a whole, we deal with facts and DFI very much so deal with facts, hard, cold evidence, et cetera. And so when we focus on the physical aspects of stress and say actually what actually is happening in your body and the science behind that, the evidence for that, it is an approach that really resonates with them.

Biologically our autonomic nervous system – we share that in the same pathways with all of the mammals. We share it with the birds, and we have the same pathways that the dinosaurs had, and yet we are the only species that will have stress as a comorbidity factor, because we are the only species that has that problem. And yet it’s just the same pathway as every other species.

So it’s a case of, okay, why – what’s making us different to everybody else? It’s that we use that pathway differently. We explain to them and it’s done in a really fun way. You don’t need any science behind it. It’s translated itself across, as Mark said, when we worked with the FBI, all the jokes, et cetera. It was brilliant. But yeah, and it’s a fun, engaging way of communicating the effects of cortisol, the stress hormone on the five whole body systems.

So we cover the musculoskeletal system. We cover the cardiovascular system, the gastrointestinal system, immunological system, and then fertility and sexual function and all of this – the early warning signs, the sort of dashboard lights that the body will put on in those systems that people will sit there and you can see it in their faces and they’ll be like, “I’ve got that, I’ve got that, I’ve got that.” And it’s about joining those dots up.

And once they’ve understood the science behind it, they’ve understood why their body is behaving in the way it is and why it’s not performing like it should do, and why they’re suddenly intolerant to foods that previously they’ve enjoyed, but suddenly onions are giving them gastric challenges, but they don’t understand why. And when you’ve given them the power to understand actually – yeah, okay, that’s why it’s happening – and the ability to identify that.

And then as Mark leads with the toolkit of 18 or 19 now, scientifically proven techniques that cost nothing that everybody can do to reduce their cortisol levels, to address their stress and resolve those symptoms and the impact of it. The feedback from it is incredible and the change that it makes to people is incredible. Over 3000 people have experienced this workshop so far.

And in one of our early workshops, we worked with a CEO as a quick example – medicated for high blood pressure and we teach the cardiovascular system. We teach what high blood pressure is, why stress gives you high blood pressure, what cortisol is trying to do when it increases your blood pressure, but then scientifically proven ways to reduce it.

Now three to four months after experiencing our workshop and committing to doing the activity that we’d said daily, just five minutes at a time, that’s scientifically proven to reduce blood pressure, that CEO had a medication review at the GP and was taken off their blood pressure medication.

Paul: That’s amazing.

Zoe: And that’s – yeah. When you understand exactly what high blood pressure is, how it leads to cardiovascular disease, how it will kill you, it will ruin your life, it’ll curtail your life. And in fact, they updated me last week in an email just talking about something else and said, “oh, by the way, this is over two years on now. Just had a blood pressure review at the GP and it was perfect.” And that’s medication free.

We live in a society, I think, very much in the western world where we’ve got that learned helplessness, where we have to have a tablet to fix something. You don’t. And actually, if you can remove a symptom entirely from your body rather than trying to treat it while it’s there, just by increasing your knowledge and then understanding and proactively encompassing scientifically proven things into your life to make yourself healthier and better able to perform without any medication, then that’s brilliant.

There is a place, I will just say, there is a place for medication and I would never encourage anybody to come off medication. That’s for their GP to review. But if you put yourself into a position where you don’t need it, that’s gotta be a good thing.

Paul: It absolutely has. You guys come at this from what I think is a really unique angle because we know the stressors that DFI can succumb to and the mental health effects. What there isn’t out there is a big block of research, which says, as a result of those mental health stressors, these physical ailments can come from them. And that’s where you guys come in. You guys have identified the fact that because of these stresses, DFI and others in high stress professions can then become physically ill, not just mentally ill, but physically unwell. Do you want to talk about the physical ailments that can come from this?

Zoe: Certainly. When we look at the musculoskeletal system, tension headaches, which people would expect, increased risk of migraines, neck pain, shoulder pain, but the one that people don’t understand – lower back pain. Cortisol causes your muscles to be held in tension. Your lower back hates being held in tension, and you’ll get lower back pain, but very often, and it was amusing to see that it is treated in the same way in the US as the UK.

We’ll get people a special chair and we’ll treat the symptom, but we won’t treat the cause. As I’ve mentioned, also high blood pressure because we’re trying to deliver oxygen and glucose to the muscles more quickly ’cause the brain really does believe there is an imminent threat to life. And all the associated increased risk of cardio events – so heart attacks, strokes, pulmonary thromboembolisms, where you get blood clots in your lungs, et cetera. Deep vein thrombosis, things like that.

The gastric system that relies on having a really good blood supply to function properly. And yet when we divert all the blood to the muscles because the brain thinks there’s an imminent threat to life – I’m gonna have to run or fight – it shuts the gastric system down. In the gastric system, you are still putting food into it, but you’re not giving it any of the blood and the glucose that it needs to actually make the energy to digest the food. And then you’re wondering why it can’t digest the food. You’re saying to it “go,” but I’m not giving you any fuel.

So you get things like stomach ulcers, can resolve indigestion, inflammation, temporary food intolerances, irritable bowel syndrome, colitis if you’re really unlucky, ulcerative colitis and things like that. Obviously the bloating and the discomfort and then things like your immune system that gets suppressed by cortisol as well.

You get an increased frequency of colds, of other illnesses, things like that. There is an increased risk of cancer ’cause your immune system is there to look for altered cells as well. As well as autoimmune conditions, as I’ve also mentioned already, ulcerative colitis – that’s autoimmune. Eczema, Crohn’s.

For many years they thought that they knew that cortisol exacerbated those symptoms, but it’s only relatively recently that evidence has come to light that actually says that cortisol can be a causatory factor. So actually being chronically stressed can instigate these autoimmune conditions ’cause your immune system gets so suppressed it goes a little bit haywire.

And then you’ve got also things like if you carry dormant viruses – Epstein Barr, that’s glandular fever or herpes, that gives you cold sores. If your immune system’s suppressed, you get an increased likelihood of them reoccurring, shingles, those sorts of things. All those dormant viruses that can live within us. Fertility and sexual function – erectile dysfunction in males and in females, disruption of either ovulation or menstrual cycles or both.

And it’s quite – when you let the body recover, when you remove these stresses, it’s really amazing how quickly those symptoms can disappear without any medication because you’re just letting the body do what it’s built to do.

Paul: You’ve just made me smile when you were talking about lower back pain. I remember when I was working as a digital forensic investigator, one of the things I really had was lower back pain, and I never connected the two until I heard you guys speak in Munich and I was sat there smiling away at myself thinking, “yeah, that’s why I don’t have lower back pain anymore.” Because those stresses that existed back then aren’t here now. And I don’t suffer from it, but I would never have connected the two had I not heard you guys speak.

Mark: And you’re not unique there, Paul. People do not connect what’s happening with their bodies with the fact that these could be stress related symptoms. And all we are doing is basically making people aware of what the science is behind stress, the effects that it can have and then looking at ways to address them. So I would like to think what we’re doing isn’t absolutely radical. It makes absolute sense, I think you need to have a specific knowledge of the science to be able to do this credibly. And that’s where Zoe comes in.

And then be able to, when you understand if you are stressed, then decide what is it that’s causing me stress and be able to address that issue? So linking your biology to stress a bit like Zoe’s analogy of a dashboard on a car, seeing what those warning lights are and understanding them is the very first thing, and that’s really the great teaching that Zoe does.

It’s then just a case of then working out what’s causing the stress, how to address that cause, as well as how to manage your own stress response better. So when you put all that package together, I think that’s what probably sets us apart from others because we are really delving into the why are you stressed and why is your body acting in a certain way to be able to then address the cause and not just the symptom.

Paul: I think also, and I really want to highlight this, the other thing that really sets you two guys apart from everyone else is the fact that you are culturally aware of the problems within forces. And I think it’s really important to highlight that. We saw a perfect example of why this is important in Munich.

When one of the delegates was talking, he explained they used to have a psychologist who came into the unit where they’d sit and they would have group discussions. And when I probed why it turned out that because that psychologist wasn’t culturally aware of the work or the stressors, et cetera, when a member of the team disclosed a particularly difficult case, the psychologist broke down and left and never returned. So to be culturally aware of the nature of the work and the operational stressors, I think is a massive value.

Mark: I think you’re right. Because people who work in law enforcement, invariably they don’t suffer fools gladly. They are prepared to call out worthless support in inverted commas. And we’ve all been there when we’ve seen wellbeing sessions which really haven’t been of any great use whatsoever.

So to be able to recognize and understand the stresses, to really appreciate the things that cause people most frustration, which may not be the material they’re looking at. It may be their supervision, it may be the shift pattern, it may be the organizational culture. And because we’ve been there for over 50 years between us having seen very good support and shockingly bad support then, we can get rid of all of the stuff that would be a barrier to us being able to engage with people properly and also when people I think are just saying things for the sake of saying it, we can call it out as well a little bit.

So the game players that you do have, because they want to do whatever. My 31 years of policing in a leadership role was about smelling the stuff that was put on flowers to make them grow nicely. And actually be able to say, “come on, that’s really not what the issue is – something else here.”

And that’s why we like looking at psychosocial risks around organizations. And really digging into them and understanding those pressures that people have within their organizations. And that’s why we really started to see themes and being able to tease out those themes in people, especially around communication and barriers of communication within the organizations, which really frustrates DFI because they do not feel they’re being listened to effectively, or suggestions they’ve put forward are not being heard.

So what is it about the way that they’re approaching the subject that’s stopping them being listened to by more senior management? And that’s a really interesting area.

Paul: It is. It absolutely is. And it’s frustrating for DFI because as you said, they really do feel unheard. Many of them have asked for more supportive mental health provision, and it just doesn’t come. Despite the ever increasing workload which is placed on DFI, the mental health provision has stayed static. And it stayed static for years and years, and that’s just not sustainable.

Mark: So the solution there is to do what we do, which is to go into organizations and we use the ISO 45003, which is basically looking at the psychosocial risks within an organization. So rather than, for instance, looking typically people look at health and safety from the perspective of physical risks, slips, trips, falls, all that sort of thing. You are much more likely to go off sick ’cause of the psychosocial risks.

And so we will do work with the DFI to identify what those psychosocial risks are and provide a report back to the organization and we’ll make it quite clear to say, “look, these are definite risks to the health and safety of your staff. If you do not address them, then as an organization there may be some questions asked at a later stage such as in employment tribunal, and wherever else?”

So you can use a stick to actually support this work. And when we’ve worked with organizations, we really have encouraged them to have a much different approach towards communication, towards line management, towards workflows. By actually using the psychosocial challenges and recognizing that they will get improved performance, they will get lower sickness and they will stop having to worry about retention issues by actually providing this support. Carrot and stick in the same way.

But the reports that we will provide and, we can do this over an afternoon, it’s not a difficult piece of work. We can provide an organization with a way of making sure that your DFI are working to the best of their abilities in a sometimes in a very cheap and easy way. Just by tweaking how the DFI are respected and recognized as part of the organization.

Paul: I think you, again, you touched on something really important there when you mentioned the ISO standards with regard to health and safety and wellbeing. I think many employers need to recognize that they have a legal obligation to their employees. I know police officers aren’t classed as employees, but they still have that legal obligation to protect them when it comes to wellbeing and mental health. And obviously you based your model, your services on those ISO guidelines. So it’s as good as it can be, isn’t it?

Mark: I think the ISO around the psychosocial risks that affect you in the workplace – I think it’s best endeavors. It’s the best model that’s out there, I think in looking at how to support your staff. I don’t think it’s perfect, but I think, and I can talk with experience of having been the employer at an employment tribunal where it’s not an easy ride.

But if an organization has shown reasonableness, fairness, and has deliberately gone to look for the problems and then try and resolve them. Most judicial processes will look very favorably at that. And so that’s what we are saying to organizations. We’re saying, “look, bring us in. Let us speak to your DFI. Let’s work out what it is that’s causing them problems, be it how their work is organized, be it their work environment, their equipment, or the tasks they have to do, or maybe the social factors that work.”

Looking at all of these, get them to identify what the problems are. Most importantly, identify solutions to those problems. And then organization, chief constable, chief executive, police and crime commissioner, health executive, whoever, you can then decide how to deal with those issues to make sure that people are working effectively and not then going off stressed. It is a very good business reason for doing this.

Not least the legal problems, like you mentioned, Paul, of if you don’t do this, if you are refusing to listen to people, then that could get you in quite a bit of trouble as well. So there’s good business reasons as well as good human reasons to do this.

Paul: Yeah, there absolutely is. Because obviously, the risk is that police forces could ultimately end up getting involved in litigation having caused such significant mental health problems.

Zoe: Absolutely, and I think, just saving money on the physical support that they then have to give officers and staff. When you look at the cost of, when people have their back pain, they have that special chair that they get bought – just as a daft example, we’ll treat the symptom, not the cause. Those special, better chairs cost 1200 pounds each. So what’s 1400 Euros? That’s about $1,600.

And if you’re not addressing the cause but you’re just treating the symptom, it won’t solve the back pain. And actually it’s a worthless investment. If you, and we recognize that a lot of forces, there’s a lot of financial pressures on everybody around the world, so therefore it’s even more important not to do wellbeing washing, not to get the wrong people in, not to waste investment on special chairs, when actually if you invested in the cause of the stress and resolve their back pain, they wouldn’t need additional lumbar support because it’s not a postural problem.

Then you actually will see the benefit. And I think, Deloitte said that for every one pound invested in meaningful wellbeing, you get a five pound 60 return. And that word is the one – it’s meaningful. And I think the culture has been, the wellbeing space is quite crowded. There’s been a lot of people making a lot of money historically for saying, “oh yes, I understand why you are stressed, et cetera. Here’s a stress ball and have you tried sleeping?” And a very holistic approach that hasn’t been resonating with people, that’s really made a lot of people particularly I think law enforcement people, people working in that area that look at evidence a little bit skeptical around it because they’ve had so much poor intervention by people, like you said, that don’t have that credibility, that don’t know their world.

And I’ll just, as a very quick – we were working up in the north of England and I’m not gonna swear on a podcast, so I’m gonna edit one word in this, but I overheard an inspector and he said, “oh, what’s this wellbeing rubbish we’re having this morning.” And I heard that before we were going in to deliver the biological wellbeing to them. And I thought, “game on.”

And we delivered the session and that individual didn’t know that I’d overheard them, but made a beeline afterwards for us and said, “that was” – and I thought this is gonna go one of two ways. They went “brilliant.” Because it’s probably the first time they’ve had a piece of wellbeing that’s actually been useful.

And certainly you get happier staff. There’s financial savings, which not only is it good ’cause it’s the right thing to do, it saves organizations money because people aren’t going off with the stress aspect, they’re not needing additional physical support from it. And an organization that we worked with where we delivered the psychological safety work as well as the biological wellbeing, and that caused them to just adjust their meeting structures because we don’t deliver and then disappear. We keep contact with organizations and three month check in, they said, “do you know what we’ve re arranged our Monday meeting, restructured it to make it more” and it has completely changed the whole week and the productivity and everybody. And they said something that seemed so simple. Wow, what a result.

I think people join law enforcement to make a difference. To help people. That’s what we do. That’s what we want to do. That’s what we’re passionate about.

Paul: That’s why we’re there.

Zoe: Yeah. And that’s what Mark and I do with this stuff. ‘Cause it’s supporting those that are supporting the others and we’re there to help and make a difference.

Paul: I think, as I say, I was so impressed by you guys when I saw you in Munich. I thought, no, we’ve gotta share this with our Forensic Focus audience, because your approach doesn’t just protect the investigators. It doesn’t just stop them from becoming the next one who breaks. It also increases their physical health, doesn’t it? It increases the physical health. It makes them more productive and ultimately creates a more cohesive, productive team and obviously allows DFI to remain in the role that they really enjoy doing for longer. So I’m really glad you guys have joined me today to share the services that you offer. Do you have any closing comments before we wrap up?

Mark: You’ve no idea what a hard task master Zoe is when you’re working. She, Zoe was my staff officer and I thought the relationship would be, I say she does, forget it. No, absolutely not. She is an absolute inspiration in command and control. And it’s a privilege to work with her.

Paul: Is the boot well and truly on the other foot now, Mark?

Mark: Yes.

Zoe: Not at all. I think what goes to show, I’ll smack him later. I think what goes to show that, because Mark and I have the psychological safety between us and that is really evident in our work that you can – ’cause psychological safety isn’t about being nice. It’s about being able to be honest and give feedback. And if I do something that’s really rubbish, boy do I get told about it, but in a way so that I can improve next time. And life is too short. It’s life’s too short to be – let’s have some fun, let’s have some learning. And let’s make a difference. And I think, I’ve said this is suitable for anyone with a pulse as long as they want to keep it.

Paul: Yep. I totally agree. Ladies and gentlemen, Mark and Zoe are Adapt and Evolve. Their contact details will be shared at the end of the podcast. They have a very unique outlook and very unique approach to the protection of mental health and wellbeing in digital forensics. If you want any further information, please get in contact with them. They will be only too happy to speak to you. Thanks for watching everybody. Thanks for taking part, guys.

Mark: Thank you. Cheers, Paul. Cheers.

Well-Being Interventions For Forensic Practitioners – Have Your Say

The following transcript was generated by AI and may contain inaccuracies.

Paul: Today we’re joined by Dr. Jo Morrissey, who is the Workforce Strategy Lead at the Forensic Capability Network with a career in police and forensics that began back in 1991 as a fingerprint and crime scene examiner. That was with the Met. Jo brings with her a wealth of experience to the table.

She’s a passionate advocate for workforce development and having led initiatives in apprenticeships, recruitment and wellbeing across forensic disciplines. Jo is the driving force behind the FCN’s partnership toolkit and the introduction of the level four digital forensics apprenticeship.

Her work bridges the gaps between police and academia and industry making her a true innovator in the field. Welcome to the podcast, Jo.

Jo: Thank you Paul, and what a lovely introduction. Apart from the fact you reminded me, I’ve been in forensics for a very long time now. 31 years.

Paul: Yeah. I’m not giving away how long I was in forensics. Is there anything I missed off your CV, which we should know about?

Jo: No, I think that covers it.

Paul: Awesome. Can we start by telling us a little bit about the study that you guys are about to run?

Jo: Yeah, so the FCN have been doing quite a lot of research over the last four to eight years since we’ve existed on wellbeing. And so the current phase that we’re in is I’ve just sent out a survey.

So forensic practitioners across all disciplines, including digital forensics, but for all disciplines and worldwide, because what I’ve found from conversations with colleagues in Canada and Australia and New Zealand is we all have the same challenges.

Forensic practitioners are having the same challenges, the same wellbeing issues, wherever they are. And so I wanted to understand a little bit more about what the challenges are. Is it different for different disciplines?

So this survey has gone out to forensic practitioners, current and past in any discipline, so that we can have a look at fingerprint examiners, crime scene investigators, the DFIs, to see what challenges they have and what interventions they’ve had available to them in the workplace, which ones they’ve used, and then which ones they think are most useful.

Because I think in policing we offer a lot of interventions and a lot of tools that people can use, but I really wanted to get a good understanding of what there is, what exists, what’s been used, and how useful the practitioners found it. That’s what this survey’s all about.

Paul: Excellent. And the survey doesn’t just cover digital forensics does it? It covers traditional forensics crime scene investigators.

Jo: It covers policing. The public sector, the private sector, and those that are working independently. Any forensic practitioners, I want to know what it’s like for all of them across all of the different areas. But yeah, digital is one of them. But fingerprint examiners, DNA analysts, anyone in forensics.

Paul: Anyone in forensics.

Jo: Yeah.

Paul: Yeah. I just wanted to make that clear for those watching the podcast. So what specific wellbeing challenges are you hoping to capture across the different disciplines?

Jo: A couple of years ago we had a forensic appendix in the national Police Wellbeing Survey. And that told us a lot about the kinds of challenges that our forensic practitioners in England and Wales have.

Some of the things in relation to workloads, some of the hindrance stresses that they have to do with working hours and shifts. But what I wanted to see was, is that the same across all of the disciplines and is that the same worldwide?

I did actually live and work in the US for six years, and I was a practitioner out there. And what I found from my experience there is the people that worked with me and for me, were the same as the people that worked with me and for me in the UK. The same experiences, the same challenges, the same problems, the same wellbeing problems.

But I wanted to see, did it differ across disciplines? So our digital forensic practitioners may be affected by different things than CSIs are, than fingerprint examiners are, because for some of them it might be the primary trauma of the things they’re going to. For others, it could be secondary trauma, or it might just be the workload.

Or the shifts and the hours and the time away from their family that is actually causing the problem. So it’s to build on what we already know, because there is, as you know very well, a lack of research out there about the challenges for our practitioners in forensic science.

Paul: Yeah, there is. I’ve been giving this a little bit of thought actually, and I was thinking in terms of the traditional crime scene investigators. And quite often how small their teams are, which will of course cause repeated exposure to some quite traumatic scenes which they have to attend.

And obviously that repeated exposure would then affect them from a mental health perspective, wouldn’t it?

Jo: Yeah. Oh yeah, definitely. But interestingly, some of the things we’ve found is that it’s not actually the traumatic incident that’s affecting some of them.

It’s the fact that there’s no one to talk to when they come back. As you’ve just said, if they’re part of a very small team. And we’ve lost a lot of our canteens and places where people could get together and talk with colleagues about what they’ve been to. And that’s causing some of the challenges.

I think that there aren’t those places where you can talk with people who understand what you’ve been through and what you’ve seen. And so I think that’s one of the things that’s affecting people more is if you’re working in a small team and there’s no one to ask questions of or to talk to, that will affect you.

Paul: It’s actually quite interesting you say that because that’s reflected also into digital forensics. From the research that I’ve done, DFIs often talk about the lack of availability of a private safe space where they can go and decompress together.

Jo: Yeah, it’s not something you want to go to a friend for Costa coffee and sit and talk about, because there’s people around who don’t need to hear the things that we see.

Not everybody can go home and talk to their spouse or partner or family or friends outside of work about it because it’s not something you necessarily want to share with people who haven’t been exposed to that. And if you can’t talk to your colleagues, who can you talk to?

Paul: Exactly. And you’ve just touched on something that I quite often talk about. I’ve said on numerous occasions now, I worked in digital forensics for 14 years. I never once went home and told my wife what I saw that day. Not once.

You just cannot do it because you run the risk of traumatizing your partner or your friends.

Jo: Yeah. Yeah. Because we’re very conscious that things we’re exposed to as forensic practitioners are not things that the average person will ever see in their life. And if they did see it once, it would be a very traumatic incident for most people. And we are, as practitioners, seeing them over and over again.

And I guess even for people who probably feel they haven’t been affected or had that major incident because of it. The next scene they went to could have been the one that took them over the limit. We never really know when we’re gonna get to our breaking point with what we see.

Paul: No, we don’t.

Jo: It’s constant. And it’s also that you don’t know when you, what you’re going to see and when you’re going to see it. For a digital forensic practitioner, they don’t know what the next photograph, the next image they look at is going to be. And it could be that next one that’s the one that triggers them.

Paul: Yep. Absolutely. Absolutely. I totally agree. So going back to the survey, does the survey include any discipline specific questions to account for the differences between the disciplines?

Jo: It doesn’t include any different questions, however, there are a few that you can select different areas. And so there are some questions like what has affected your wellbeing. And so exposure to CSA material is included, which is focused on digital forensic practitioners.

That probably won’t be something that would be ticked for a lot of other practitioners, but it would be for the digital. So no, there aren’t any specific questions for specific disciplines, but it will be interesting. And that’s deliberate actually. Because I want to see how the different disciplines select the responses differently.

Paul: Yeah. Yeah. That’ll, yeah, exactly. We don’t know.

Jo: No.

Paul: Because the research is spanning multiple forensic disciplines, isn’t there?

Jo: Yeah. Yeah. There’s a paucity of research just for single disciplines. We know that crime scene investigators and digital forensic investigators are those that are highest at risk. We know that, there’s evidence for that, but there’s still not a lot of research even for those disciplines.

But for the others, the people that would be more exposed to probably secondary trauma, reading information, we really don’t know very much about them at all. So I’m really hoping that we get a little bit more information about that. And this is just the first stage of some research I’m gonna be doing.

This is just like the initial investigation, which depending on the results we get, will lead into further research moving on.

Paul: And as far as I’m aware, there’s no research out there currently which has compared the different disciplines to see if similar mental health stressors are experienced by them all?

Jo: I’ve not seen it. If it exists, I haven’t seen it, so no.

Paul: Not me. No.

Jo: Yeah.

Paul: So are you aiming for a representative sample across all forensic disciplines, or are certain groups like police employed versus the private sector being prioritized, or are they all being analyzed together?

Jo: They’re all gonna be analyzed together. I haven’t aimed for a representative sample because the way I’ve sent the survey out has been through FCN channels. It’s been to forensic leads across the country. It’s been via social media to contacts that I’ve got in police forces across the world.

I sent the survey out last Friday and I’ve already got 110 responses. Which is fantastic, including about 20 to 30 from Australia and New Zealand. So they’re really engaging with it.

And everywhere I’ve sent it out, I’ve said, please share. So it’s a snowball sampling. Just send it out to anybody. So the results I get at the moment, I’ve got more CSIs that have responded than anyone else, but it’s about a third.

Digital forensics about half CSI and then the rest cross disciplines. So I really don’t know what I’m gonna get, but no, it’s not been prioritized for anyone, public or private. Just anyone.

Paul: That’s really good. That’s really good. So what criteria are being used to assess the effectiveness of wellbeing interventions?

Jo: That’s where I guess it’s gonna be a bit subjective because it’s just the individual’s perception of how effective it was. I’ve not used any clinical measures because that’s outside of my expertise and that’s something that I think potentially we can think about as we move forward. Maybe we could do that in future, look at it, make it more clinical.

But it is going to be how the practitioner who has interacted with the intervention thinks it worked or not. So is it scientific? Is it clinical? No, but it gives us a good indication of how people felt.

As a practitioner, if you’ve done something and you feel better and you can go back to work. Then that’s worked for you. So that’s the sort of level this survey is at.

But as I say, this is just the first phase of a project that will go on hopefully for the next year or so, getting more detailed and starting to look more at it with people like you helping to look at it maybe from more of a clinical point of view.

Paul: I have to say, when the other stages start to be publicized and shared with the practitioners, I’m sure we at Forensic Focus would love to help do that.

Jo: Yeah, that’s fantastic.

Paul: So just drop me a line and we’ll get something arranged.

Jo: I will. And we’ve got some academic partners from University of Birmingham who have interacted with the questionnaire with me which is just gonna be published through the FCN. And then we are applying for ethical approval for the next stages of it through the university. So yeah, I’m happy to work with Forensic Focus as well on that.

Paul: Amazing. So will the study explore whether interventions were used preventatively, or in crisis situations?

Jo: It doesn’t, there’s not actually a question that asks that. I’m not going into that level of detail. It asks them do they know what interventions are available to them or are there any interventions available to them in their workplace? Do they know what they are?

And then there’s a long list for them to select from. Or they can add others. And then if they used them, which ones did they use? And then if they did use them, how effective did they think they were? And those are spaced on a Likert scale of whether they thought, how useful they thought they were.

Paul: Whether they were effective or not. Yeah. Is the study gonna explore barriers to accessing wellbeing services?

Jo: Some of the questions are about are the resources available to them? So rather than the barriers, it’s about what is there, what’s available? Do they know what’s available? And then there are some free text questions where they can put information like that.

I don’t ask that explicitly. But that is one of the questions I want to pursue into the next phase is what are the barriers? Why don’t they use interventions? Or if they are available to them, what are the barriers? Because we know that there are barriers.

Paul: Yeah, we do. Yeah. That’s been well researched. I think probably the biggest barrier that immediately springs to my mind is the stigma around help seeking behavior, which we all know still continues and still exists.

Jo: And that’s a really interesting point, Paul. Because one of the answers I read today from someone who submitted their form said exactly what they said, that the barriers are the stigma to asking for it or asking what’s available and then using it afterwards. There’s still a stigma for them.

Paul: Yeah, I was talking about this with someone else actually earlier today. And it wasn’t just a stigma, it was the worry that, how can I put this, the worry that it would affect their future prospects.

Jo: Yeah. Yeah. I think that’s definitely, as I say, just looking at this one answer that I looked at today, that was exactly what it said. They’re worried about their career prospects. They’re worried about, especially for digital forensic practitioners, they’re really concerned that if they say I’m struggling at the moment, and I don’t really want to look at any more of these images, that they’re gonna be taken away from the job that they love.

And sometimes they just need a short break. Sometimes a month, two months, three months out doing something else is all they need. And then they’re happy to come back. Or maybe they’re happy to do three days a week looking at it, but they’d like two days doing something else.

But they’re worried that if they ask for that, they’ll be moved out of the section and away from doing a job that they love.

Paul: Yeah, I can echo that. I’ve spoken to dozens of DFIs through the work that I do with Forensic Focus, and it is a common theme that they are terrified to speak up and say, I need a break in case they are moved away.

And the problem is with many DFIs are civilian investigators and unlike police investigators who would just be moved to another section, another shift, another department. That’s not the case for civilian DFIs, is it?

Jo: No. You’re right in policing in England and Wales, that is a challenge. What else do you do if you’re not doing your primary role? There’s only so many project teams or validation studies that can be done.

And so for managers it is, to be fair to managers, it’s a challenge for them because they’ve got backlogs and workloads that they need to meet, and if they identify that their practitioners need to move, it’s like, where do I put them? There’s nowhere for me to put them to do something. And I need somebody else to fill that space.

And it’s not that easy because they’re skilled, trained practitioners, highly trained practitioners. And so it is not an easy answer for anybody, but what we need to do is build it into practices so that everybody gets that respite, whether they ask for it or not, everybody gets it so that we are protecting everyone.

Paul: Yeah. Yeah, I agree. So has the survey received ethical approval from a university or a professional body, or is it something that’s being managed by the FCN?

Jo: Yeah, it’s being managed internally by the FCN. It’s been reviewed by our internal departments. So we are compliant with GDPR and all the things that we need to be.

It’s not going to be published in any professional journals. It’s part of an FCN report that we are going to issue, that we will share. But it’s not gonna be an official publication in relation to a journal. But it will feed into that kind of research going forward.

So that’s why I said stage two, which I’m hoping to do some interviews with practitioners, will go through an ethical process with the University of Birmingham, get it ethically approved so that we can then publish our results in a professional journal, in an appropriate journal.

So this report will be shared. It will be available to everybody who’s taken part and everyone in policing. So it needs to be done so that it benefits people. I don’t wanna write a report that just sits on a hard drive somewhere. It needs to be something that is useful and usable.

Paul: I was gonna ask, how are the findings gonna be fed back? So will they be published via the FCN website?

Jo: Yeah, so it’ll be an open report on our website. And I’ll also share it obviously with any police force who’s interested in reviewing it, or forensic practitioner who wants to review it.

Paul: Yeah, I was gonna say, if you could share it directly with us and we could share it via Forensic Focus.

Jo: It’s not gonna be something that is a protected document only available to UK law enforcement. Everyone will have access to it.

Paul: So from all the research that’s being done, obviously it’s very early stages for this study, but from all the research that’s being done, do you think there might be an intention to develop new national guidelines on minimum standards for the provision of wellbeing based on the research as a whole? In the UK.

Jo: I think it will definitely form part of the discussion for national standards. So previous work that I’ve done on wellbeing for practitioners has been shared with Oscar Kilo and they’ve, which is our national police wellbeing service in the UK, in England and Wales. And they’ve been really interested in what we’ve done.

The results from this will be shared with them as well. And we are engaged in that conversation constantly through the National Police Chief’s Council on how we can make sure that we protect the wellbeing of our staff and whether it will lead to minimum standards or guidelines.

Minimum standards are exactly what I would like to see that we do issue some kind of good practice. This is what we would expect, and if we could have some kind of national guidelines that everyone had to follow? That would be the ideal.

Paul: Yeah, it would. Something that quite often crops up during conversations that I’ll have with DFIs is the fact they do mention the guidelines that are published quite often around digital forensics by Oscar Kilo, which I have to say I have read and they are really good.

There’s some really good guidelines, really good pieces of work published by Oscar Kilo. But because the guidelines, they are not being put in place on the ground. So whereas if it were national standards, then there would have to be adhered to,

Jo: Yeah. So I work with the National Police Chief’s Council, Recruitment Retention and Wellbeing Investigators Group. And they are very keen. They’re looking at the wellbeing of investigators across the whole of policing.

So this will also be fed back into the work that they’re doing and they’re the NPCC body that would lead. So I would love it to become minimum standards. Definitely. That’s what I would like to see.

National guidelines everyone has to adhere to. But I think before we can have those guidelines, we need the evidence base to support that. And that’s why we’re doing this, so that those guidelines aren’t just based on what you or I think they’re actually based on the evidence from research.

I think it might be a way before we get those standards because as we’ve already said, there’s a lack of research, there’s a lack of evidence, and it needs to be evidence based to support it, to make sure we’re doing the best for our practitioners.

Paul: I absolutely agree. It’s something I’ve thought about quite a lot actually, because from an operational point of view, you’ve got ISO 17025, which has come in, and it dictates the procedures and policies around the actual work that’s done in the labs. So it makes everything safe and sound and secure. Yet the same approach isn’t applied to the wellbeing of forensic practitioners, is it?

Jo: No. And that’s because those guidelines you are talking about? The forensic regulation that we’ve got, it’s based on research, it’s based on validation of methods, and we’ve not done that with wellbeing. We’ve never really analyzed it and we’ve not got enough of an evidence base.

We’ve got some research, but not enough, and so that’s where the work that you’ve done, the work that we are doing, the work that others out there are doing. Because it is becoming, people are aware of how much of a risk it is to our workforce.

And so people are really keen on it and there is some research going on now. Hopefully we will get that depth and quality of research and responses so that we’ve got the evidence base so that we can create those minimum guidelines so that forces are obliged to stick to them.

Paul: And I think what you’ve just said about those kind of guidelines being based on evidence, which comes from the research that you do, just shows how important it is for practitioners to actually take part and complete this survey that is going out via Forensic Focus.

Jo: Yeah. I would love to get a thousand responses. My analysis would be difficult, but it would be fantastic. As I say, it’s only been open four days and I’ve already got 110 responses or something. We are doing well and a lot of those have come internationally already.

I’m really keen to get as many responses as we can. We’ve got 4,500 forensic practitioners in the UK. If we could get at least 10% of those to respond, it would be fantastic.

Paul: It would be amazing, wouldn’t it?

Jo: Yeah.

Paul: And that would really put quite a lot of weight behind the requirement for national standards, wouldn’t it?

Jo: Yeah. And that was the problem with the National Police Wellbeing Survey that gets filled out every year. The response rates are so very low that whilst it’s really interesting, the results that we get, the people that tend to respond to surveys are those that are either very happy or very unhappy.

Paul: Yeah. And there’s no middle ground, does it?

Jo: Yeah. No. So I would really like it if as many people as possible filled it out, even if they just say, yeah, I haven’t had any wellbeing problems. I’m fine. Thanks. At least then I know that.

Paul: And that’s equally as important to know, isn’t it?

Jo: Exactly. Exactly. It is. Definitely.

Paul: So will the data that’s collected be used to support funding bids for pilot schemes or interventions, for example?

Jo: I haven’t, it’s interesting. I haven’t really thought yet about applying for funding, but I guess that is something that we could think about depending on what I get out of this first stage, the second stage.

As I say, is gonna involve more work with, interviewing people and analysis of interviews. So yeah, potentially. And it doesn’t even have to be FCN if other people have got ideas and they want to come in and collaborate with them on funding bids. Getting the money is always the challenging bit.

But there are, there is funding available. I have seen some funding available for wellbeing initiatives, especially if we use technology. It’s about thinking smarter and thinking about what else we can do. It isn’t at the moment, but I don’t think that will preclude us doing that in the future. Definitely.

Paul: So have you identified any differences in wellbeing outcomes or services used between digital forensics and more traditional disciplines?

Jo: At the moment it’s such early stages. I haven’t really had a chance. As I say, it only opened on Friday, so I haven’t had a chance to look at it.

My experiences from policing in England and Wales, probably not because police forces offer the same interventions to everybody in the organization. So I don’t think that there’s gonna be any huge differences. Not that I’ve seen yet, but I might be surprised. That’s why I want to do this. Because I don’t know.

Paul: Exactly. We just don’t know, do we?

Jo: I don’t know. No. So that will be a really interesting question and that’s why I’ve opened it to every forensic discipline. Because I want to see, are fingerprint examiners more likely to do one thing than DFIs are? Are CSIs more likely to do something?

Does the fact that they work shifts or anti-social hours affect what interventions they ask for? Does the fact that CSIs are more frontline mean that they’re more likely to do one particular thing than someone working in a forensic enhancement laboratory who’s based in a police station all the time?

I don’t know. I wanna see are there nuances, are there differences or does it not matter?

Paul: I think you’ll get some really interesting results when you start to compare the answers from the different disciplines. I think it’ll be really interesting to see.

Jo: Yeah. And one of the other things I’m really interested to look at is the differences between male and female. Are there differences in responses about that? Are the interventions that are chosen different depending on age group? Are the interventions that are chosen different depending on your time in the role?

So is someone that’s very new into the role, more likely or less likely, is someone a bit longer in the tooth like yourself or I, Paul, that we’ve been around a bit longer. Are we less likely than somebody who’s 20 and has been brought up with mental health being talked about all the time?

Mental health was not talked about when I joined policing in 1991.

Paul: No.

Jo: It was a get on with it, shut up and don’t moan. Go and get another job if you don’t like it sort of approach.

Paul: Pull your pants up and get on with it.

Jo: Yeah. If I’d have said, I’m struggling a little bit with that, they would’ve just said, go down the pub, or, you’ll be fine. So does that make a difference? I think it probably will, but I could be completely wrong.

Paul: I think you touched on a really interesting sort of comparison there between new investigators and old investigators, because obviously from a cultural perspective, the youngsters who are coming through now are far more educated and far more open to talking about their emotions and feelings as opposed to the dinosaurs. Who are you and me?

Is it, does that make a younger investigator less susceptible because they’re more open to talking about it than an older investigator who’s less likely to talk about it?

Jo: Yeah. One of the other things I’ve really thought about is there a sweet spot as well where if you’ve been in policing for a certain amount of time, so maybe is there, if you’ve been in two, three years, does that education you’ve had not matter anymore because it’s the policing culture that takes over that you feel like you can’t?

Do these people change? Do they, for the first year or so, maintain that? I can say what I feel. Does that change with time in policing? Are you more likely after a certain point to no longer think, oh, I can talk about it because my colleagues don’t, so maybe I shouldn’t or. Is that not true anymore? Has the culture of policing changed that everyone feels comfortable talking about it? That’s the kind of thing I want to get into.

Paul: I think time’s a really interesting factor in this because I’ve published a few studies now. In one of the studies I looked at, which wasn’t actually in digital forensics, it was in general policing, and it looked at the effect of it looked to see if cops suffered from anxiety and depression.

And one of the really interesting things I found in that study, I did moderation analysis to see if over time those reported symptoms reduce and I found by the time they’d served 15 years, the reported symptoms actually did begin to reduce. Which was really interesting.

Now, I wondered, I gave this some thought and I wondered, is it because they develop protective measures themselves, or is it the ones who are more resilient stay within the force and the less resilient leave?

Jo: Yeah.

Paul: Which would result in the same findings.

Jo: Which, that’s another whole area that I think resilience that we can look into is resilience inherent in our personalities that some people are just more resilient than others? Is it something that we build throughout our career? Is it something we can learn and that we can teach people?

Because resilience is something that you bring up all the time. You have to be resilient. How do you measure resilience? How do you build resilience? That’s how do you capture that?

Paul: Yeah. That’s a whole project in itself.

Jo: And I totally agree because it’s something that I’ve thought about. How do you become more resilient than the next person you’re sitting next to, because you’re both faced with the same material. But how does one stay longer than the other?

And I’ve hypothesized that maybe, and this is a hypothesis, it’s not tested, maybe individuals who live through ACEs, adverse childhood experiences, who become very resilient from a very early age. Maybe that continues in the adulthood and into these posts. And it increases that person’s resilience and ability to stay in the job longer and deal with the exposure that they do.

Paul: Or does that actually work in reverse?

Jo: Yeah, we don’t have, and is it something to do with personality? Because you could get two children that have been brought up in the same household where they’ve both experienced the same ACEs or very similar, where one will be very resilient and the other one struggles to cope with life after the ACEs.

And so you wonder, is part of it your experiences or part of it inherent personality? It’s fascinating. It really is fascinating. And there is some work on that. There is some research on that. Looking at adverse childhood experiences and resilience.

There is some research about that. So maybe that’s something we could look at to how we could use that to build it with our practitioners.

Paul: Yeah, I think that would be a really, that would throw up some really interesting results.

Jo: Definitely. Definitely.

Paul: Good. I know, Dr. Tehrani has done some research around adverse childhood experiences, but I think I’m only aware that she’s done one study about it, so I think it’s worthwhile doing more exploratory work around that.

Jo: Yeah, definitely. She did some work for us about the digital for the level four digital forensic technician apprenticeship. Because we were concerned that bringing 18 year olds into a DF environment looking at some of the images they’re gonna be looking at will affect their brain because they’re only 18.

Paul: It’s still developing at that age, isn’t it?

Jo: Exactly. So she did some work, some really good work for us on that to reassure us that we could bring 18 year olds into the workplace. So yeah there’s some really good research we could ask to get done or we could initiate. Definitely.

Paul: So before we have to cut this off what’s the closing date for the survey?

Jo: It’s the 4th of July. Easy date to remember. 4th of July. Any Americans who might wanna do it, the 4th of July is the last date. But if anyone misses the cutoff and they really wanna do it, they can drop me an email, my email’s on the survey, and I’m happy to extend it if need be.

Paul: Perfect. Jo, thank you very much for joining us today on the Forensic Focus podcast. We’ll get this out to the users of the platform and we’ll include a link directly to the research study. And if you wouldn’t mind coming back and reporting the results, we’d love to talk to you again.

Jo: Yeah. And I would love to do that as well. And at the end of the survey, if anyone wants to be involved in future research, the interviews I was talking about, they can put their email on there. No one, I won’t share that with anyone else. Their results, all their other results will stay anonymous. But I’ll get in touch with them for the latest stages of this research if they’d like to take this further.

Paul: And actually, you mentioned you would like some participants to be interviewed via teams?

Jo: That will be later in the year. So if I come back and report the results from this survey to your viewers, then I can then ask for volunteers. Anyone that will be interested in the next stage can contact me then.

But thank you for giving me this opportunity, Paul. Really a good opportunity for me to share the work we’re doing.

Paul: Oh, that’s great to catch up with you, Jo.

Jo: Yeah, you too.

Paul: Thanks. Bye for now.

Jo: Thank you. Bye-bye.

Tom Oldroyd From Semantics 21 On Protecting Investigators And Reducing CSAM Exposure

The following transcript was generated by AI and may contain inaccuracies.

Paul Gullon-Scott: Hello and welcome to Forensic Focus Podcast. I’m your host, Paul Gullon-Scott, and today we’re diving into a conversation that places both innovation and investigator wellbeing at the heart of digital forensics. In this episode, we’re going to showcase the capabilities of Semantics 21, a platform that is transforming the landscape of digital forensics.

While cutting-edge technology often takes center stage, today we’re placing special emphasis on something just as critical—the protective features built into the platform that support the mental health and wellbeing of digital forensic investigators.

Joining me to showcase this is Tom Oldroyd, who is the Director of Strategy and Sales at Semantics 21. Together we’ll be discussing how the platform enhances efficiency, reduces unnecessary exposure to harmful material, and introduces forward-thinking tools designed with the welfare of investigators in mind. Whether you’re a practitioner, a manager, or simply interested in the evolving world of digital forensics, this is an episode you’re not going to want to miss.

Paul Gullon-Scott: Thanks for joining me, Tom.

Tom Oldroyd: Hi Paul, good to see you again. Thank you for having us on the podcast. We’re delighted to showcase what the team at Semantics 21 have been designing. I’m quite lucky because my background was in policing for 17 years, where I ran a digital forensic unit as a sergeant.

Prior to joining the police, I was always a geek and worked in the pharmaceuticals industry, so naturally going into policing, I fell back into digital forensics. The subject we’re talking about is digital crime, and sadly, most of that digital crime revolves around the protection of children and CSAM investigations.

I’ve had years of working with all the different forensic tools and I’ve been lucky to work with various companies. Now I’m the Director of Sales and Strategy for Semantics 21, a UK-based business with the sole mission to help law enforcement rescue as many kids as possible and design cutting-edge technology that does that job efficiently and cost-effectively.

We have a good understanding of the dangers that digital forensic investigators face doing their job. It’s probably one of the worst jobs in policing—the most challenging, but also one of the most rewarding, which is why I know so many people want to do it. But it does come with significant dangers, so we’re really glad to show what we have on offer.

Paul Gullon-Scott: Thanks for joining me, Tom. It’s fair to say that there is no other job like a digital forensic investigator’s role, is there? They are exposed to this material on a daily basis.

Tom Oldroyd: Definitely. Having worked in various specialized units within police, I remember when you worked on a firearms team, you had special priority bonuses of a thousand pounds. If you worked in a body recovery unit, you had another thousand pounds, and if you worked on a surveillance team, you had another thousand pounds. All those jobs had those bonuses for a reason—because they were difficult to do.

When I turned up in the digital forensics team dealing with CSAM investigations, I wondered where the bonus was, where the extra perks were for us having to do a job that I personally believe was far more damaging and dangerous than the other roles that were getting those extra payments.

I think we don’t respect digital forensics enough and the types of work that people do. I think it’s very taboo—historically, it’s been “keep those people that deal with computers out of the way and locked away in a cupboard.” But the job is now all digital, and sadly a lot of that involves CSAM or extremist content media review. It’s a tricky challenge to face today.

Paul Gullon-Scott: I think even right now, the mental health effects of working as a DFI and the dangers of working as a DFI are hugely underrated. Do you agree with that?

Tom Oldroyd: Yeah, definitely. I think it’s one of those areas where we’ve never had the statistics or data to back up the types of volumes of crime that people are having to review. We know there are backlogs, and it’s one of those things where we expect there to be a backlog of work within digital forensics.

That just means there’s never really downtime for those people doing the work—it’s job after job without that decompression or relaxing stage, without the time to take a break. That doesn’t really happen in the digital field.

Whereas if you look at football violence or other sorts of crime, which are very dangerous and hands-on, they do have times to take a break and step away from those tasks. We don’t see that in the digital world—we just see the demands getting more and more.

Paul Gullon-Scott: That’s backed up by research which has been done in the field, showing that the amount of grooming cases and sharing of indecent material has grown exponentially. I read a report not so long back which identified that the distribution of indecent material over the past four years has grown by over 300%. That’s a frightening statistic.

Tom Oldroyd: It is, and I think the scary thing is we’ve all probably thought we’d gotten over the hump—that we were actually seeing we were at the peak of demand with this type of crime. I don’t think we are. I think we’re still seeing the world become more digital, and we’re now seeing the introduction of AI, which allows people to do things a lot quicker and on a larger scale.

I don’t think we’re actually anywhere near the peak—I think those numbers are still going up and they’re alarming. I think we’re going to continue to see this trend even with the amount of effort the police are putting in today.

Paul Gullon-Scott: I agree. With the introduction of the internet and everything being so accessible, especially across boundaries and borders internationally, it just makes it so much easier for individuals with an interest in children to share that kind of material, doesn’t it?

Tom Oldroyd: It does. As a company, when we work with big tech firms, we’re quite lucky. When you work in law enforcement, you’re pretty much gatekept away from talking with people like Meta, Microsoft, and Google—they’re very nervous around dealing with law enforcement directly.

But having left and now working for the private sector, we have open relationships with those companies because they’re doing the right thing. They want to protect their networks and customers; they don’t want to have criminal activity on their platforms.

When we talk to them and see how they’re dealing with the scale, we see it’s increasing and how people are commercializing CSAM offenses because they know there’s revenue to be made from offending and attacking a child abroad. Someone’s making money out of that, and that’s where they’re exploiting these platforms.

The platforms are doing the best they can to chase the money to see who’s paying for this abuse to happen and obviously put their rescue missions in place. We normally find those countries aren’t as advanced as the western world, and obviously criminals exploit that.

Paul Gullon-Scott: So can we have a look at Semantics 21?

Tom Oldroyd: Of course we can. Let me show you what we’ve been busy working on over the last few years. Semantics 21 was really founded with the mission of taking artificial intelligence and empowering government departments with reviewing big-scale media.

As we’ve grown the company, new technologies have come on board, and we’ve seen new technology advances that we can take and benefit our users with. We’ve looked at what’s been done historically, and while we would never criticize any of the efforts anyone’s ever done previously, we want to advance and make things even better.

When we look at databases and when we look at PhotoDNA and how AI can be used for good, we need to use technology and we just can’t stay still. It’s really nice working with a company that’s got that ethical approach, where we can keep building solutions and work with big tech providers to help us.

As a small British business, there’s only so much we can afford to do, but when we ask for help from teams at Amazon or Google and say we could use some advice on how to process things more efficiently, because they know we’re here on a mission to rescue kids, we do get help from those big companies.

The main product we have is called S21 LASERi-X. The idea is that we can take all digital media from as many platforms as possible. If you’re using MSAB or Cellebrite to download mobile phones, we can take your UFDRs. We can take your GrayKey extractions, and if you’re using Axiom for computer forensics, you can do your computer analysis on those devices, export the media into this program, and we can utilize the AI to start doing that heavy lifting.

If you’ve got 5 million pictures to look at, which is probably an average-sized case these days, you really don’t want to be going from page to page—we need to apply intelligence so we can find the key evidence as fast as possible and reduce exposure levels.

One of the key things we find is that everyone internationally is doing the same type of investigations, so we know that databasing is the quickest way of finding indecent images—it always has been. The hash value of a file is really important, and in our software, we have the ability for you to create as many databases as you want.

They’re not encrypted, and that’s done on purpose so you can connect other forensic tools to what we use—MySQL or SQL as a backend database system. That allows you to add your Project VIC databases, your CAID, NITRA database, and all your own local databases run normally by your project or country.

When you’re bringing digital evidence in, we can do that comparison. Those databases have been a really good idea to have people collectively join those hashes together in one set. Now at Semantics 21, we realize it’s a good idea, but we should be doing something better because we know everyone globally is trying to tackle the same thing.

Although an indecent image may be created slightly differently abroad, it really makes no difference—we can still utilize that data. What Semantics 21 has created is the Global Alliance Database. It probably doesn’t get enough credit for how clever and intelligent the system is and how easy it is to use.

Simply, you would have your local database here—your MySQL database—and you would export to the Alliance. You agree to the terms and conditions, everyone has to have terms and conditions, you choose what data you want to share, provide an organization name and details, and then you have optional export options.

If your agency only wants to share the hash values and the labels that you’ve applied for your country, that’s fine. But if you are prepared to apply flags, metadata, GPS data, device make and model information, or notes, then that can also come into the database that we control.

It’s called the Global Alliance Database. You would generate an export—it takes a few seconds and is really quick. That would create an exported file which is encrypted and remains encrypted, so even when it’s transferred to us, it remains encrypted, and this is all offline.

You send us that file, we send you the master file back, and again, you agree to the terms and conditions. You then navigate to where that file’s kept—I can navigate to the Global Alliance file, click okay, and that’s now added 3.1 billion hashes that are community member hash values.

We’ve now got this deployed in numerous countries across the world. This is legally held content, this is CSAM material, this is AI hashes, this is revenge pornography flagged files. This allows us to create a truly global offline, end-to-end encrypted system.

When we talk about speed and efficiency databases, that’s what they’re very good at doing, and this is where we see that reduction in exposure levels because we know that when we’re looking at files that have been labeled internationally as legally held, they probably are legally held materials.

You still have to verify them as a human and double-check, but it means you’ve now got access to a database of 3.1 billion hashes—all law enforcement data, contribution-led, and it doesn’t cost anyone anything to access it. Our database is limited to our software at the moment, but we have reached out to the big forensic providers to say there’s going to be an API connectivity into the database.

Ultimately, we’re just doing this on behalf of the community so this will become tool-agnostic, because we know everyone’s on the same mission, but no one historically has joined all the dots together until now through Semantics 21.

Paul Gullon-Scott: Tom, can I just ask—you say there are 3.1 billion hashes stored in your international database. How does that compare to what’s held in CAID currently?

Tom Oldroyd: If we look at UK Home Office CAID, it’s probably one of the biggest databases available, and I think they stand at around 120 million. So we’re considerably bigger. As I say, we aren’t a company that’s criticizing or saying don’t use CAID—I’m not saying don’t use Project VIC.

What we’re saying is this is evolution, this is next generation, this is secure and encrypted. There’s no risk of losing a file that could have historically happened because back then when those databases were created, privacy concerns weren’t as tight as they are today, and obviously legislation wasn’t as good as it is today around data protection.

That’s why we had to evolve with time. When we look at the import of 3.1 billion hashes, it takes less than a second. If we look at CAID today, if we try to import the 120 million, or if we take Project VIC America which is about 90 million, it will normally take you 10, 12, 15 hours to ingest that data as a JSON file.

That’s not good—we don’t want investigators having to wait and waste that time having to import data. There are better ways of working today, so that’s where we’ve evolved to.

Paul Gullon-Scott: So Semantics offers a global database which contains 3.1 billion hashes and it’s time-saving when it comes to the import of those hash values.

Tom Oldroyd: Exactly. What that means is when we now bring in mobile phones or computer evidence or cloud data and we bring it into the software—no matter what the source is, doesn’t matter if it’s Cellebrite, Magnet, whoever you’ve downloaded the device with—we now add that media. Its first job is to compare against the database because it can check the hash values and see if they’ve been seen anywhere in the world before.

If they have, it’ll put them in a filter and say this file’s been seen in Australia and it was graded as a legally held image, or this image here has been seen before and it’s been graded by a Canadian investigator as a Category 1 image.

Category 1 in Canada would mean that it’s a CSAM image. Even though in America and Canada they normally have a very different category numbering system where Category 1 would be sexual abuse of a child, whereas in the UK we would say that could be an A, B, or C image because we break down the types of CSAM images differently.

All I would need to do is say this is a Level 1 in Canada, so I can look on the screen and say okay, in the UK that would be classed as a C and then categorize it as a C. But time to evidence is incredibly quick because we’re now utilizing the data and the efforts that somebody else has done to benefit our cases.

We’re seeing with big agencies across the world that normally when they add a mobile phone or computer today into the software, between 15-70% of the data is pre-labeled. We’ve actually had customers contact our support team to say they think the software’s broken because there aren’t many images on the grid—they’re not seeing the whole 300,000 pictures that they expected to see.

When we’ve said “just tell us what’s in the filters,” everything there is labeled because the database has been so efficient, they only have 50,000 files to actually review. The rest have been labeled already, and that is a huge time saver. This is where we say when we want to look at overworking and burning out our staff, that could be because they’re not working very efficiently because historically we haven’t had these sorts of setups.

Paul Gullon-Scott: So in theory, it not only expedites cases, but because of the vast hash database that Semantics provides—and you did say they provide that free, didn’t you?

Tom Oldroyd: Yeah, it’s completely free. All you have to do is contribute—you have to be part of the community. The reason being is when you contribute, you agree to the terms and conditions of the usage of the system just to make sure we comply with GDPR rules across Europe, and the system is also compatible with US and Canadian laws for data handling.

As I say, we can’t see inside the database, so it’s an end-to-end encrypted system. That’s not a “get out of jail free” system—it’s what’s internationally accepted now when we’re doing police-to-police data sharing.

Everyone that has access is from an approved country, and the database even has an expiry—after 90 days, the database will self-destruct. If we find that there are issues with a particular country or their political stance may change, it means that the database only has a lifespan of a short period of time.

Then all you would need to do is redownload the latest version again when it’s all privately controlled access and fully audited to make sure the database is going to the right people. It’s encrypted with the software so that people can’t break in and steal those hashes because we appreciate some of that data could be deemed sensitive.

It’s gone through its full audits—I’d probably say it is the most secure CSAM hash intelligence database in the world, and it’s also the largest.

Paul Gullon-Scott: So it not only expedites the case, but because of the vast hash database that it actually holds, it very quickly identifies and automatically categorizes the indecent imagery. From a psychological point of view, that reduces the exposure to DFIs immeasurably.

Tom Oldroyd: Yeah, definitely. I’ll show you a case and workflow that we would normally expect people to do for a small computer export, and we can prove exactly how fast this can run. We fill in normal case information just so we can track what the software is doing.

If the investigation isn’t CSAM, you just tell the software this isn’t a CSAM investigation. The reason we have that is some of our customers aren’t in the sex offenses—they might be tax office or border force—and they don’t want references to child abuse showing in their computers.

So we actually pivot the software to remove any reference to child abuse so that if you are dealing with an investigation that is non-child abuse, you are not going to get references to looking for indecent images or the CSAM detectors.

Even the design of the software takes into consideration the end user to make sure we’re building things as efficiently as we can. In here, we’re going to select an X-Ways export—we think X-Ways is a very good carver from all of our testing, so we always maximize evidence recovery.

We’ve got support for your UFDRs, your GrayKeys, zips, and there’s a processor where you ultimately just build up your evidence. If we have multiple exhibits—phones and computers—we put them into one product because we can then deduplicate and use those same databases.

You’re not having to review the iPhone in Cellebrite Physical Analyzer and then look at the iPad in Axiom where you’re probably seeing duplication of evidence, which means you’re getting double the amount of exposure. There is method in our madness for the way we work.

In this case, we would run the database—we simply say turn on the database. We can double-check to make sure which databases are enabled, and we could say this is a CSAM investigation from NCMEC. I could very simply navigate to my NCMEC cyber tip and say okay, and that’s now passed all the relevant data out of that NCMEC cyber tip.

That’s going to be one of the early searches that the system’s going to run against, so I’m not having to manually look for the data from the cyber tip that’s come from NCMEC—the system’s going to do that automatically for me. This reduces the demand on you as the investigator.

You’ve got Project Arachnid, which is the Canadian Centre for Child Protection. They provided us their asset database, so they obviously trawl the web looking for indecent material. They’ve worked with us and we now have access to their asset database—it’s encrypted and locked into the software.

We want to make things as efficient and quick as possible. We can go through these options for some of the AIs—color analysis, object detection. We work with the sex industry, the adult pornography industry, to look at the types of content that they’re seeing.

We’re looking at sex positions, sex toys, sex objects because when we have crossover child abuse with adult imagery, we need to know what they all look like and what sort of objects you may need to search for to speed up your analysis. We have a dedicated CSAM and adult porn detector, an AI designed by us where we’ve worked with international agencies to get representative samples of genuine CSAM that we can teach the AI to learn.

During the research, the team found very early on that CSAM in the UK actually looked one particular way, but when we worked with Latin American customers, we found that CSAM they were exposed to, or Asia Pacific region, was different. To teach an AI model purely on Western CSAM would introduce that bias, so when you’re trying to use an AI somewhere else in the world, or CSAM being shared across borders that we’re not used to seeing, the AI would have difficulty detecting it.

The team here—their expertise is AI engineering—can take all these things into consideration. By simply saying CSAM detector, we can see there’s a graphics card on my laptop, and this software works on just basic normal hardware—it doesn’t need to be anything that’s a rocket ship.

We’ve got junk filter technology so we can filter all that low-level risk material—things that may come from social media, videos that are very short that have probably been carved, little tiny one-second videos, anything that the operating system may have identified. Everything that’s low level, which we call junk.

We do that on purpose because sometimes we don’t need the AI to run on the junk, so we want to be cost-efficient with your energy and time. What happens on a Friday afternoon when you are working Monday to Friday in a digital forensics lab—you really shouldn’t be looking at CSAM unless it’s operationally required that you need to do it urgently.

What we would advise people to do is on that Friday afternoon, look at the junk. We know you’ve got to look at the low-level, non-risk material or low-risk material, so pivot the search instead of looking at CSAM instantly—sweep the search because then at least you can have a bit of decompression time.

You can get through the junk files and still grade them as legally held and get them out of the way, but it’s not something you’re going to see that awful video or picture that when you’re leaving work and going home, that’s the last thing you remember and you haven’t got your peers around you to speak to or have that safety net. It’s probably not the sort of matter you want to talk to your family about because it’s not something that normal people really need to know about.

Paul Gullon-Scott: What you’ve just said about you’re just about to leave work on a Friday and the images and videos that you’re normally exposed to aren’t something that you want to take home and think about over the weekend—that’s reflected quite strongly in research that’s been done which suggests that at the end of the day, DFIs shouldn’t be grading CSAM so they don’t actually take those images home with them.

Tom Oldroyd: Yeah, definitely. I think we’re starting to see that everything we do in our software we track, so the database—it’s optional for users to have, it’s not a performance managing system, it’s an exposure management system. We want investigators to be able to have that transparency of what they’re exposed to.

As a unit manager, having been there, I never knew when I had 50 CSAM cases and I divided them out to each of the staff—I never really knew who had a negative case or who had the world’s worst case. We talk about it, but I would never know the volumes of data.

When I came to Semantics, I was like we need to track that—we need to know what the exposure level is and what the numbers look like so that managers have good oversight. That’s what we do with the software.

Everything we’re doing here, adding the media and grading, gets tracked in the database. We have a separate application called the Wellbeing Monitor, which I’ll show you, where as a manager I can see every investigation, every exhibit, I can see who’s graded it, how long it’s taken them, and I can see the demand and the risk.

Like you say, it’s that risk that we’re now identifying to say Friday afternoon, don’t grade outside the operational hours of 9 to 5 because when people are grading late at night on their own without peers around, that could be quite damaging. You are concentrating too much on your work and you do need to sometimes just pull away from the screen a bit.

Paul Gullon-Scott: When you’re talking about cases, cases don’t mean individual items that have been seized—many cases contain multiple items. So the exposure potentially can be huge per case, can’t it?

Tom Oldroyd: It is, and that’s one of the things we’ve noticed when an organization or police forces have downloaded a phone using one product and then a computer with another. If we look at the iPhone, the Apple infrastructure—if you download my devices within the house, I’ve got two phones, three iPads (not that I’ve got lots of money, but I’ve got old iPads), I’ve got the mini iPad, I’ve got two Macs in the house.

You’re probably going to find exactly the same photos because photo sharing is on. If you downloaded them and looked at them in individual forensic products, you’re going to get that duplication.

Whereas bringing it in together, you’re still going to be looking at well over 150,000 files that are privately owned family photos, then you’re going to have all the internet cache. It’s normal to now be hitting cases into the millions, and we have had cases where people have had to come to us and use our software because they’ve used another product that couldn’t deal with the volumes of 20, 30, 40 million images.

For us, we’ve designed the software to deal with scale, and we’re blown away with the numbers of pictures that people are having to go through.

One of the features here on the screen is to set the threshold. This is something the UK government decided to bring in—when you graded to a certain threshold, it made no difference to the charging decision. When you had that large collection, the person wasn’t going to get any longer term in prison because they hit the top threshold.

This was added into the product to say we can do that calculation for you and show you how far you are through the grading to hit that percentage. Then the software will say you’ve hit your thresholds, you can stop.

Obviously, that comes with a big risk, and there’s a CARAT system here where you would carry out that risk assessment to say does the person have access to children, are they in a position of trust, do they have previous offenses? Really, I think we would say you can have your spider senses on here—if you think you’re coming across first-generation material, don’t do the thresholding.

But when we see that there’s just volume crime, as people would call it now, CSAM investigation, we built in the threshold system for that particular purpose just because of the sheer volume.

We’ll go over this very quickly, mindful of time, but we prioritize victim rescue—that’s the difference between our software and other solutions on the market. We can categorize, but we have a lot of clever capability to find those victims.

Obviously, we know with the scale and the numbers of crimes going up, there are going to be more victims out there that do need to be rescued. Very simple, human-readable answers and questions that we ask for—photos of your victims, your suspects, and the devices you expect to see, even the areas you think they may be offending and the type of offender they are.

When you’ve answered those questions, you click the go button and the software then takes all that intelligence you’ve applied to your case, and that’s how we rescue victims a lot quicker than we historically have. As I said before, this is just a very small case we’re showing you—it’s 42,000 files.

On my laptop, the import speed is about two and a half million pictures a minute, so it’s incredibly fast at bringing data in. In the background, you’ll see that the images are loaded onto the grid, so I can now already start to go through page after page, or if I wanted to look at the videos, I can even hover over the videos and see every frame of the videos because the software’s been designed to be quick and efficient.

We don’t want you to have to wait for delays. You can see we’ve compared to some of the databases already, so we’re identifying files that are legally held, low risk from the NSRL. We’re now calculating the PhotoDNA to look for files that are visually similar based on the PhotoDNA scores, and that’s how we can stack images on top of each other.

We’re not having to see all those images that are so similar on the grid. In the background, you can see the images are automatically being graded. This is a test demo case, but the database is fast—this is comparing not only against my small half-million files in my local MySQL database, but that is also now comparing against the 3.1 billion hashes that we have in the Global Alliance Database.

This is where we see a huge benefit, and this is where people really are excited by the development and the speed that the database is actually growing to allow us to find those files.

All I need to do is simply expand out the box here and we could see a breakdown of my Global Alliance scores. We added an NCMEC cyber tip, and these are the results from that NCMEC cyber tip. Time to evidence is far quicker than we’ve had before—this is where we can then say that we know these are CSAM materials.

We could then go and look in the same directory, we could look at the same time and dates to see that sex offenders have a type of OCD—we know they’re probably going to store data in the same location. We can get straight there and make that decision of this person needs to be interviewed now, they need to answer why this is on the machine.

Hopefully get that quick conviction so we’re not having to drag out an investigation. On the left, this is the grades—this is where we would now see instantly a breakdown. This is a test case, but this is where we would see a breakdown of those international grades.

If I wanted to only see legally held content that has been identified by Canadians, I simply put a tick in the box, and if I wanted to see who graded it, I click on the world icon. This will now give me a breakdown of who has seen that file and when.

We’ve got a popup here that tells me I’ve got some project hits as well. Instantly, within a few seconds, we’re finding the key evidence, we’re drawing the connections globally to where the image has previously been seen without really any stress and hardly a great deal of work.

My mindset is when I’m clicking on to show me Category A, B, and Cs, I know what I’m going to see. Yes, the database may have errors—we fully understand that humans make mistakes. If you come across an error in the database, you just simply correct it and the database will update the next time around.

This is where we see big data can make a huge amount of difference. As we said before, Paul, the Friday afternoon when you only want to look at the legally held data, just simply click what you want to see and get yourself in the mindset that you are only looking at the data that you’re selecting from what everyone else has come across.

When you are adding those labels and grades on, it’s all been stored here in the wellbeing statistics so that we could see a breakdown of cases I’ve been involved in, my previous cases in the last 30 days or last 100 days, and that is what’s being tracked. That obviously allows us to add an extra level of security to the end user as well.

Paul Gullon-Scott: Can we see the wellbeing monitor again?

Tom Oldroyd: Yeah. In the bottom, we’ve got—this is where we want to always be transparent with people. There are a lot of safety mechanisms built into the solution, whether it be you may want to have limited distractions, so we can remove all the buttons from the screen—you just get the grids.

We can scroll up the grids if we need to, we can put auto scroll on. This is one of the features that really we probably don’t take into consideration enough, but just to be able to put things on like auto scroll—the stress of not having to go through page after page. We can now sit there with a cup of coffee, we can go through the images, and when we see the relevant image, we can then stop.

It’s little things like that we add into the product, but when we look at what we’re tracking, we can look at the statistics of the grades you’ve done—your As, Bs, and Cs. We also have the ability that we have play wellbeing videos after so many minutes of you grading, and it’s an intelligent counter, not just a counter that happens every 30 minutes.

We know when you’ve been grading material and we then say the recommended time is 30 minutes—take a break. As part of that process, we also say because we know you have been seeing indecent images, to cleanse your mind is to actually watch three separate videos of different subject matters.

That has been proven to help decompress and help you forget what you’ve been looking at because you’re concentrating on these videos—kind of like cleaning the RAM in a computer system is how we put it. There are overlays in terms of how you would want your images to be—would you want them to have a glass overlay, do you want images to be pixelated, would you want the border outline applying, would you like blocks, would you want edge so we only see the edge files as well.

We can also turn on grayscale mode, so if we only wanted to see images in grayscale, we could do that as well. It just means we’ve got a lot more flexibility in the security of the user.

The reason why we look at grayscale—we always tell people don’t grade with grayscale turned on, do that when you’re creating your reports—is because the human brain can detect things incredibly quickly without really fully understanding why. One of the things we always talk about is if we see someone with a large cut on their arm and lots of blood, if we see it in color, the hairs on our arms stick up and we realize that’s danger.

We see that same image in grayscale, and we don’t actually react to it in the same way. It’s the same with CSAM material—if you’re grading, you need to see it and you need to see it quickly so you can apply the label and understand the context of that picture. Is that a live victim?

But when you’ve already graded that and you are looking to create your reports, you can put privacy mode on so you don’t see any of the images—you just see the privacy mode message when you’re doing your reports—or just put grayscale mode on. That means you are not going to have that memory and recall of the picture as quickly.

Everything we’re doing here is in little bits to help you and protect you. When you are grading and doing all your work, you don’t really notice this, but everything’s getting saved back to the local database. The local database allows investigators or managers to have a separate application—this is what we call the Semantics 21 Wellbeing Monitor.

This would allow you as a team manager to track that exposure level of all your investigators. We could see a label breakdown, we can see label breakdown per user, we can see average scores per grading per hour. This data is in its infancy—we’ve got the data, we’re now trying to really work with some agencies to track what we can learn and where we can identify risk patterns and how you can use it.

This is where it really is useful—we don’t, this isn’t a performance managing software, that’s what we stress. This is there for agencies and customers to be able to say to their SIOs, to the senior management, “Look how much material the team are going through,” and maybe that’s there to justify additional equipment.

Maybe it’s there for justification of additional staff or for decompression days. I think police forces are realizing it’s important the job gets done, but if your staff aren’t prepared to do the work anymore, or you are starting to see a drop-off in performance because you are burning your staff out, or they’re leaving and you’ve now got to go and employ new staff and train them, that’s where there’s that hidden cost.

You’ve got to put the protection mechanisms in place there to protect your organization and your staff. I know Paul, we’ve spoken previously, and we suspect this will happen more—organizations will be fined for not protecting their staff. It’s going to happen more and more often.

Liability levels are going to be very high, and I think sadly, we’ll end up seeing that happen more often before people really do take a stand and realize that there is a real danger when we’re dealing with CSAM investigations to staff exposure.

We’ve never had the figures, and until now, this is where we can now start to create a breakdown per number of staff, the times and dates that they examine, which exhibits yield the highest number of images that contain CSAM and dangerous material. What we’re hoping to do is work with agencies to say can we get the investigator wellbeing monitors to start driving some safety mechanisms that organizations can put in place—stopping the grading of indecent images at high-risk times, stopping on the Friday afternoons when we start to see a dipping performance from staff.

Not to say “Hey, you’re not working fast enough,” but to actually look and say is there a problem there? Are we identifying a trend that this person’s probably overexposed and getting burnout? I know that’s where your passion is—I know you’ve put a lot of effort into that and will continue to do so—but this is the idea of having the data that we can start to make those informed decisions with.

Paul Gullon-Scott: I think the development that you guys have put into the wellbeing monitor is phenomenal. I haven’t seen another piece of software on the market which has put this amount of development into this side of things. Having that in the background where the managers can then very quickly search to see what level of exposure a DFI or a team of DFIs have had gives them an early indication of DFIs who may be becoming susceptible to the known stresses and do something about it at the earliest opportunity.

I really like that wellbeing monitor—I think it’s a fantastic development.

Tom Oldroyd: I think, like I say, we want to do more. We’re trying to prioritize how do we tease out more material that we can get from the end users—that performance feedback. We need their input on how they actually feel while they’re doing their investigations.

But also, this doesn’t need to be limited to our tool. One of the things we’ve always said as a company is we don’t like this idea of companies having a monopoly and closing their ecosystem. I think when we look at CSAM, we all have to put our big boy pants on and work nicely as a community and have the export and import capabilities across the whole infrastructure.

For us, when we look at the wellbeing side of it, yes, we’re collecting the data for our product when you are grading with our tool. I don’t see a problem that if you are using GrayKey or if you are using Cellebrite or any of the tools, why can they not actually provide us the data that they see when you are labeling with their product? Could that not feed into the database that we have?

Could we now actually start to have that cross-company acceptance that we all need to work together to protect the users? That’s where I’d like to see this go—I’d like to see all of the products feed into a solution that, I’ll be honest, we don’t make money off it. The Wellbeing Monitor we give to managers for free—it’s part of our offering because we know that the data for us is useful to identify at-risk patterns, and we’d love to see other vendors start saying people can categorize and grade with our solutions and we’re happy just to have a connection to your database.

There’s nothing valuable there, but it’s the exposure levels that hopefully managers can then identify from all of the products, not just ours.

Paul Gullon-Scott: I’m going to ask you the big question before we call it a night. What is the price point for Semantics 21?

Tom Oldroyd: We are open and fully transparent in our pricing. The price I normally advertise in dollars because the biggest market in the world is the US. S21 LASERi-X, the main product—the highest price you’ll ever pay is $2,000.

If you pay for that, you’ll get all the AI, you’ll get the databases, you get access to the Global Alliance Database, the wellbeing solution is provided within the solution. The data and the wellbeing monitor for your managers is included within that price as well.

You install the software, there’s no servers, there’s no cloud requirement—you just install it on a standard forensic machine and you’re good to go. Normally around about the £1,500 mark or $2,000 mark. But again, some site licenses are a lot cheaper.

We’ve just donated over a million—over this year we’ll have donated a million and a half in pounds in software to developing nations where obviously they either don’t have the finances or special project teams that we work with. Homeland Security in America for the Hero Project, where ex-military vets that are injured that have now gone into police to help rescue kids and they’re dealing with CSAM investigations—we’ve always said they will never pay.

They get our software completely free of charge, and they always will do. That’s because we like the mission—it’s people that are coming from horrible environments of war and they still want to help do a public service. It’s only right that we help them out as well.

We try and keep our prices as low as we possibly can. We are a business, we do have to operate and pay our salaries and keep the development team going. We are lucky—we do get a lot of help from big companies, big tech firms that see what we’re trying to do and they do try and help us out as well.

Links to academia is definitely one of the things that we’re really pleased with and happy to work with because they’ve got some very bright, talented minds there that we want to help, and they want to help us look at where do we go in the future.

Paul Gullon-Scott: Just before we go, one other question that’s just popped into my mind. If the users have a particular requirement for the software, how flexible are the developers around including that requirement?

Tom Oldroyd: Unbelievably. We rely on the feedback of users to say what do you see that you like, what technology trends are you seeing, how do the offenders operate, and let us know. For instance, QR codes—we were told by one of the tech firms that QR codes are being used to hide messages on online platforms.

We were like, that’s quite a clever, nifty way of trying to get around and obfuscate your conversations. We all know text messages are being read by the big platforms, but QR codes weren’t. Literally within minutes of telling the developers, “This is what bad guys are doing,” we had already a proof of concept of how to read and detect QR codes, to translate QR codes, and probably within a day it was in the product and available.

We have Swiss customers that have just come on board that said our labels don’t look like that anymore—we’ve changed our grading labels. Within half an hour, we had a version of the software with all their brand new labels so they could continue to use and grade using their label system.

I don’t think you will get that level of support or customization from many companies in the world within digital forensics, but we have to react as fast as we can. We’re always open to new ideas, new suggestions.

We’re just in the school badge lookup for the whole of the United States—we’re now 130,000 schools for all their logos and badges we’ve added in. We’re now getting other countries approaching us saying they love the idea and have the same problem. Would we be prepared to research all school badges for their country as well? Of course we will.

We’ll follow the demand, and we’ll add things in that customers need.

Paul Gullon-Scott: Actually, on the subject of the school badges system that Semantics has developed, for those who are interested, Forensic Focus has just released a great article specifically about that. If you go to the Forensic Focus website, you’ll be able to read all about that in depth.

Tom Oldroyd: One thing we missed off the article is if you are not one of our customers and you have a logo or badge that you are seeing as part of your investigation, you may use one of our competitive solutions—message us, tell us what the description of the badge is, or find an agency that has our software. They’ll do it for you, but just describe the badge to us and we’ll tell you which school it is.

This isn’t a lock-in where you have to buy our product. We’ve done the research, we’re sitting on it, and it literally takes our team a couple of minutes and we can help you locate a school badge even if you’re not one of our customers. Don’t be shy about approaching us even if you’re not one of our active customers—not a problem at all.

Paul Gullon-Scott: I know there are formal AI-generated or AI applications built into Semantics 21. Sadly, we haven’t got time to show them all tonight, but one of them that particularly pops into my mind is the AI application which also helps identify areas.

Tom Oldroyd: Yeah, so the location lookup is amazing. When I was first shown that technology, I was very skeptical—most cops are. I was like, “How the hell does that do that?” It’s completely offline where you would expect the system to be online.

If anyone’s seen it, it’s called AI Location Prediction—it’s a completely offline system, it’s part of S21 LASERi-X, the same program. You can either select an image in your case, or if you have an external image from social media, maybe outside in a field or a town center, and all you do is provide the image to the system and say “Where is it?”

The AI has five models—the five models then examine the content of the picture, not the EXIF data. We don’t need the EXIF data at all. If you think we’re cheating, take a screenshot and literally it will look at the detail of the picture and try and work out where it’s from.

As long as the five AI models are quite close together, it’s a strong probability it’s in that position. Last week in America, we had some American investigators do exactly the same thing as I would have done—prove it. They took a photograph inside the foyer of a hotel and said, “Okay, whereabouts is this?”

Literally, the AI had detected it was about a mile and a half down the road from where the actual picture was taken. The accuracy was amazing in the middle of Florida. This thing is designed for historically military intelligence type investigations, but now available to all domestic police.

There are cases where we have child abuse cases—where is the child in the UK or are they abroad in Europe somewhere? If we’ve got a series of pictures, we can start to build a picture of where that child potentially was being injured or being attacked. Or if you’ve got a suspect that’s just been stupid, who’s photographed themselves on social media and they’re on the run from the police, you can probably work out where they are and then go and get them.

It’s incredibly clever technology. We set the challenge to people—we don’t believe us, trial the software, give it a go. It’s just part of the package. We won’t tell you it’s guaranteed every time, but so far I think we are probably up to 60 cases now where we’ve had successes in locating suspects or victims that we’ve been made aware of.

The technology was released at the beginning of the year and we get customer feedback of “it worked, we were really impressed, it found the suspect, it found the victim,” which is great for us to hear.

Paul Gullon-Scott: That’s fantastic, Tom. Thanks very much for joining me tonight on the Forensic Focus podcast. The software is obviously available through Semantics and people can contact you how?

Tom Oldroyd: Yeah, so contact either sales@semantics21.com or tom@semantics21.com. If I want to get bombarded now with lots of spam from people, or just go onto our website and obviously we can communicate with you straight away.

Any of our customers, we now offer our customers WhatsApp support, so it is just a text message and we communicate via text message. We’ve gone like with teenagers—we communicate on WhatsApp. Just to make life a little bit easier to deal with support portals, let’s get rid of that. Let’s make it frictionless and as easy as possible for everyone.

Paul Gullon-Scott: That’s fantastic, Tom. And long may the development of the wellbeing aspect of the software continue. Thanks very much for joining us tonight.

Tom Oldroyd: Yeah, lovely. Thanks for having us, Paul.

Paul Gullon-Scott: Thanks Tom.

Hexordia’s Jessica Hyde: Navigating The Future Of Digital Forensics

The following transcript was generated by AI and may contain inaccuracies.

Si: Welcome, everyone, to the Forensic Focus podcast. We are delighted to have with us today, Jessica Hyde. Jessica has been on before. Although I was going back through the archives and I was wondering when this happened. You talked to Christa, and brought Desi and I on several years ago now and we started working with her, and then she went on to other things. You spoke to her alone back before we even joined, but you did recently interview with Forensic Focus. You’ve got an article and an interview up.

Si: To refresh the listeners’ minds and to bring everyone back, could you give us a little bit about your background now? I’m going to prompt this because I did my research for a change a little bit before we started this. You started off as an avionics technician in the US Marine Corps. This is not a typical start in life for anybody, let alone a start in life to then end up teaching at universities for digital forensics. So how exactly did this transpire?

Jessica: Sure. So I joined the Marine Corps, not typically where you find people who wind up in this field, but right after September 11th. I was a direct ship in October 2001. Kind of giving away my age here.

Si: Younger than me, so that’s fine. Let’s carry on. That’s not a problem.

Jessica: I will preface this by saying there are some other folks who came specifically out of avionics and some other Marines into digital forensics. So you just mentioned Brett Shavers. Brett Shavers and I are both Marine veterans, as is Harlan Carvey and Alyssa Torres. So there’s quite a few Marines who have become forensic experts, and then there are some avionics personnel, albeit more from the Air Force side, namely a SANS instructor as well as Leslie Carhartt. They also were in aviation, but I might be wrong about Leslie. I know Leslie was Air Force.

Jessica: So nonetheless, it’s common but uncommon, whichever way. But I would say that maybe those of us who were in the Marine Corps, we are the kind of people who make our footsteps known. We’ll leave it at that. We might be a little less afraid of being loud.

Si: Yeah, that’s fair enough.

Jessica: So when I got out of the Marine Corps, I took a job in a lab doing reverse engineering of improvised explosive devices. This was still very much in the timeframe in which the US was heavily involved in the wars in Afghanistan and Iraq in the mid-2000s. I took a job doing that and reverse engineering IEDs and ones that were blown up. What are they connected to in terms of trigger and receiver mobile phones?

Jessica: So yes, this is pre-smartphone, but definitely phones that were post-blast. So I like to say that I got my start in forensics analyzing circuit boards of unknown origin and phones that were blown to pieces. It’s a little bit of a different start. I recognized I was really niche, went on and got a master’s in computer forensics to help myself get more well-rounded. Did my stint in the private sector, went and worked for one of the big four firms, EY. And then went back into doing forensics as a government contractor again and so forth and so on. And here we are.

Si: You say you went back to do a master’s in forensics, but that would mean fundamentally that you had an undergraduate degree. Was that in avionics? Was that in…?

Jessica: No, electronics engineering. Electronics engineering, which I did because I was in avionics. It made sense. The government said, what do you know how to do and what can you do? Apparently it is dealing with electronics. And I did that weird thing where I was working on my degree while on active duty. So I went to lots of different institutions and pieced together an undergraduate degree slowly but surely. And here we are now.

Si: I’m going to just ask, because my education background is varied as well. Do you actually think that has been an advantage to you, or do you think that it was just the same or do you think it was a disadvantage to have that?

Jessica: Oh, I think it’s an absolute advantage. I’ll start with the fact that I think our job in the digital forensics field is to solve changing problems that exist with new technology and how to find data. So we do a lot of troubleshooting. As an avionics specialist working on the Harrier, my job was to be able to troubleshoot technical issues, communicate with people who weren’t as knowledgeable about the technology.

Jessica: They were very knowledgeable about their area – pilots, right? They’re very knowledgeable about how to fly a plane. This is much akin to dealing with lawyers. They’re very knowledgeable about law, but not necessarily about the underpinnings of the technology. I was an expert on the technology that was helping them fly versus a technology that is providing digital evidence.

Jessica: So our job is to be able to troubleshoot under austere circumstances and figure out how to solve problems that haven’t been solved before, where the manuals don’t tell you how to do it. From that perspective, it’s the same mental skillset. From a technical perspective, I soldered, I worked with wires, I worked with multimeters. As someone who does a fair bit of hardware analysis in my forensics career, those skills were directly transferable.

Jessica: So the fact that I soldered wires and dealt with electricity and signals and computers and swapping discs – those things literally happen on jets, much the same that they happen in our forensics labs. So yes, I think that there are directly transferable skills, but I will also advocate for the fact that I think the best teams in digital forensics and the best ways for solving problems is by having people who have diverse backgrounds.

Jessica: I love having lateral movers out of different fields on the team because they bring different approaches to problems and oftentimes have soft skills, which are very necessary for talking with our stakeholders, be them generals, lawyers, etc. But also, I worked a fair bit in the beginning of my digital forensics career with the Department of Defense and I still do.

So my time in the Marine Corps has literally allowed me to articulate things well in that manner too, having some understanding about military organizations. So yes, I think it has directly helped, and it’s a lot of the same mental process when you think of it from an abstracted layer.

Si: Yeah, I get that abstracted layer. What we try and say, I think, is that we follow a scientific methodology, but that scientific methodology of test, verify, and loop around when you get it wrong and understand is exactly the same.

Jessica: So I’ll tell you the process on debriefing a pilot, right? They come to you with a gripe and so you’re going to ask them questions about the problem that they have. That’s exactly the same as when we’re brought a question from an investigator or an attorney. Then the next thing you’re going to do is look at, acquire whatever data you can, and then create a testing scenario, create a hypothesis, conduct your testing, and then based on your testing, apply it back to the original problem.

Jessica: Swap it apart. Replace something. Understand how something works. Write a script as we may do in digital forensics. And then you’re going to verify your results. And then you’re going to write a report or write up your documentation. In all of these things, we have to do documentation as we go. Trust me, when you’re working on a jet, you’re filling out your logbook as you go. Just like we document as we go through our process.

Jessica: Put up a report at the end, be able to brief people high up, be able to give status updates to people high up on mission critical things, be able to work in time-sensitive environments, and then the result goes and flies, or the result goes to court. The biggest difference is, presuming everything is going right and your jet has no major mishaps, you shouldn’t have to testify as a digital forensics examiner. If you’re somebody who is working on aircraft, hopefully never.

Si: Never. Yeah. It’s interesting actually, because I think one of the skills that is most valuable is that note-taking, those contemporaneous notes. And actually it’s very hard to teach, or at least I found it very hard to teach. I found it very hard to learn, to be honest. I came from a systems administration background and I did a lot of things, and then I wrote documentation. I didn’t write documentation while I was doing things, and it has taken me a while to get around to being a little more efficient in the note-keeping department.

Jessica: Yeah, I’ve got to say, keeping logbooks in the military that are timestamped with who it is, what happened, being able to give a bottom line up front – that’s the big wording in the military, the BLUF. And then be able to substantiate every step you took, and it can be read by other people who have to pick up your problem. Yeah, that’s definitely a skill that I had acquired there. I think you’re right, it is. I think the best way for people to learn how to do that is to see samples though.

Jessica: I think showing them how you take notes and showing the quality of notes and actually, peer review is another big thing. Having people peer review notes of people who are learning how to take notes is really important so that they understand the most important thing. I like to tell folks, when I’m teaching my students at the university or students in a Horia class and we always talk about note-taking on the first day, because if you don’t know how to take notes, how can you do all of the other things you’re supposed to be doing?

Jessica: I always like to say the most important reason to take notes is in case you’re hit by the lotto, because I want to put a positive spin on it, but somebody else has to recreate your work. And how many of us have worked something that comes back years and years later? I want to make my own life easier. I like it when past Jessica does current day Jessica a big favor or future Jessica a big favor.

Si: Yes. I was going to say, I don’t get too many cases that loop back around a couple of years later, but I had one a little while ago that came up and it was like, “You reset the password on this,” and I was like, “What did you set it to?” And I was like, “Oh my God, that was four years ago.” That is not in my mind anymore. And you’re flicking back through your notes. It’s like, “Oh good, I did write it down.”

Si: That sort of mad panic as you realize that you’ve reset an account in order to get access to it, and then you can’t necessarily recall four years later when you need to get back into it again. So yeah, I wholeheartedly appreciate that. You looped in an excellent segue for me to go to your students. So I’ve seen you are, obviously Horia is your company in your organization and you’re a university lecturer. You have been at Champlain…

Jessica: I only taught at Champlain for a year. I’ve been teaching at George Mason since 2016.

Si: And George Mason as I worked my way up to this. It’s alright, don’t worry. How did you fall into that?

Jessica: I’m very lucky. I did my master’s at George Mason and so when Bob Osgood knew that I worked specifically in a mobile forensics lab and that I had spent my time focused on problems pertaining to mobile forensics, and he needed an instructor, he reached out to me and asked me if I was interested. And I was like, absolutely, this was a no-brainer for me.

Jessica: I had the luxury of doing some teaching in my roles in labs of first responders and creating content to help our practitioners within our lab skill up. So writing a class to teach mobile forensics was a no-brainer, and I love it. Do you know why I love it? Because I learn more from teaching because of the questions that get asked by folks who this is new to. They look at it differently, and as each new group of students who have had a different set of circumstances that have brought them to where they are, come to take this course, the situation is different.

Jessica: The technology they grew up on is different. The way in which they’ve been exposed to the environment is different. So their questions change and it helps me gain perspective and it also challenges me always to be aware of the newest operating system and the newest issues. Not only does my casework inform that, but having to be prepared for each lecture in the fall, it’s the most fun because the new operating system versions for Android and iOS typically hit in September or October. Usually about one to two weeks before I’m teaching.

Jessica: And of course, I want to know what’s happening and what’s changed on that newest operating system. So it gives me an extra little push even before my casework has hit it. But also, the questions that are asked and the “let’s figure it out, let’s find out” – I learn more from the questions people ask than I could probably even come up with on my own or from my independent coursework or from my colleagues.

Si: Yeah, I love my opportunities to teach and I’m going to say I’ve been very fortunate in having my own children educate me frequently on the way that phones actually work, as opposed to the way that I think they work.

Jessica: My children – I have two teenagers, or I guess one young adult and one teenager. I guess they’re technically both teens, but neither here nor there. They definitely are the people who I go to with slang terms that I don’t understand that are in data. “Hey, completely no context. Do you know what this means?” They school me.

Si: Yeah. I had an absolutely wonderful opportunity. During lockdown and COVID, we were giving evidence remotely to court. So I was sitting actually in this chair here giving evidence in a case. And a question came up and the judge was like, “Do you know what would happen under these circumstances?” And I was like, “I don’t, but actually, if you give me two seconds, I can test that because I’m here.”

Si: And it was me madly texting my daughter upstairs going, “What happens if this happens?” And she’s responding, “What I saw was this,” and I’m like, “Your Honor, what we saw was…” She’s gone on to a career in law, so I cannot…

Jessica: Oh, how appropriate!

Si: Yes. My influence has rubbed off in that regard. But yeah, it’s the way that people use technology that varies upon the way that they… The app does the same thing, whether I pick it up or you pick it up, or they pick it up, but the way they use it is so fundamentally different. And that’s fascinating to me, that sort of approach that they can bring.

Si: And I was also very fortunate in the degree that I was teaching previously. It was very keen to bring on all sorts of backgrounds of student. It wasn’t just maths, computer science, physics people. We had English, we had foreign languages, we had psychologists. We had all sorts of…

Jessica: Different perspectives. That goes back to what we were saying earlier about different perspectives in the lab makes for different solutions. I have folks who have transitioned from healthcare, from education, from so many different fields that you get to collaborate with. And when you have people who do that lateral movement, they definitely approach problems in different ways.

Jessica: The best teams are going to have somebody who comes from a law enforcement background, somebody who comes from an academic background, somebody who comes from a computer science background, somebody who comes from an electrical engineering or hardware background. And when you take those different backgrounds, they’re all going to have a different approach as to how to solve that same problem.

Jessica: Many times the problem would never get solved with just one of those people working in a silo. It’s when they all start communicating and then they’re able to feed off of each other to come to a new resolution that no one’s brain would’ve come to on its own. And that’s awesome. That’s how we solve technical problems.

Si: Yeah, the fantastic concept of interdisciplinary sharing is amazing. And we start to hear about it in all the really sexy things like biomimicry, where they make robots crawl up walls, pretending to be geckos and stuff. But it applies all round and that’s absolutely amazing.

Jessica: I’m going to have nightmares about your biomimicry example now. Thank you.

Si: I’m sorry. I’m sorry. We won’t get into the glow-in-the-dark jellyfish and all sorts of things like that as well.

Jessica: I’ve been to Australia. No, I’m joking. I have, the jellyfish are the scary thing.

Si: I was about to say, Desi would be able to answer this more accurately, but I’m pretty sure everything in Australia is trying to kill you. I have yet to experience it myself, but it seems that way from any guidebook I read: “And this is poisonous and this is the most poisonous.” And “Yeah, don’t touch these. And the spiders are this large.” Yeah. No. Thank you. I’ll stay here.

Si: Obviously you come from the electronics background. Are you still hands-on with chip-off forensics? I’m not going to say necessarily exploded phones, but you may still be getting exploded phones.

Jessica: I don’t usually get post-blast phones. But yes, and I would say because we’ve been doing a fair bit of IoT forensics, a fair bit of IoT research, and at the end of the day, those are the chips that are unencrypted still, or a lot of them are. So those are where a lot of those techniques are more relevant – ISP, JTAG, UART. They’re very relevant still on getting data off of physical hardware.

Jessica: You can still do a lot of chip transfer in the repair world. So for damaged devices, yes. And there are a couple of folks on my team as well who are strong in that area. So the answer is yes, but not as much as I used to when I was dealing with post-blast devices every day or even when I worked with a team where we had our own hardware exploitation lab.

Jessica: It still does happen, and we do quite a bit with IoT devices in both research as well as casework and instruction. So yes. But definitely seeing more digging into databases these days than into other data structures. Trying to understand Android binary XML, SQLite, LevelDB and dealing with those kinds of data constructs, I’d say, are more common in my daily world at this time.

Jessica: But we have an IoT class that we teach and we get very hands-on in there. Not so much where we’re teaching students chip-off and JTAG – there are fantastic courses out there that do that – but we’re teaching them how to deal with that data, and that’s still how we’re getting that data.

Si: Are you finding that there’s a particular sort of class of IoT device that you are seeing more frequently? Is it like the Nest home things or is it security cameras or…?

Jessica: I’ll give Google some credit that the Google devices are the ones that are encrypted. So the Nest and the Google Home, those are encrypted. It’s a mix. There’s a lot of smart watches that we see, a lot of health data devices that people are giving up a lot of their health data for, for their own personal information. But it’s coming up a lot in casework.

Jessica: Also smart speakers, just because they’re almost ubiquitous in people’s homes, but there are sensors everywhere. I think that there are a lot of door cameras or doorbell cameras, but a lot of that’s just being gotten from warrant returns more than taking the data off. We actually have a cool project for the DOJ where we were analyzing, does it make sense to seize the hardware or is most of it in the app or is most of it in the cloud?

Jessica: And trying to determine what devices it makes sense to get the hardware for. I’m not getting cases where the refrigerator is what we care about the data on, but refrigerators could have data. And if your refrigerator is synced to tracking geolocation of your kids and to calendars, that may be valuable. But I think part of the IoT landscape has to do with awareness and what is the best source of data.

Jessica: So if we can get the data from the mobile phone, and that is where the data is resident, why wouldn’t we stick with that? Because it’s in the sync app, but sometimes you may not have access. So I think that it ebbs and flows based on what is in people’s environments. Not a particular area of my expertise, or there are other people who spend way more time in this, but the most IoT thing that’s giving people lots of data on lots of cases is vehicles.

Jessica: Vehicles are a giant moving IoT device. I know this because I particularly drive a low-tech vehicle and I am not looking forward to having to replace it because I like that I don’t have a heads-up display and that my car does not have CarPlay or Android Auto or any of those features. And it will be harder and harder to find vehicles that have that.

Si: My car is decidedly archaic – doesn’t even have Bluetooth, so it’s a long way down the scale. But the thing that fundamentally scares me is, and Tesla is the prime example of this, and I know they’re having a really bad time at the moment for various sorted reasons, mostly to do with their own fault or at least their CEO’s own fault. But it’s the idea that you can push updates over the air.

Jessica: I’ll stay away from discussing vehicle forensics at this juncture in time. I’ll give the clear disclosure that my husband works in the red team side of the house for a major motor vehicle manufacturer. So that’s probably the one area, and that’s the reason I say I try to stay out of that area just because I don’t ever want there to be any question about my knowledge or my information or where things come from.

Si: That’s more than reasonable. And we can have this struck from the record, if you’d like.

Jessica: No, it’s actually fine either way, but there is definitely something funny about having a red team, blue team marriage there.

Si: I was going to say, we spoke to Heather and Jared a little while ago from Cellebrite. And yes, the dynamic of two people in the same industry is quite fascinating when you come down to it. My wife’s a project manager, so I’m not sure how it would go if it wasn’t that way. Certainly if we were on opposing sides technically, I think it might be a little more interesting.

Jessica: We did meet fixing jets. My husband and I both fixed jets and that’s how we met. So the fact that he is a red teamer and that I do defense security is ironic. But yeah, I steer away from the vehicle stuff.

Si: That’s very fair. “Steer” is a funny pun though. “Steer” vehicle. I do love puns as evidenced by anyone who’s ever seen a CTF I’ve worked on. I think that a slightly irreverent sense of humor is an absolute must in this industry. I come across some people who are way, way too serious for their own good, and I’m not sure it’s good for their mental health, if I’m honest.

Jessica: I think it’s important to have a sense of humor because at the end of the day we deal with the darkest of humanity. So if we can’t have levity, if we can’t find places to have joy in the mundane, how are we going to be able to deal with the fact that we are dealing with, and I don’t care, even if you’re on the incident response side, you’re dealing with companies on their worst day.

Jessica: No matter where you are in this field, you’re dealing with people on the hardest day they’ve ever imagined. And our work affects people’s lives, and that’s heavy. That’s a heavy weight to bear. So if we’re going to bear that much weight – how cool are our jobs? We get to use our technical knowledge and our brains to figure out problems, to be able to find truth and help with justice, and help people resolve issues and conflicts and sometimes save lives or protect lives.

Si: Absolutely.

Jessica: We have the best jobs in the world, but the weight of it is important. The weight of it is important for us to be aware of and feel because it should drive us to do the absolute best we can, regardless of what side you’re on, what environment you work in. Our work has victims. Not a case exists without a victim. Be it a company, be it wrongly accused, be it a victim of a crime.

Si: Yeah. I think it’s a very important thing that seems to get lost a little bit actually is that we talk about the sides that we’re on. We talk about prosecution or defense. But actually at the end of the day, we’re all here to achieve justice. That is what our role is, and we are a burden to the court. We’re not burdened to anyone else.

Jessica: Our job is to find the truth in the data. That is our role. Our role, regardless of whom is hiring you – our responsibility, and I think that this is really keen, is that I’m very involved with HTCIA, the first VP at the international executive level at this time. And one of the things I was really happy about is that the organization two years ago got rid of its rule that required it to limit membership to people who limit anybody who does defense-for-hire work.

Jessica: And I am so glad that there was a unanimous vote by the organization to say no. The High Tech Cyber Investigation Association represents the work we do. It doesn’t matter who you work for, because the results should be the same. Our goal is the truth in that data. What attorneys do with our work is beyond our control, but it is our job to do our due diligence and to represent the facts as they are displayed in the data, which again, takes that testing and that need for understanding and validating, etc.

Si: I think it introduces the interesting problem of bias. I was talking to a colleague about this not terribly long ago, like yesterday. And we were saying everybody has bias.

Jessica: 100%.

Si: It’s not whether you are biased or not because you are. It is a very biased opinion to think you’re not biased.

Jessica: Yeah, exactly. You’ve got to allow for that fact and to handle it and manage it and to say, to think that you are not is a mistake. But if you only do defense work, if you only do prosecution work, your biases are almost increased. It’s inherently an echo chamber.

Jessica: We started with a bias. We talked about generational bias, right? That the approach that people take. So both of us who are parents of young people now in this world, the way that they approach or see technology is different, which means if you or I are testing, “How did this artifact get here?” If we don’t think to involve, and again, this is one of the great things about having multi-generational teams.

Jessica: I have people who are much more senior to me in age and much more junior to me in age as part of my teams. And if we don’t get that perspective, I might not be thinking of some of the ways in which data could wind up on a system. Sometimes my young folks, they do things with their fingers on the screen and I never thought of interacting with said app in that way. And it makes magic happen.

Jessica: So we don’t necessarily even understand all the ways. In order to test a feature, to say, “How else can that data get here?” And that is the truth in the bias. So anytime that we see that we have something that is demonstrative of this is how something got there and that we can test and prove that in the affirmative, we need to be able to ask what else could have caused that data to get there.

Jessica: What would it look like? What other actions could cause that to not be there, right? So we need to look at the complete opposite of the things that we’re proving to make the best attempt to neutralize the bias that is going to be implicit. When your scope in itself in an investigation introduces bias. However, it is an intentional bias that prevents us from actually having privacy issues in a lot of instances. Someone’s phone is the most…

Si: This is an interesting distinction actually, between US and UK law. Because you are restricted by your warrant. We aren’t, but what we’ve seen as the counter to that is that quite often we are seeing victims almost self-submitting evidence. And selective. And it’s not because they’re not victims. I’m sure they are. But they are making a selection of the things that they think are important and sharing them with the police.

Si: There is a limited capture done on the basis of what the complainant says, and it’s not the full picture. And you end up with some very interesting questions.

Jessica: This is fascinating to me. There is an interesting paper from the Scientific Working Group on Digital Evidence that I’m a member of (SWGDE). I love it. Lots of great papers coming out on minimization of data, what is the right way to minimize data for privacy concerns. And this is really critical. My personal opinion is that if possible, minimization should be done in the analysis or via a human firewall and not on collection because of exactly what you said there.

Jessica: If we are only given a subset of collection of the evidence, then we risk not having access to exculpatory data, to being able to put together the full picture. When a database only has part of the data, but it actually correlates to some other database that maybe isn’t within a time restraint. So I really believe that we need as complete a collection as appropriate, and then to minimize on analysis.

Jessica: And I am very heavily speaking towards mobile and digital forensics here, as opposed to incident response where you would not collect a full endpoint of every single device, because that would diminish the capability to do incident response. Or even in a large enterprise environment, it might not make sense from a source and amount of data.

Jessica: But if we’re talking about somebody’s mobile device, having a human firewall, or I hate this expression, a “taint team,” those things may be more appropriate to protect someone’s privacy concerns. And again, I’m trying, because you just mentioned the fact that the laws are different, I’m sticking straight to privacy and to have the most respect for people, the people whose devices we’re looking at.

Jessica: And I think that’s really important because we want to be able to still have access to the exculpatory data. And for another reason, and this is something I’ve been hammering a lot recently, I just had an article in Forensics Magazine about this – acquisition should be seen as preservation because of how the availability of data degrades rapidly.

Jessica: Particularly in the world of mobile, and I’m not just talking about access, phones rebooting from a FU to BFU or USB restricted mode. Let’s say we’re in a completely consent-based environment. Consent-based, not consent-based environment where the person is giving us a password and the device and they’re giving consent for their device to be looked at. Maybe they’re a victim even in a consent-based environment.

Jessica: Data degrades because they’re and becomes nonrecoverable when you introduce the element of time. So I’m not talking about things like the WhatsApp wiping somebody’s phone, I’m not talking about… I am talking about literally that every day that goes by, knowledge loses data or cache locations loses what’s seven days old on that date. Literally data we will never be able to recover and it could be exculpatory or inculpatory.

Jessica: So while prosecution may want in a criminal case, access to that data so they can demonstrate where someone was, validate an alibi, etc., defense may likewise be saying this: “How can you even proceed? You miss the evidence that could have shown that my client wasn’t there because you didn’t get those cache locations images that degrade after 30 days post deletion.” And this is data that is no longer recoverable forensically.

Jessica: This wouldn’t be a question if we were talking about other wet science data. And there’s actually a good paper. One of my colleagues at Horia, as well as a co-forensics examiner Holmes from a university in Europe. Frank Adelstein and… I’m going to butcher his last name. Not in the UK, in Europe. I am sorry, Holmes. I know I just butchered your last name.

Jessica: They had a paper that just came out yesterday as part of DFWRS-EU. And they basically were saying timely preservation is critical because if you were to try to get the cast of footprints a week later, they’d be gone. The same thing happens in digital evidence and that we also, they brought up an interesting point, need to be preserving our test data at that time.

Jessica: Because the way in which the phone, not just what app version it’s on and what database it’s on, what’s stored on the backend of the server, it’s communicating with changes the capability of the server on the other end changes. And so I’m really just keen on this topic of acquisition as soon as possible. That timely acquisition is just absolutely critical particularly in mobile, but in digital forensics as a whole and that we need to pay more attention to it.

Si: I think it’s fascinating because, I’m going to say my age is greater than yours and therefore my starting point in this is a bit different, but we started off with “You get a computer, pull the plug straight away. That’s it. Done.” That was the way I was taught. That was the original start to this.

Si: And then it was like, “Oh no, there’s a whole bunch of ephemeral data that you’re going to lose if you do that,” which is completely true. You lose potentially encryption keys, network connections, all sorts of stuff. So we started thinking about doing that.

Jessica: And no one’s going to question you if you pull RAM on scene.

Si: No.

Jessica: But if you image a mobile phone on scene instead of just seizing it and putting it in a Faraday bag, that is questioned depending on your jurisdiction, where you’re in the world. Now it’s a search, or are we just… because the US has this really big ruling, very famous called Riley, and it’s the reason you can’t image a phone upon arrest.

Jessica: And at the end of the day, the ruling in Riley said, “Hey, the reason you can’t do it is because you can use these cool little nifty things called Faraday bags.” Guess what? Putting a phone in a Faraday pouch doesn’t stop a dead man switch. Putting a phone in a Faraday bag doesn’t stop these timers, doesn’t stop the reboots, doesn’t stop the non-recoverable data due to time degradation.

Jessica: So it’s just, what do you know? Technology changes and we have to continually adapt our methodologies. Speaking of SWGDE, they put out a great position paper on this, and SWGDE does not put out position papers all that often. So when they do, it’s important. I believe it’s called something like “Timely Acquisition” or “Timely Preservation Through Acquisition.” Don’t quote me on it, something to that effect. It’s definitely absolutely worth a read and definitely a conversation I hope people are bringing back to their labs, but more importantly to the attorneys who are telling them what rules they have to live under.

Si: Yeah. In the world of CCTV and surveillance forensics, what’s going on is that everybody and their dog now has a Ring doorbell or something like that. But unless that is seized or the data is acquired in a forensically sound way, within 24 hours, 48 hours of an incident having happened, it’s just going to vanish.

Jessica: Here’s the thing, then it becomes who is paying for what version of service, right? Because I have a doorbell camera on my residence. I’m a very big proponent about cameras outside of the house. And I’m a personal proponent of no cameras inside the house except for obviously the one I’m using for this communication. Webcams are a bit different and I can turn them off.

Jessica: However, I’m a very big proponent of cameras on the outside, but I also pay the added service fee to have my data maintained for 30 days, because I know that 24 hours… I travel a lot. I might not even know something occurred within a 24-hour period. So I want to have that 30 days worth of data so that if something happens… but again, I come at this as somebody with a specific heart for digital evidence.

Si: This is the world we collect in. And if you look at it – I’m not going to quote any numbers – but if you look at the amount of data that’s created now daily on the IoT devices, the things that we have, it’s astronomical. We could probably solve every murder in the world that ever happens if we actually collected it all in one place and managed to filter it in any sensible way.

Jessica: There’s no human way of doing it. It’s impossible. It’s just way too much. And different formats and all of this.

Si: And what does it mean is different than what is there, right?

Jessica: Exactly. Yeah. I get nervous when we start talking about large autonomous systems that could deal with all of this data.

Si: No, so I’m going to say we could segue into AI and its use in here. I am a terrible Luddite in this regard. I’m the one who’s going to be throwing a spanner into the AI works. I actually studied artificial intelligence at university once upon a time. And I wish people would stop calling it artificial intelligence for a start. “Applied statistics” is my personal choice of phrase.

Jessica: There are many different applications that fall under AI and machine learning. Everybody is all on the new hotness because of their personal user-end experiences with generative AI. AI has been in digital forensics, different levels of it since 2007. Anybody who’s done an e-discovery case with targeted assisted review or TAR has used AI. Anyone who’s used most forensics tools have… it depends what kind of algorithm it is.

Jessica: We use algorithms, we use computers. They are important. The criticality is that machines don’t understand what they don’t know. And a large part of our problem is dealing with the unknowns. I like to cite the fact that there’s over 6 million apps just between Google Play and the Apple App Store. I could generously say a thousand are supported by commercial tools and I’m probably being generous.

Jessica: So that leaves a wide, vast world of unknowns, proprietary data structures, things we don’t know how they’re stored. But even more importantly, even if the AI can figure out what all the data translates to, what causes the timestamp to occur, what does it mean? What causes that URL, what is that IP address of? What other things could cause it? The meaning takes a human and testing and understanding.

Jessica: And my big concern is the legal system erroneously thinking that our jobs could be done better by computers than humans. Now there are some humans whose roles in this field are not doing deep technical work, but with the rate of change of technology, I would say those people who do go beyond the “find evidence” button, beyond just clicking, are going to be needed in order for justice and truth.

Jessica: And if not, we’re going to have a large issue with misinterpretation of data because if we can have multiple experts on the stand in the same case, interpreting the same thing differently, not because they’re saying that the ones and zeros are different, they’re saying that the meaning is different. And that is what we provide and that’s the reason digital forensics experts should be here to stay.

Jessica: And because somebody’s got to test and validate and think of those new apps. And yes, testing could be potentially automated in the future. And a lot of things should – we should automate as much as we can to allow humans to solve the problems humans need to do. And besides that, it keeps our work more interesting. So there’s my ten seconds on it.

Si: I couldn’t agree more. I think the important thing is that we back away from calling it artificial intelligence because it has no intelligence whatsoever. And it’s a very misleading thing to say at any point. The idea of automation, the idea of even things like fuzzy pattern matching is technically sitting in the right area. But it’s enhancing our skills, enhancing our tool set a little bit.

Jessica: I’m not going to use a slide ruler and an abacus to do math problems. I’m going to use a calculator. I’m going to use my phone. I might even call out to a smart assistant as I’m cooking and say, “Hey, smart assistant, how many cups in a quart?” Because I do have to deal with cups and quarts instead of liters. You’re lucky.

Si: I’ve given a couple of talks on AI in my time. And many years ago, criticized it very badly, but I heard a talk and I’m just going to look up his name because I don’t want to miss… He’s an American… not Brandon Epstein.

Jessica: Okay.

Si: A guy called Jared Carter. He’s… hang on, let me scroll through and I can give you a little more information.

Jessica: The truth of it is there’s good, there’s bad and there’s ugly, and we should let computers do what computers know how to do well, but we shouldn’t be thinking that computers are replacing humans in this digital evidence element. They’ve always been a tool. We love our tools, right?

Si: Yeah. Jared actually specializes in accident investigation.

Jessica: Ah, okay.

Si: He’s a forensic analyst in collisions. Lovely. But he was playing with ChatGPT and a couple of the other ones to see whether they could solve collision problems, mathematical collision problems. And what he very interestingly discovered was that they were getting it completely wrong.

Jessica: Because generative AI isn’t the right type of computer for math. Generative AI isn’t good at math. It’s a large language model.

Si: So it was returning a probabilistic statistical…

Jessica: …based on what should be, yeah.

Si: Yeah. So if you want to talk about bias – when you feed something the entire world of the internet, and as experts as we are in knowing what grossness and evil exists on the internet, the last thing we’d want is that. I’ll tell you a fun quip. I obviously work for Horia. I do not, nor have I worked for SANS, but I was trying to find a picture of myself and look at a GitHub profile for myself, and I said, “Jessica Hyde and forensics.”

Jessica: Google Gemini brought up an automated, created bio it made for me and it said “founder at SANS.” Now my bank account would love it if I was the founder at SANS. I also was 12 years old when SANS was founded. So this is not a true statement. I was around 12. My point being that AI will get things wrong because it will call different things from the internet and try to make an assertion about them that is not quite right.

Jessica: So yeah, it’s bad at doing logic problems – that is not the goal of a generative AI. However, there is lots of great computation that can be done of math, otherwise we wouldn’t be able to use hash values.

Si: Exactly. And this is using tools appropriately for what they’re designed for and looking at your areas, understanding the limitations of what they are. And also not trying to, like you say, not trying to push stuff further than it should be going because just because it’s a new hot and sexy thing over here that everybody’s talking about doesn’t mean you should be shoehorning it into your forensic tool today to do stuff.

Si: I’m going to perhaps speak slightly out of term because I know there’s a possibility we may be getting them on to talk about their products, but I’m aware of a company that has a feature in their forensic video software that re-colors infrared footage.

Jessica: Oh!

Si: Now infrared footage is recorded in monochrome, what they’re effectively doing is making up colors and sticking it on top of it. And I’m a little unsure how one could possibly do this in any forensically sound way.

Jessica: I am not educated to speak to that, but fascinating.

Si: It’s interesting and I think something that somebody said was that you can’t stick your head in the sand about it. We have to be aware. We have to be able to refute it. We have to be able to understand it. But it’s not…

Jessica: And again, it’s been in our world. It’s been in our world.

Si: It’s been in our world. Like I said, I read it at university, and I was, like I said, SANS was founded probably after I was 12. You’ve made me feel so young. I’ve enjoyed this. Thank you.

Si: Oh, trust me. You’re, don’t worry about that. Like I say, I went and read it in university before the turn of the century, which sounds so bad. But yeah, so it’s been around 25 years minimum now. Absolutely more than that. So we really do need to get a grip on it, I think is probably the way to phrase it, rather than anything else.

Si: It’s there. We just need to learn how we’re going to live with it. And also dial back the rhetoric a little bit about how, first of all, how it’s going to destroy us all. Because it isn’t, something can barely tie its own shoelaces, let alone come out and…

Jessica: …introduce a Terminator. It’s the chicken little thing, right? Do you remember when they told us that big data was going to destroy us and then encryption was going to destroy us? We weren’t going to be able to get data because of encryption, and then locked phones were going to get us, and then the cloud was going to get us.

Jessica: And there was going to be no data on devices. It’s just the newest in what’s going to get us. And you know what? We’re still going to be able to do our jobs for a long time. It’s a game of cat and mouse and we’ll continue to do what we need to do as professionals who adapt to technology to be able to uncover the truth in digital evidence.

Si: Absolutely. Now, I think as we’re coming towards the top of the hour, that’s actually quite a good point to draw perhaps a final question for you, which is: with everything that you’ve had an opportunity to see, and with your successful business there at Horia, and with your role at the university, what do you see as our next biggest challenge?

Jessica: Our next biggest challenges are going to be in policy. Policy and law are the biggest challenges. Morrison and technical will continue to evolve to meet the technical needs, use technology to deal with technology, but it’s educating the legal professionals so that they understand our world.

Jessica: I meet with many an attorney who still pulls out a cart full of paper and documents every time you go to court. And it is educating the legal system and those who make policy on how to deal with the newest technical issues at hand.

Si: Yes. I think you’re absolutely right. I think that we are in a position whereby we are evolving faster than the law. We’ve always been evolving faster than the law.

Si: One of the joys – I’m a big fan of history – but one of the joys is that the first computer crime case in the UK was actually prosecuted under Fraud Law. And it was prosecuted on something called “making a False Instrument,” which is technically used for creating a fake document to prove who you are.

Si: Something like a fake passport or a fake driver’s license. And they translated this to making a fake password because the password was what proved who you were. And therefore by using a password that wasn’t really yours, you were technically creating a false instrument, that password that allowed you to enter…

Jessica: …who you are. Oh, my.

Si: And very shortly after this, the Computer Misuse Act was created in the UK because they found that this wasn’t really fit for purpose. But it’s just a demonstration of how the law is several steps behind.

Jessica: I’m not an expert in the law. I am so glad that there are so many good legal professionals who understand digital evidence, but there’s a lot who need education in digital evidence.

Si: I have to say it’s been an absolute pleasure talking to you.

Jessica: Likewise.

Si: And thank you very much for coming on. And please don’t leave it three years before you come back again. It would be great to have you back on to chat again in the near-ish future. When something else happens that we can have an opportunity to talk about, which would be wonderful.

Si: For listeners out there, you’ve obviously already listened to this, but I’m still obliged to say that you can find this podcast on various mediums like Spotify, iTunes, all of the good stuff, YouTube, but of course, most importantly on forensicfocus.com – our own website, which will have this and the interview with Jessica written up.

Si: And various other wonderful things and you can come and participate in the Discord channel. You can drop in and come chat with us on the forums. And basically we are a huge community of people who like to talk about forensics like this because it’s fun and it is, as Jessica said, the best job in the world.

Si: And there’s nothing that beats it because we get to make a difference. So again, thank you so much for joining us. I really appreciate it and I look forward to having an opportunity to talk to you again.

Jessica: Thank you. This was such a pleasure.

Cellebrite’s 2025 DFIR Industry Survey – Key Insights

The following transcript was generated by AI and may contain inaccuracies.

Si: Hello everyone and welcome to the Forensic Focus podcast. We have back with us Heather Mahalik. Sorry, Heather Barnhart.

Heather: It’s okay. It happens.

Si: Who we have spoken to relatively recently and on previous occasions, and for the first time ever we have Paul Lorenz with us as well, both from Cellebrite. We’re going to talk about whatever comes into our tiny little minds today, or at least my tiny little mind. These are big brain thinkers over at Cellebrite.

Si: But we’re gonna start off Paul, as you haven’t been on before, and this is your very first time. Do you wanna do a brief intro of yourself and your background and how you got into this crazy, fun, joyous world we call forensics?

Paul: Fantastic. Thank you for having me on. It’s a privilege and honor. I know you have a big reach, so it’s fun to speak to people as well. So where do I start? I’m based in Ottawa, Canada. I started in law enforcement, spending close to 15 years across two different agencies.

Paul: I left finally with Ottawa Police service. Started on patrol like most people, went through various parts – patrol, traffic, some plain clothes stuff, high risk offender management, child exploitation investigations. Then I took on a temporary assignment in tech. I had interest in tech – broke computers when I was younger – and they’re like, “Hey, you’ll fit right in.”

Paul: Sure enough, I came into the section and took an interest in mobile forensics, had some very big files. Worked with Cellebrite and pretty much all the tools that were out there. We were very fortunate – I think how Heather called it before, we were a “rich lab.” We had many different tool sets at our disposal.

Paul: The unfortunate part was primarily doing child exploitation cases, which of course has its toll. One day out of the blue, I met with one of the guys from Cellebrite and they asked if I wanted to come over to Cellebrite. That’s how my journey started. Had no real intentions of leaving policing or law enforcement – I absolutely loved it.

Paul: At Cellebrite, my journey has been a wild one as well. Started with pre-sales, ran the CAS Advanced Services Lab in Canada, moved over to product. Now I’m part of, or the head of, customer engagement. A lot of the forward-facing work – I have some very smart minds that work with me like Heather, Ronan, JP, and we’re expanding out.

Paul: I try to be that voice of the customer, try to be that thought leadership piece to bridge that gap of what customers need, what the industry needs, and bring that back to our products. Hopefully providing support, providing that digital face to talk to people on Discord. Essentially trying to be that person that I didn’t have when I was working forensics. It feels like you’re always alone, where there’s thousands of people across the world doing the same thing. In a nutshell, it’s a big community and we’re trying to help bridge some of those gaps.

Heather: That was such a positive spin. I like it.

Si: I think that’s a beautiful segue into what we were talking about very briefly before we started, which is you’ve just put out the industry trend survey. Obviously that’s a huge part of customer engagement – going out and finding out what people are actually doing and what they want. As a business, it’s important to know whether you’re delivering on that or not. It determines whether they stay with you or go to Magnet. So what of interest came out of that? What jumped out as the key salient points worth bringing up?

Heather: It was all over the place. Everything from how you identify – what’s your persona? Are you an investigator, an analyst, head of a lab, a prosecutor, examiner? Issues? The biggest issues we found were obviously locked devices, locked iPhones. That was the biggest. Encrypted applications. We asked about cloud versus USB storage – the old days (I say old, people still do this) of “here’s my data, Si, have it, good luck, sign this chain of custody.” Even AI and what people think of AI – is it useful? How could it be used in digital forensics? What did I miss, Paul?

Paul: It was surprisingly a large subset of views – the survey hit over 2000 people. It was a lot of people that responded, which is great because it gives a better baseline rather than just 20 or 30 or 100 people. Backlogs – all the stuff that we talk about. The backlogs, the trends of how do you deal with all this data?

Paul: The fact that tools are getting easier to get more data out of devices, but what do you do with it? How do you effectively review it? Printing to PDF – a 400,000 page document… what do you do? It’s scary, but it’s a reality for some. And then how do you effectively use it?

Paul: I still remember days from my old job having multiple Excel documents on my screen and thinking, “Okay, which one matches? Do we have a link between these?” It’s mind-blowing. There are still agencies doing this. I think this is where the downside of having full access and full file system extraction is that you’re overloaded with work.

Heather: And it’s nice when we do these surveys – Paul and I had 110 slides of results, trimmed it down to 23, and then talked about it. But when I brought up Skopje, Macedonia, there are things that just spur your memory. When we’re having questions coming in, I’m like, “I wanted that to be blocked out of my mind forever, that experience.”

Heather: But it’s old casework and old things that come up that you see people still doing. When I was in Skopje, I was, oh my gosh, 27 years old, 28 years old. It was two years ago, Si.

Si: Yeah.

Heather: It was a long time ago, but it’s crazy how you see people asking questions and saying things. I’m like, “How do people not share enough on experience and how to progress beyond?” I think some people still just struggle on catching up.

Si: It’s an interesting one actually, and it’s a conversation that we’ve been having in the UK for a little while about provision of mental health care. We are not very good across an industry – we have our little silos, so there’s prosecution or there’s defense, and we have perhaps one law enforcement agency versus another. They’re not necessarily talking and sharing.

Si: And we need to get better because at the end of the day, we’re all actually trying to do the same thing. But everybody seems to be getting better. Do you think it’s getting better?

Paul: I say the growth of the online communities has started to bridge some of that stuff. Even five, six years ago – I’ll use the Discord channel as an example because I live in there daily – people can easily share stuff. So those avenues of sharing information, sharing details and talks and all different challenges they have, is easier.

Paul: But I think at the same time, the complexity of these investigations isn’t going away. Whether it’s encrypted applications, encrypted devices, or hardened devices, all this stuff is just as hard, if not harder now, because people expect this. Working together is super important.

Paul: Also factoring that legal justifications and legal challenges are completely different from one side to the other. What I experienced in Canada – we have these very strict timelines of prosecuting a case – don’t apply to the states.

Heather: I’m still waiting. I’ve been working a case for years.

Si: I’m gonna say it is fascinating because I don’t think there’s a statute of limitations in the UK. I know you guys have them. I’m prosecuting cases that are 10 years old – just because they finally come round. I don’t know if they ever run out. But I understand that there are statutes of limitations in the US and Canada definitely.

Paul: But that even puts pressure on the investigations. I’ll give you an example – it’s the Jordan decision. Essentially it means that depending on the complexity of investigations, you either have from the time you put handcuffs on someone or charge someone to concluding a case – 18 or 36 months.

Si: Geez.

Paul: So if you think about it, that’s a lot to put onto an investigator. I’m taking a step outside of the forensics piece – just everything else. You add a lot of pressure to it, and then you factor in all the other challenges on top of the forensics piece. You could be trying to get into a device, and then if you get the device, how do you examine this and how do you share it?

Paul: So there’s a lot of challenges, and I’ll say that being mindful to the different ones across the world, I think in the end there are very similar challenges. It comes down to people not having enough time. Your backlogs are getting bigger, you’re getting more cases, you’re getting more data.

Paul: One of the points, Heather – it was that the reliance on DNA was going down, but the reliance of digital evidence was going up. In the end, it makes sense too. That’s one of the survey results – we’re seeing more digital evidence going in than DNA. Everyone’s got a phone.

Heather: I actually remember one stat – I can’t believe it. Nine out of 10 who took the survey, so of these 2100 people, nine out of 10 said that digital evidence helped close a case in court through prosecution.

Paul: Prior to going to trial, I think. And then bringing things to court quicker. Making all that part will help – even from the survey results – was getting cases resolved prior to even going to trial. So that rush and everything else – if you get that evidence ahead of time, it’s gonna save time for the investigators, save time for the victim having to testify, all these fundamental pieces.

Paul: If we can help chip away at even the court backlog – I’m not sure how it is in the UK, but post-COVID, it’s been a total mess here.

Si: Yeah, it’s horrific here. And the idea of having to complete a case in 36 months, I think, would have most prosecutors here sobbing in a corner because it’s just not gonna be feasible. I literally got a case the other day and I was told that not only is it dated back to whenever it was, but they’re not gonna pay the current rates. They’re gonna pay the old rates because it was contracted back then, not now. I’m like, come on, that’s not fair.

Heather: That’s wild.

Paul: There’s that one stat – I think, Heather, you’re the one that brought it up yesterday – the 7% of people or 7% of devices don’t even get examined.

Heather: Yeah, just ignore it because they’re locked. 7%. So imagine if you’re accused of a crime, Si, and I’m like, “I can’t get into it, so I’m not gonna look.” But that’s what would prove your innocence. Isn’t that wild?

Si: Yeah, that’s… We’re very good as human beings in rounding things up and rounding things down, but that’s one in 10. 7% is nearly 10% – practically one in 10 devices. That’s not a risk you’d really wanna be taking.

Si: I remember somebody told me about a case years ago where they raided a guy who repaired laptops and computers for a living. He had stacks and stacks of machines, and they didn’t know how to process it, so they made a random selection from them and processed a couple.

Heather: They need to look right in the registry and see which ones belong to him.

Si: That didn’t matter. They pulled it, they processed it, and they found CSAM on there. But it wasn’t his – it was a random lucky guess on one of those devices from somebody else who had sent it in for repair.

Heather: Holy cow.

Si: If you had processed everything, then you would’ve gotten that without a shadow of a doubt – the guy was innocent. He hadn’t actually done anything, and he was acquitted, but the ongoing prosecution resulted in that. But that was like a random selection from a stack. That’s crazy because that was the only way it could be processed.

Heather: And the bravery of the person that put that computer in for repair – I guess they really needed that nastiness back in their life. Worth the risk. Crazy.

Si: Yeah, somebody clearly thought something was encrypted and it didn’t. That’s my official term – the nastiness.

Heather: The nastiness. I think we should roll that out across the industry. It should be a sticker.

Paul: But I did a lot of cases from submissions from repair shops. You’re like, what are you guys doing? This is not…

Si: Yeah.

Paul: But it segues into the other part of all these extractions that we’re doing from devices. I think one of the stats was 25% hold no valuable data. So out of all these extractions that people are doing, that 25% is wasted time.

Heather: Wasted time then? Yeah.

Paul: Wasted time. So if you think about access, whether it’s brute force and then extract and then analyze – how many hours are you wasting because you didn’t triage or take a look at it ahead of time to say, “Hey, is this even worth looking at?”

Heather: Look at the Boston Marathon. The guy that was caught – what was his name? Like Tsarnaev? The younger brother that was caught on the boat. When he was caught, he had a backpack full of random phones from a pawn shop. The amount of confusion that caused – I remember people saying, “Help us make sense of this. What is this stuff? What evil…?” I was gonna say a cuss word. I won’t say it, but seriously, what in the heck is wrong with this?

Si: This isn’t a PG rated podcast. I was gonna say evil fucky.

Heather: Who goes to a pawn shop and thinks, “I’m gonna get a whole bunch of phones and put them in this backpack just in case I get caught by the feds and it’s gonna mess with everyone”? Because it made no sense. The data was completely nonsensical. It was just like 20 random phones in a backpack. Why?

Si: Yeah, that’s… Unless they’re planning to make little bombs out of those.

Heather: That’s what I was also wondering if they were going to use those like a long-term strategy for detonators.

Si: Yeah, it could be. And you definitely want somebody else’s old phone, not one you’d bought brand new.

Heather: And these weren’t nice phones. They reminded me a lot of what I was seeing in Afghanistan back then in the work I was doing. So I’m like, this is “Hurt Locker” style – gonna get a call on this Nokia and everything’s gonna blow up. But that’s also where my nasty mind was back then.

Si: This is the thing – we’re all a little bit devious, aren’t we? Let’s be honest. A lot of us came into this industry from backgrounds like security. I was very used to trying to break into things rather than into people. So I love getting my Computer Misuse Acts and the hacking cases because it’s like, “Oh, I wouldn’t have done that, but yeah, that’s not bad. That’s cool. I quite rate that.”

Si: But after a little while, you’re like, “Oh, that’s a really cool idea.” And occasionally I think I’m in the wrong industry. There’ve been a couple of cases – especially the drugs cases, it’s terrible to say – where you’re watching these guys. They got caught, so they’re not good at it, but they’re there sitting on top of their Ferrari with the bags of money and the bags of cocaine, and you’re like, “Yeah, I’m driving my old Ford Focus and this is not really getting me very far.”

Heather: This is true.

Si: I guess I sleep at night, so you know, this, that, and the other. Oh dear. So anyway, your global survey – you said 2,100 people and this is across the world?

Heather: 95 countries responded.

Si: 95! Wow. That actually must be pretty much every country that you’re legally allowed to sell it in, I would’ve thought.

Heather: That’s a good point.

Si: Yeah, export restrictions. When you get higher than that, you have to start worrying about whether export restrictions are working or not.

Paul: That part has a lot of oversight at this point – where it goes. Because we ran a poll during the webinar yesterday and asked about AI – what’s your thought on AI? You have two different camps of people. What do you consider AI? Which component is it? And just what’s your view on AI and digital investigations? 26% from yesterday’s poll for everyone that attended live said “Full steam ahead, let’s go.”

Heather: Where are you, Paul? Where do you fall into this camp?

Paul: I’m cautious but open to it. I like the idea of augmenting some of the stuff that we’re doing – the mundane tasks. But you’re not gonna summarize – there’s no “find my evidence” button. There’s no “Hey, where’s all the critical pieces?” because there’s still an investigative mind, the intuitive mind. You still need a pair of human eyes to oversee this.

Paul: Hopefully it brings you to something quicker – fantastic. But you can’t, what I’m worried about is someone presses the button, goes “poof” off to court, and you’re like – that’s a poor forensic examiner going, “WTF am I doing with this? What does this mean? There’s been no validation.”

Paul: So there’s a lot of room to help improve the stuff that we are doing, whether it’s automating some of the tasks or surfacing stuff like, “Hey, these are pictures that are AI generated that have been modified” – something that you can look at that makes sense. But there’s still, no matter what, a need for a pair of human eyes to go over something, validate it, verify it before you’re saying, “Hey, this is what this is,” and not just totally trusting the tool for it.

Heather: Yeah, I also worry outside of forensics – it’s just gonna make people stupid. Everyone relies so much on it to write anything, to do anything. I used it a little bit yesterday to help me write an email because I thought I was gonna be nasty, and I needed it to make me sound nicer.

Si: Did it work?

Heather: Yes, I think so. I haven’t gotten a response yet.

Si: I find mine makes me sound horribly sarcastic if I try and do that sort of thing. Maybe it’s not one for me. It is very interesting – I went to a talk probably about three or four weeks ago now. It was an American crash investigator, an accident investigator who had been testing AI to see if it could solve traffic collision problems.

Si: It was very simple stuff like, “I’m traveling at 45 miles an hour along the road. The coefficient of friction is this. How long will it take me to stop?” When he started doing this investigation, it came out with some really plausible sounding things that were completely wrong.

Si: What it had done is gone out to the internet, scraped it, and gone probabilistically – “These are the sort of things that sound like good answers to this kind of question.” It assembled the bits together to give an output that sounded good but had no relevance to the actual figures used.

Si: Then he pointed out that there’s now a calculate button or a think button in a lot of AI. When you pressed that, it actually started to take a lot longer to come up with a response – two, three minutes at a time. But it then actually went and did the math.

Si: I was playing with this the other day – it was a very silly example, but it came up in a family conversation where there was a sequence of numbers, and the challenge was to write a poem with words of that length. So it was like 1, 3, 5, 2, 7, 9, 1, whatever. I couldn’t do it – there was no way on earth I could do this with 20-odd numbers.

Si: Then I plugged it into ChatGPT and said, “Go ahead, do this.” It went away and came back with a poem. It promptly counted the numbers of words and said, “Right, now here’s a five letter word: ‘the’.” And I was like, “You haven’t quite grasped this, have you?”

Si: But when I hit the calculate button, it went away and took five minutes to come up with something. It actually came up with – I’m not gonna call it good poetry because, first of all, I wouldn’t know good poetry if it came up and bit me on the bum. It wasn’t great, but it did get the word numbers right, it did make sense, and it did the job. You’re like, “Okay, maybe there’s a bit more to this than I originally gave it credit for.” But you have to have the calculate button ticked, otherwise it doesn’t work.

Heather: Which app were you using?

Si: That was ChatGPT.

Heather: I’m gonna see if I have the calculate button. I’m gonna look at it right now.

Paul: I think the example that you used yesterday resonates, Heather. If someone tried to go through six years of chats between me and you, that’s a lot of work. And I think that’s where that kind of stuff can help give you an insight to say, “Hey, they’ve known each other for this long. This is the stuff they usually send each other – ridiculous videos or TikToks or reels.” But how also are you gonna quickly go through six years of conversations?

Paul: The reality is you’ll still have to scroll through some of that stuff, but if you can get a snapshot and then verify afterwards… because how else do you go through thousands and thousands of messages?

Si: Yeah, I think AI is a fantastic investigation tool. It’s not a forensic tool – it’s an investigation tool, and we need to make that distinction very clear to people. But actually, the bit that scares me is the false negatives, like those laptops. If the AI comes back and says, “We’ve gone through it and we’ve got a probability thinking that it’s 90% likely there’s nothing of interest in here” – we’re back to that one in 10 where actually there is something of interest, but the AI hasn’t picked it up.

Si: Probability and AI are a nightmare anyway because it’s hard. It’s also things like – we have the concept of nuance, and if we are talking to two people, especially if you’ve known each other a long time, you have your own language. You have your own internal references that even the best AI is never gonna get – those in-jokes because your husband doesn’t get those in-jokes. So there’s no hope for AI.

Heather: They may think we’re psychopaths. AI’s like, “Do not talk to these people. They’re not good.”

Si: Yeah. AI recommendation: just don’t touch this.

Heather: Stay far away. Save yourself.

Paul: But it’s wild to think that if your one in 10 is wrong – that’s the scary part. I remember even doing the investigations years ago, you’re more worried about the person that’s wrongfully convicted than the other hundred.

Heather: But speaking of people wrongfully convicted – lately I feel like a lot of the cases coming my way, I’m told a narrative and the people asking for help expect me to say, “Yes, that is exactly what happened.” They’re not happy when I don’t confirm their theory. All I can think about on this one specific case is if they didn’t ask me to look at it, there’s a good chance a jury would have found this woman guilty of killing her kids. But the data doesn’t support that conclusion – they need something else. They can’t say, based upon what the digital evidence shows, that’s the truth.

Si: I do a lot of work similarly where assertions are being made that aren’t necessarily supported by the evidence that’s there. I think it’s very interesting because I’ve done a lot of video analysis courses recently with Lever. One of the things they’re very clear on is about cognitive bias and bias in general.

Si: When examining a video, they try to ask you to avoid being told what it is that you are looking for or the conclusions that others have made so that your examination is what you find, not what you are predisposed to find because somebody has told you in advance.

Si: I think that’s a very interesting concept – for case review, perhaps we should just be given the images without any context and asked, “Okay, here you go. Tell me what you find and what’s of interest to you.” At that point, maybe we’re into a way of getting a fairer representation of it.

Heather: But I think you need at least a little clue on what you’re looking at. Otherwise, the hunt’s gonna take forever.

Si: This is it. It’s a difficult one, isn’t it? Because where do you allow that cognitive bias to go? How far do you allow it? It’s easier when you are doing the case review because at that point you’ve got a great deal of evidence that’s been put together into this storyline that you’re looking at, and you’re looking for the holes in it technically.

Heather: But even something simple – instead of saying, “Hey, this person did this, wrote this note, that proves her guilt,” say, “Hey, can you look at this OneNote and make sense of how that data was created?” Just something simple like that.

Si: Yeah, I have a lovely exercise I do with my students when I’m teaching. I create an image and give them a disk image. They go off and process it and come back. The amount that come back and say, “This is what happened” – and I’m like, “No, for two reasons. One, this is a fictional thing, and two, that wasn’t the way that I created that image, so I know that’s not what happened because I did it a different way.”

Si: So there’s always gonna be more than one way. They need to learn at a fairly early stage that just because what they have seen could be that, phrasing it as a certainty is a very bad idea.

Paul: It’s similar to the capture the flags that we run. We put out these images without much context and a brief summary of what happened. People take completely different paths to get to that result, which is wild because it shows their investigative, inquisitive mind. Seeing people’s writeups afterwards when they submit how they got to the answers – it’s fantastic to see how they approached it and the direction they went.

Paul: But to your point about bias – I remember most of the cases we worked were presented as, “Here’s the crime, here’s the suspect, this is what happened. Find the evidence.” You have to take a step back. I remember one case I had with a USB drive – something ridiculous like, “Here’s a USB drive found at a suspect’s house.”

Paul: Sure enough, the guy had his resume on there along with CSAM and all that other stuff. But in the end, if I can’t link that to someone else, there are so many potential holes. You have to be able to step back. I think this is where users and examiners always focus on very definitive things, but sometimes you just don’t know, and it’s okay to say, “I don’t know.”

Paul: We always try to please and answer questions, but in reality, it’s okay to say, “I don’t know how that timestamp gets created. I tried to test it. I can’t figure this out.” Talking about making assumptions – there are several active cases where, based on a timestamp’s interpretation, it could lead to a completely different narrative. It’s okay to not know – I think that’s something we should help junior people understand.

Si: To say you don’t know is far better than claiming to know something you don’t.

Heather: But I’m a woman, and I know everything.

Si: Yeah, we’re not gonna argue that. That’s fine.

Heather: I’m the queen of saying, “I don’t know.”

Si: It’s essential. And it’s also when you come up against another examiner in an adversarial court scenario, and they are so certain about their correctness – those are the ones I really enjoy taking on. Sounds terrible, but…

Paul: At the same time, I remember seeing a quote over the past couple days – “You don’t learn from successes, you learn from failures.” It’s the time when you get raked over the coals in court that you realize what you should have done differently.

Heather: Was that Winston Churchill? Where did we see that? I saw that too. TikTok?

Paul: How about the cloud piece? This came up as part of the survey – transitioning and being open to the cloud, which is actually surprising. Some of the numbers we saw, I think there was like a 10-point increase from last year to this year of being open to the cloud.

Paul: That’s not from a user perspective – that’s from agency management and heads of labs. It’s surprising how much people are opening up to the idea of it. I think all of us still cringe a little bit, but are cautious about it because all your case data being stored in the cloud is scary. Then add CSAM stuff into that as well.

Si: A friend of mine very early on nailed it for me. He said every time you see “cloud” in a sentence, replace that with “somebody else’s computer” and then see how you feel. Because that’s what you’re doing – “I’m going to store all my case data in the cloud” becomes “I’m going to store all my case data on somebody else’s computer.” It sounds a lot scarier.

Si: I’ve done cloud work in the security space for things like patient data and the NHS here – the National Health Service. It’s all about how to make sure that data is safe and only accessible to the right people, and it’s all to do with encryption. We have moved to the point where the technology is generally speaking good enough to allow the safe storage of data.

Si: I’m still a little bit risk-averse. I prefer a private cloud or a local cloud to store it. The infrastructure scalability and virtualization and all of those good things still exist, but it’s just under a little tighter control.

Paul: Do the additional security mechanisms like FedRAMP and all that stuff in the states – does that sway your view a little bit? If the agencies and companies are agreeing and abiding by that and are certified, does that make it easier for you?

Si: It’s made it easier for me to do it professionally because you go, “Oh look, Microsoft is accredited to hold MHSA, so that’s great. Let’s use them.” From a personal perspective, I still have reservations. I’m not the person who’s ultimately signing off on the risk of these things, so it’s not for me to say or to accept that risk. I wouldn’t want to try and sleep at night if it were me.

Si: It’s very good. It’s very close. But we all know how reliable computers are and how vulnerabilities come up and get found. You just need one, and then somebody has accessed every CSAM case that you have uploaded there. At that point, you’re like, “No, I can’t condone it.” It’s a low risk, but it’s such a high impact. For me, that equation just can’t work.

Si: I’m not against it for lower impact stuff – I think it’s a fantastic idea. But to be honest, you probably won’t know that it’s higher or lower impact until you’ve examined it, and you won’t examine it until you’ve uploaded it. Then you’ll find out it’s got something dodgy on there that you want to pull out.

Si: Getting stuff off the internet or out of a cloud isn’t as straightforward and as clean as you might think it could be.

Heather: And attackers are really well versed on attacking the cloud. There are not enough protection mechanisms – barely any multifactor authentication set to protect – and logging?

Si: Logging – again, I’ve done logging and monitoring configurations for things, and people never do it well enough. It doesn’t matter because by the time you’re reviewing your logs, it’s too late anyway. You know who’s done it, but they’ve already got it.

Si: Given what we’re talking about, that’s what we want to stop. We don’t want to know who’s got it afterwards – we want to prevent them from getting it in the first place. I am a Luddite in that regard. Hands up – that’s me. I admit to it. I’m risk-averse, and for me, it’s just not there yet.

Paul: I think there are slow steps in that direction, but I totally agree that the potential impact is difficult. But it’s interesting to see the trend slowly going up – 10 points from last year of people being open to it.

Si: I think we’re gonna see the same with AI. We will see it increase, but there’s a familiarity that breeds contempt. You’ll have seen this as well just on the front line – before, you’d seize a phone, it would go into a bag, it would be handled carefully. They’d want to give it to a techie as soon as humanly possible because they didn’t know what they were doing.

Si: Now everybody’s got a smartphone. Everybody knows what they’re doing. Every phone that gets seized has been tampered with in some way by the guy who seized it because he’s decided to take a look for himself and scroll through it just to see if there’s any evidence on there.

Si: I think what we’ll see is that because people use the cloud constantly now – we’ve all got a Gmail account. I remember Gmail being invitation-only. Crikey. And I was an early adopter on that front. We all use the cloud. We all use OneDrive, we all use Apple iCloud. It just happens automatically.

Si: We’re all so familiar with it – it’s just, “Oh yeah, it is fine. It works the rest of the time, it’ll be no problem.” And then… I don’t know if you’re aware, but the UK government has decided to request that Apple turn off strong encryption in iCloud. Apple is currently fighting the lawsuit in the UK courts.

Si: But people are already there – their data is already there. They’re already using it. They’re not gonna stop using it because the government’s turned off strong encryption. They’re just gonna carry on because for most people it doesn’t matter.

Paul: Do you think it’s generational? Because if you think about it, some of the decision makers are the younger ones moving up through the ranks too, right? They’re more, as you said—pretty much everyone’s familiar with phones now. I remember when I started, we were just introducing laptops in cruisers. So it was a new thing, and then all of a sudden the guys on the road have ops access to everything: GPS, live search, everything.

I think that part too is that the people making some of these decisions are probably starting to grow up with technology more than the ones before. We call them dinosaurs, but it’s different people who were making some of the decisions previously.

Si: You’re right. I think there’s a little bit of a disconnect though, because I don’t think it’s the tech people who are getting promoted to those roles. I think it’s the operational people who are getting promoted to those senior level roles.

Si: Tech is… good. Hang on. I’m phrasing this really carefully so as not to offend anybody—something I’ve been doing all my life, offending people by opening my mouth and saying what I think instead of what I should be saying.

Heather: Story of my life.

Si: I think that the best technical people want to stay technical people. He says, modestly putting himself into this bucket. God, terrible. One of the reasons I stopped doing security work was because I ended up writing reports and risk assessments. I ended up doing lots of paperwork. I was such a high risk that nobody would ever actually let me touch a computer with security because they were afraid there would be a backdoor in it.

You get to that point and then you’re like, “Actually, I really miss it. I got into computing because I wanted to play with computers. I didn’t get into this because I wanted to write tons of paperwork.” You made that change. I think techies, the techy mindset is like that for the good techies, and therefore they’ll stay in the lab. They’ll switch careers or go somewhere else where they can play.

I don’t think they necessarily stick out that promotional career ladder to keep going. I think you’re quite a good example yourself, Paul. You didn’t stay in the police to get to a position of authority. You left to go and do something interesting. I think that makes my point quite well.

Paul: I think with people, it’s just the change in technology and how it’s evolved as well. I think that’s where it’s everywhere now too, right? You either—

Heather: —grow with it or you die.

Paul: Like with AI, right? I think that’s where we’re going with it.

Si: But consumer devices have been made so easy. Fundamentally, you buy your iPhone, it connects to your laptop, you sync your calendars, it all happens. Last time any Apple user ever opened a configuration file was decades ago. They don’t even know what a P list is, let alone have the capability of editing one.

Paul: But forensic software’s the same, right? I think if you take a step back, we’ve created this industry of making things much easier as we go as well. To help move cases along quicker, make finding some of those deep diving artifacts easier, to surface them. We’ve created this “easy examination” button as well.

Si: Yeah. I think this is one of the reasons that training is so important, and I know Cellebrite does it and I teach it at a university level. But training is the thing that says, “Okay, first of all, we’ve got to drum into people that if they are presenting, they have to know what it is that they’re presenting, where it came from, and how they got it.” Just sticking this thing in front of a jury and going, “Ha, I found this” is not actually valid forensics.

Heather: At least you hold people true to that.

Si: Yeah. I’ve done Cellebrite training courses and I’ve seen a little bit of how the sausage is made in terms of the results coming out of it. I think that’s very important. But the trouble is, because of the overload, because of the sheer volume, the training requirement is going down for first responders. They are essentially at the point of plugging this into a kiosk, getting the data off it, extracting something of evidential value, and then going to arrest someone.

I have no problem with that, but it needs to be escalated to a forensic analyst afterwards to verify, to make sure, and to understand. I think that’s the stage we are currently missing. But again, this is not a fault with software or training. This is a fault about staffing, manpower, and money. On the police side, it only comes from governments. And on the defense side, unless you have a particularly rich defendant, it comes from governments as well who are even less willing to pay for opposing their own money.

Paul: Speaking of training, there’s one of the points in our survey about online versus in person. I’d love to hear this. I’m just trying to find the exact number on that. Was that six out of ten?

Heather: Six or seven out of ten prefer in person over online. I’m terrible with online training. I cannot pay attention.

Paul: Squirrel brain.

Heather: Yep. What’s hard is now the US government is frozen from attending training in person. So they’re forced to do it online if they have a budget at all. And it’s expensive too. I know SANS is not cheap, but if you’re North America local law enforcement, you can get 50% off all training, and most people don’t know that.

Si: Yeah, put that out there. Everybody heard that here first. A significant number apparently will have heard that here first. I’ve got mixed feelings about it personally as an individual because I don’t like going places. No, that sounds terrible. I like teaching—

Heather: —virtually sometimes so I can be in my sweatpants and my socks.

Si: Yeah. Teaching virtually, although it’s more exhausting. It depends what you’re doing because if you’re teaching professionals and they’re paying to be there, you can do things like, “Okay, everybody, I want the cameras on.” If you’re teaching a class of 30-odd students and you’ve got to abide by various privacy rules, you can’t say, “Alright everyone, I want the cameras on.”

So what you end up doing is sitting in Teams and staring at a bunch of those little circles with letters in them, apart from the character students who changed theirs. One of my years was fantastic because they decided their theme would be frogs. None of the cameras were on, but every single icon was a different frog.

It was a frog fest. That’s so cool. Very good year. But you sit there and talk for an hour, giving a lecture, and there’s not a sound. You’ve got the headphones on, but nothing’s happening. They’ve all got their mics muted. Occasionally you’re like, “Could somebody stick a thumb up if you’re still there, please?” And a couple of hands go up.

Heather: Now when I teach, we do something called hybrid as well, so it’s in person and people virtual. They can unmute themselves. The first time someone unmuted themselves, I jumped out of my skin. I was like, “Who is that? Jesus! What is happening?” I remember looking around, “What is that?” I also had a guy recently who had his camera on all day. There’s a huge confidence monitor in front of me when I’m teaching, and I just see him staring at me. It was so weird, but awesome. Good for you, guy. You’re paying attention.

Paul: Yeah, it’s hard when you’re presenting too. You’re doing onboarding stuff, and you’re like, “Okay, am I talking to anyone? Does anyone even care?” At this point, I could be talking about my Ninja Creamy recipes, and I’d get the same feedback.

Si: Yeah. One of my issues is that university regulations specified that lectures had to be recorded. Someone’s not going to come or turn up if it’s recorded lectures. They might log in and then go away and do something else. They’re going to play it back on double speed. Actually, it’s funny because my students—as you can probably hear, I talk reasonably fast—my students told me they were so glad the lectures were recorded because they could play me back at half speed and hear what I was saying.

But yeah, what was the statistic again? Six out of ten?

Heather: I thought it was seven out of ten.

Si: Seven out of ten. I’ve really enjoyed going to do on-site training. I’ve done—Lever is the most recent example. I did two in-person courses and two online courses. The online courses were excellent. But like you, I suffered from sitting at the computer to do it. The computer is what we use every day. It’s what we have our email on, our Discord, every other communications thing we use, plus all those academic papers we haven’t read yet, plus the news and the web browser.

I’m also the squirrel brain. I’m terrible. Somebody will say—and you’ve probably seen me do it—you said “Boston Marathon,” and I’m like, “Okay, I’m just going to double check what his name was.” So you go off and Google it.

Heather: Tsarnaev?

Si: I don’t know. I did discover that the Boston Marathon is the world’s oldest annual marathon though. So I think his name was—

Heather: Tsarnaev. Now I’m going to Google it.

Si: Rather nicely, all of the top hits now are actually about the marathon instead of the bombing. So when I just put it in, it wasn’t the—

Heather: Tamerlan or Dzhokhar?

Paul: The relationships you build from the in-person trainings too, I think that’s where it’s really cool. Because you build these bonds. I ran into someone from my first computer forensic course from years ago at a conference, and we were like, “Hey, it’s been how many years?” It’s wild.

Heather: Last week at C2C, this guy Rob Fried who runs a consulting firm in New York City—Rob taught me when I was 23 years old at NW3C. And now he’s sitting in the audience consuming what I’m putting out. It’s so interesting. He posted a picture on LinkedIn.

Si: He’ll be thrilled to have his name mentioned here.

Heather: He was a great instructor. I remember learning FAT32 and NTFS from Rob Fried and Berla. I told him, “I remember how you said it.” His analogy was that in FAT32, the file system in each file is like Thanksgiving leftovers. You can’t just let it overfill and stuff it in. You have to put it into a smaller container that sits beside it and makes the whole—I’m like, “I noted that. That was 2003, and I still remember that analogy.” Food works for me. Food and drink analogies stay forever in my mind.

Si: Brilliant. I’m going to have to start using food analogies in my teaching. Squirrel brain often. Hey, there’s nothing like—

Heather: —slack space and Thanksgiving dinner. It helps. See, this ended up being fun.

Si: I’m not very happy to draw a line under it there because I’m fairly enjoying it, and I can carry on talking to you guys for hours. I hope you both come back and we speak again on the podcast because it has been great fun. If nothing else, this time next year to find out what the shifts are in the results. It will be fascinating to see if another 10% goes up in the cloud.

Paul: Yep.

Si: And whether people are entirely fed up with AI by that point in time, or whether they still think there’s a good idea. Just keep hearing it on repeat is driving me around the bend. If nothing else, it’s the reality. We have to live with it. We have to accept it. We have to get on board or—

Heather: —or get left behind.

Si: Or get left behind. That’s it. It’s quite funny because obviously, one of the prime examples of AI going horribly wrong is in the Terminator movies, and it’s Skynet. Skynet is the horrible, overarching thing. That’s actually the name, or at least it was the name of the UK military satellite network. There’s a place where I used to work that had a Skynet Avenue because it was part of the thing. You’re like, “I’m not so sure I want to be here anymore.”

Oh my goodness. It doesn’t seem like such a good idea. Anyway, I digress massively. So I will say thank you very much, Heather. Thank you very much, Paul. It has been an absolute pleasure talking to you. As always, you can find the Forensic Focus podcast on all of the places that Desi remembers and I always forget, which is Apple Podcast, Spotify, and the Forensic Focus website.

But the point is, if you’re listening to this already, you’ve already found it. So me saying this is irrelevant and totally superfluous. I will say again, thank you very much indeed. It’s been an absolute pleasure, and we would welcome you back on any time.

Paul: Thank you.

Heather: Thank you very much indeed.

Si: Thank you.

The DFIR Investigative Mindset: Brett Shavers On Thinking Like A Detective

The following transcript was generated by AI and may contain inaccuracies.

Desi: Welcome everyone to this episode of the Forensic Focus podcast. As always, you’ve got Si and Desi as your cohosts, and this week we’re joined by Brett Shavers who, as we were just saying offline … We’re both fanboys of Brett’s, and there’s a lot of people that were very excited we’re interviewing him.

He is the author of DFIR Investigative Mindset, which is an excellent book if you haven’t got your hands on it, and it’s not too much of a read. So I think, what is it? It’s only 200 or so pages. Yeah, about 222 pages. And I’m still getting my way through it, but it’s a great read. Welcome Brett. Thanks for joining us.

Brett: Thanks for having me.

Si: And we say that you are the author of that which you are obviously, but also the fairly definitive “Putting the Suspect Behind the Keyboard.” And also, and this is one of my favorite and often referenced books, is the X-Ways Forensics guide. It’s pretty much the official manual for a tool which is used in a significant number of organizations across the world.

It’s really a pleasure to have you on and to be able to talk to you about the work that you’ve done. Saying you were old earlier, and I didn’t mean it in any way. I’m so sorry for that. Yes, we are, but I’ve been in the industry for a while then I’ve been familiar with your books for a while, but how did you get into this? How did we start off? Why are you a forensics guru to the rest of us?

Brett: I’ll just be able to keep my head above water like everybody else with the technology. I did undercover work for about a decade, I guess, in US law enforcement where buying drugs and guns, and I bought some humans. I was a hit man a couple times and a bunch of different things for that. And toward the-

Si: I’m gonna ask, just on the basis of this, you were buying these people in real life. This wasn’t a digital “I’m logging into the Black market and buying some drugs.” This is meeting some shady guy in the back of a bar somewhere and asking him-

Brett: Yeah, a bar, a nice boat. Anywhere, parking lot. I’ve bought pretty much anything that’s been illegal, I guess you can think of, and sold probably just the same as well, but where there’s an arrest, not just letting drugs on the street or selling people. But yeah, a lot of those operations and a lot of the criminal organizations that I did were international or transnational, I guess you look at it that way.

So I had a lot of different crime groups, outlawed motorcycle gangs, some Asian crime groups and that sort of thing. And that, the last part of that decade, one of my co-case agents was a federal agent, and he was gone for a few months, and I’m working the case by myself.

He comes back and I said, where you been? And he said, all I can tell you is I’m marketable. And I go, what does that mean? And he had gone to FLETC, which is the computer forensics federal training. And he told me all about it. And I said, yeah, that’s probably a lot better than the job that I’m currently doing because there’s a lot of close calls and I had guns pointed in my gut and that sort of thing.

And so then I started to work my way into that field. My agency didn’t have any forensic unit, didn’t care about it. Budget’s always a problem. So I begged, borrowed, and stole. Took a lot of free training, practiced a lot. I imaged all the computers in my department as much as I could find for practice, and eventually did some cases and learned that it’s a lot harder than I expected it to be.

And a lot more important than I thought it would be. And it got me in the direction that I’m now. So that’s the short story. I didn’t wanna be killed on the street selling things or buying things. But computers, never know. They’ll probably kill us one day too. But that’s where I’m at.

Si: It seems like just not yet a sensible way of preserving one’s existence. I have to admit. But did you have a technical background at all before you came to it, or was it purely through that training?

Brett: I took a basic class in high school, so that’s how old I am when we had BASIC in high school. And that was the extent of it. I joined the Marines at 17. And my wife says, I just walked around the woods a lot. So no technical background in the military. It’s just us. So I came into law enforcement, and after seeing what forensics could do, that’s where I got into it.

Desi: And talking about how it’s hard and like you spend a lot of time imaging and getting good at it. We saw your recent blog post that “You Don’t Belong in DFIR.” And I was reading through that last night as well. What kind of- ’cause I agree with it, I like the image that you have on it – DFIR being the tip of the spear in cybersecurity.

And when you do think about it in the context of it being used for law enforcement – ’cause I think contextually it’s bastardized a little bit and used just in general in cybersecurity – but what was the motivation for writing this blog? Was it something that had come up? But it sounds like it’s a long time belief as well.

Brett: Okay. Culmination of people online complaining about it is difficult to get into the field. And I think DFIR, and I always put a slash between both ’cause it is a separation, but it has some Venn diagram in there as well. And I think IR is just as probably tougher for me. I’ve done IR work. I don’t like it. That’s why I stick to the other side.

Desi: Yeah.

Brett: But I know it’s just as important because you have businesses and you have people and families who rely on income from having jobs and businesses. So that’s very important. And it is the tip of the spear in that realm. But you have different types of pressures. You got people breathing down your neck, like literally on your neck, telling you to hurry up.

Desi: Yeah.

Brett: And you’re, and I think it’s even harder because you’re trying to predict human behavior. Like, what is this person trying to do? Or what’s happening? What’s happening right now? And how do I prevent it? Am I gonna miss something? Where as the forensic side, you’re looking retrospective, historical, the world’s not ending. It’s, and I have this dead image on my desk, so you have more time to be more methodical. So there’s different pressures on both.

So for the tip of the spear, that’s why I really put both in there and I know I wrote the article where it’s more like the law enforcement side, but it really does lead over to both. And I get questions, emails, “How do I get in? How come I’m having such a hard time getting into DFIR?” And I come to the conclusion that it’s really not an entry level job. It’s not something- it’s Indy 500. You can’t expect to take a 40 hour how-to-drive class, and then you’re racing at hundreds of miles an hour. When you get into that car, you have to be able to drive hundreds of miles an hour from that first second, or you’re gonna die.

Desi: Yeah.

Brett: So the point of it is you have to build up your experience and your skills and move into it. But that’s my opinion. It can always be, sometimes there’s luck. People can get in obviously, if networking and-

Desi: Yeah, it’s funny. Like while I was reading this post last night, I was actually talking to a couple of people on LinkedIn that just randomly connect and always are like, “Oh, how do you get into IR? How do you get into cybersecurity?” And I think there’s a cohort coming through now, and this is quite a good blog to get them to read as well, but it’s not an entry level job.

But they think that going and doing a Master’s or a Bachelor’s at university will get them into it, because it’s formal education. But then when I’m like, “Okay, but you wanna get into a technical field, so what have you done technically to hone your skills and get your foot in the door?”

And they’re like, “Oh no. I don’t like doing any of that stuff, but I want to be an IR person.” I’m like, “But it’s all technical at the entry level.” So you’ve done this theoretical Bachelor’s, which is great. I think getting a Bachelor’s is a good thing. But it’s not gonna get you into IR. And I think that’s the gap in some of the messaging, ’cause I think universities are selling that. They’re like, “Hey, you do our Bachelor’s. We have a 90% job success rate for our students.” But they’re probably not saying that the people getting jobs might be getting jobs at fast food joints still when they’re coming out. Like it’s not in IR, the employment ratio is not-

Si: -necessarily directly related to your degree. Yeah. I’m gonna say I was gonna comment similarly and Desi sits on one side of this beautiful field in the IR space, and I sit very firmly, like you, I don’t need the stress of someone breathing down my neck. I don’t need the- I do it, I’ve done it occasionally, but it’s “Oh, this is really critical now where our shareholders are gonna kill us.” And it’s “Yeah, that’s great. I’ll go back to my nice criminal case over here that’s not going to court for another three months. That’s brilliant.”

But I came to this, I was a systems administrator first. I spent literally decades as a security specialist and then got into forensics, and the- I do some defense work now. I do quite a lot of defense work now, but you’re reading the reports and you’re like, “You just genuinely have no idea how a computer actually works, do you?”

You’ve sat the FTK course, you’ve done perhaps a couple of bits of additional learning, and then you’ve made a statement which fundamentally undermines the basis of computing here. It’s like you’ve not read any of Turing’s papers, you’ve not understood the computability of numbers or any of this stuff. And therefore, I’m going to take you apart because you don’t know your stuff. So it definitely is that, and I think the vendors have done us a dirty by- and X-Ways is the one that hasn’t – but a lot of the other ones have done us a dirty by going “Here, click this button. You get evidence.”

Brett: Yeah. I think tools are great, compared from way back when, when we were doing command line, everything, or Norton Disc. It is nicer to have push buttons and I think that’s necessary. But like you said, we have to know the underlying- what is it actually doing and where is this data, how did it get generated, where does it live? Where do I find it? And like you said, I’ve come out of a trial before and the opposing expert came up to me and asked me where did I find these messages on this phone. And in my mind I’m thinking you didn’t find them. It’s-

Desi: That’s a scary thought though, isn’t it? And it made me think-

Brett: At the same time, what else did I miss? Because if they missed it, then I probably missed something too. So there is that level of- we have to know what we don’t know out there as well.

Si: Yeah. And it’s funny ’cause we complain- I complain, I think we complain as an industry, that the disks are getting bigger. And it’s “There’s no way I’m ever gonna look all the way through a five terabyte disc.” And I’ve got cases with 10 terabytes worth of data, and it’s unworkable. But it’s not like I ever sat and looked through a 1.44 meg floppy end to end either. It’s a little bit illusionary that data is ever particularly manageable. So yeah, tools and the search and the question of what is it that we’ve missed is always a thing.

Brett: Yep.

Si: Or misinterpreted. Yeah. I have a great fun exercise with- when I teach, and you teach students, and you give them this piece of material to examine and they go, “Oh, it must have been created this way.” And you’re like “No.” ‘Cause I know how I created it and it wasn’t that way.

Yeah. You’ve written the definitive X-Ways book. How did you get into the relationship with X-Ways?

Brett: Lemme see. I don’t get too much detail on, when I was trying to get into forensics and law enforcement, I was working undercover and I was assigned to a federal task force, and I would sneak off to training and I wouldn’t tell my agency, but my federal task force would send me.

So I’m working cases on the East coast when I’m living on the west coast, I’m doing everything remotely, buying and selling things. I’m having people do arrests for me and I’m looking at software, trying to find software, and one of the ones was X-Ways forensics. And my partner and I were- this is before there was any training, I think X-Ways version, I can’t remember what version it was.

The first version of X-Ways forensics had come out and we had emailed Stefan and asked, is there any training? And he said, no. So we said, how would you like to come to Seattle? We’ll pay you to come to Seattle. And so he came to Seattle and he gave a class on X-Ways and it was a 40 hour class, his first class. And there was like no breaks at all. We had a 30 minute lunch. It was something crazy. And so it was really intense. It’s brutal. And watching what X-Ways could do at that time compared to now, it’s just a drastic difference. But at that time it was like, “Oh my gosh, this is incredible.”

And then I go to another forensic training on these calls at FLETC where we get EnCase, FTK, a bunch of other tools, and we get a test image. And we’re all working on the same image, but we can use whatever tool that we want to use. I wanna use X-Ways ’cause I just took the training. I think I like it, right? I got the guy next to me using EnCase, another guy using FTK. That was version I think four in EnCase at the time, maybe five.

And we’re doing data carving. And on my image I’m coming in with a lot of pornography. Adult pornography, not child. Had one of the IRS agents teaching the class walking behind me and she accuses me of surfing porn on the internet, right? The computer doesn’t have internet access, number one. And I said, “This is from your image.” And EnCase and FTK couldn’t find it. We all were trying to carve for it, and I’m going, “Wow, this is neat.”

So it turns out that image was created by one of the instructors, his personal computer, and X-Ways actually carved out a lot of pictures. They grabbed our images and canceled that test for that day. Now I’m sure FTK and EnCase do a great job of the same level of data carving, but at that time, X-Ways was the only one. And we did the whole classroom test for that. And I was like, “Oh, I’m impressed. I like X-Ways.”

And talking to Stefan here and there, I mentioned the manual and I said the manual’s not that easy to read. I guess it’s trying to find how do I use it. In his opinion, which I don’t disagree with, is you should already know how to use it. So the manual is not gonna teach you how to use it. So that’s where the book came. It’s “I need to take a lot of notes here.” And I took a lot of notes and I eventually said it probably needs to be a book. So that’s my X-Ways introduction.

Si: And what version are you on now? It’s only 20. I certainly own at least two myself. 20?

Brett: Wow. 21. And it keeps getting these releases every other week it seems like.

Si: Yeah. That’s true. Yeah. The updates keep coming in. That’s very fair. Yeah. And that’s impressive. You are a prolific writer, both in terms of posts that I’ve seen on LinkedIn and in terms of books. How much time do you actually devote to- I’m gonna say putting pen to paper, the metaphorical thing I’m trying to get at here.

Brett: I could do, I should do more, but not that much daily. It’s usually just an intense moment of, “Okay, let me sit down and get this one done. Let me sit down and get this chapter done in a couple days, or let me write a post tonight.” So it’s more intense work than instead of… I guess more consistent is better, but I’m consistently- I guess I’m consistent at intense work, rather than every day.

Si: And saying that, am I not mistaken that you’ve got another book coming out this year?

Brett: Yeah. Yeah. That should be a really good book. It’s different than I think any other forensic book that’s been written. So it-

Si: It’s Investigative Strategies, I’m seeing driven by the title on your post. I came to this from a very technical background. It is interesting the way the field is split between law enforcement- sorry, Desi, we’re gonna go off on a little tangent here, into forensics. But it’s an interesting split between the law enforcement guys who have come from that detective investigative mindset versus those of us who come at it from a very technical perspective.

And I think we’re both trying to learn each other’s fields. How do you- I’m gonna say, how do I phrase this question would be a good start? What’s your opinion about the necessity of an investigative mindset? You’ve written a book on it, so I’m gonna guess this is fairly important to you.

Brett: I think it’s most important. And I think Desi, one of your shorts came up on my feed one time you were talking about what’s called infinite pivoting or something, and you said something about “Oh yeah, thinking like, if I was a lazy hacker, how would I get in?” I think that’s right?

Desi: Yeah.

Brett: And I thought that’s exactly one of the ways of thinking. Law enforcement does that all the time. It’s if you look at a burglary of a house, it’s “Say, how did this person get in? Well, lemme check the windows. Lemme check the door, lemme check this, lemme check.” So you’re wondering how they got in, and if it’s lazy, maybe the back door’s open. So it’s the same kind of thinking – not to be a criminal, but to think like a criminal or the adversary. That’s one way to think about it.

And I think that’s very important. ‘Cause you can be technically expertise in everything. You can read a SQL-lite database and know everything. But if you can’t understand human behavior of why somebody did something, or you know the motive, you’re not- you’re gonna miss some things of how- you’re gonna miss some things of the case.

And a criminal investigation obviously, is even more important because you really have to prove somebody did it. Technically, you can say this happened on this machine, right? It happened. Well, in the IR world, that’s fine because we shut it down, we contained it. The business is running, we’re good to go. But on the other side, the forensic side and law enforcement, even civil litigation, it’s “We know what happened, but who did it?” ‘Cause that’s what the whole thing is about. Is someone- there’s gotta be justice. Either someone stole some IP or there should be some justice. Someone assaulted somebody, there should be some justice.

So it’s important in both aspects, but it’s really important on a forensic side. But I really believe it helps the IR side because if you can start to understand how breaches are happening, you can see, “This definitely seems to be like an insider attack because it’s got whatever indicators” or “This one seems to be coming from someplace else,” and you can handle it. Your path is gonna be different when you’re looking at the work because you have an idea of where it’s going by the evidence, not by just guessing, but it’s “This is what I think, let me check. Yep, there’s some clues. I think I might be on the right track.”

Desi: Yeah. And we were saying just before this as well ’cause my, now that I’m in insider risk and insider threat, like the difference between someone external, like from an IR perspective and then an insider, is very subtle in a lot of the evidence, but then there are certain behaviors.

So if you’ve got a baseline of that user, things like their browsing habits – like if their browsing habits on the internet don’t change, it’s more likely to be an insider than someone else, ’cause the persona on the keyboard versus the person… And is the person really gonna know that this guy is really into the Yankees? And searching them on the internet all the time, day by day while they’re doing their job? Probably not. So yeah, like little subtle things like that because I guess some of the stuff that I do now does eventually go to court ’cause companies will take individuals to court for litigation.

Si: Yeah. I’m gonna say it’s a fascinating one. I came up- ’cause like I said, I worked in security for a long time and I remember specifying, against government set standards, but specifying the logging and monitoring that needed to go onto a system. And I get there now and I’m looking at it, I’m going, “Oh my God, that’s not nearly enough to actually point to an individual.”

And I’m coming up against it. I’ve got a case, I’ve got an ongoing case where yes, the guy’s user ID has been used to access something. But because of all of the other, the failure of pretty much every other single control in the rest of this space, there’s not actually a way to pin it on him. Which is a nightmare in terms of security. It’s a nightmare in terms of forensics. It’s just absolutely appalling. And yeah, actually that aspect of “Putting the Suspect Behind the Keyboard” – he says plugging a book quite conveniently – is absolutely critical.

And this is where your book has been fantastic and continues to be, is because of that investigative mindset, that fantastic set of suggestions and ideas and ways of approaching that that you’ve obviously worked on over a long period of time from real world experience. What would you characterize as the main sort of ways of actually approaching that?

Brett: These are hard questions because, and I got some answers, but just as a kind of a background on this mindset. In 2008-ish or so, I was given a workshop to, was it DFRWS? It was whatever DFRWS and this is that one. Yeah. So way back then it’s a room full of PhDs and I have just a few years of doing forensics full time. And one of the professors in the front row, she asked me a question.

She said, “It sounds like you’re saying everyone needs to have investigative experience as law enforcement.” And I said “No.” And she, and they all basically said it sounds like it. And I go “I don’t think you have to. I think you just have to have the thinking, the mindset to do it.” And she said “How do we teach that if we’ve never done it?” And I said, “I don’t know.” So I didn’t know, honestly.

And for years, and I wrote it in that first book that I wrote, I think I wrote a few pages of, “You have to have the investigative mindset,” but I didn’t really flesh it out enough. But over the years trying to find and research, how do you teach this? ‘Cause I was teaching at different universities and I’m thinking “How do you teach this?”

Other than in law enforcement, you go out in a police car, you have a case, a crime, a 911 call, whatever it is, you become a detective, you gotta figure it out, right? And you learn through trial and error and eventually you become an investigator if you really focus on it. But in this world, we don’t really have that kind of experience or training of, “This is how you think, this is how you handle this evidence.”

So that’s what this book, I think the whole premise of it is, here are the things, the tips of how to think when you’re doing these technical investigations. ‘Cause it’s one thing to be technical. I say technical is easy because you can learn to do forensics on YouTube. If you’re gonna learn a lot of wrong things, you’re gonna learn a lot of old things. But if you know where to look, you can learn, you could pay and have someone teach you “This is the current right way to do it.” So you can do that.

But the investigation part is difficult because how do you get that experience of “I’m gonna go and investigate stuff.” I can’t. Because how do I do that? And if I have an image, how do I know human behavior? So there’s not much training. And I know we talked about vendors before, push button tools, and there’s been complaints about vendors need to teach forensics. They need to teach these things.

And I disagree, because if I’m gonna take a class in X-Ways, I’m gonna spend three, $4,000 on the tuition and a thousand for travel and all the other things, and if they spend a day or two on “Let’s talk about human behavior. Let’s talk about psychology, let’s talk about…” I’m gonna say, “Look, I just need to know how to- where’s the button at? Where’s that right click gonna take me? Where?” So I think the vendors have to teach their tools because we’re paying them to teach their tools, but we’re missing that other part.

And with the college education, they don’t typically teach that either. You may have a critical thinking class as an elective or maybe some critical thinking within a class. And critical thinking is just one aspect of an investigative mind. That’s just one thing to look at. It’s like an umbrella and there’s that, you got a bunch of other things in there, biases to deal with. And so I think that’s what this book came about and I wrote it, 200 something pages and it took a while to condense this topic into something that’s easy to read.

So my point was you can read it in the weekend, you can go through it and if you’ve been doing this work for a long time, you can say, “You know what? I’m validated in a lot of the things I’ve been doing. I feel better, more confident. And I learned a couple things.” And the other side of the coin could be, “Wow, this is the way that I should be considering to think. I didn’t know I had these biases.” I do have, ’cause we all have biases, and now I know how to mitigate it. “I know how- I’m not a detective, but I can see how that works.” So I try to make it a readable, entertaining kind of thing, but also important, I guess useful. A useful book.

Desi: Yeah. Yeah, because I’m still like reading this book. I’m still early, like less than halfway. And it definitely- you could breeze through this in a weekend for sure. What I find myself doing is actually read a chapter and then I am like sitting in my office lost in thought, thinking about what the chapter was, and then I end up, and then I go, wait, I read something in that chapter, and then I go back and I can’t remember where it is. So I’m rereading chapters, which is, this is the first book that I’ve done that. Normally I’ll, like, when I think about I-

Si: I want this noted on the record, Brett, you’ve made Desi think.

Desi: Oh, and I love- because I really love- I’m very passionate about education. Like I’ve worked at an education company before for gamified cyber learning. I think that’s fantastic. I think that’s how a lot of people should learn. But then there still is, like you said, the gap between how do you teach someone to investigate when it’s outside of the cases that you are teaching. That is, I think, the key point.

I can teach someone to do an image and a case and go, “This is this case,” but then it’s still a very large leap to then let them do their own case on something completely different and then go, “Okay, I need to not only apply all the technical skills that I learned and learn new technical skills if there’s new data I come across, but then also think about how to investigate that whole case by themselves.”

And I was very fortunate coming up that I had really good mentors. And I feel like that seems to be the key way for a lot of people to get into this field, which is probably why it’s not entry level, because you need the aptitude to learn off people when there’s so much uncertainty in getting this skill.

Si: Yeah. I’m gonna say I’ve been very fortunate, in the same as you, as I’ve had excellent mentors. And one of the universities that I work with – and Desi, you’ve spoken to her as well – Ms. Sarah Morris has worked very hard on putting together training scenarios, which are reflective of the real world in terms of investigation. If not, obviously none of us wants to do CSA cases as part of our training, but we’ve created this sort of training scenario that is set in a fictional world that has its fictional criminals and its fictional things in order to do that.

And recently she ran a crime scene simulation where they had to go in and actually look for stuff. And astonishingly, some of the students didn’t get it. They didn’t understand that this is about investigation. They just wanted the hard technical stuff. They didn’t see the point of all of this. And it’s such an all-encompassing field that we need to be looking at what the requirements are in order not only to prove a case, but to make a point, but to investigate, to find out, look for additional links, look under the- lift the keyboard up and see if the post-it note is there with a goddamn password on it.

Because we’ve all spent- I remember this years ago, it was like I got a device sent to me and I was like, do we know what the password is? And they were like “No, we haven’t got a clue.” Open the device – 1, 2, 3, 4. And it’s “Yeah, okay, fine.” Let me in straight away. But the point is that if you have no concepts about things like, what are the most popular passwords? What are the likely human things, you can’t start to do any of the technical stuff if you can’t get into the damn device or haven’t found it in the first place.

So yeah, it really is a hugely important aspect to build this mindset. And it’s funny because I came from originally a computer science background and I studied artificial intelligence as well, which perhaps is my redeeming feature. ‘Cause I had to wonder a lot about how things think.

You don’t ask these questions in computer science. You look at algorithms, you look at data, you look at normalization of databases, you look at programming languages and whether you can put them down into BNF form and all sorts of stuff like this. But you don’t actually look at people, and we forget – and I’m gonna say we – we forget that this is what this is about. We are not looking at computers, we’re looking at what people do with computers, whether it’s IR or DF.

Brett: It does come down to that. I think one of the concepts – I think that if I tell one person one thing to do this job better, is to look at the computer and the data as if a person did it, right? Every action, a person did it, even if it’s malware, someone wrote it to do something. So everything goes back to a person.

Technically, we look at things like the end point is the machine. That is our end stop. We’re going all the way to the wall of the drive. This is the end of the drive. This is the end of our case, but it’s not. Somebody touched it for a reason and they touched it somehow. And I think we’re looking at, we’re investigating a person. We’re not investigating a computer, we’re not investigating a smartphone. A person touched this, a person handled it and the person used it to commit a crime, whatever it may be.

And I think if you have that perspective and that mindset of “I’m looking to track a person down,” even on the IR side, I think especially because you’ll never find those people usually. ‘Cause it’s somewhere else. But to have that perspective, I think makes a big difference. And I brought that back from doing undercover work, buying drugs and let’s say, cocaine, for example. When I looked at cocaine, my thought process is I know the whole process, manufacturing process, the smuggling process. I know how people use it. I know how much money they’re making from it. All these things about it.

So whenever I would see some cocaine or buy some cocaine, in my mind is, I know the people who were stepping on the leaves, the kerosene, all these things. I know how it got there, and that’s how I would approach all my cases of knowing more than just “I have some powder in my hand.” It’s more than that.

A computer’s the same, it’s more than a smartphone. This thing was used to victimize a dozen people. This computer was used to victimize a thousand people. So who did that? Or what group did that? And thinking like that, then I think you can start to crack that wall of technical expertise by saying “I’m just gonna use these tools to get to that person,” right? Instead of, “I’m having fun using these tools. Oh, look what I found. I found this deleted file. This is great.” I say that’s great, but what sense does it make?

And I know on the law enforcement side, one of the differences compared to, let’s say a computer science graduate who doesn’t have any experience. On the law enforcement side, it’s more like, “What evidence do I need to prove this case, right?” I got 10 terabytes of data. Do I need 10 terabytes of data? No. I need the evidence within that 10 terabytes of data to prove that somebody did it, that somebody legitimately did it. Whereas on the computer science side is “I wanna learn everything I want to. I’m gonna break apart everything I can and I’m gonna have a 500 page report and look how good I am.”

And yes, it is a hundred percent technically accurate, better than what the law enforcement guy could do, right? Because the report’s a stick compared to this tree. But what is more important for the case? IR is the same. You can go through the whole network and you can map it all out and say, “This is what we got and I got all this stuff.” But the answer that the C level employee, the executive level is, “Wait a minute, is it fixed or not? I just, is it fixed?”

You know what I’m saying?

Desi: Yeah. It’s a lot of the time, ’cause like most organizations will just wipe their network when the investigation’s done and restart. But it’s that risk versus reward of if we spend more time investigating, what are we gonna get out of it? And if your answer is “Not much,” then it’s “Okay, investigation’s ending, we’re resetting the network,” right? And then we’re going from there. So it’s that- it’s always that balance and yeah, it sounds the same in DF.

Si: The interesting thing in DF is actually we gotta remember who our end client is. And yeah, it’s not actually somebody who has the foggiest idea of what you’re talking about. The end client is a jury. And a judge. And I’m not gonna be rude about judges ’cause I’m gonna have to stand up in front of some of them, but juries definitely don’t know what you’re talking about. And you’re going to be presenting incredibly complex technical ideals and ideas. And if you’ve got a 500 page report that details everything, you’ve lost them from the outset. You need to be succinct and to the point and about the things that are critical in there.

Brett: Yeah. That’s the other major point is I don’t think we teach enough to convey information that people can understand it because it’s ego, I think, is the thing where “I’m smarter than everybody else in this room and I’m gonna prove it.” Where if you’re really smarter than everybody else in the room, then you want to make everybody else just as smart, right? So they can understand.

And I’ll give you an example. I was in a federal court. And the crux was on backup tapes, right? And I’m not an expert on backup tapes, I know what a backup tape is, and that’s how they work and sort of thing. And so I go on the stand and I give my spiel on my perspective on the backup tapes in this case. And then the opposing expert goes up and she gives her spiel. And it’s really technical and I’m taking notes because I’m, “Oh man, she’s killing me. She really knows backup tapes very well.” And I’m going, “Okay I’m gonna be called on this one, I’m sure.”

And the judge had stopped her midway and said and asked her a question, and she gave this long convoluted answer, and he asked her again, and he asked her a third time, and she kept giving these long answers. And he turns to me in the back of the courtroom and he said, “Can you explain to me what she’s saying?” And I said, “I think she’s saying this.”

And I asked her, “Is that right?” She goes, “Yes.” And he says, “Okay, now I got it.” And I thought, “Okay, this is a good day.” And so, the technical part is important, but like I said, if you can’t help the end client… And I think the end client goes all the way back to the victim. Whether it be a business-

Desi: The business. Oh, yes.

Brett: Yeah. Or it could be a falsely accused or who knows. Even the defendant could be a victim, if it’s a false accusation, that sort of thing. So we don’t have to explain to the victim. We gotta explain to the court, or to our C level and different things. So some IR should be a criminal investigation because if it’s gonna bankrupt the company, regardless of what you do, well, you might as well go all the way and get some justice out of it. So conveyance is, I think, a big deal that we miss.

Si: Yeah. Yeah. And again, in the technical scenario, one of the things that isn’t taught particularly well, generally speaking, is report writing. They’re told the technical details, but not how to construct that into a sentence that actually makes sense. So definitely want to watch-

Desi: I am not sure whether it’s structured the same way in DF for you guys, but I find, like when I came in and kind of the entry level job, it was very much like the focus on the technical and getting all the information and then putting that technical information into a report. But then it’s not until you hit like the principle level, which is like three, four levels above the entry level, that they then start to teach the skills to go, “Okay, now you as a principal, you need to convey that to C-Suite who have no idea what you are talking about.”

And why is it that you wait like those five, six years until you hit that level that you’re starting to do that? Like they don’t, and there was no education pathway when I was doing it. But even, I think technical training now like we’re saying it’s starkly missing on how to write a concise report in DFIR.

Brett: I think part of that is a lack of peer review in a private world, private sector, especially. In a police world, the patrol officer writes a report. It goes to a sergeant who approves it or sends it back, and then it goes up the chain into the computer and eventually goes to a- if it goes to trial, a prosecutor’s gonna read it. The defense attorney’s gonna read it, the jury’s gonna hear it.

All those things happen, and after a police officer goes through one of those, if it goes to trial, and then the report’s being read and torn apart, that’s probably the biggest lesson of how to write a report after you’re getting smashed on the stand of “I’ll never write that way again.” And you learn that way.

Desi: Yeah.

Brett: On the private world, it’s you write a report and people- I’ve seen it. People will read it, and I know, and they’re looking at it saying, “It’s not really that good, but I don’t care. It’s not my report.” And they’ll send it off and there’s no feedback. And I think if we have more feedback or some- and I think I wrote in this book as well, is some peer review is always a good thing. Show it to your buddy.

Si: Yeah.

Brett: And like on the book that I’m writing now, it’s a completely different book as far as how it’s written, but I asked my tech editors and beta readers to kill it. If it doesn’t sound right, it doesn’t read right, if it’s too difficult, it is worthless material, so beat it up. You won’t hurt my feelings. I’ll cry in the corner later, but-

Desi: I think I’ve shared this story before, but, and like talking about peer review, and I think I’ve shared this to you Si as well, but I had a very good mentor in my first job. She was an amazing boss and is now heads up one of the biggest cyber teams in Australia. But she- I wrote this report and instead of giving me any initial feedback, she sent me a meme back, and it was the 1970s film of Godzilla where it was like the prop set was Godzilla in a cart on its side, and then the caption on the meme was like, “Your report was so bad that you gave Godzilla a stroke.”

And that was my initial feedback from my first ever professional report and I was just like, “What is this?” And she was just like, “We’re having a meeting to discuss your report writing.” And it was good. Like I honestly, my reports got much, much better after that. But it was very astute feedback.

Si: Yeah. Yeah, my wife is a project manager and she deals with comms a lot, dealing with from the people at the bottom to the people at the top. And if I ever give her anything of mine to read, it comes back with comments like, “Why isn’t there a full stop for three paragraphs? Why do you not understand punctuation?” And I’m like, “It’s been proven that the longer a sentence is the more intelligent the person writing.” She’s like “No. It doesn’t work. Just, it’s too long. Put some fucking punctuation in.”

Brett: My first private sector report was- I got an IP theft case. And the attorney is in New York. I’m on the West Coast. He’s on the East coast. And I did a police report basically on this forensic exam and I emailed it off and the attorney called me maybe 10 minutes after I emailed it, and he’s dropping a lot of F bombs and it all come down to “Did my guy do it or not?” And I said, “Yes.” He goes, “Just write that.” And I learned, I guess that’s what they want is “Did they do it?” Yeah, the technical goes in the back. Just give the answer upfront.

Desi: Yeah. So I think like we’re coming up to the hour now, but what is your feedback for people? Like you said, you get the question all the time about how do I get into DFIR, and my recommendation is I think some technical training, like your book. I recommend a lot to people even in the space that have been in a while. But what is the answer that you give to the people that reach out to you quite a lot?

Brett: You must be technical. You have to be technically proficient. You have to be able to do the actual technical work. And I’m not to rely on- not to bash a vendor training for a tool training, you have to have tool training, but you have to have exact training on “This is what the registry is, this is how you pull the-” you have to have that information first. The basics. You gotta have the basics, you have the fundamentals. And a lot of people wanna skip that.

There’s a lot of cert hunters where “I’m just gonna get the cert. I’m not going to even take notes in the class. I’m just gonna pass.” There’s so many classes you can take. You’ll get the cert ’cause you showed up and that doesn’t prove you learned anything. And you put it on a resume and it makes hiring bad because now you’re hiring someone who doesn’t really know what they got the cert for. Technically proficient is probably the number one thing. And then second is this part, the how do I work a case? And I know IR doesn’t really look at it like casework. “Hey, we have an incident.” It’s actually a case.

Desi: Yeah. You, the process…

Brett: Is the same. Here is our problem, right? What is our objective to solve this problem? What tools do we use to solve this problem? And how do we wrap it up? So we have to have that mindset of how do I work a case, right? And with the people, there’s someone who did it, a group did it, a person did it, whoever, accidentally or on purpose. You have to have that secondarily, but you have to have it.

And I think they’re both important because you can hire a technically proficient person, but it’s not gonna do the job. It’s “Oh, we keep getting these reports of data. Now we gotta look at what you did and figure out what it means.” You wanna have people who can do both. And I think you have to do both. And I don’t believe one is- you can be stronger in one than the other, obviously. But if you can solve the problem, if you can have a law enforcement person who doesn’t have a computer science degree, but they can solve all these cases at a less technical level, but they solve ’em quicker, faster, cheaper, more accurate, then that’s great.

You can have a technical person who doesn’t have the law enforcement experience, but if they can jump in, ’cause they know where the data lives, they understand, they live and breathe it, like it’s almost born into a computer almost. And they can quickly get it that way. If you have those two, that’s all you need. It’s just that don’t skip these things.

If you think- I’ve talked to a lot of people who say “Oh I know enough how to investigate a case.” For me, there’s not any really investigative training for thinking. I’ve taken a lot of investigative training by title, like homicide training, homicide investigator, narcotics investigator. And almost all of ’em are checklists. I took a blood spatter class, right? And it’s “Here’s the ruler, here’s this and laser, and here’s what it means.” And I equate that to a tool vendor training where it says if you see a pop up, you click B, and then you’ll get your answer C.

That’s good technically, but what if it’s Z? Where’s my answer to that? We have to teach: if you don’t see that, well, you’re gonna have to use a strategy of thinking rather than tactical skill. So to get into it, I think you really have to have both. Start with the technical, because if you can’t- if you can’t pull a registry, it doesn’t matter how good you can investigate. But if you can pull a registry, you still have to know how to investigate. So don’t skip it. You gotta have it.

And don’t expect to be given- I can’t imagine an organization hiring somebody new and handing them an IR incident that could bankrupt the company or lose millions of dollars. That’s not gonna happen. Same with the criminal defense case. You got a guy facing murder, maybe he’s innocent, and you give it to somebody who doesn’t know technically- the guy might be convicted. You have to have both.

Si: Yeah. Yeah. I still worry, even when I get cases now, I’ve got 10 years experience. I’m like, “Do I know enough to do this?” It’s like that?

Brett: Yeah.

Si: I totally get that. And it’s the appropriate leveling of resource. But I think you said something very interesting, which is actually collaboration is a huge tool that we don’t leverage enough. Which is that, if you are in a position to be able to leverage an investigator and a technical expert and stick ’em together in a way that makes them work, I think that’s it. And I think that’s one of the great things about DF actually, is it’s the fantastically friendly and compliant community that we have, that people will step up and go, “Actually, you know what? I’ve seen this.” If you ask a question, people will say, “I’ve seen this before. This is where you need to go.” So yeah, I think there’s some really good things that can be taken away from that.

Desi: And you touched on there as being the fundamentals of the technical side, like of knowing a registry and stuff, and then on the investigative side. And that’s a really interesting point. ‘Cause when I think about IR, it does case management, I think in general, very poorly. And that would be a fundamental skill of that.

Could you think of – other than like setting up an appropriate case management system of like how you store the data and how you- when I think back to my IR days, like the amount of times that we weren’t probably storing the evidence just in case…

‘Cause I think some of those could have turned criminal and they would’ve come back and been like, “Hey can we get a more detailed report on this?” And we didn’t have images or that kind of thing. Like what other kind of fundamentals can you see on that side of the house that IR- and DF, I think DF probably has it down pat, but what are those that IR could think about?

Si: Yeah, I dunno. So I just think you guys are like, got it sorted. But maybe not.

Brett: One of my frustrations with IR work is- here’s a big difference with IR/DF. In digital forensics, you get what you get. It’s here’s the evidence. It is what it is. Maybe it’s corrupted. Maybe it’s all these different things, right? You get what you get.

With the IR world, before something happens, you can set up everything to collect whatever evidence you want, right? It’s like “We’re gonna set this up and if something happens, we know where the evidence is gonna be. We got these logs set up, we have all these things set up.” So then it becomes a forensic exam. Now we have perfect evidence because we designed the capture of the evidence of what we want.

The DF guys, it’s like a criminal case. It’s “This is the computer that was in the back of the trunk of a car, and that’s what we got.” And the IR side is “This is our system and we set up everything and we can capture what we want. We can ignore what we want.”

So if you’re looking at it like “Just in case something is gonna be criminal we might want to prepare a little bit,” right? So that makes DF guys really happy. If they’re coming in after the fact of an IR that becomes a case, a criminal case or a civil litigation where the DF comes in, they go, “Wow, this is nice. You guys have everything preserved, set up as if from the start you were prepared for this.”

And it’s “We weren’t really prepared. We were prepared for it, we’re hoping it didn’t happen, we got it.” But I’ve walked in where drives are being wiped on a legal case. And the IT guys were saying, they’re doing me a favor by cleaning everything. I’m going “No. That’s not a favor.” So I think having the ability to set up the evidence trap, I guess that’s what I would call that – a trap to catch evidence, I think is the neat thing in IR.

Si: I think there’s one stage more than that, that IR has over us, which is the opportunity for continual improvement. Because I was gonna say, I’ve worked in security, stuff happens all the time. Okay. You got hacked today. That’s great. You’ll deal with it. You’re gonna get hacked tomorrow. It may be one week, it may be three weeks, maybe three months, but it’s gonna happen again.

You know that you’ve got lessons learned from that, that you can take back and you can reply. We are not gonna get the same murder twice. Yeah. It just doesn’t happen. So you can’t go back and apply continual improvement and say, “Next time what I really want you to do is capture this.”

Desi: Yeah. I love how you guys have this perfect image of IR, and I had this perfect image of DF because, and I think maybe this is a lesson that people can take away because I’ve walked into cases where you’ve got this thousand plus endpoint network and you’re trying to track this adversary through the network and they’re like, “Don’t worry.

We collect all of our network logs and it’s everything there.” But then you realize they’ve got, I won’t name the vendor, but there’s- and probably all vendors do this anyway, but they’ve got a particular edge device that is collecting all these logs, but all it does is it collects the external IP and then it maps external IP to an internal IP and then puts that to the endpoint. But there’s no translation log because it’s not turned on by default.

So then you are like, “Okay, all of the logs are now useless.” ‘Cause they don’t know which end IP maps to the internal IP. ‘Cause they have no logs for the translation. And I guess that’s the lesson learned. And the lesson learned is if you want to set all that stuff up, probably run through a scenario of someone breaking into your network and going, “Hey, can we get- can I actually track this through the network?” But it is funny that we all have ideas that we’ve solved all our problems on the other side of the fence.

Si: But the moral of the story actually is that war gaming is good.

Desi: Yeah.

Si: Running through a test scenario which you’ve set up will start to highlight some of the areas where your procedures are weak. Not all of them. You will learn the particular areas that are weak the first time it’s used in anger. But genuinely, war gaming, trial runs, practice runs are very important.

Yeah. I think we have come to the top of the hour now and I just wanna say again Brett, it’s been an absolute pleasure talking to you. And again, huge fan. I have your books and I will continue to get your books because they are such good quality and good value and I recommend them as Desi does apparently. Which is fantastic news. Just to say to all of those who are listening today, thank you very much for listening to the Forensic Focus podcast. We really appreciate your custom, loyalty, I don’t know, pick a word, but coming and listening to us anyway because we thoroughly enjoy doing it.

We get to talk to people who we admire and have the opportunity to learn. And we hope that you pick up some things from this too. You can find the podcasts available on all good places that you can find podcasts, of which are a list. If you’ve ever listened to the podcast before, you will know I cannot remember or recall in any way, shape, or form, but probably include Spotify, iTunes, and other sources of stuff. We do have actually a YouTube channel.

Desi: You can actually get the list, I saw, from our website. So if you check out our website, I’m pretty sure the list is there so you can link out to everything from there.

Si: Brett’s books are available from all good booksellers, Amazon, etc. They are available in Kindle, I believe. If you do not wish to buy a paper copy, is that correct or am I talking out? Except for this one?

Brett: Yeah, except for this one, which is fair enough.

Si: But I would thoroughly recommend the paper copies. They are very high quality print and are definitely pocketable and carryable to a location of your choice to read on the beach, in the car, in the pub, whatever your preference is. Brett, thank you so much. Desi, a pleasure as always. And we will call this recording a recording. Thank you very much indeed.

Brett: Thanks.

Desi: Thanks everyone.

AI Unpacked: Magnet Forensics’ New Series On AI In DFIR

Register for AI Unpacked

The following transcript was generated by AI and may contain inaccuracies.

Si: Hello everyone and welcome to the Forensic Focus podcast. Today, we are delighted to be joined by Brandon Epstein from Magnet. Brandon is joining us from a hotel, so if you hear some weird noises in the background that’s the exciting life that he’s leading being somewhere at the moment. Is this a carryover from the Magnet conference or is this something else?

Brandon: Actually it’s funny. I was telling people I love the User Summit so much and I love Nashville so much, I just decided to stay and move here. We’re actually in the process of moving and we’re in a hotel waiting to move into a house right outside of Nashville here. It would be easier commute for the User Summit next year. But I’m still about 25 minutes south of Nashville right now.

Si: Wow. That’s really cool. Nashville being obviously one of the places that most of us outside of America have actually heard of. I’m very excited for you. That’s brilliant. And how did the User Summit go off this year?

Brandon: Awesome. Incredibly well, like every year. I think it’s actually one of my favorite events of the year, not just because they pay me to say that and they sign my paychecks, but really because it is such a unique event where the energy you find there is hard pressed to find at any other conference.

Just that mix of those working in the industry to provide the software solutions and the people actively using those solutions get everybody together in the same room. It’s so unique and the chance to share information both ways – from the product advisory councils that show up on Monday to provide information that drives product development as well as sharing user information or sharing tool development information, software information, and also tool agnostic things with the end user. It’s a fun week and then the nightlife’s okay.

Desi: That sounds like a massive undersell, but I get you want to highlight the conference. I always find personally like conferences are always fantastic, whether they’re vendor or not. I haven’t had the chance to go to the Magnet one yet, but I’m sure that I would love to one day and it sounds really fantastic.

But it’s always the networking, it’s the people that you get to meet in person because so much like us now, like we’re talking over Zoom. But when you’re in person you just get so much more benefit. I think that we neglect that some days and that’s really something that a lot of people are missing out on.

Brandon: I think the ability to get some great information during the day, and then I’ll just leave it at the fact of live music and a mechanical bull night really tries to draw people together. I remember giving a talk recently this year at the American Academy of Forensic Sciences to new grads and people first coming into the industry.

My advice aside from the normal is really never be the first one to bed. Always make those connections over a meal or just having a cup of coffee or a drink. You meet lifelong friends that you see maybe once, twice a year at a conference like this. But you also are able to just reach out with, “Hey, have you seen this artifact before?” Building that network really is so much of the importance of having these events.

Desi: Yeah, definitely. And the advice that I give is don’t sit in the lecture theater if you are doing one after the other. Get up, stretch your legs. But go grab snacks – that’s what I love about conferences as well. There’s always a stock snack table somewhere that you can go get.

If you walk up and you just stand next to someone, you’re like, “Oh, hey what do you do?” The opportunities that I’ve gotten from just randomly talking to someone at a snack table because we both love snacks, is phenomenal.

Si: Absolutely. Common shared interest. And that common shared interest is food. I love it. The last conference I was at, I was very well equipped with bacon sandwiches, so that was a very good thing. So anyway, Brandon you work for Magnet now. What’s your background that’s gotten you to this place in your life and moving to Nashville?

Brandon: My background really starts in February 2014. I was working as a major crimes detective in a municipal police department in New Brunswick, New Jersey where we started really seeing a lot more digital evidence and video evidence becoming more prevalent in our cases.

Being the junior guy in the unit, I was tasked with doing a lot of this work of acquiring and maintaining predominantly video evidence from CCTV and then working with it. I realized that we were really ill-equipped to deal with it at the time. So I went to the bosses and I said, “Hey, there’s gotta be a better way.”

I must’ve annoyed them enough. They said, “All right, go ahead and figure out a better way.” We ended up taking some forfeiture funds, which we had in the most ironic ways. I worked a recent case back then about pirated CDs and DVDs where a contract investigator for the recording industry brought to our attention the proliferation of pirated Mexican bachata music in downtown New Brunswick.

We seized a lot of cash, and we used that money to buy our very first video forensic system and me some training. To Desi’s point, I still remember meeting a fantastic gentleman there who’s unfortunately no longer with us from Sweden who traveled for the class, and him turning me onto an organization called LEVA, the Law Enforcement and Emergency Services Video Association.

He said, “If you want to get serious about it, go find some training” and that’s what I did. I dove headfirst into the LEVA training, going to all four LEVA levels, getting involved in mobile forensics, attending some mobile training. And this kind of ties right back to it – during one of those LEVA classes, another great guy named Gene Henderson who retired from Texas DPS many years ago.

We were sitting at dinner one night and he said, “You really should get involved in SWGDE (the Scientific Working Group on Digital Evidence).” I said, “I haven’t been doing it this long.” He said, “No, you have something to say. You should show up and let your voice be heard.”

He encouraged me based upon a shared love of food. It wasn’t just snacks – it was a full meal and maybe a couple beers too. But I started to get involved in SWGDE, furthering my network and meeting many great people there, including some professors from the National Center of Media Forensics (NCMF) at the University of Colorado, Denver.

At the time I had a high school education. I remember saying to them, “I’m gonna go back, finish up college. I had a few credits left, and I’m gonna be your student.” So I ended up going back, finishing up college, working on a master’s at University of Colorado, Denver, in the NCMF program.

My master’s thesis was looking at video file structure and how it changes through iOS device transmission. A few years earlier, another great friend and colleague of mine, Bert Lyons, had shown me some research he was working on regarding file structure.

I nodded and smiled and said, “Oh, that’s really interesting,” but I didn’t quite understand it until it came time for me to look at it. I called up Bert and I said, “Hey, was this what you were talking about?” And he said, “Yeah, we built a prototype around that, a tool around it, at the time it was called MedEx and asked if I wanted to use it for my research.”

I remember talking to him literally two days later saying, “You have no idea what you have here.” Bert’s background is in library information science, very steeped in the digital archival world, but doesn’t really have any connection to digital forensics and law enforcement.

I said, “Listen, this is gonna make an immediate impact on media authentication, ICAC cases, CAM investigations, ICE investigations – there’s a lot of good that could be done with this.” So we ended up talking more and eventually launched a commercial tool called Medex.

The three of us – myself, Bert Lyons, and Dan Fisher – were the founders of Medex Forensics, which was then acquired by Magnet in August of last year. That tool has now been rebranded as Magnet Verify. And that’s my path to Magnet.

What I work on now – they’re not gonna take my hands out of the media authentication space because I have too tight of a grip on there and I like it too much to leave it alone with my crazy product ideas. But I’m doing a lot more work with our Idea Lab and the AI team, bringing the exam review point and the forensic application of what can be done within AI.

I like to stay active. Especially with my role at SWGDE, I currently chair the organization and my viewpoints and ways I think that we can deploy AI responsibly and do it in a way that is demonstrably reliable for a specific purpose. That’s where my role fits in now at Magnet, aside from media authentication, taking on more of how we could effectively, responsibly and reliably deploy AI.

Desi: Are there any kind of developments, because we talk about the deployment of AI quite a lot, both from a tools perspective and use by criminals. From your perspective, is there anything that you can share at the moment of what you’re working on or what’s already out there with Magnet and your division?

Brandon: Just to be clear, we have a team of product developers and engineers. I’m not actually the one with my fingers touching the keyboard to write any kind of code. There’s a lot of things that were set in motion and a lot of great stuff that they’re doing beforehand, before my involvement.

I’m really like the traffic cop at the intersection that gives the information back from the field to our developers and then helps relay that information to the field to explain which direction we’re going and making sure that it’s doing so in a way that actually has purpose.

Within the most familiar tools that we look at within Magnet – within Axiom is the Copilot feature where we have some advanced search, some natural language search features across outputs from cell phone exams or computer forensic exams. Really creating those efficiencies for the investigator.

We’re gonna start seeing a lot more of that in the future in Magnet Review to be able to create those efficiencies. I think it’s important to contextualize that because there is a big need. AI could be a time saver in many ways, but I think it creates some efficiencies in investigative outputs because it will provide us information that we would typically use in an investigation.

Not necessarily something where it’s gonna result in a forensic examination or opinion. The things I just talked about, in Review and Axiom are more in investigative outputs. Within Verify, we’re deploying AI in a different way – not generative AI, but machine learning in a way that is used as evidence with demonstrated reliable, probabilistic output from a classifier.

It has the signed error rates that meets the evidentiary standards to be able to introduce AI or machine learning evidence in court.

Si: Is that in an adversarial concept to verify or to at least attempt to identify the products of other AIs? Are you using it in that capacity?

Brandon: Within Verify, it’s not necessarily just identifying AI generative material, though that’s the biggest concern right now. It’s more about creating context for the creation of media files, whether video or images. How is this file created? What encoders, what software is used? Is this original to a device that it was acquired from?

If not, what touched it? What did it pass through? The probabilistic output really is taking a combination of what we know about our patented method of file structure analysis, which is really deterministic. It’s like a fingerprint for video encoders.

That gets you down to maybe 20 different encoders. If we want to look at which one is most similar, that’s where the probabilistic results come in. It differs from what we’re doing in Axiom because in Axiom it’s that investigative output.

Let’s say I ask Copilot in Axiom, “Can you tell me if there’s any evidence of drug use on this phone?” That’s really an investigative lead that somebody’s gonna look and review and use to say, “All right, I need to talk to this person, or I need to charge this person.”

The AI didn’t really give me the results. The AI told me where to go look for the actual data, and I read the data itself. I didn’t just look at the AI telling me that John Smith is dealing drugs. AI said, “Hey, there are some text messages here that are indicative of drug dealing.”

It gives me a citation to it, and I went and read those text messages. The AI isn’t telling me what it says, I’m reading it the same as I would without it. Where in Verify it’s providing that output saying that this unknown file is, out of all the 125,000 plus files in a reference library, most similar to Runway Gen 3 synthetic encoding.

That pushes past what a human is capable of, which I think is unique to that product, to that approach. And we do so in a way that we can discuss what the error rate is, how we articulate that probabilistic output and effectively use it in court.

That’s what’s missing in a lot of AI applications. I think the forensic community has done a good job of deploying probabilistic results from AI output. But I think a lot of people think AI results and they immediately think ChatGPT or other similar tools that aren’t necessarily built for that forensic approach.

It’s probably not the best idea to dump a spreadsheet or a list of cell sites into ChatGPT and have it map this out.

Desi: You mean we can’t get Midjourney to create a sketch of the suspect if we don’t know who they are?

Brandon: Yeah, that’s right!

Desi: I see you’re about to give a webinar series on “AI Unpacked” with Magnet. That looks like it starts on April 16th, and then there’s two more follow-ups on May 14th and June 18th. Maybe you could give us a rundown of what you’re going to be covering.

Brandon: I’m really excited about this webinar series because everybody’s interested in AI and how it works and how they could use it in their work, or should they use it in their work. There’s a lot of opinions out there and I think the goal is not necessarily to say should you or shouldn’t you, but to allow you to make informed decisions by providing good, responsible, reliable information.

That’s the goal of “AI Unpacked” in that webinar series. We have six planned for this season, at minimum. It really starts with that first episode that airs on April 16th. Those that were at the User Summit a couple weeks ago actually got a sneak peek of this.

I participated in Magnet’s product advisory councils Monday morning, gave this talk Monday afternoon, and I heard these really sharp, fantastic examiners talking about these concepts of AI. As a forensic examiner (and I get in trouble using the term interchangeably – “we” as forensic examiners, “we” as Magnet Forensics, so I’m trying to differentiate) – these great forensic examiners were talking about concepts which are not foreign within the AI world.

The only reason I know about them is because I’ve been working in the space for a bit and have had to learn them. Later that day I could say, “What we were talking about just then, this is the concept, this is what it’s called, and this is how it’s defined.”

Just trying to build that knowledge base of what the underlying methodologies are in AI and how it’s applied to digital forensics. So that’s really what episode one is – just that introduction. Let’s go over definitions, let’s go over basic concepts of how we evaluate.

I keep going back to probabilistic outputs. I think it’s probably the best way to describe what we talk about when we talk about AI outputs. It’s not an absolute certainty. It’s not like “I found this artifact at this specific file path location.” This is a probability of what this result is.

Even on the investigative side, did this person talk about drug use? The responses aren’t absolute certainties. With some degree of certainty this person probably talked about drug use, but it’s incumbent upon the actual examiner to go and look at that.

That’s really what we’re talking about in that first episode – to define what we have to understand about AI to then make informed decisions about it. We’re going to build on that from there.

The other two episodes that are up on the website right now are really diving into the guiding principles of AI development within Magnet. I want to put that right up front because I think it resonates with our user base that we’re not doing this just to do it. It is very transformational.

I said this at the User Summit in 2024 when AI was really becoming popular – this is a tremendously interesting time for us in digital forensics, both in terms of what we could do with software and what we have to analyze based upon this new technology. It really is transformational.

But I want to highlight the steps that we take as a software developer and really say, this is the thought process that goes into what we should develop, how it gets developed, how we do it reliably, and how we approach that. It’s a written guiding principles document that they take very seriously.

It wasn’t developed overnight. If you’ve ever looked at a document that has a lot of changes in a shared drive, it looks like a multicolor rainbow of words.

Desi: Takes five minutes to open because it’s loading all the comments.

Brandon: Yeah, exactly! Let’s start slow, let’s hide all changes and ease into this a little bit.

And then the third one that’s on there right now, which I think is probably the most interesting to people, is really the intersection of AI and the law. How do we responsibly implement this in our workflows? At the end of the day, we are all forensic examiners.

When it comes time to use this as part of an exam, what is the appropriate use for AI in our investigations and examinations to demonstrate reliability for court? And when do we say that it’s not appropriate for that? It’s not all things in all ways.

Si: Pulling you away from Magnet for a second, I’m sure SWGDE is doing something particularly interesting in that regard, being a fairly definitive source for the industry as a whole in the US and quite influential in the UK as well. We take SWGDE documents and correct the Zs to Ss and change some of the spelling around. But apart from that they’re really good. Where’s SWGDE sitting on the AI front at the moment?

Brandon: Great question. Our next meeting will be in May. In January of this past year, we stood up an ad hoc committee specifically to address AI. There was a tremendous amount of work done in the January meeting.

I couldn’t be more thrilled about where this document’s going on the initial use of AI within digital forensics. It will provide that resource not only to the digital forensics community, but for manufacturers to say this is what the community needs in order to demonstrate reliability in what you’re providing to us.

That’s very much in the works. I don’t know if it will be out for public comment at the end of May. I feel more confident that it will be out for public comment at least by the end of the September meeting. To get consensus-based documents created in six to nine months is actually a pretty quick process.

Desi: For our listeners that don’t know the acronym SWGDE, I had to look that up myself – Scientific Working Group on Digital Evidence. Maybe you could give a quick background on what that is for non-digital forensics people.

Brandon: I apologize. I should have led with that. The Scientific Working Group on Digital Evidence is a standards development organization that sets best practices and standards for how things should be done in digital forensics.

Whether it’s how to acquire media from a cell phone, or best practice for image authentication, or best practice for audio enhancement – it covers basic computer forensics, cell phone forensics, cell site analysis, forensic photography, audio forensics, video forensics, and provides solid reference material.

The importance of it is that it’s consensus-based. It’s not one person saying, “This is the way it should be done.” It’s a group of people that write the document together. That document goes out for public comment, and the result is really strong reference material that has been influenced by a wide range of practitioners.

Both public and private sector, academia, attorneys – the private sector plays an important part in providing that information for the community. That’s essentially what SWGDE does.

Desi: For our listeners as well, Brandon’s the chair of that and they have about 80 member organizations ranging from government agencies to private organizations like Magnet Forensics, Cellebrite – everyone coming together to help provide those standards.

Brandon: Exactly. It helps drive how examinations should be handled, how an investigation should be handled. It also provides great feedback to the tool developers. We can see that recently through a document that involves acquisition as preservation where you see two of the most major cell phone tool manufacturers developing methods to provide examiners ways to rapidly acquire or preserve data.

We know data can change rapidly on cell phones, and that feedback is directly related to what was published from SWGDE.

Desi: Fantastic. We’ll post the links in the show notes along with the webinar and everything else. I can already see there are some awesome resources you can go and grab straight from there.

Si: It’s fascinating actually. I came across SWGDE through LEVA the same way as you did. I did all four courses in one year because we’re insane. There’s no sane way of going about doing that! But I got hold of SWGDE through that.

It was very fascinating to see how, because I’ve been doing digital forensics and computer forensics for a very long time before I started doing video forensics. I went and got all the video forensic training because LEVA obviously teaches to it and works with SWGDE.

But then looking at the digital standards for computers, I realized what a wonderful baseline it is for best practice. What we have here are the ACPO guidelines, the Association of Chief Police Officers, for handling digital evidence. It was all very similar – it’s best practice, but it’s so well documented, so well written, and updated frequently.

As you say, there’s lots of input to it. You send these things out for comments, and it’s not closed. It’s open to anybody who wants to comment, whether you’re in the UK, whether you’re a member. If you are capable of inputting to it, you can. I think that’s a wonderful way to approach it. It gets us to the best place.

Brandon: Obviously I’m a true believer in the power of it. I started out in my digital forensics journey as a one-person lab in a municipal police department in an urban area in central New Jersey. I didn’t have a ton of resources.

I read the documents to say, “All right, how should I be doing this? Do I have to develop a policy? How do I develop that policy?” Then, starting to go to those meetings, I met lifelong friends that I still talk to on an almost daily basis.

The organization as a whole I think is one of the greatest aspects of the digital forensics community. I might be biased, but I’m proud of the work we’re doing. About the comments you mentioned – we encourage those, and they don’t just come into the committee to be adjudicated.

Everybody looks forward to them, and every single one is discussed and sometimes debated to see how we can improve those documents. Every person that comments gets a response, such as “Thank you, we’ve improved this based on your feedback” or “We understand where you’re coming from, but the document already says this.”

Every comment gets addressed and logged. The submitter is notified – it doesn’t go into a black hole. You’ll get notified about how it all pans out.

Si: How is SWGDE funded as an organization?

Brandon: Good question. SWGDE historically was funded by some US federal government agencies that no longer do that. A few years ago, SWGDE became officially a 501(c)(3) charitable organization, a nonprofit.

Right now we have a couple different grants from NIST here in the US that provide some funding to operate the website as well as…

Si: Sorry, just before you go any further, NIST is the National Institute of Standards and Technology. We deal in acronyms!

Brandon: Yes, dollar to the acronym jar! The National Institute of Standards and Technology. NIST has a couple different grants that allow us to keep the website up as well as, most importantly, help pay for travel funding for small businesses, whether private or government, that can’t afford to send guests and members to the meetings.

Our SWGDE meetings are in person. We actually found that during COVID when we went virtual, productivity decreased, which was a bit of a surprise. But I understand it after seeing it – you can’t lock 8-10 people in a room and have them focus on something virtually.

If you’re in the office or appearing virtually, somebody’s always getting pulled out and then coming back in. Inherently you work on something and then somebody that’s stepped away for half an hour comes back and says, “Wait, I have an issue with that word three paragraphs ago,” and now we’re back to that, as opposed to everybody locking in and getting it done. It’s actually a much more efficient method.

We also have support from some great people in the private sector through sponsorships. Magnet Forensics is actually our platinum sponsor, long before I went to work there. It really was a phone call that I took from a colleague at Magnet on the way to the airport after we first decided to take on corporate sponsors.

It wasn’t a decision we entered into lightly. There are very rigid rules – there’s really no influence. There’s not much you get out of the sponsorship, aside from saying, “I want to support the work that’s being done.”

I said, “You’re going to get an email from our sponsorship committee saying that we’re accepting sponsorships.” The immediate response was, “What’s the top level sponsor you have? How much is it?” I told them, and they said, “Put us down for it. We’ll square this away next week.”

They were immediately on board, no questions asked, because they really believed in the work that’s going on there. It makes me feel warm and fuzzy that the industry is being supported that way.

Si: Our industry is very interesting. On the one hand, there are people like Magnet – and I’m not picking on Magnet in any sense – that are software vendors. That’s what you do. If you look at the way the industry works for other software vendors, the soonest they can get one over on their competitors and get an advantage and market share, the sooner it happens.

In forensics and in our industry, it seems to me that everybody, because we come into this with a desire for justice, a desire for the right things to happen, actually seems to be very willing to collaborate, work with each other and get stuff to happen. It’s a great place to be, a great place to work.

Brandon: 100%. The people that you meet here, whether it’s software vendors or others – that conversation I mentioned with Magnet wasn’t just Magnet, that was just the first conversation we had. The amount of software vendors that said, “We want to support this” – you can go to the website and look at the list, it’s pretty incredible.

Going out to events and conferences, some of my closest friends work in the software community, some work in the forensic examiner community. I’ve never met an industry where – and I’m not trying to sound cool by saying this – it’s a different vibe within the digital forensics community.

I’ve never met people that are more open and willing to help and willing to help elevate and help a lesser experienced examiner or investigator step up and improve their skillset and just openly share information than in digital forensics. It’s such a unique and great place to work.

Si: So on the Magnet front, we’ve talked about Magnet Verify. What else is going on? Magnet is a large vendor with many products. What else is coming up on the Magnet radar at the moment? Axiom, Automate, GrayKey of course – everybody loves GrayKey, if you can get a license for it, because that’s quite locked down, isn’t it?

Brandon: We have GrayKey for the private sector as well. That’s getting outside my area of expertise, aside from being a GrayKey user for many years as a forensic examiner. What I’m most excited about, aside from the AI development (because I have my hands in there), is how much crime we’ll solve and the accuracy we’ll get.

We’ll achieve things that we don’t even comprehend now with AI, which I think is going to be incredible. On the acquisition side, there are some pretty exciting things coming out soon from the folks on the GrayKey side of the house, as well as vehicle forensics and acquisition.

Coming from my MedEx background, we were developed as a SaaS platform, natively cloud-based to start with. There’s a desktop app as well, but starting to see our tools like Review that are cloud native or the ability to work in more of a platform approach where I could move data around without having to get it onto a thumb drive and move from one computer to the next.

Then leveraging a whole bunch of different analytics tools in one unified platform, which we’ve called Magnet ONE. Looking to the future, I don’t want to paint this rosy picture, but the sky’s the limit. You unlock yourself to do so many more things when you start looking at this holistic cloud platform approach.

If I have this data, I could start running any kind of analysis on there. A lot more becomes available because it’s just so easy to move that data around. This isn’t going to happen next week – it takes development time and it’s ever-changing technology.

But aside from the AI stuff, the platform aspect of being able to leverage that and deliver some really interesting data about media forensics or media investigations to the end user or directly to the investigator based upon that platform approach – there’s a lot of power to that.

Si: I think it’s a very interesting area. My background before I came to forensics was information security. Cloud was kicking off just about when I was firmly in information security, and we were looking so much at how we protect large amounts of data in the cloud.

I think it’s changed a great deal. The technology has changed a great deal, but also people have taken up private cloud. Large organizations have taken up private cloud much more, which gets rid of some of those fundamental issues we were facing. You can’t put police data onto Azure because that’s just a really bad idea.

But if police forces have their own secure data centers and are running things, then we can start to do some more interesting stuff. For me, it was always the instantaneous scalability of cloud. I’ve got this thing, I need it tomorrow, let’s give it 4,000 processors and 20 gigabytes of RAM and we can have that in an hour’s time.

It’s going to cost a small fortune, but if that’s what’s necessary, you can do it. That massively distributed concept of computing I thought was fantastic.

Brandon: As you’re saying that, I’m thinking to myself and putting my government hat back on – I can only imagine how long it would take to purchase a system that I needed, where I could just spin up something in the cloud.

The story I tell people about IT infrastructure in a government agency is, there were so many times that we would have to go back and start from scratch with a quote, because by the time we got approval to purchase, the thing we wanted was actually obsolete and no longer offered.

That’s how long it takes, whereas you can say, “I have this cloud system where I could spin up as many workers as I need” or this kind of unlimited aspect without having to procure hardware and maintain hardware. And living through more than one ransomware attack in a local government agency, I feel more secure about putting my data into Azure or AWS than in the server in the basement of the PD.

Si: My favorite procurement story is actually from when I used to work at Cancer Research in the UK. One of our researchers had figured out that he had a company credit card to let him spend up to 10 grand at a time.

Brandon: I like where this is going.

Si: And he discovered that a blade chassis cost 9,000 pounds and each blade cost 9,000 pounds. So he basically bought a chassis and bought the blades without getting any authority whatsoever, just in 9,000 pound increments, for something that worked out to about 120 grand’s worth of system at the end of the day.

There were occasionally ways and means around these things.

Desi: Mine was very similar. Being in the Air Force, we were trying to do what this cloud stuff is – have a centralized server to have the horsepower on the back end to do the investigations and then have the endpoints just give the results.

I remember submitting the paperwork for the purchase order and then also the sustainment immediately. My boss was like, “Why are you submitting the sustainment?” I said, “It’s going to take us about 18 months to get the purchase order fully approved up the chain.”

“So the sustainment needs to be signed off because it’s already going to be out of date by the time we purchase the hardware.” And being in government, you have to adhere to all the patching and security requirements. I said, “We don’t want a system that’s brand new that’s already failing to meet an audit.”

He just said, “Fair enough,” and signed off on the sustainment as well. That ended up working well, though I’m pretty sure it fell out of sustainment pretty quick, like most government things.

Brandon: I think that actually even along those same lines, the three of us sitting here could absolutely immediately see the benefits. If you put 20 examiners in a room or frontline people in a room, it’s immediately yes. I think it’s going to take some education on our executives and our administration and IT people to say this is really where it’s going. I think it’s getting easier and easier to get that adoption, but it’s still a challenge.

Si: We’re filtering people through now. We’re a relatively young industry still. So people who are in a position of authority now and have worked their way up, haven’t necessarily seen all of the technologies that have come since they left operational service.

That’s gradually becoming less and less of an issue as people retire out the top and people get promoted up and explaining this. And also even if they haven’t had operational experience of what we are asking for, they at least have the language for us to be able to go and talk to them about it.

I think it’s certainly something which is becoming more common that people understand and are able to deal with, but also I think there’s a wider recognition now that it’s actually important. I think before it was easy for a senior police officer to look and go “I’d much rather spend money on putting another guy on the street because that’s gonna solve more crime.”

As opposed to now going, “Actually, you know what, if I can go through this guy’s computer and pick up another 20 drug dealers, that’s going to solve more crime.” So that realization of the way that crime works, the way that our industry works and all of that, I think is starting to be a bit more sensible now. All we’ve got to do is persuade the government that this is money that is well spent and get them to give it to us to spend it in the first place.

But next stage, hopefully we get some politicians who know what we’re talking about soon as well.

Desi: I just remember having a few conversations around cloud computing and adding that into digital forensics, probably beginning of last year. I think now, not only is the education there from vendors and also at conferences and everything else, but there’s also the use cases now, which I think weren’t around before.

So now there’s the success stories that you can point to. It becomes easier to sell because you can articulate the risk through all the education, but then you can also say, “Here’s proof that there’s benefit and here’s how you’re gonna save money and here’s how it’s used in these cases.” I think that’s getting a lot easier to sell in that aspect.

I do remember we were even on the fence – we saw the value, but then we were like, “What’s the risk?” But now I think it’s very clear in 2025 just how valuable it is.

Brandon: Yeah. I think you made a good point with conferences. I think you’re hard pressed to find a conference program nowadays in the digital forensic space where the description of the talk doesn’t involve something about AI or the cloud.

Si: Yeah, definitely. I’m thinking of the two conferences I’ve been to in the last month, and both of them had AI talks. One didn’t have a cloud talk, but the other one definitely did. That was about centralized media and CCTV media stuff, so you’re definitely right about that.

I’m going to say another interesting acquisition that Magnet has picked up relatively recently is DVR Examiner, which has been renamed to Magnet Witness. How’s that coming along?

Brandon: DVR Examiner actually is still an offering and it has evolved into Magnet Witness. I think it goes back to your background – if you ask any law enforcement executive: how often does digital evidence play a role in criminal investigation? And it’s going to be almost every case.

And of that, how much does visual media play a role in that investigation? It’s going to be almost every case. I think we’ve gone through the life cycle of originally the CSI effect, where it’s “Where’s the fingerprints?” And then we saw the OJ trial and now “I want to see the DNA.” And now we’ve migrated to “Show me what happened on video” because it’s so proliferated, it’s everywhere.

And it’s just the expectations. We live this life with so much surveillance video to actually be able to use that in our investigation. So that’s really where the DVR Examiner and Witness come in, not only for acquisition and initial analysis to be able to acquire large amounts of data and sort through large amounts of video data.

Then Witness allows you to look at that from a more individual file approach and to be able to convert and concatenate and trim files for use. A lot of the work that we do within video forensics is not really that forensic at all. It’s a lot more just processing and technician level of “Hey, I need to get this clip out for BOLO (Be On the Look Out) or to share this amongst investigators.”

Later in my career, a lot of work that I did was to prepare exhibits and demonstratives for trial. How do I take four hours worth of video and make it into a succinct five minute presentation that somebody that’s unfamiliar with an area can understand? And that’s really where Witness comes in, especially dealing with doorbell cameras with Ring, Arlo, Nest to be able to acquire those.

As we start seeing more of those, the missing piece of that – and I’ll mention this because it’s the product I’m most tied to – is Verify, which is really about proving authenticity. It goes hand in hand with that. You’re hard pressed to find a case now where we’re not seeing a concern or claim that a video file or image is a deepfake or synthetic.

How do we prove that authenticity? That’s why we need tools like Verify to be able to look at and deterministically, quantifiably say that we’re not taking a guess at it. We’re not looking at heavy signal processing to do it – we’re at scale, really rapidly using video as a data object or image as a data object, or an audio file as a data object to be able to say, “All right, this is an original recording as it’s claimed to be” and demonstrating that.

One of the things that shocked me along the way during product development is the need to demonstrate with an independent tool that video acquired by law enforcement or by the police has actually not been changed, because the officer’s word or that chain of custody is not held to the same weight that it used to.

We see agents that really need to take that step to authenticate and show that video has been unedited or unaltered, or is that camera original. That acquisition piece of DVR Examiner, the processing through Witness or the authentication from Verify is only going to be more important. I think Magnet sees a need with that and is really focusing on that media stack of products.

Si: Yeah. We are seeing a slightly different problem in the UK, or I’m sure that what you’re saying is still a problem here, but one of the issues that I’ve seen time and time again is victim self-submitting evidence.

Of course, the defendant is sitting there going, “Of course it’s a biased opinion. They’ve just accused me of something. They’ve handed this over. It’s clearly been tampered with.” And then we’ve got to unpick that, which is a thing. But the prevalence of the technology and the fact that we all carry a mobile phone camera filming everything – and then the police just go, “Oh, send it to me” – and we end up with it as evidence becomes a much harder proposition to address.

Brandon: And that’s where Verify actually really shines, especially as we start sending things through public evidence submission portals. The videos have been transcoded or images have been transcoded and metadata has changed.

Even without that, how do I know that victim-created video that’s five minutes long hasn’t been trimmed from a seven minute video? The metadata isn’t going to tell me when it comes from a submission portal because the metadata’s new. Verify, because of our unique approach, will absolutely discern and be able to say, “Is that original to that iPhone 13? Or has that been trimmed on that iPhone 13 prior to submission?”

Which is the all-important question, especially when you start talking about domestic violence issues or assault complaints where we’re relying so much on that cell phone-created evidence. Do I have the whole story? And how do I articulate that I have the whole story? That’s really where that file structure analysis in Verify really shines.

Desi: I’m not sure whether you’ve come across this at all – and this is just from my own personal interest – but any cases involving any of the new smart glasses and the video recording features on them?

From what I understand, I think the Meta ones stream from the glasses straight to your phone and then I assume straight through the app into some kind of draft format for Instagram.

Brandon: You know what, Desi, I think that you just gave me a note as the next project for our platform and engineers to look at. We have not looked at the glasses yet, but that’s a super cool research project. We typically try to identify based upon user feedback where we need to go next.

Recently we added WeChat, or stuff that might not be so prevalent here in the States, but we have partners across the globe that are able to access that. Or the newest iPhone comes out, or we need to look at drones, or whatever it may be. But glasses would be a good one.

Desi: I was watching a YouTube video with this ex-con who now cooks and travels the world and does a vlog series on YouTube and helps people try and stay out of prison through his motivational talking. One of the episodes he was using the glasses and the series was walking through the most dangerous neighborhoods in the world.

But he was using the Meta glasses to film a lot of it. I can imagine criminals just filming their cash hauls that they get. I can imagine them buying a pair of Meta glasses and then doing the same thing.

Si: You are being very civilized about this. We all know what it’s going to be used for, don’t we? Being able to have your hands free clearly leads it open to various other uses.

Strangely, I actually came across my first pair of smart glasses in the wild the other day, literally a couple of weeks ago. Somebody had a pair of the RayBan ones, and they loved them. They thought they were brilliant and really useful.

So they were getting a lot of time out of them. It was really interesting to hear. And also they weren’t as obvious as I thought they would be. It was only when I was standing talking to him face to face for some time and I went, “Hang on, are those smart glasses?” And he said, “Yeah, they are.” Otherwise, I’d been around him all day and I hadn’t noticed. It wasn’t something obvious.

Brandon: I’ve seen a couple in the wild. I’ve never had anybody that has had to acquire data directly from the glasses. Probably you get it off the phone, but I was also reminded of when the Z Flip phone first came out.

I remember saying, “I’ll never see one of those in real life. Nobody’s ever gonna buy it.” And I swear a week after that came out, one came into the lab for an exam. I was like, “Wow, it took somebody really long to have some criminality with this new Z Flip.” And naturally everybody wants to come over and look and fold the thing.

Si: I was similar to you. I thought these folding phones would never take off. My PT has one and it’s fine if he’s got it. And then they became commonplace. It’s just a thing that is out there now. Technology moves on and it never ceases to amaze me the things that get uptake. I never thought Alexa was gonna take off particularly, but there you go. What do I know?

This is a fantastic opportunity to sit here and go something like “Alexa play the Forensic Focus podcast” and then watch a bunch of people scramble for their phones at the moment.

Desi: Siri’s gonna be so mad at you, Si though. Because she’ll be like, “Who?”

Si: I have all of this stuff turned off because I’m a Luddite. I’d be the one throwing the spanners into the looms in the spinning machines. That’s me. I just grasp the technology enough to use it and then somebody brings something new out. I just want them to stay still for five minutes so I can have a bit of a break.

Desi: So we’re at the top of the hour now and we really appreciate you coming on and having a chat with us. We generally like to just check in with people to see what they do outside of their job at the end of the episode. So what do you do to unwind and enjoy your time?

Brandon: Right now it’s full-on moving mode. We’re all in boxes, but outside of that I do like to get outdoors as much as possible. A lot of the time right now is spent with my 10-year-old daughter who’s playing a lot of softball.

So it’s nice to get out and be able to watch her play and watch a whole bunch of kids really try hard. Youth sports is always a nice afternoon. So between boxes and softball, that occupies a lot of the time right now. I think there’s gonna be a lot of Home Depot trips in the future, but I’ll relax one of these days.

Si: Moving is always an experience from my previous times of having done it. I wish you the very best of luck and I hope it goes smoothly. Enjoy your new home in Nashville. Wow. That’s pretty cool. It’s on my list of places to go. I’ll be giving you a ring at some point when I drop by.

Brandon: No time like a Magnet User Summit to get back to Nashville. I’ll grab the grill, pull the grill out, and have everybody over at the house. It’s hard to pull you away from downtown when you’re right downtown for the User Summit. You’re not gonna wanna travel a lot, 25 minutes out into the country, but…

Si: 20-25 minutes, that’s nothing there. There seems to be a strange disconnect because my understanding of the US is it’s huge and people are like, “Oh yeah, I’m jumping in the car to go to the shop. It’s four hours away.”

And Desi is much the same actually being in Australia, which is vast. It’s “I’m popping to see my mate. It’s a six hour round trip.” For me, I live in reasonably rural Oxford here in England, and it’s still only half an hour for me to get to Oxford from where I live. I don’t consider that a long way, particularly especially if the traffic’s bad, then it can be considerably longer. But 25 minutes for a barbecue? No, I’m down. That’s not an issue for me. That’s a short trip.

Desi: Especially considering how far we’d both be flying to get there.

Si: Oh yeah, that additional 20 miles? Minor detail, that’s a deal breaker. Thanks Brandon. It has been an absolute blast. I’ve really enjoyed this and it’s been fantastic to hear about the new things that Magnet is doing and talk to you about it all. It’s really exciting. And I’m so happy for you to be moving to somewhere new and exciting. That’s brilliant. I’ll let Desi wrap up because I screw it up every time.

Desi: For all our listeners, anything that we’ve talked about, we’ll put in the show notes and there’s some links down there. We’ll grab anything else from Brandon and his team if they want to add anything else. There’s a transcript available from our website. And from the website you can grab the video, the audio, or see all of the platforms that we host our podcast on – Apple Music, Google Podcasts, any way that you can find us.

We also post it on YouTube as well. So there’s plenty of places that you can listen and watch from. But as always, thanks everyone for joining us this week and thanks so much Brandon, for coming and talking to us.

Brandon: Thank you so much for doing this. It’s awesome. Had a blast.

Desi: Cool. Cheers. Catch ya.

Si: Cheers.

Rob Fried’s Award-Winning Approach To Digital Forensics

The following transcript was generated by AI and may contain inaccuracies.

Si: Hello everyone and welcome again to the Forensic Focus podcast. We have back with us our good friend Robert Fried who, as far as I can tell, doesn’t have any time in his day to sleep because he keeps generating content, he keeps winning awards, he keeps posting fascinating things on LinkedIn. So I guess the opening question is: do you actually sleep?

Rob: Given we were chatting this morning, probably at about four o’clock, that’s up for interpretation. But I do have three young kids at home, and I guess being able to close my eyes and have a little bit of silence around me is sometimes when I do my best work. So, I guess that all depends on the day and the situation.

Si: Fair enough. We haven’t spoken to you – I didn’t actually look it up before we came on, but it must be a year or so now.

Desi: Yeah.

Si: Since we last spoke. And since then you have – and this was the one that impressed me the most – and obviously you’ve got another book.

Desi: Yeah.

Si: Which we’ll talk about in a minute, but I saw on LinkedIn that you are the top professional investigator of last year.

Desi: Yes.

Si: That’s a heck of an achievement to pull off in what is probably a fairly saturated market in the US, I would have thought. How’s that come about and how do you feel about it? Tell us a bit more. And did they give you a cash prize?

Rob: No cash prize. Everything I do and everything I write is voluntary, actually. And it all came about just through contributions. I think being present is key in a lot of the things that happen in any industry. When there are activities and opportunities to sponsor events and be part of an event, I make an effort to be active there.

So I belong to Aldanese and to SPI. These are two organizations in the private investigators world that encompass membership of both private sector and also law enforcement individuals because it’s professional investigators. I’ve actively spoken at meetings, I share content, I make myself available, and I guess those types of rapport with my colleagues, with fellow members of these organizations, have allowed me to transcend from just a regular PI into somebody who’s sought after in these particular organizations.

So I help whomever wants to chat and see what we can do together to collaborate.

Si: That’s fantastic. And in an industry – it’s odd, but in an industry like ours, we see so much antagonism between the prosecution and defense and things like that. But actually, the reality of it is that the more we all help each other, the better the industry gets and the closer we get to solving crimes and improving justice and things like that. I think that’s wonderful.

Rob: And the landscape has changed. For example, I entered into the industry in about 2002 and navigating that had its own nuances and things like that, but it was relatively straightforward.

Now you have a new generation of examiners. I go to conferences and I feel like the old guy. I’m not too old, but I feel like the old guy because when you talk about the war stories and who you’ve crossed paths with, people don’t know some of these individuals. But they’re the guys that were writing the books with the NIJ, National Institute of Justice.

They were breaking down a lot of the concepts and procedures that we followed, especially when I was training law enforcement. Now it’s just a matter of how I can give back in the amount of time that I have. Then just last month I was over at my alma mater teaching law enforcement for a week with the Henry Lee Institute where I’m a fellow, and that was very rewarding for both the students and myself.

I had to lecture for about 40 hours – my voice was shot and I’m sure they got tired of hearing me talk, but it was a very rewarding experience to give back and to help the next generation of not only just examiners, but law enforcement too. Our industry transcends so many different skill sets and needs that you just meet everybody from all different walks of life and all different roles and professions.

Si: I think it’s an interesting statement of the way the world is now. It used to be that you would have your separate digital forensic examiners and you would have your crime scene guys, and they’d pick up a computer and they’d bring it over to the digital guys. But actually, everything is so integrated now, digital teams on the ground are much more necessary.

I’d like to say they’re more common. I think they are in the UK. I don’t know how it is elsewhere in the world, but I think that initial triage, that initial arriving with somebody who is digitally – maybe not technically deeply, but certainly digitally aware – is vital now, because otherwise you’re going to walk out of a room with 50 percent of the evidence missing.

Rob: And I will say that although this new generation has grown up with the technology, they’re more savvy. You have to bring them in a bit because that makes you more comfortable interacting with the technology, but you have to say, “Hold on one second, let’s think through this” and prepare yourself and not just be overly confident, because there are steps that you need to take consistently and just make sure everything is documented.

The one book that I usually give out is “If it’s not documented, it didn’t happen,” and you know that’s the key in all the things that we do. No matter what I talk about, it always goes back to that because the technology may not be there for every scenario. So we document, we know what we go back to.

Si: Yeah, there’s a phrase which is “familiarity breeds contempt,” and I’ve certainly come across it in a number of cases. And also, you see it on television, which really doesn’t help – the guy will walk into the crime scene, pick up the phone, scroll through it, and you’re like, “Oh my gosh, please don’t.”

I’ve actually done cases where it was a harassment case and the examining officer, not forensically trained, picks up her phone and then phoned the person who was being harassed from it accidentally. And you’re like, “Oh dear.” It’s a terrible breach of everything. So yeah, it is that getting that awareness and that balance is definitely a challenge.

I was flicking through the new book, because I guess that’s something that you’ve just put out – the Forensics Data Collection 2.0. And I missed 1.0, but reading through it, it definitely seems like it’s aimed at law enforcement or students to just get them into it or what to think about to go out to forensic collectors. My favorite one that I’ve read so far is the one on Alexa.

Desi: Oh yeah.

Si: So I guess from your perspective, was that the motivation to write the book? To give that insight just to law enforcement who aren’t directly involved with all the technologies?

Rob: That’s a great question. I wrote this because I saw a gap. I went to school for forensics and at the time, in 1999-2000, nobody was teaching you what you’re going to encounter when you go out to the workforce. I only got into the private sector side of things because I saw the law enforcement side, and I wasn’t sure if I’d ever get to move back to Long Island.

I was working in West Virginia, of all places, and I said, “I want to get back home to New York. How do I do this?” And then I started to see there were some opportunities to go into the private sector. But the challenge when I started doing consulting and going in and answering questions was that I had the knowledge base because I had always been exposed to law enforcement through my first job, but also in school. We had practitioners and residents who were crime lab directors, who were former detectives who were retired or active.

So I just wanted to really address that knowledge gap so the next generation of students had an understanding as to what they’re really going to encounter when they go and work at an organization or an agency, and all the things that you need to put into perspective because you have to apply your knowledge to scenarios or concepts. And I wanted to say, “Hey, if you came across an Alexa, or if you came across an Android, how do you address this stuff? Where’s the data?”

And it’s so funny because I’m not even ready to write about AI because there are so many questions rather than answers to this thing.

Desi: Yeah.

Rob: All the concepts that are covered in my books, either in cloud storage or databases or being able to acquire from devices – it all relates to how we’re going to address AI. It’s the same concepts, but I can come up with a list of 50 questions and only be able to answer a very small portion of them right now, just because of the evolving nature of all the different models out there and how people are going to encounter them, where the data is stored, how long it’s stored. It’s the same concepts, different data.

Si: It is quite fascinating because my background is computer science. I was a computer scientist and I studied AI before I got into all sorts of other weird and wonderful things. But actually, we forget that the principles of computing fundamentally were defined by Alan Turing in about 1948-49, with his paper on the computability of numbers.

Nothing’s changed since because it’s a mathematical fundamental basis. Yeah, we’ve speeded it up a bit and we’ve got some bigger bits of data, but actually the mathematical principles and what a computer is and what a computer does hasn’t changed. And I think this is one of the issues that we’re seeing with the wonderful buzzword of AI, which is fantastically non-descriptive and a complete lie.

If you turn it around and you say, “Actually, what we’re talking about is applied statistics,” people suddenly have to treat it as, “Okay, so you’ve got applied statistics, which is just maths, which is just computing.” How would we process this if it was a large financial system doing predictive stock market stuff? It’s exactly the same. It’s not actually doing anything fundamentally different to that. So yeah, to focus on the basics, to get the basics right, and the rest will come. It’s a bit Karate Kid, isn’t it? Wax on, wax off.

Rob: And I think that it’s only going to be one piece of that overall puzzle or equation that you need to solve. You may have damning evidence, but you also want to put that together in different ways. There’s not one case sometimes that only has one piece of evidence. If I’m looking at a document, I want that computer. I want the device where it was created, already thinking that there’s got to be some other data out there. There’s got to be something that is an artifact or some kind of residual type of information that also is associated with this to tie everything back.

The whole concept is to make it so that you can uniquely identify things, but also come up with a timeline of events. And again, that’s only one piece of a longer timeline. You want to look at somebody’s day activity, what got them to this point where they started to use an AI model to start typing in things. Then ultimately – is that cleared from their cache? Is it saved? How do we get access to it? Do we have credentials? Is it up on the screen?

All these things – like I said, between the three of us we can probably ramble off so many questions that we can come up with the next book, Forensics Data Collection 3.0.

Si: I look forward to collaborating with you on that, definitely. But I think it’s an interesting point. You hit the nail on the head there in what you’re saying – quite often we forget as technical people (or we shouldn’t forget, I’ve seen people forget, I try not to forget) that actually the technical part of it is possibly the smallest part of whatever the actual thing is. Because at the end of the day, someone has done something which has impacted on someone else, and you’re talking about people. You’re not talking about technology.

Until we have the day that the computer makes the decision on its own, which I sincerely hope never comes because it’ll decide that we’re not worth the effort and get rid of us all… you know, we’re actually interested in what people do because you can’t criminally prosecute a computer, yet we’re on that.

So what you said is tracking the movements of someone, what their day has been and all of this to put it together. And that’s where your conversations with law enforcement are really valuable. I see some issues in the way we teach digital forensics here in the UK, whereby they are deeply technical courses, and they’re fascinating, and they’re really good. But they forget that it actually has to come together to put evidence on the table that links an individual to something.

Rob: What I want to say to that point is, for the book that I wrote, the first one within the series is with a gentleman by the name of Ralph Friedman. He is the most decorated NYPD detective that’s on the records. One of the interesting things with him is he retired – he got hurt on the job and he retired – and there was no technology, really, when he was a police officer.

People would say, “You’re a tech guy. Why would you bring in this kind of concept? To talk to somebody who’s not a techie?” You talk to Ralph and everything’s in all caps. He’s like the epitome of the guy that gets it, he’s got his own way to do things. But it’s the human element in talking with him. And I’m not a law enforcement officer at all – I never went to the academy for auxiliary, I never was a cop – and you talk to him and he had the same level of respect that I gave him. He gave back to me because we were talking in parallel to our experiences.

“Hey, my career is all based on technology. Yours was walking the beat, getting people, doing your canvassing of neighborhoods, being able to get information out of people, not looking at cell phones – there weren’t any. How do you gather information?” And that’s really the point and the role of a detective – to gather information. How we do that is all dependent on our methods and things like that.

But the fundamental thing that most people still have to realize is that there’s still a notepad or still notes that every law enforcement officer has to abide by, that has their written word associated with that. Even now there’s apps that do that, but again, it goes back to the documentation piece.

And that’s where we said, no matter what you have as a kind of technology advancement, there’s always gonna be that human element to update it, to patch it, to do things like that. I always bring up AFIS (Automated Fingerprint Identification System) because I remember in school this was like a groundbreaking thing for me to learn about. I was like, “Wow.” But the thing is, there’s still an examiner matching up the minutia. They’re still looking with the human eye to make that judgment call.

No matter what it is, you can have all the forensic reports that you have, but you still need to tell your client, you still need to tell the prosecutor what you’re finding because you’re actually the one not only being tasked with analyzing it, but also interpreting it for them. That’s your skill set.

Let’s not forget about what that tool is showing you. And I also want to bring up the point of validation of these things. There’s going to be another examiner on the other side that you’ve got to speak to and they’re going to look at your documentation. There are so many cases now with rebuttals here that I’m working on where it’s more about documentation than the technical aspects of the case, believe it or not.

Si: Oh no, as an expert who often serves for the defense, if not usually serves for the defense, yeah, the failure to document, or the failure to do all of that, and the failure to understand what they’re doing – I find the rebuttals are significant.

Rob: Yeah, people… it’s a very emotional thing. People are willing to spend the money and invest the time, whether or not the courts want to invest the time is a different story. But it’s a very passionate thing for people when these types of challenges come up.

Is this actually the device? How can you tell that? How can you tie this back? To sign in to Desi’s computers, we look at it in several different ways. We look at their profiles, we look at their activity, we look at whether there are any accounts that are associated with it that put possession at some point in their hands, put them behind the keyboard, and that’s a big part of the work today.

But it’s also about the metadata. I wrote a very brief chapter on metadata because people don’t want to read so much today – they want information to extract it. You’re on a call, you want to learn about metadata five minutes before your call, read my chapter on metadata. I’m not going to bore you with all the binary file formats of Microsoft and how that all breaks down, because that’s going to be outdated with the next version of Windows in 2026.

Instead: what do you need to look at between application, file system? What does that tell you? How does that get modified? And what information can you bring to your case that you’re dealing with that may help you determine if this is an authentic document or if somebody modified it in some way?

Si: Yeah, absolutely. The pace of technology – it’s fascinating because on the one hand, we still have file systems that were invented 30 years ago that are still keeping the same metadata. On the other hand, Microsoft arbitrarily adds in another flipping thing whenever they feel like it with a Windows update.

So you’re right, it’s the fundamental principle of it. I think it’s a bit of a shame that the average attention span of people has decreased. I think there are two things: the amount of time people have available to spend on things, like you say – you’ve got five minutes before a meeting and it’s like “I need to know about this before I go in.” But also I think it’s the way that the internet has somewhat dumbed down our own ability to take in long-form content, which is a bit of a shame.

But the bottom line is that actually it leads to a more concise and information-dense writing style. And I think you’ve captured that perfectly with the way that you’ve done it, with good-sized chapters on a range of topics that have enough information in them to genuinely add value.

Rob: And when I’m writing things, I always think of the “what ifs,” right? I don’t just give you the scenario that’s in my head at that moment in time. These articles are really written over one or two days where I’m actually thinking about all the various scenarios that you may build upon, like a decision tree.

If not this, then that, or if this, you also should really start thinking about that, so that you’re taking down a path based on somebody’s experience, not just talking about a theoretical all the time. It’s like, how can I relate this back to reality? Hey, if you have somebody’s username and password right now, you’re going to need their two-factor authentication.

Or you’re going to need to ask about mobile device management because you’re going to get tripped up if you don’t. And that’s going to result in more time, more of a delay, all that stuff. Hey, if you’re not familiar with evidence management or evidence handling, that cell phone – one of the things that was eye-opening for me was we all have different levels of stress in our roles.

In the private sector, we may have deadlines. On the law enforcement side, that may be a little bit different. But one of the things that really resonated well with me was: “Hey, we get cases and sometimes these guys don’t go to trial two or three months down the road. I’ve got to keep that cell phone powered up at all times. I got to come in every day, make sure that stuff is good to go.”

That’s like in the back of people’s minds when they’re getting ready to go to bed or leaving for the weekend. There’s a constant concern, and that’s a really good thing, guys, because that shows that there is a conscientious person behind all this. If this was just a job to people, then it would be a different story. But in the investigative world, in the analysis world, we’re really getting into understanding, taking ownership of that case, being conscientious about all the impacts. And that’s what I’m trying to educate people on, right?

Kind of just thinking a little bit and taking this seriously, realizing that you may have to testify one day. Hey, you know what? You may be two or three levels deep in your team, but your name’s on there. And they may say, “I wanna go speak to Rob. Where’s Rob? Oh, he’s in Texas. Let’s fly him in. Let’s have a chat.”

Desi: Yeah, I am definitely like, reading some of the back end of the chapters as well. You’ve got the “remember” piece, and I think you touched on it with the human factor of all this. I guess investigation hasn’t changed since it went from no computers to now, but how do things get used? How is the human interacting and what’s the context you have behind the evidence?

From my opinion, it’s easy to teach people tools and how to pull data out and how to validate – that’s a hard skill that you can learn. It’s that investigative methodology and how to interpret and how to get to a point and go, “Oh, I’m gonna pivot here,” or “I need this piece of evidence.”

It’s good to see it in here, and I guess, talking to the detective, was that something you guys covered a lot in that first book, or something you guys just talked about?

Rob: No, we had some extensive discussions, and it was funny, because my name is Rob Fried, his name is Ralph Friedman. We had that camaraderie to kick it off. He actually invited me up to his house up in Connecticut with my kids – they always ask about him. It was such a great series of conversations – he calls me up for my birthday. This guy is legendary in the PD.

Just talking to him about this stuff, he was very giving of his time. And his war stories are pretty amazing – things that he needed to do – and it’s also being able to interact with people, knowing how to talk with people.

I wrote my last and most recent chapter on the skill sets of an examiner or a practitioner, because like we were saying when we opened up, there’s that technical piece, but then there’s the empathy piece. It’s knowing how to talk with people, right?

I could be the guy from New York coming in and saying, “Hey, I need your data, give me your data right now.” Or I can come in and say, “Hey, nice to meet you today. I really don’t want to take up a lot of your time. This is what we’re going to do. It’s going to be a couple of hours, let me help you through the process.”

Not give them so much information that it’s too much and they’re going to be like “Whoa.” But just understand that, hey, look, if I was in your shoes, I would probably be thinking about these things and let me bring some clarity for you. And if you have any questions, go speak to the lawyer, go speak to the supervising agent, whoever it is that you’re dealing with.

But understand that if you were in their shoes and somebody said, “Hey, I need to turn this over, I need you to cooperate with this,” it’s intimidating for anybody.

Desi: Yeah.

Rob: So the human element goes so far. If you stop yourself and say, “How can we all be successful today? I know you never want to see me again. I know I want to get out of here so that I’m not interrupting too much of your day. Let’s just work together.”

It’s a very difficult thing for someone to sometimes give over information, to give you access to their system. There are a lot of nuances, but being from New York helps a little bit. I’m not the guy that’s going to go knock on your door and be like, “Hey, I’m here to make it happen.” I’m going to say, “This is what’s going to happen and I hope you can help me out.”

Si: Yeah, it’s interesting because I couldn’t agree with you more – people skills. We think that digital forensics is about computers, but as we’ve said, it’s not, it’s about finding out about people. People skills are so important, everything from collecting evidence, but also standing up and giving evidence in court.

They do the courtroom skills courses about what to say and what not to say, but at the end of the day, what you’re actually trying to do is create a rapport with the 12 people sitting in the jury, so that they’re listening to what you’re saying as opposed to what the other guy is saying. It’s almost as if we need mandatory drama classes to help us enunciate better and to look people in the eye and stuff like this that really helps.

Rob: It goes even beyond that in the sense that it starts from the first interaction that you have with somebody, unless they’re a trusted repeat client or person that you’re dealing with. But it’s answering the call – it’s unbelievably satisfying to the person on the other side to say, “Hey, somebody picked up my call or responded to my email when I’m having an issue.”

Nobody’s calling us because it’s a beautiful, sunny day out, and let’s talk forensics. No, they’re calling us because there’s a job to do, there’s something to respond to, and it’s just the way that when you pick up that phone, and people are like, “You actually answered. You’re willing to travel for me on July 4th weekend to come take a trip.”

These are things that – you look at how you build a career and you build memories and experience. And it’s not always about answering the call, but it’s the opportunity that you have once you answer that call as well. You build rapport, you execute on the task, and that could be a client for life.

Si: Yeah, definitely. I mean, trust is a fascinating thing, isn’t it? Because it can be broken so easily and it takes so much to rebuild it afterwards. But actually when you’re given a blank slate to start with, you can do so much initially to create a good relationship, as long as you don’t screw it up. You’re in a fantastic role.

Rob: I’ve been taken to beautiful places over the years and they just said, “You’re in public, keep your mouth shut, you’re working on a very important case that’s all over the newspapers. Anything you say in relation, people will pick up on buzzwords, names.”

And if you respect that kind of information and you actively listen – rather than saying, “Hey, I’m in a beautiful place and I’m gonna just enjoy the moment” – yes, you want to do that, but you also have to realize that you’re on a mission to help somebody.

You’re being brought in from a long ways away sometimes, and you really have to respect the situation that they’re putting you in, and say, “Hey, this is a big responsibility.”

Even when I was training law enforcement, the fact that I was actually being taken from wherever I was in West Virginia to go fly around all over the United States to teach was a mission for me. It was like, what’s my job this week? It’s to give people that light bulb, the brightness to a light bulb that’s sitting out there right now, and just turning that on to activate people’s understanding of this stuff in certain ways.

You really have to understand that when you’re taken out of your comfort zone, so many great things can happen, but you got to pick up that first call and raise your hand.

So many times, I’m so impressed by the younger generation that really want to learn. They’re eager. And unfortunately, some of the tools are push-button in a way. But you sit down with them, you take the time, you develop those skill sets with them, and that will help you always want to be in a training position with somebody.

Shadowing is a big part of what I try to do with my team – give people the opportunity. “Hey, what are you interested in? What do you want to learn? Let’s get you on something just so you’re in the background, so at least you have that experience.” It goes a long way, even with building rapport with your teammates.

Si: I think it’s interesting that you say that the young people are so willing to learn. And I think you’re completely right. My children are older than yours but they’re not older than you. I’m taking your college dates and I’m thinking, yeah, you’re about my age, so that’s fine. But my kids are older than yours, I think. But yeah, they are so willing to teach as well.

I have discovered so much about technology that I would never have done by going to them and talking to them about some new application and they’re like, “Oh yeah, I know that. Yeah, we use that.” And I’m like, “How do you use that?” Because the way that it’s been designed is not the way that people actually use it. And to pick up on those things is just so fascinating.

Rob: And they approach it with a lot of hands-on. Even my son’s nine, he can work his way around and he’s telling me about shortcuts. I just know basic commands. But I think it’s great. Like I said, it’s a matter of kind of tempering that a little bit with the understanding that, “Hey, there’s an underlying concept or process that you really need to follow,” and documentation of that workflow, although it may change, is something that you still need to figure out.

“How can I repeat this so not only can I teach it to dad when dad comes by, but also be able to understand that the next time there’s a change, to identify that change and maybe start validating on their own? Hey, what does that do that’s different than was done before?” It’s natural progression.

Si: It is, and it’s fundamentally the basic scientific methodology of hypothesis, test, get your results, find out where you were wrong, try it again, vary… and also the other thing that I see so many people doing wrong – vary one variable at a time. Because people go in and they go, “Oh, I’ve done all this.” And then they go back and they change three things and it does something different. And I say, “So what changed it?” And they go, “I don’t know. One of these three things.”

Rob: A very good manager that I had, and now he’s a very good friend – somebody who, when we were doing comparisons, and I’ll give a shout out, Mike Weil, great friend – he basically said, “When you’re doing testing, use the same data cables. Everything is labeled down to a color so that you can identify, is this machine, is this set up working the same way it did last time?”

And that’s always stuck with me. It’s like you’re saying, change one variable at a time, get to the root of the source, document that so that you can go back and you can exactly relay that to your peers.

Even when we were doing some of the testing for the work that we did with the Tagos ballistic imagery, I did a whole write-up on it. We did everything to the T so that we figured out what was going to be the best scenario to run that tool based on the hub, the hard drive, the computer. Everything had to come together and align for us to say, “This is the best we can do at this moment in time in doing this testing.”

Desi: Yeah, I think that’s definitely a gap in not just digital forensics and all this stuff that we’re talking about, but that attention to detail with documentation and then applying the validation to your peers’ documentation.

Because we all have a lot of assumed knowledge in our head, and if you go into a process, you might miss five steps because to you that’s just like breathing air. And then I’ll come along and I’ll be like, “Oh, how did he get from C to D here? There’s a whole bunch of letters missing that I don’t understand.”

But yeah, I’ve seen that at countless organizations. There’s just, especially engineering documentation for one, but you read that and you’re just like, “How do they install this thing?” And they’re like, “Oh, you just needed this infrastructure set up in the background. I just have it running all the time.”

Rob: Yeah, it’s putting that in a way that you can teach the person. Like one of the guys that I was teaching at the Institute a few weeks ago, he said, “Look, I know nothing. I’m here. I need to be here. But I know I’m the guy that I’m lucky if I can get this machine turned on. Where’s the power button?”

And at the end of the day, you’re exactly right. It’s a science. Beyond the technology, you have to understand the science. And then once you understand and tap into the science, I am intimidated sometimes based on the scenario that we’re walking into, more so the emotions. Like I’ve walked in, there’s guns, people have guns in holsters. People are… companies are getting restructured, they’re getting laid off, bankruptcies, all this stuff.

That’s more of my focus right now, because I know at this point, no matter what anybody is going to throw at me, I’m going to start processing in my head like, “Okay, what’s the workflow?”

Desi: Right.

Rob: And you have to really be confident in the fact that you can take any technology, any situation and start thinking about how you can solve it. And you got to solve it fast because somebody will throw something at you: “Oh, what do we need to do? This is your one shot to do it.”

Step back, figure it out, however you do it. I do a lot of writing. Obviously, I try to figure out the game plan – everything I do starts off with outlines to just think through. But my goal in most anything that I’m doing is not only to preserve it and collect it, but it’s also to allow my other team members down the road to be able to use that information to do what they need to do to push it through the process.

But that’s… it starts off with the science. The science is: what steps are repeatable that I can do right now that I’m documenting for somebody else to come do that same thing at that moment in time and then put it through that same process.

Si: It’s fascinating because, obviously like you say, nobody ever calls us when it’s bright and sunny outside and things are going well. So you are walking into these scenarios where it’s high pressure, high stress. And the other thing we all know is that every scenario is completely different.

There is no… whatever you think this is going to be the same as, it’s not, it’s completely different. But having those fundamental processes and procedures documented and understood and knowing that they work in the way that they work is so liberating to allow you to think about what this scenario brings differently.

And Desi, obviously you’ll testify to this in incident response. You’ll have an incident response plan. 90 percent of it will work. The other 10 percent is complete rubbish and goes out the window because it’s not the same as the last time it was done. And yes, you’ll refine it the next time, and that’s the other thing – you’ve got to go out of whatever scenario you’ve gone into, figure out what didn’t work and reinsert it back into your learning and your process as you’re going through.

But yeah, documentation is so important and such a lost art form in so many places – in corporate industry in particular.

Rob: Just being able to find a forum right now that people are going to be comfortable talking about these challenges, right? If you say that you don’t know something or you’re not up to speed on it, it’s… you go on to some listservs. I really want to put that out there. Or you just phone a friend who I feel comfortable with.

So I’m trying to create a collaborative environment, a community right now. Because I’m posting stuff and that may go to so many different people, but I’m posting things now to people who are genuinely interested in talking about some of the things that we’re experiencing.

So what I’m doing every day now is I’m forcing myself to put out a poll of questions. Today’s question was, “Are you comfortable with cloud storage to store sensitive data out there?” And it’s just to get people thinking about things outside of the box so that we can all come together and be like, “Hey, there’s a lot of changes in our industry.”

Especially in the last 10 years, especially with the legal industry starting to pick up on this stuff as well. There’s just such a fast-paced need right now to continue to move forward, and all these providers out there – everybody’s in the same boat. They’re all trying to figure out what’s the next thing to bring to market. Who are the people that are going to be able to be our subject matter experts, our advisory board.

So I’m trying to bring together people that when we chat with each other, you can really engage and talk about topics that are difficult. The best one so far was, “What do you look for in software when you buy it?” A lot of people say training. Training is really important, and then kudos to the people that are saying that. Cost is one aspect of it. Features, you know, is another piece because you need those features. We’re the market, sometimes we’re the ones in the trenches. We’ve got to dictate a lot of that.

So people have different needs and responses and ways that they navigate this very, very interesting career path, and it’s stressful. It really is stressful, because it’s not a nine-to-five. That’s why I take the training, because it’s my alone time. And that’s where I write up a lot of this stuff.

But it’s trying to build a network of people that are in the same boat, that feel comfortable talking about topics that are really important today, to discuss with such a fast-paced landscape that we’re moving across together.

Si: Yeah, absolutely. I certainly saw the software poll. I don’t think I’ve seen the cloud one yet today, but…

Rob: Yeah, every day. And I’m going to be looking for additional admins and moderators to keep those polls going, because at the end of the day, it’s going to tell a really big picture of our community, of what people are facing – the challenges people are facing, the solutions.

And it’s really about giving people useful information, useful nuggets of information to address all the different types of data that we’re coming across and having it in a place. It’s not like a listserv, “Hey, I’m dealing with this phone right now.” It’s, “Are you dealing with this?” Even AI – as much as we talk about AI, not a lot of people are seeing it in their cases right now.

Si: I’m seeing more argument about whether or not we should be using it in the processing part of forensics than I am seeing it in any case yet. Although what I’ll tell you what I am seeing it as – I’m seeing it as a “Trojan defense,” what we used to call the Trojan defense, which was, “It wasn’t me, it was a virus.” It’s now, “It’s not me in that video, it’s a deepfake.” I’m seeing that crop up more often as a defense, which obviously clearly is a load of bullshit.

Rob: I’m seeing it like the fake images and the authentication. But again, that’s going back to the source. Where’s the source? Who put the person behind the keyboard that used that technology to build that out? And start talking about that timeline, that life cycle.

Desi: We’re seeing it in cases in corporate at the moment with people using it as an exfil vector. We’re seeing people – because if you’ve got a personal account, you can upload and then take data.

And then also people using it to create deepfakes. We’ve actually got an investigation write-up coming out. Someone created a deepfake voice audio, which was to try and do racial discrimination to get a better severance package on their way out.

So it’s understanding the technology and how it’s made to then go look for that. But it does come down to looking at the system and then going, “What was the human behind it doing? Where did this data actually come from?” rather than just taking it on face value of “This is a legitimate recording.” It’s like tracing it back.

Rob: And then where do people go? Are they going to go to the local police? Are they going to go to corporate compliance? Are they going to go look for a forensic examiner? And then who’s the forensic examiner that’s going to be confident enough to go take that to the next step? Because there’s so many… there’s a limited scope of tools out there right now and concepts of how to address it. But yeah, kudos. That’s an interesting case. That’s a good example.

Si: Because I guess if you’ve got the system then you’re falling back on traditional computer forensics then. Because you’re tracing the lineage of the file, rather than worrying about the file itself. If you can prove where it’s come from, then it’s less about what it actually is. But that’s part of your book as well, is like, collecting different sources of evidence to tell the story, not just relying on one piece and going with that.

Rob: That’s right. That’s right. And it’s people knowing to think a little bit outside the box. It’s like your job’s not done just because you processed this scene and took all these computers. Now you gotta sift through and see what else is out there.

That’s where we discover all the thumb drives, the email accounts, all the web searches, and then take that further. “Hey! You didn’t tell me about this other drive that was out there. Where is it?” “Oh, that was given back to the recycle company six months ago.” That’s a problem.

Desi: Yeah.

Rob: So there’s all these stories and it’s actually becoming more and more clear what the timeline is of things as you are able to use the dates and times. So many of my cases right now are associated with dates and times and timelines. That no matter what the technology is, we’re going to be able to bring it back to the fundamentals of forensics of being able to say, when was this put on this machine? What was done with it? Where could it have come from? What other accounts are out there?

And people need to know that we all know if you have one account, you may have – or one device, you may have data populated – it’s almost like POP reinvented, right? POP email, it gets downloaded to one machine, then it’s somewhere else. It’s the same thing that we’re thinking about in those days where people are sprinkling information all of the time.

Si: Yeah, that beautiful scenario – you do a seizure and there’s five old phones sitting in the drawer, each one has a snapshot of their phone usage at that point in time up until there, and it’s not deleted properly. Heavenly. Absolutely brilliant.

So yeah, I know exactly what you mean, but that… POP email is a concept. Oh, yeah.

Rob: It’s the same thing with these modern attachments, the hyperlinks in emails. I’m like, that’s no different than linked files. I keep saying that with everybody.

Si: I saw that you’re giving a talk on that. Is that… you either have done or are about to give a talk on that with Oxygen?

Rob: I have, I did one with Oxygen, I did one with Exterro, different kind of take on things. With Oxygen I was talking more about Oxygen Forensic. The other one for Exterro is talking about just in general, some of the concepts. And then I think I’m giving a shorter one coming up on just things to consider.

But this is like the big buzz in the e-discovery space right now, because you have to collect all the versions of the documents. But I keep saying that’s no different than the link files. Because you collect that folder, and now if there’s a shortcut in there, you didn’t go and get the shortcut. So this is… you have to review sometimes or figure out how you can triage.

But there’s always going to be these human element pieces that spot that. And you know, in a high-stakes situation when you only have one shot to get it, unless you have somebody boots on the ground that’s sifting through that stuff and exporting out the inventories, it’s going to be a very tough thing to find all the shortcut files and if you have access to all of them.

Si: Yeah, there’s… I’ve seen some interesting debate here at some higher levels of the justice system suggesting that the only way that we’re going to move forward in successfully addressing coming digital forensics problems is through automation. And you’re like, it’s not gonna work. It’s just not gonna work. You need to fund this properly, put people into it and things like that, but automation is not gonna solve your problems because it’s not simple, right?

Rob: And it also depends on that human interaction in the end, too. Are people deleting things? Are they moving things? Are permissions being changed? All this stuff that circumvents people’s ability to have unimpeded access. In a pristine world, everything is together and you can figure it all out. But that’s not the way.

And then, at the end of the day, you also have to make a judgment call. There used to be a time when we would collect data and there’d be locked files or files that we just couldn’t get. And do we want to keep hammering away at this, or do we want to move forward and keep knocking down the task list that we have that’s ever-growing?

So there are a lot of judgment calls. Like I said, I keep a very open mind, but I also am very level-headed with this stuff and say, make that judgment call. Do you need every version of the document? It really depends on the type of case. Some cases, absolutely. What are the expectations?

If you don’t communicate expectations, that’s just a big piece of success right now – keeping calm, cool, and collected, but also being able to communicate well and let people know really how long something may take. And that comes with a lot of experience, being able to feel confident in those decisions of giving people those time estimates, cost estimates, all that stuff.

It becomes more of an issue when you’re dealing with an actual crime scene, too. You don’t have that much time to get all this stuff collected. But kudos to a lot of the law enforcement recently on some of the bigger cases that we’ve had that hit the news, and the timing of everything – it’s just fascinating how quickly that mobile crime scene has become, where people are dealing with things on the fly. It’s become fascinating to watch.

Si: We’re coming to the top of the hour and I’ve actually got a whole bunch of other questions that I wanted to ask you. I’m gonna have to get… we’re gonna have to get you back again.

Rob: We’re friends, we can always…

Si: But let’s end on this question. On the back of the book, there are two quotes. One is from a guy called Frank Canova, who is the inventor of the first smartphone.

Rob: Yes.

Si: And then the other quote is from Neil Papworth, the guy who sent the first ever text message.

Rob: Yes.

Si: How on earth did you find these two people, and how do you know these two people to get them to review your book and give you a quote about it?

Rob: And the last two guys were Bob Kahan and Vince Cerf, who…

Si: Vince Cerf, of course. Yeah.

Rob: My brother’s an inventor and my brother interviewed people, the likes of Marty Cooper, and we have a sort of thing going on where I don’t interview as much, right? But it’s about finding people who can take information and kind of relate it, right?

So with the proliferation of mobile evidence these days, people don’t even think about how this technology came to be, and to start questioning – did these guys that actually thought about this stuff, did they think about how ingrained in our daily life this stuff would be?

No, they were developing it to fulfill a need. My brother always said, “You’re solving an issue when you’re inventing.” They never expected it, and of course there’s good and there’s bad, right? The internet has a lot of good, also has some negative stuff. But at the end of the day, they look at the impact on our daily lives.

And you and I, we all can’t live without our phones and without the internet. And I wanted to reach out and get somebody to really make an impact to say, “Hey, when we were dealing with this stuff, we were just designing something, we never expected all this stuff to happen, but it’s now part of cases.”

And as long as we’re able to gather information, it can be used to help bring justice. It also can help corroborate other evidence. So they look at it from the standpoint of “Hey, it’s a data source.” And although I look at it from… they look at it from the technical standpoint, I’m looking at how it’s impacting us from the investigative standpoint.

And I got Frank initially, and I said, “Wow, it would be amazing if I got the guy that…” – everybody wants text messages off phones right now – “What if I got the guy that sent the first text message?”

And they were such nice guys, they’re actually sending me back some stuff in the mail. We’ve been chatting, good friends already, exchanging messages. I also had Fred Cohen do the intro for me or the forward, who you know is one of my professors from UNH who is involved in a lot of the computer security, computer virus stuff. And Eugene Spafford, a guy I also know for 20 years.

It’s just people coming together that really wanted to contribute, and they did it really graciously and gave their time. I’m so thankful, again, to be able to put this out there to people. And I brought in copies just to actually have people doing what they’re doing online right now – showing, reading the book, taking it places. To me, it’s a great feeling to be able to send you guys a couple.

Si: I’ve got mine, I’m taking it on a trip tomorrow. It’s going somewhere special. I’ll post the picture on LinkedIn for you tomorrow night.

Rob: Next time you guys come to the States, we’ll give you some more. It’s just giving of my time, and really it’s so rewarding to be able to see the content being enjoyed and going around the world. It’s awesome.

Desi: Yeah, that’s really cool. Rob, thanks so much for joining us this week and talking through all this. It’s been super interesting, and I’m sure when you publish your next book in two months’ time, I’m expecting a 3.0 covering AI, and also wearable technology would be great if you could just chuck that in quickly. We’ll have you back on so I can ask all these questions that he was missing this time.

Rob: My nine-year-old wants to write my next book with me, and I’m saying, “Oh.” But the only motivation right now is to be able to keep my home office, where I actually do all my writing, because the third kid is actually starting to get out of the crib and needs a new room.

We got to keep… got to find a reason for me to keep writing. So just keep up the contributions and the support and I’ll do what I can do.

Desi: Nice. Nice. Awesome.

Rob: You guys are awesome. Thank you so much for all the support. My pleasure to talk to you. And I hope to see you guys soon.

Si: Thanks, mate. Absolutely, bro.

And thanks to all of our listeners. You can get this podcast or video wherever you get your podcast from. We’re also on YouTube and our website. We’re on YouTube, right? I always forget. Yeah, we are on YouTube. Yeah, we’re on YouTube and our website. We will post all the links in the show notes for the book and where to go and do the polls and anything else that we talked about in this session as always.

And we’ll catch you guys all next time. See ya.

Desi: Thank you.

Protecting Investigators: Dr. Michael Bourke On Building A Healthier DFIR Community

Paul: So welcome and thank you for joining us at Forensic Focus today. We’re honoured to speak with Dr Michael Bourke, who’s a distinguished clinical psychologist, researcher, and expert whose work has significantly contributed to our understanding of the psychological impacts of working in internet crimes against children.

Dr Bourke has Co-authored insightful studies exploring secondary traumatic stress, coping mechanisms, and the broader implications of this challenging yet vital work. As frontline defenders against some of the most distressing crimes, digital forensic investigators face unique stresses that can deeply affect their mental health, relationships, and overall well-being.

Through groundbreaking research, Dr Bourke and his collaborators have shed light on these critical issues, providing invaluable guidance for law enforcement agencies, mental health professionals and policy makers. In this interview we aim to delve into the motivations behind Dr Bourke’s research, unpack the key findings of his studies, and discuss how these insights can be applied to better support digital forensics personnel.

We’ll also explore the broader implications for law enforcement and the critical role of mental health in sustaining the resilience and effectiveness of these dedicated professionals. Thank you, Dr Bourke, for taking the time to share your expertise with us.

Let’s begin with a few questions. Can I first ask you what inspired you to explore the psychological impacts of digital forensics on the personnel?

Michael: It was due to cries for help. There were officers, investigators, analysts who were coming up to me at different conferences that I was attending, and they would ask me to help them out.

They would say, I’m involved in work that’s very meaningful, but it’s toxic. It’s hurting me. It’s hurting my relationships. It’s affecting my relationships with my children or my partner. Really it was just because a lot of people were coming up and asking me for help in how to cope.

Paul: Did those personnel have access to any resources at that time?

Michael: Sadly, the answer to that is almost resoundingly no. There were a few Internet Crimes Against Children Task Forces that were exploring relationships with therapists or counsellors and were trying to do some prevention work but I would say overall the overwhelming, number of personnel were receiving no services whatsoever.

Paul: Do you find that a surprise or shocking?

Michael: I don’t because particularly in the law enforcement community there has been, traditionally, a stigma against any sort of weakness. I’m putting that in quotation marks because it’s just this antiquated idea. That seeking help is somehow indicative that you can’t handle the work or that you’re not tough enough and it’s a philosophy that is pervasive across law enforcement.

But, like I said, this has nothing to do with being tough. That has nothing to do with how macho or how strong you are as an individual. Human beings are simply not meant to view media depicting depravity day in and day out it worms into our psyche. It affects even the healthiest of individuals.

So, it didn’t surprise me that the attitude in law enforcement agencies, not just in the United States, but around the world was hey, if you can’t take it, then go back to patrol. If you can’t hack it, then let somebody else step up who can and that’s just a lousy way to take care of people.

Paul: Certainly, here in the UK, I’m aware of a lot of research which suggests that there is still a lot of stigma attached to either seeking help for mental health issues or being referred to see an occupational health unit for mental health issues. Is that what you found in the States?

Michael: That there’s a reluctance to seek help?

Paul: Either a reluctance or a stigma attached to it.

Michael: Yeah, I think so. Fortunately, what’s happened at least in the past couple of years is there started to be a shift. There’s just too many people now that are cognisant of how this work affects them.

There is growing insight into the fact that we have to A, do more work and we have to select people differently for this work. Then B, we need to prepare them differently for the work. We need to like the metaphor that I use is armouring up. Like a warrant squad would do before they go into a house, they’d put on their body armour and have their shields and they would take all these precautions to make sure they’re physically safe.

We need to do the same kind of armouring up psychologically so that we’re not purely using a reactive model. Too often in law enforcement, the model is if you’re hurt, then we’ll give you a phone number to call or you can go down the hallway to this office and they’ll help you. But that’s a reactive model.

It sends the message to personnel that we’re not really going to take care of you until you’re hurt and then we’ll try to patch you up. Really the key to taking care of people is that we don’t want them to be hurt to begin with. It’s all about prevention. It’s all about getting in front of it. That’s how we take care of people.

A lot of emphasis needs to be on the resilience and proactive efforts. Then we do want to have maintenance and monitoring and ways of keeping checks on people and having an environment that supports wellness.

Then we have to have that reactive piece in case secondary traumatic stress does get through our armour. Despite all of your most protective actions, it sometimes does find the chink, the Achilles heel. So, we have to have something in place to take care of our personnel if it gets to that point.

Then the last thing that’s often neglected as well is follow up. By that what I mean is sometimes our folks leave the unit. They decide that it’s not what they signed up for. They decide, maybe there’s something in their background and this is bringing up too many issues for them or whatever it might be.

There’s completely legitimate reasons why people may choose not to do the work. If they’re leaving because of secondary traumatic stress, sometimes those symptoms don’t emerge for three to six months after the person has extricated themselves from the environment.

I think we have an obligation to go back to people who have left the unit. Either they’ve transferred to another unit, or they’ve left policing, or they’ve left whatever the environment is. Child advocacy centres or intelligence centres etc. We should go back and we should ask them 6 months later, are you okay?

Now, I’ve had lawyers that have told me once they’re no longer employees, we don’t have any obligation to. I understand that legally we may not be obligated to but morally we are. In my opinion, morally, we are.

Sometimes people say what would we do if they said I’m not doing very well? I said you would give them the same list of providers that you would give your employees. You have a list of practitioners who are qualified and culturally competent, and you know that they’re available to provide support, techniques and perhaps referrals to other professionals. So why not bring them into the system that you already have in place?

It doesn’t cost you anything. So, I think this is a holistic, multifaceted approach to wellness. It’s not just what do we need to do if this happens, it’s throughout the spectrum of their employment.

Paul: I agree. I also agree that it should be a more proactive approach to mental health as opposed to reactive because at the point someone becomes susceptible to secondary traumatic stress or burnout, then it is a lot harder to recover from that and it can also be quite time consuming so it means a lot of time away from the workforce. Do you agree?

Michael: I do agree, there was a study that was done on individuals that enter this work and they are trained and that training can be very expensive to acquire certain credentials as an examiner or child forensic interviewer or investigator.

To go through that process, do the work, not have anything in place to armour up and not having the right support system in place. When those people leave, this study found that the cost to replace them was three times their annual salary. So, it actually costs three times as much because you have recruiting, the background investigation, their academy, all of the different things that people have to go through and then you have to retrain them.

Meanwhile, while they’re gone. Other people are having to pick up that work. So now you have overtime costs, or you have other people burning out. This ripple effect is continuing on because you’re short staffed because somebody quit. So that is interesting for those who are maybe less persuaded by this idea of taking care of people. Which I think is abominable.

There are more bean counters and more of the people that are paying attention to the money. I say, there’s very compelling arguments to take care of personnel from a monetary standpoint as well, because it’s simply cost prohibitive. To keep having this incredible staff turnover.

Paul: I agree. Aside from the monetary cost, you’ve also got the loss of practical experience that goes with that person when they leave. You mentioned something also, cultural competence in therapists, to deliver the interventions to DFIs. Can you explain for the viewers what you mean by cultural competence?

Michael: Cultural competence is just a term that refers to a clinician’s ability to understand the context in which someone is working or operating. In this case, it would be an understanding of the police culture as a whole and, within that, this subculture of Internet crimes against Children or child exploitation and sexual abuse. Child sex trafficking.

People that are working in that field, what do they experience? What’s a normal day look like for them? What kind of coping strategies in that community are common? Some of those might be adaptive coping strategies, and some of those might be maladaptive coping strategies, but yet they’re still common. The more you understand exactly how that culture works and what the norms are, what that looks like for someone to engage in help seeking behaviour.

Is that likely to be seen favourably or will they get a black mark in their file saying Jones has something going on. Understanding the department hierarchy or the agency’s chain of command. What resources are available either laterally, such as a mental health professional that’s in house and then what sort of resources are available that are separate from the department.

How supportive are is the upper echelon? How supportive are the middle managers? What’s the culture like among peers? Because the research shows with regard to who does well and who struggles some of the main factors that make a difference is your relationships with your peers and your relationships with your immediate supervisor.

Those 2 relationships are by far the most important factors in being able to vent or release some of this secondary trauma on a regular basis. The other relationship not surprisingly is a relationship with someone such as a partner or a loved one at home, outside of that environment. That’s also really important to have confidants and others who are not in that inner circle.

Interestingly, a lot of police officers will tell you I can’t take work home and that’s very common in police. They say I have to keep work at work, people say. They’re like I can’t talk about what I see and I can’t talk about what I do. This is true for even road policing. They say, I saw a vehicle accident and I saw this and I’m not going to take that home. That’s actually a mistake. That’s a mistake because they absolutely can talk about work at home.

Now, you don’t want to secondarily traumatise your partner, you don’t want to go back and give them all of the details, but you can absolutely go home and say to your partner, I’ve had the worst day I’ve had in a month. You can even say the series of child abuse material that I had to view was a child that’s the same age as our child or the name of the series is the name of my nephew.

Something that made you a little bit more vulnerable and it upset you more than average. That’s not going to traumatise your partner. That’s not going to secondarily affect them. It can result in you getting some extra care and support from the person who cares the most about you. Otherwise, we’ve left them out.

Paul: Yeah, I agree. It can be quite cathartic just to talk around the difficulties that you’ve had in the day without giving specific details of what you’ve actually seen counted.

Michael: Yes. An important part of that is what we recommend. I used to work for the marshal service, and what we would recommend to our personnel is you have to train your loved one, for lack of a term, on how to take care of you.

What we noticed is that people would go home and say I had this terrible day and the partner wouldn’t know. Does that mean you want to talk about it? Does that mean you want me to leave you alone? Do you want to go for a run? Do you need to take a hot shower and get rid of all that stuff that you saw? What exactly is the best way that I can support you right now?

So, we say you want to sit down before all of this stuff affects you and say, if I say X, this is the best way to support me. This is what I need. We’ve had some very interesting cases where the lack of communication with people actually backfired.

It doesn’t just have to be a domestic partner. This can be adults, children, it can be a pastor or rabbi. It could be a parent. It could be your best friend. The key is to involve people in your social support system who know you well. Who say you seem a little bit off or you seem to be drinking a little bit more or you haven’t been going to play cards with your friends as much.

Somebody who’s noticing because the metaphor that I use here with secondary traumatic stress is a sunburn. We know that this environment is potentially toxic. We know that these things that we view are not things that a normal person should have to view all day long, every day. We’re just as human beings. We’re not set up to view morally abhorrent videos in colour in sound. Like looking through a window almost on our computers.

We’re just not meant to do that. I say that material is potentially like radiation from the sun. A lot of times we don’t know that we’ve been affected until 1 of 2 things happens either a that damage has accumulated so much that were burned.

In the world of child exploitation, that initial radiation is what we call secondary traumatic stress. When it accumulates up to a point where it is hurt you, that’s what we call vicarious trauma. Now you’ve moved from experiencing a stress into now becoming traumatised.

The 2nd way that we realise that we’re being affected is going back to the sunburn analogy is if someone says, your skin is red, you haven’t been protecting yourself like you should. That’s usually how people know that they’re getting burned is either it begins to hurt or someone lets them know.

It’s the same thing with secondary traumatic stress. The more people you can involve around you who know you and care about you. They’re the ones that are going to say have you been putting on sunscreen? Have you been protecting yourself? Have you been going through these rituals and these protective practices when you go into work? Because what I’ve noticed is you’re beginning to get hurt.

Paul: I think that’s an excellent analogy. Speaking from personal experience, I didn’t talk to my family, my wife or my kids, about what I’d saw on a daily basis at work. I put it into a little box. I put a lock on that box and I put it away until I returned to work.

In exactly the way you’ve just explained, it gradually grew and grew until I couldn’t hide it anymore. By that time, it was too late and I didn’t return to digital forensics which is why I now campaign for increased mental health provision for DFIs.

That was an excellent analogy to explain it. In secondary traumatic stress among digital forensic investigators, you highlight the relationship between the frequency of exposure to disturbing material and secondary traumatic stress levels. What practical steps can organisations take to mitigate that impact?

Michael: I actually teach entire courses on this because first of all, there’s many different things that organisations can do. I think I have over a hundred different categories of things and different techniques and whatnot.

The second thing is what I have found over the years is that it really needs to be customised for each agency or each department because there’s a big difference, for example, when I was helping, Interpol in Washington, D. C. There was one person that really needed the safeguarding and that was the person who was receiving all of the phone calls and all of the emails from all over the world.

Many of those were in different languages and basically, she didn’t know what she was going to open until it was opened. It might be a suicide, it might be an act of terrorism, a drug cartel act of violence, or it could be child exploitation material.

When you think about resilience, a lot of it is the preparation is knowing what you’re about to encounter. For example, Paul if I knew every day at 3 o’clock you were going to punch me in my arm. I’m sure you’ve got a good wallop from policing and it’s going to knock me back, but if I can steel myself for it and lead into it, I’m going to survive.

Paul: It’s going to reduce the effect, doesn’t it?

Michael: Yeah, but that unanticipated punch out of the blue. Is going to knock me down, right? There’s a lot to be said for that preparation. She didn’t have the ability to steel herself psychologically for what, what was about to enter her psyche.

There was no filter she could put up to guard. That’s very different from war crimes investigators over in Geneva at the UN who are looking at mass graves, war atrocities and interviewing victims of torture. The support system is different. The mission is different. The personnel involved are different. The context of the exposure is different.

So, if you said, what should agencies do? Well, agency A should do something maybe quite different from agency B because they have different resources and all that other stuff I just mentioned.

Overall, what I would say is you want to have an environment that supports people in taking care of themselves. You can’t do things like pickle them in depravity. You don’t want to have somebody go in at 8 o’clock in the morning and view child abuse material all day long. That it is inevitably going to overwhelm our defences.

You have to put protective measures in place. You have to have breaks. You have to have periodic moments when you’re shifting gears psychologically.

There’s two amygdalae in the brain. There’s two little almond shaped organs in the brain. Actually, amygdala means almond because they look like little almonds. Those little organs in the brain are responsible for the fight flight freeze response.

What’s really interesting is one of those on one hemisphere is much more responsive to language and logic and the other is much more responsive to imagery and more primitive kinds of threats. When you’re viewing in the field of child exploitation, you’re often exposed to both types because you might be looking at a chat or someone is soliciting a minor or there’s a fantasy or a story online.

So that’s over here, or you might be just viewing this video of a child being assaulted. That’s this very raw, visceral visual where there’s no one, communicating. You don’t have to figure anything out. It’s just right there.

So, the fight flight freeze is very different, but here’s just a quick example of how an agency could help protect somebody is you have them switch. I don’t know if it’s dolphins or sharks or something where they sleep with one half of their brain and then the other half of their brain is awake. They can still swim and get away from predators.

So, I tell people, be a shark. You either do that chat work or the verbal work that uses that part of your brain or you do that other part. But, every 45 minutes or so switch and that lets that other side of your brain, that amygdala, begin to relax. Then you switch again, then you take a break and then you let them both relax.

There’s other coping things that you can do during that interim. I’m a big fan of movement. There’s good research that suggests you have to get up and you have to move. You don’t have to run, although that’s not bad either. If you want to go for a run at lunch, that’s fantastic. But moving is good.

There’s good research that shows that it’s helpful to go outside whether it’s the sunshine or whether it’s the wind or even if it’s rain. I’m not saying go out and get soaked, but I’m saying go outside and feel nature, drink water, eat healthy foods, talk with people, not about work but shifting again, it’s all about shifting in the brain.

By the time that day ends, you have used about half of those resources that you would have otherwise spent. If you had that that digital forensic investigator looking at images all day long, they would have been depleted twice as much just from that. There’s effects in psychology, the primacy effect and the recency effect. The most important thing here is the recency effect is the last hour of the workday is what you’ll take home.

That last bit of your workday, you should not focus on depravity, people being injured, people being assaulted, people being victimised. That last half an hour to hour you should do more mundane tasks, do your time sheets, put in your vacation, take your security online course that your agency makes you take, go and clean up your desk, scrub a hard drive. Do a task that is not where you’re doing a deep dive into something that’s morally injurious.

Research again shows the primacy and recency effects are very powerful with regard to what’s stuck in your memory. You don’t want to be ruminating on that last hour on your train ride home or your bus home or your drive home. You want to have that be behind the wall so that when you get home you can just be with your family.

Paul: I’m pretty sure that’s the advice you gave in your 2014 paper. I’m sure I remember reading that. It was really good advice.

Michael: Thanks. I wish I could say that I came up with all these ideas because I’m some kind of intellectually bright guy here. The truth is that I have learned all of these techniques through talking to people that have been involved with the work.

Whenever I meet someone who’s been involved in child exploitation work, whether it’s in a child advocacy centre, or whether they’re a police officer, or whether they’re involved in some other way like a computer analyst or something.

I usually try to have a conversation with them about what works, what do they do that they find helpful, what are their bosses do that they like, what kind of things don’t seem to work.

We put out the national wellness survey 5 years ago. That was a collaborative venture between academia and law enforcement and we sent that out across the United States.

We asked those questions of 1st responders and we said what have you tried and how effective was it? Did it work? If so, why? If not, why not? If you didn’t seek help then what stopped you? Was it financial? Was it stigma? Was it that you were afraid it would hurt your future promotional opportunities? Was it that you just didn’t know how to seek out a therapist?

I’ve had officers tell me, I don’t know the difference between a psychiatrist and a psychologist. I don’t know what a Freudian is and what a Jungian is, I don’t know if I need medicine or not. So, there’s a lot of mystery around mental health services and just. How do you find a good therapist.

Paul: On the subject of the National Wellbeing Survey, you’re busy preparing to distribute that again, aren’t you?

Michael: Yeah, we are. We weren’t sure how many people would respond to this because it’s a long survey. It takes about 35 minutes. People told us, you’re not going to get cops sitting there for 35 minutes, filling this out.

I said, I disagree with you because I have met way too many digital forensic examiners, investigators or not, and child advocacy personnel who are thirsty for more work to be done here. They really do want studies to support what they know intuitively. They’re talking to their brothers and sisters, and on the thin blue line here. They want to convince the bosses, or they want to get more resources to take care of themselves and it’s a legitimate ask.

So, I said, I think they are going to participate. We had 8,000 respondents. I think it went out to 14 and we got 8,000 back. That’s an incredible response rate. It speaks to the fact that people want more answers and they want more support from academia about what they know experientially is true.

We’re getting ready to do it again. We hope to reach even more individuals. We hope to send that out to our brothers and sisters across the pond in the UK. I think it would be fascinating to continue some work we did a couple of years ago looking at the differences between the United Kingdom investigators and personnel and those in the US.

There might be something that we can learn from each other there, there might be some gaps or some best practices and we’re still learning. This is not anything that we’ve got it all figured out. I think it’s going to be a constant learning process of how can we better take care of our folks.

Paul: I agree. I have to say, talking about the National Wellbeing Survey. I will absolutely do everything I can to help distribute that here in the UK, because I think the comparative analysis between the US and the UK will be really interesting. It’ll be an exciting thing to see.

Michael: I agree and you’ve made that offer before our podcast today. I’m very grateful for that because I don’t have as many as you would have, I don’t have a lot of connections over there to distribute that. No matter where I go, I’ve been to 34 different countries training and speaking to folks. No matter where I go from here to Australia, Central South America, Canada, it’s one of these universal things.

It’s just about being human and viewing something that’s evil around the world.

Paul: Yeah, I agree. Before we go, can I ask you to talk about the FORWARD Centre, which you were talking to me about when we had a chat a few days ago. I think that’s an incredible achievement and I think it’s really important to share.

Michael: Yeah, I agree with you. I was asked to participate in the FORWARD Center. The foundation for first responder wellness and resilience is the full name of our nonprofit organisation. The centre that we’re going to create, we just call it the FORWARD Center. That acronym kind of spells forward.

Essentially, this is a group of police professionals, fire professionals, dispatchers, emergency communication operators, EMS, emergency medical services. I think you call them blue light services.

Paul: Yes, we do.

Michael: So, we’ve gotten together a number of mostly chief executives. Most of the folks are chief executives, but not everybody. The idea is to create a facility that is devoted toward wellness.

It’s a holistic centre. About 10 million dollars was donated, and I think we’re going to be shifting buildings. The top floor is devoted towards traditional psychotherapy, counselling and traditional psychotherapy.

The second floor right now is a medical floor. It has psychiatry sleep studies, which are very important. Sleep is a very important part of wellness. There are other medical types of assistance. Acupuncture may be offered there as well.

Then on the first floor. We have chaplains. We have a facility dog training program. We have our administrative personnel.

On the top floor is a green space for things like yoga and meditation. For people that just want to have some time to themselves for a few minutes or what have you.

The point of this centre is that everyone in that building will be culturally competent. Everyone will understand the culture with first responders, fire, EMS, corrections, police, and they will be specially trained. Whether that person is a homicide investigator, if they’re an internet crimes against children investigator, if they’re a firefighter, if they’re a correctional officer they will understand that world and this facility is solely for them.

It is going to be available to them regardless of ability to pay. So, if they can’t afford it, or they need to be on a sliding scale and they can only afford 5 dollars or whatever, that’s fine. Money is not going to stop anyone from getting services.

The other important thing is we’re also offering it to retired personnel, because we know from many stories that people struggle when they leave. They’re leaving their vocational family. They’re leaving their identity. They’re leaving their support system. They’re leaving things that are important to them. They’re leaving their world. It’s very difficult to transition and we want to support them in every way we can.

We even have a financial planner who’s helping them with the sometimes confusing finances of the pension and 2nd employment etc. All of that is offered regardless of ability to pay and it’s for retired personnel as well as active personnel.

The last neat thing that I like about it is that one of the other things that stops first responders from seeking help is that they’re afraid their bosses are going to find out.

If they go to an in house psychologist, they’re afraid there might come a time when that psychologist, who’s an employee of the organisation reporting to the assistant chief for example, that one day that assistant chief may say I need Johnson’s file. They understand confidentiality, but they are also very nervous because it’s the boss and he or she is telling them what to do.

So, the other neat thing about this is it’s not attached to any department. There are no ties. There is no one is beholden to any department. They will never get that file. In fact, you can seek services anonymously. We have a chip system for payment where you could literally give a chip to your friend who’s going through a tough divorce.

That man or woman could come in, could receive support, could receive psychotherapy, could receive a sleep study, could see the chaplain and they could just drop a chip down for payment. They don’t even have to give their name. I guess the short story is we’ve tried to eliminate every barrier that would stop somebody from being taken care of because this is tough work and we have an obligation to do better.

Paul: You also told me that the attendees of the centre given a second chip.

Michael: Yes. So, when you leave, you would be given two chips. One is for your next appointment and one is for a friend.

We’ve had some departments say, we’re going to take all the extra chips and we’re going to put them in a jar in the middle of the squad. Anybody who needs one can just grab one, almost like M&M’s or a penny jar etc. If you need one, grab one.

Other people say they wanted extra chips for supervisors. So that if a supervisor was seeing a decrease in work performance or maybe just heard through the rumour mill that somebody had experienced maybe a loss, maybe someone passed away in their life, or maybe they maybe their pet passed away.

There are things that can be really stressful for people and that person might not think to themselves, I better go see a psychologist because my pet died, but a supervisor might just give a little nudge by leaving that on their desk. So, when they come in the morning there’s a chip. Don’t forget about this resource and don’t be ashamed to go and just say to somebody, I need a little tune up. I need to just check in here because I’m going through a rough period.

It doesn’t mean you have to make it some extensive year long, psychoanalysis. Sometimes people need a 15 minute tune up, like an oil change in your car. It’s not major maintenance, but if you do the oil changes regularly, you find out that car will hum along for 50 years.

Paul: Exactly. I’m blown away by that initiative. I think it’s absolutely incredible and for it to be a non-profit organisation. Obviously, it gets funding from other areas as we discussed. But I think it’s a phenomenal initiative and I hope it grows. I really do.

Michael: We’ve already had requests from folks that want us to export the model, but we have to crawl before we walk or run.

It’s not a money making venture. We haven’t met anybody yet that’s looking at this from a profit standpoint. We would be quite happy if it just makes enough money to keep going year after year. Just to stay afloat.

We take donations from different people, groups and even individuals. We have an initiative, we call it 9/11 after both the tragedy in New York on 9/11 and also our emergency system, 911, so people can donate 9 dollars and 11 cents every month. It just gets taken out of the bank account.

It’s 9 dollars and if enough people were wanting to sign up for 9 dollars, then that actually ends up paying for food for their facility dog or it pays for someone to receive a sleep study or whatever it might be and that might be an older person who can’t afford it.

Paul: Dr Bourke, it has been fascinating talking to you tonight. I want to say thanks on behalf of Forensic Focus. I absolutely appreciate how busy your schedule is and for you to give up this time for us it’s really important, so thanks for that.

Michael: Thanks for having me.

Paul: Please stay in touch with us. I’m sure if we can help you in any way, especially around the study we will be able to facilitate that.

Thanks again for joining us today. 

Michael: Thanks for having me, Sir.

Paul: Thank you.

Michael: Take care.

DFIR In 2025 – AI, Smart Devices And Investigator Well-Being

Si: Welcome to 2025, a year of exciting upcoming presidential swaps in the U.S.

Desi: Yeah, 20th of January, Donald Trump is in, Joe Biden is out. I only read about that today, and then that deep fear struck me. But we’ll see how that actually turns out.

Si: I was flown out to a conference in Luxembourg, in central Europe, on AI in law.

It was talking mostly about the implications of AI in the court system and in things like decisions made using AI in immigration processes etc.

It’s quite broad, as well as the things that we’ve talked about, like computer generated imagery and stuff like that. It was the day after the election, so we were all sitting around and I could see the tickers on the news saying that that Donald Trump had won.

There were a couple of Americans who were at the conference and one of the things that they were telling me was actually that some of the legislation that was actually put through was very good on a legal standpoint.

They were saying for presidential acts around AI, one was done by Obama, two were done by Trump, and one was done by Biden, and they’re all actually good law.

What we see externally is often fear mongering because it sells newspapers. It’s not about the good stuff that gets done in the background that you know makes a country work. It is getting a bit better and it will be interesting to see.

I think my concern with that particular one is that I feel we’re already seeing some of the impacts of it in things like Facebook or Meta as a whole because it includes Instagram, are scaling back on their moderation.

Desi: Yeah, the free spirit. I found out about that as I was scrolling through LinkedIn this morning for looking for stuff for my job. There was a bunch of articles about Mark Zuckerberg being a convicted paedophile and had gone to jail for the last 36 months and contracted all these diseases. But it was a mock Facebook post.

That’s how everyone is now reporting on this news. I saw six of them and I was like, what the hell’s this? Then When I found the video of and who knows whether that video was deepfaked. For someone who is so in the public, it’s very hard to tell some of these defects because there is so much voice data and visual data.

Si: Yeah, I mean basically, we’re screwed then. You realise that, don’t you?

Desi: Oh yeah, definitely. Definitely realise that. I was looking at AI generated images in terms of humans in pictures and you could train your individual self to try and find pictures, I think it was earlier in the year we might have been talking to Ant about that.

It was like that uncanny valley. You’d look at something and you would feel slightly uncomfortable. You wouldn’t know what it was, but it was that kind of deep human feeling that this isn’t natural.

I was looking at some of those images today and now I’m questioning myself. Is this an actual photo or are they saying it’s AI generated and it’s not. But looking at the photos, it looks like family photos from two years ago, it was phenomenal, some of the content that was coming out.

This is scary, now we’re getting to the point where if they can hide the digital traces of this, and especially with phones now. You have Samsung, you’ve got an Apple, all of that has AI software into the pictures. How do you tell between the two?

It’s a scary thought going into 2025. Not the fact that the technology is there, it’s how it’s going to be used is the scary part.

Si: There was interesting proposal that was put forward by Leica, the camera company. They basically digitally watermark genuine images from the start.

So, we’ve given up on trying to show what’s not real, but if we can prove that something is real, then at least you’ve got that extra layer of assurance. I think we may end up going that way, actually.

It’s easier to do that than it is to get everybody to tag. Because unless you’re going to make your own camera, which is possible and technically feasible to do.

Desi: It’s almost the reverse of when DVDs had the copyright encryption on it. People would go through and jailbreak that copyright so they could then burn the DVDs and sell them to the black market.

Companies like this will do this encrypted watermark. If this watermark is on the picture, it means the picture’s real. I can see criminals then reverse engineering that, to then put the watermark on AI generated images.

Then you have, in the news cycle, cybercriminals who have figured this out. These images from these dates we don’t know whether they’re real or not, because it’s got this watermark. We’ve updated the watermark, but between this six month period, who knows.

Si: Yeah. I think this is the new normal whereby you see something and you’re not necessarily going to be able to trust it.

It’s interesting because we’ve given all sorts of advice. You can go and look up all the advice about how to check an image and check sources, verify using multiple things and all of this. But none of us really do it. This thing pops up on your Instagram feed and you’re sending that to everyone.

Desi: Yeah, and it’s already there designed to be an echo chamber of your own opinions and what you’re viewing.

Si: I think the other problem is, is that reality is actually every bit as bizarre as I think it is. You get some really weird headline saying that some politician has said something and you’re like that can’t be true. It turns out to be utterly real.

There’s a quote attributed to Einstein, which I think it may have been disproved as being his but I like it for him anyway, which was there’s only two things that are infinite, the universe and human stupidity, and I’m not so sure about the universe.

Desi: I love those fake quotes. There was one from Isaac Newton that said, kids are always on their phones these days. That’s fantastic.

So, to continue on from the watermark breaking and putting on pictures, where I can see that becoming an issue is the value. I was just looking for news articles, there’s been a bunch of men convicted in 2024 for generating AI CSAN, and they’re getting quite hefty prison sentence sentences for all of that.

I can see the rarity of the natural product that they’re pushing, which is the CSAN material that’s generated with real victims being a premium within that market. So, this whole encryption thing is where I could see the motivation for doing that. Those niche circles to push that, to then generate the AI images to sell, maybe if they’re selling them at a higher cost as a market product.

Si: Oh, that’s so deeply disturbing.

Desi: I know right, but that’s the real dark side of AI and where all this technology is going. There’s so much benefit, but then when you try and put yourself in the shoes of a criminal and go how would I use this poorly? How would I use this for bad?

I think it’s because we’ve had so many of those discussions last year in terms of AI is being used to try and detect this stuff and where I can see it being used on the other side. Unfortunately, probably where some of those conversations will go this year, as we talk to more vendors and more people in the space that are researching it, that it’s that prediction where it’s going.

I read today that NVIDIA is coming out with a desktop supercomputer for 3,000 US dollars. Have you seen that?

Si: I haven’t, but then you’re going to say that you’re younger than I am, so you haven’t seen quite as many iterations of the desktop supercomputer as I have.

In my garage, I have one of the very first, desktop level, supercomputers, which was a Silicon Graphics Indy Machine. At the time, the graphics card in it alone was a £15,000 purchase and the rest of the machine was an incredible piece of kit. When I picked it up, we were throwing them out from the company I was working with. Which was insane, I’m having one.

I’m going to say it’s Moore’s Law, isn’t it? We constantly increase in this almost exponential rate. It’s slowing, but it’s the processing power that’s available and the cost of it is coming down. The processing is going up, the cost is coming down.

Then again, the new M4 chips with the Mac are phenomenally powerful desktop processors. The speed of them is ridiculous. I’ve got one M1 and one M2 chip and even those are still blazingly fast.

This is on the M1 and it’s still blazingly fast. A machine that’s three, four, five years old and it’s still holding up brilliantly.

Desi: Until the AI models, when you’re trying to generate that stuff where you need way more processing power, anything else you can throw out day to day is nothing, right?

We hit a peak on where we couldn’t generate a software program big enough to challenge the chips that we had. With AI now, when you’re working with large data model sets, that’s the next benchmark. Cinebench will go away and it’ll be handling these multinomial AI models and see how fast you can churn through the data set.

Si: It’s interesting because there’s huge range of issues in doing AI. Like you say, churning through a data set and building a model, but actually disk access.

You’ve got to have your buses that are handling all of that data to be able to put it into a multi core processor in a VPU. To distribute it, and then the memory’s got to be able to pull it and push it at the rates that the process is handling at.

The technology is being pushed on leaps and bounds. This is before we even get to quantum computing.

Desi: I think that’s the leverage, looking at some of the write up for this. They haven’t released all the specs yet. They announced it recently. The leverage that it has they’re doing a lot of it in VRAM. All the processing’s done there and then it’s out onto a NVME drive. Still quite high right speeds, but all the processing be done. It’s just pushing the solution out of it.

Si: Obviously parallel processing is the way forward. How can it not be? You’re doing more things at the same time, purely logical. I wonder if we’re heading towards seeing more things like distributed parallel processing, whereby you’re, you’re chaining together multiple machines, perhaps of a lower spec.

Desi: That’s the NVIDIA one.

They were talking about that you can buy multiple units and chain them together.

Si: When the link comes into the show notes, I’ll look forward to that very much. 

Desi: It’s a brief, initial announcement for them. You can go on a waitlist at the moment, but it’ll be interesting to see some of the early testing that comes out when they pass it off to vendors to run tests and what their reviews say.

They’re going the way that Apple went. Everything integrated onto the one chip, it’s not a piecemeal thing. If you’re plugging pieces in, your bandwidth is limited. So, they’re pushing everything in the same way.

Si: Interestingly, on the chip front, Raspberry Pi 5, 16gb edition drops this morning, so you can have a Raspberry Pi with 16gb of onboard memory as a system on a chip.

Desi: Raspberry Pi is now just like a computer from 2010, right? That’s where we’re at.

Si: I would agree with you, except I think it’s better than a computer from 2010. I’ve got one that sits behind my TV running a of a media server version.

Desi: I have a computer from 2010 running a media server. So, it’s probably better than mine. I had to get mine fixed because the RAM failed. So maybe I should just upgrade to a Raspberry Pi 5.

Si: Yeah, there you go. It’s probably cheaper than a couple of sticks of RAM.

Desi: It is, because it’s Ddr4 which is like hen’s teeth to come by these days.

Si: I was going to say, you offered to send me something earlier, I’m pretty sure I’ve got a drawer full of DDR4 kicking around somewhere. I’ll send it in exchange.

Desi: I was in that transition period when I was looking to buy my new computer, which I didn’t end up buying before I got this one. It was right in that in between where Ddr5 was new and it was so expensive, but then Ddr4 was getting more expensive because they weren’t making it anymore. I’ll just wait five years and then Ddr5 will be cheap.

Si: The one thing about the Apple ecosystem is that I can’t upgrade the memory in my machines because otherwise it breaks them. So, I buy as much as I can from the outset and then live with it. Having said that, my laptop is a 96gb machine, so it’s not insignificant for a little portable device.

I’ll share this window with you. Apologies for the quality of the photo, it was taken in the supermarket but this is where we’re heading.

Desi: Rise of killer robot fridges. Boffins fear AI devices going rogue.

Si: The prevalence of fears about AI hitting the press. I wouldn’t necessarily say that the Daily Star Sunday edition is quality press.

Desi: The font type of choice doesn’t scream professionalism to me.

It almost looks like one of those slasher films from the 80s and the camera starts off looking at a news stand about a serial killer killing a bunch of people. Then it pans to the street and there’s all the college kids having a milkshake or something.

Si: This was in the entryway to my local supermarket, so a pan to the right would have given me the meat fridges, and if they were eating someone it would have made perfect sense. Perhaps it’s a horror film yet to come.

Desi: Those fridges, they’ll get you.

I’m fascinated by stories, the headings and the kind of choices that journalists make for their titles that are clickbait. Then when you read the actual article, what is the underlying message?

It’s always been like this, but you see it a lot more in Instagram, Reels or TikTok’s, where you read the title and it’s not representative of the content because it’s generally AI generated or it’s just trying to be catchy.

Are you looking at the story?

Si: I’m actually looking at the daily star.

Desi: Your phone is going to track you and give you a lot more Daily Star now. That’s going to be the end of your news cycle on your phone.

Si: But yeah, fridges could lead a robot takeover of the world.

Almost all UK homes have a refrigerator. That’s a fairly self-evident statement. 40 million fridges. Experts, however, reckon that as home tech gets smarter, they could soon be plotting to overthrow us.

Desi: I’m currently reading the same article, and I’m not against one of the points in here.

So, worries, however, have been raised that the internet connected fridges could be targeted by hackers, and that they could talk to other devices through WiFi. Now, that, I’m on board with.

I went and did a sleep Apnoea test. Turns out, didn’t have it. The breathing machines were really shit to use, but the majority on the market are WiFi connected. Now, there’s the whole ethical issue about those companies just collect your data and then sell them off. I found a security researcher that hacked a whole bunch of them and gets you your data, which is awesome. I’ll try and find that and link it in the show notes.

Those devices themselves are WiFi connected, so the doctors can remote in and then control the breathing function. Now, if you had a full face mask you could ramp up the pressure to push the air back. I don’t know whether you could kill someone, but you could definitely disrupt their sleep for a long time and make their life miserable.

It’s those WiFi home devices that I’m then concerned about. It’s not the fridge killing me, but if the fridge is the initial vector, then into a breathing machine. Or even heart pacemakers that are Bluetooth connected. Could someone get in, via the fridge, into someone’s laptop, which then has the Bluetooth connection to the heart device for the pacemaker?

Si: There’s a beautiful murder case coming up somewhere in the future, isn’t there? Am I giving the criminal the plot now? I am so struggling to remember what series it was on television, that somebody carried out an assassination by Pacemaker in this television series and this was years ago.

I think it was probably more complicated at that point in time. I went through the sleep apnoea test as well, although I didn’t have a mask at the time. I was wired up to a million different things in The John Radcliffe Hospital in Oxford, overnight.

Desi: Oh, you did the overnight test. I just did the, I did the take home one. 

Si: If there’s nothing that is going to make you sleep worse than being wired up to a million different things overnight, I can’t imagine it.

Desi: Not in your own home as well.

Si: I have one of those CPAP machines. It’s Constant Positive Airway Pressure, CPAP machines and mine isn’t WiFi. I don’t know whether it’s better or worse. It’s actually mobile, it’s GPRS, it sends them to back via the cellular network.

Si: For free, I hasten to add. I didn’t buy the machine and, and don’t pay for the data.

Desi: In Australia you can put little Sim chips in them and some connect via WiFi. I was researching because I was trying to find the security researcher that hacked the CPA machines. There was another one. All CPAP machines now have an activated microphone by default. It’s meant to collect sound data, but it’s like another Alexa just collecting your voice data.

Si: I may have to check on that. I don’t think mine does, but I may have to check that.

Desi: When I was chatting to these people, because if I did need to get a machine, I want one that I just control. Happy to have a digital interface, but I don’t want to have GPS. I don’t want to have WiFi. If it does have WiFi, I want it to be disconnected and I want it certified that it is not connected. That it can be proven.

They couldn’t provide me, because it’s all like really closed network of these companies that sell these machines. So, none of the actual specifications are available.

To buy a machine that doesn’t have any of this stuff was like twice the cost. They’re just not produced as much, so they’re rarer to get and there was one company in Australia that you could get it from. That’s ridiculous.

It’s essentially pushing people who need these machines into this closed off market where their data, let alone the security concerns of someone hacking your own CPAP machine. The fact that these companies can then just harvest your data and you can’t do anything about it is horrible.

Si: I was enrolled into it automatically by the NHS and it’s really good, by the way, if you do need one. I thoroughly recommend.

Desi: I’ve got plenty of family that use them and they’re great.  It’s just the privacy concerns.

Si: I log into my app and it tells me all of my sleep data about how many what incidents in sleep apnoea, when you stop breathing.

Desi: To finish off on this CPAP rant that I had because I went down a rabbit hole last year about it. I think there was also a case where an insurance company had purchased the data and then denied someone, some kind of insurance claim because of it.

Obviously that person found out somehow, I think someone whistle blowed or something, and then they countersued as you shouldn’t be able to access that data because it’s private medical data.

That was interesting, I’ll definitely try and find all this stuff with the CPAP Machine. I might have notes somewhere, because I really went down a rabbit hole on this one. It was super interesting, because it’s a niche medical industry.

Si: That is an interesting question though, isn’t it?

On the one hand if you are disrupting someone’s sleep through a hack. I know how much better I feel for having been on it, versus not. How much less tired I am. If you can induce somebody to be in a state where they are more likely to have an accident, then there’s that.

At the same time, being told by my insurance company that, no, you were driving tired that day and therefore I’m not paying out on that accident claim that you’ve just put in. That sounds horrific. It’s an interesting topic perhaps to debate, which is that wearing an Apple smartwatch.

I think it’s an Apple smartwatch. You’re wearing a smartwatch of some kind.

Desi: Oh, mine? Mine’s a Samsung Fit 3. I bought the one where it’s not collecting much. It does step tracking, I can get it to do my heartbeat, and that’s about it.

Si: Oh, right. Okay, so it’s not as bad as it could be.

But even that if that was subpoenaed as part of an investigation into something about you, it’s going to start handing over data that normally wouldn’t have been collected.

Desi: There’s a recent one. Apple’s privacy lawsuit with Siri. They had a 95 million dollar payout. I’m just reading the article from Reuters.

They settled a 95 million dollar lawsuit for Siri, which includes probably some health data out of that, realistically.

I think they calculated per user what that was for how many estimated Apple users they have, and it was like 0. 09 cents per user.

I think it said how much Siri made in a year, and I think for Apple based on the data that they have. It’s not in this one. It was 205, from memory, but I can’t remember whether that was million or billion. Either way, 205 million is still above in a year, is above the fine that they got for essentially selling their data or using the data inappropriately.

All of these things and how it’s being fed into AI, and where all of our data is going, in terms of privacy, is an issue. When it’s then being used against us in health insurance claims and everything else.

Si: I guess the question is, are we heading towards the dystopian future of what was it?

It’s Tom Cruise Minority Report, isn’t it?

Desi: Where they predict the crimes and stuff?

Si: Predicts you’re going to commit a crime in advance and acts. To a certain extent, already we see it because there’s predictive algorithms.

Desi: Your cholesterol’s a little bit high; you’re definitely going to stab someone today.

Si: Yeah, that’s it. But predictive algorithms for policing patrol.

Desi: Yeah.

Si: They do do that sort of thing. To a certain extent, yes, we are. We are already starting to live in the dystopian future. Happy 2025 everyone. Actually, that was an interesting one.

Desi: Just as a side thing, I found the security researcher, which I’m very happy about.

Going back to the Apple thing. Apple will pay out 20 dollars to Siri users and users can submit a claim for each device they use. It’s not just an automatic $20; you have to submit it. Up to five devices or $100 total. Ridiculous.

Cancel the apocalypse, what we can learn from film set in 2025. Right.

Si: I came across this the other day. What the future has been predicting for us in 2025, Pacific Rim. There we are, we have Repo man. Reclaiming organs if you don’t pay your debts. I’m not sure Thor counts entirely.

But Pacific Rim. Large robots fighting in the middle of the Pacific to guide you, he says, stretching his knowledge of Japanese culture. 

Desi: Yeah, it is. Wasn’t it last year that Japan built the giant robot? The giant fighting robot? Then the U.S. were like, we’ll fight you, and I don’t think it worked. Was it Japan?

Si: I mean, if anybody’s going to have done it, it’s Japan, isn’t it? Let’s face it.

Desi: Oh no, it was a while ago. I was way off. It was 2017 when that happened. Well, those nine years went fast?

Si: Time is purely a social construct anyway.

So, what will 2025 actually bring? Hopefully it’s not large giant robots battling, or nuclear apocalypse, although that’s on the cards, it seems.

Desi: I don’t know whether we spoke about this actually, but I got recommended a series, which is also a book and I ended up listening to the audio book of it. It was about the US’s strategic preparation plans for like continuation of president and the White House, essentially. Like Designated Survivor, if you’ve ever seen that TV show.

What it did is go into the history of how all that started. When presidents essentially started to become targets for assassination they went into the world and were traveling around the country, that kind of thing. Then the Cold War with the nuclear deterrents that were going on between the two countries.

The presidents back then, I don’t think they do this anymore, but for a while, there was an assistant to the president that would always carry around the suitcase, which was the football, which had the nuclear armament codes, and that they could launch nuclear weapons.

I should look up what that’s called, but there is a series that you can watch in Australia it’s on SBS, so you could watch it on demand. It was very interesting to hear how there was this huge nuclear arms race, and then what essentially stopped two of the explosions were just people being really hesitant, not wanting to blow up the world, but it could have happened.

Then you see some of the dictators who are chasing nuclear arms who are just unhinged. An you’re like, are we going that way?

Si: I think that’s somewhat scarily been brought more to our perspective with some suggestions of the annexation of areas of land that are of strategic importance, shall we say. Like Greenland. Yeah, put the title of that in, that sounds fascinating.

I did watch some of Designated Survivor.

Desi: Raven Rock is the book. I’ll find the link for that and the TV series is called something else, but I’m sure if you’ve looked up Raven Rock TV series. Very, very interesting.

We’ve kind of talked a lot about AI. That was one of the things we wanted to talk about when we jumped on. The other big thing that we both spoke about a lot together last year and with the guests that we had on was mental health.

I don’t know about you, but I felt myself, and with a lot of people that I’m close to, 2024 was a rough year for a myriad of reasons.

This is me speculating, but I was thinking about this today before we were doing this, well this is my night time, before we were doing this. I was wondering if this is the hangover from COVID still. We had this massive pandemic and for me, that was a huge time sink.

Now, we’ve kind of lost two years, and then we’ve done two years. For me, now I’m like we now coming out of this, and there’s a lot more problems that are symptoms from what we all went through as a society, and even as we’re working.

I felt like cybercrime rose a shitload when we all went to remote work because there were so many workflow changes without any of the security in place. World economics and countries that are putting tariffs on each other, and there’s so much more turmoil than there seemed to be. Then that’s flowing from a macro level down to the micro community level as well.

For me it felt 2024 was like that. I feel like we were only just scratching the surface at mental health when we were chatting last year. I think, I know we wanted to focus on mental health again this year, and we’re going to have another host that’s coming on and he’s doing a few talks potentially around mental health as well that are going to be released.

Si: It’s interesting because I saw this informational video the other day. I will share and I’ll try and find a link for it that doesn’t go through Facebook, but this is the copy of it that I found.

I don’t know if I can share sound, but let’s just go with the video. It’s documented anyway, and it’s fairly self-obvious. It helps if I also share it, doesn’t it? That really helps.

Desi: I see what this is doing.

Who put out this ad?

Si: Sandy Hook, one of the US shootings.

Desi: I know it’s from one of the shootings, is this like a foundation thing though? Like, the Sandy Hook Promise?

Si: I don’t know, actually. I think it is. I’ll try and find out more detail.

Desi: Oh, it is. Sandy Hook Promise Preventing Gun Violence. It educates and empowers youth and adults to know the science to prevent violence in school shootings.

It’s a non-profit US organisation established in 2013. I’ll chuck that link in our show notes as well.

Si: Just the isolation, I think it definitely had an impact, I think it definitely had a feed into it.

Desi: Yeah. Well to share a bit of a personal story, I got out of the military in 2021, I think? No, September 2020. I think September 2020. COVID had started at the end of 2020 and then we went into it.

During that time a whole bunch of defence stuff, defence is great sometimes and then not great other times. I think coming out of defence you lose that familial network of peers. Then hitting COVID straight away. I’d also ruptured my Achilles and had just had surgery as well. So, I was like house housebound for kind of eight months straight.

The year and a half of COVID where it was very limited interaction, for me exacerbated quite a lot of social anxiety. Which is weird because I jump on this and I can chat to you and one on one is, is fine. Doing podcasts and all the content that I put out is fine, but I found coming out of that, it was very hard to go to social gatherings, even with friends if it was more than like three of us there.

To the point where, plenty of times Liz and I would jump in the car to drive and I’d get halfway and I’d be like I can’t do this. I didn’t think anything of it. I was just like, oh, I’m just tired, or there’d be all this other stuff. I’d drop her off, and then I go pick her up afterwards.

Then I went through an assessment process from post military through Defence Veterans Affairs in Australia and part of that’s a mental health assessment. I had all these things that I wanted to talk about from when I was in the military, but as I was talking through them, and he was asking me questions about what I’m like now, I was explaining some of this stuff. I thought that I’m way more fucked up than I had realised.

I think it is typical for a lot of veterans to feel isolated, but then I think COVID made it so much worse because my workmates all still lived near me, but we couldn’t hang out and have beers because of COVID, so there was none of the getting out and still hanging out with friends for a little bit and making some new friends. It was just you’re in lockdown and that’s it.

I think that’s where I was kind of coming at it from. 2024 for me was my realisation year that, that happened. It’s still bad, I haven’t solved any of that, but it felt like that for a lot of people that I spoke to. It’s hitting them that they’re having to go out in the world again now, because there are workplaces that are return to work three days a week kind of thing, two days at home. I think that’s stressing people out because they’re like, I haven’t had to do this for four years.

Si: I’m going to say that the return to work thing is actually a particularly interesting one because, I work at home anyway, so it’s not really an issue for me. But I know that for a long time, even before COVID hit, what I was doing in a day was going into an office, sitting at a desk, typing on a computer and interacting with people for maybe an hour in that day.

I used to travel a lot for work, not in the sense of I used to travel a lot like you do to go to conferences and go places and seek clients, I just used to do an hour plus commute every day to get there and an hour plus on the way back. I was wasting two and a half, three hours of my day, occasionally on one particular job, four hours of my day, getting to a place where I sat at a desk.

The somebody goes, you can work from home. Great. I have four hours of my day back. That’s 20 hours a week that I am not spending getting to somewhere to earn a living when I don’t need to be there. I think a lot of knowledge workers are actually objecting to that encroachment into their personal life again.

It’s not the issue of being in the office. If there was a transporter that would take them there for the meeting that they need to see people for and then they could be back in the comfort of their own home, sitting at their desk, doing the things that they do anyway. I think the return to work thing, as well as that we’ve forgotten how to be social animals to a certain extent. I think that’s quite a weighty conversation.

It’s interesting the way that certain employers have taken it as well because it’s like some employers were like, right, we’re going to save all our costs, scrap all our offices.

My accountant did this. In fact, he doesn’t have an office anymore. He’s only a small firm, but they figured out that everybody was working from home, it was all going perfectly swimmingly. So, they now don’t have an office. Everybody’s perfectly happy. Whereas others are now saying you’ve got to be back in three days a week, minimum.

Desi: Yeah.

Si: So yeah.

Desi: I think beginning in 2024 when I started seeing it, I was against the whole.

It’s never been a threat for anywhere I’ve worked. All of the companies that I’ve worked for since I left the first initial cyber job that I was in when I first got out of the military, have been American companies and they are remote work.

So, start of 2024, I was like this sucks for a lot of people, but I think even myself sometimes, if you only interact with people for one hour a day, it really depends on what your home life is like.

If you’ve got a family, maybe you’re taking your kids to sport, you’re interacting with other parents and you’ve got social interaction in that sense, then work from home makes 100 percent sense. You’re getting the human need of human interaction, physical human interaction, because I think that’s different from you and me being on a call.

I loved when I came over and you showed me around Oxford. Fantastic. I’m not saying this is shit, but it’s way different from the catch ups that we do. So, Liz has had a very busy year at her work, she’s been away a lot for trips for her work and is very busy all the time and I’ve just got the dogs. My human interaction, I’ve found, is very minimal.

If I’m not forced to do it, then I don’t need to do it and it was already an issue for me to avoid it. I definitely felt that towards the end of the year. Especially when I was going through all the shit towards the end of the year, I was like I actually don’t have any work friends that I could just go for a coffee with and sit down, and have a chat.

Sure, I could arrange a call and have a coffee with someone, but that isn’t the same as let’s just go for a coffee because you’re at work. I’ve definitely appreciated having that in the past. I think it definitely depends on your family dynamic, where you’re getting your social interaction and that’s just the individual human side.

There’s definitely arguments either way for companies. On the other side, because my background now is insider risk. Insider risk is much easier to manage when you’re in an office. It is much harder when you’ve got a remote workforce. But then it’s also how society has gone.

You used to live in a house and you drive five minutes to the factory. Whereas city costs, cost so much, which is where all the tech centres are with knowledge workers, and what you were doing is now a commute. Now if businesses were hiring you and then paying you for that commute, you might be less opposed to doing an hour commute, because you can listen to a podcast, you’re just driving into work, but it’s part of your job.

When companies say we’re going to employ people from two, three hours away. I think if they took that stance and they only going to hire people in the city, and then no one can live in the city, they’d find out pretty soon that they’re not going to have any workers.

There’s economic arguments and time based arguments etc. But, it’s a tricky balance. It feels like an us versus them. Going full circle back to what we were talking about at the start, sensationalised media. That’s what the media is like.

Every article title that I read about return to work, work from home, it’s like companies are losing all this money, but then on the other side they’re making Brenda, who’s like a single parent, travel two hours. It’s not clear cut. Let’s have balanced reporting, but I don’t think most journalists know how to do balanced reporting.

Si: Balanced reporting doesn’t sell. It’s that simple. Looping back around in conversation perhaps this is a good parting point for us, is that boring articles that are very fair and reasoned aren’t going to sell newspapers if you don’t have killer AI machines.

Actually, the headline the other day on the Daily Star was how to survive a Yeti attack. So clearly, they know their target market. I have to say, I have taken the photo of covers of that newspaper twice in probably about two weeks because it’s caught my eye, because I’m human, because I’m a magpie like everybody else and I look for shiny and it does that.

We’re a victim of our own success as a species, aren’t we? We pull it out. We want to hear about the gossip. It’s very interesting, two books, I don’t know if you’ve read either of them. One is the Selfish Gene by Richard Dawkins, which is a fundamental exploration of evolution, funnily enough.

Where Darwin specifies that the item that evolves is the species. The species does it. Richard Dawkins puts forward the suggestion that actually it’s the genes because the gene is the bit that gets transmitted and survives. The animal doesn’t, but the genes do. It’s very interesting thing in that regard. The other book is Humans by, and I’m going to get his name wrong, unless I look it up.

Desi: It’s not A Brief History of Humankind? Yuval Noah Hari

Si: Yeah, that’s it.

Desi: Or Sapiens.

Si: That’s it. This is what happens when you don’t make notes before you start a show, and then think of things on the fly. But yes, that one. Obviously, you know, communication and gossip and things that build us as a society are hugely advantageous to us.

We value information, and that information means that. I don’t. associate myself with someone who is a risk to me. Gossip basically exists to go, you know that bloke who lives down the street, he’s a bit dodgy, stay away from him. Means you stay away from the guy who lives down the street who’s a bit dodgy. That sort of thing is actually a survival instinct. It’s something that we as human beings do.

Gossip for us is actually a hugely important aspect of our societal structure and as we build into larger societies the way that we communicate these things is by the press, by television, by word of mouth. We still want the gossip. We still wants the things that are going to stick in our mind as important facts.

Fear AI fridges and perhaps it’ll work, perhaps we will stay away from AI fridges. Perhaps it will stop them from getting world domination and imposing a lifetime of ice cream upon us or something.

I don’t know. We are victims of our own success in this, but what we’ve done is then gone off and created a bunch of tools that allow us to make up stuff completely fictional.

Desi: That’s the thing, right? Gossip, and especially language, has evolved.

Us evolving when language started, the gossip would have been to protect the tribe from external threats. When you think about it, maybe like a from threat within the tribe would have been potentially someone with like a mental illness that was struggling

So, that was gossip to stay away from them, which I think is interesting because I mental illness has been a big thing that I’ve been looking into this year around the different disorders that exist and also, into the research that exists. It’s still quite infant when you look at it because the human brain is such a hard, complex thing to map, let alone understand the actual thought process that’s in it.

Then how does that play in it. Then we’ve gone and created all these methods to create fake things. Then we’ve also created all these networks to then publish all this information very fast so that we can’t even fact check. The news cycle used to be the 24 hour news cycle and it would go into a static paper. Whereas now, the news cycle is like a minute.

Si: I was going to say 24 minutes would be good. It’s not even that long, is it?

Desi: Well, when you look at the attention span of most people and what reels are these days it’s like 15 seconds. How much information can you put in front of someone in 15 seconds? They’re scrolling through that for an hour. How much information are they taking in? How much of that’s fake?

Si: This is a really good question. How much of it are we taking in? I remember the informational piece I showed. I remembered that from an Instagram scrolling session, admittedly. It’s obviously successful enough to have caught my eye and to be memorable. But if you asked me what else I’d scrolled past, I have no idea.

Desi: That’s probably good point to end, because it’s late at night for me.

Si: Yeah, I was going to say, it is very late at night for you.

Desi: That was quite a good recap. We’ll capture some more links to put into the show notes, but we’ve got quite a few there.

Si: I think it was a good warmup for the year. Hopefully we can get a few good podcasts set up. We’ve still got Brett Shavers to organise. Between the three of us, we have singularly managed to fail to coordinate a workable time.

Desi: There was quite a lot of travel towards the back end of the year. Which I think hit all three of us at some point.

I think when we first tried to book that in, I was actually working remotely in Thailand at the time.

Si: Yeah, you were in Thailand, he was in America, I was in the UK. Then he was in Japan, you were in Australia, and I was in the UK. It just didn’t pan out. But we will figure it out. We will get there.

So that’s certainly coming up, and hopefully we will have conversations again with all our good friends. I’m pretty sure that Amped will be on again with the AI image generation. I know that they’ve just released modules to do with reflections and reflection tracking, which is really interesting and an exciting piece of work.

Again, it’s something it doesn’t get right yet, so if you can start to figure out those things. So, that’s another good way for picking it up if you have a reflective surface within.

Desi: I am optimistic for this year. Excited. It will be, I don’t know how much you’ve been tracking cyber threat actors, but as always, Christmas was an exciting period for our cyber defenders out there. We’ll probably see that trickle down into cybercrime. It will be a busy start of the year for those people and I think the message there is to take care of your mental health.

I’ve been there before, and you probably haven’t had much of a break, and you’re probably running into a very busy start of the year with a lot of companies coming back, realising that they have been breached.

Then to all of our Digital Forensics friends as always, there’s lots of mental health issues there, was chatting to a few of them over Christmas as well around, a bit of burnout. There’s a few people who changed different roles from the criminal side into more admin roles. So that’s always an ongoing concern, but it will be a big topic for us again this year, I think.

Si: I think it’s always going to be a big topic.

The question is, is are we going to get to the point where there’s something that’s actually being done about it or not? 

Desi: It feels like at the moment, and where we were getting to at the end of last year, is it’s more of that exposure in those roles that haven’t had it before. If talking about it more on here helps push it out more, gets it in people’s minds, then that’s a good thing.

Si: Absolutely, and maybe some decision makers somewhere up the tree will listen and go, maybe we should invest some money in this.

Desi: I guess the message that we’ll leave you all with, as Si and I sign off, is that if you are feeling lonely, there are plenty of services that you can reach out to. I know Lifeline’s a big one in Australia that’s reached out to a lot over the year. You’ve got Beyond Blue. We’ll try and dig out a list and we’ll put those in the show notes as well.

Si: We’ll make sure they all get put on to the end and indeed if any of you are really struggling pop onto the Forensic Focus, he says, also in the vague pitch attempt Discord channel. If you DM me I’m, I’m happy to have a chat with you personally.

I’m not qualified, but I have been where you are so, do let me know.

Desi: Also, to the people that aren’t struggling, if you are working remotely, reach out to your peers is what I’d say. Christmas and the holiday period itself is a very stressful time for a lot of people because families aren’t always a great time.

So, if you are doing well, then reach out to the others and try and have a deeper chat than you normally would. Especially at the start of the year as we move into 2025.

Thanks everyone. We will see you in a lot more podcasts this year. Hopefully we’ll make it out to a few conferences and can meet you in person. I am excited to be back. Forensic focus. I think this is going into our third year, right? I think like we were kind of halfway through. We’ve definitely done two new year things. So, it’s going to be at least, at least one year full plus others.

Honestly, when I started this, I was like, this will be a quick year-long thing, but here we are three years later and it’s still going.

I’m keen to keep doing it. Good stuff. All right. Well, we’ll catch you all next podcast.

Si: Bye everyone.

Inside The Minds Of CSAM Investigators With Prof. Patrick Brady

Paul: Joining me today for this podcast by Forensic Focus, I have a very eminent professor from the U.S. Professor Patrick Brady, would you like to introduce yourself, sir?

Patrick: Hi I am Patrick Brady. I am a professor in criminal justice and criminology at the University of Colorado in Colorado Springs in the U.S, in Colorado.

Paul: In 2017, you released a paper which exclusively looked at the mental health effects of digital forensic investigators. What inspired you to focus on secondary traumatic stress and burnout among child exploitation investigators?

Patrick: Great question. I never thought in a million years that I would ever be looking into this topic.

A lot of it started in my childhood. My neighbour was kidnapped and she was never found. We were in the same grade and still to this day, she’s never been found. I just remember the response to the community and how they really emphasised stranger danger and things like that. I always thought that was a really interesting response.

I wanted to get better at research to figure out how we actually improve outcomes, but also the struggle of investigating when the crimes involve those that are most vulnerable. So, I went to school to study forensics and while I was going to school, I got a job supervising adolescents who had been adjudicated felony sex offences.

I didn’t even really know the full gamut of what they were charged with and convicted of and things like that. So, I worked there for two years and it really changed my whole perspective on the crimes, but also society in general.

I started to notice how it was really impacting my thinking outside of work and how I was really looking at things through a different mindset. So, while I was working there, I really enjoyed the job but, I knew it wasn’t going to be my future career.

I was fascinated with people that they do this on a regular basis, particularly the digital forensic examiners who are exposed to horrific videos, images sounds, and also the stories of these cases.

When I went to graduate school at Boise State, I really wanted to explore this idea of vicarious trauma, secondary traumatic stress and burnout, and more particularly, how can agencies support the people that are doing this work.

So, that we can have competent, but also healthy investigators who still enjoy what they do, still feel like they are being successful. Feeling like they have the capacity to do this work while still being mom outside of work or while still being dad and having a healthy quality of life at work and outside of work.

Working on a project with a family justice centre, and they also conducted forensic interviews of Children. My focus was on the domestic violence aspect of it. I was able to make some connections with forensic interviewers, and then also investigators who were investigating internet crimes against children.

I was able to make some connections and get a survey out both on a private Listserv for internet crimes against children task force members and those who were certified forensic interviewers that work for a child advocacy centre. I really wanted to explore, how this work impacts people who are in the room with children as they are disclosing and/or not disclosing these horrific things.

Also, the reasons why they’re not disclosing these things. One thing that was really interesting is some of the older victims were very keen to think, I don’t really want to talk about it because if I know if I did, dad’s going to get arrested and then my mom’s not going be able to afford rent.

So, I was interested in how those aspects really impacted the forensic interviewer, but more I was interested in the investigative aspect of it. Those who may not always have direct contact with the children, but were exposed to horrific images, child sexual abuse materials and the sounds with that.

More particularly, I was really interested in this work life balance. Like, how do people do this while also maintaining a good quality of life outside of work? I was really interested in the parental aspect of it, like, how do we actually get good measures and how do we actually get sound information?

I published a study that was looking at secondary traumatic stress, burnout and compassion fatigue. Like a lot of researchers, I think if I had known what I know now, I would have done the survey differently with some different measures, but I still feel like it really gave us some really interesting information on some of the correlates that increase these aspects.

Secondary traumatic stress and burnout tend to be the negative aspects of work and compassion satisfaction is tied to the positive aspects of it. One of the things I was focusing on was does being a parent increase your risk for negative mental health issues?

At the bivariate level, we did find that being a parent does increase secondary traumatic stress and burnout. But when we put it into complex. multivariable models, other factors tended to matter more, specifically prior trauma. That was really interesting because I do a lot of work in domestic violence.

One thing that domestic violence shelter managers tell me a lot of the time, is that whilst it’s great to have people who want to work in this field sometimes it’s hard because a lot of the people that are drawn to this field have backgrounds in it. Not everyone is always able to cope with their prior trauma and maintain a professional role in it.

One shelter manager was saying sometimes I’ll have a new advocate and they’ll be working with a client. Then all of a sudden, I have two individuals that are in crisis because whatever this person said had triggered the other one.

I was wondering if that was necessary or would it screw with investigators, because we have to realise that these are people too, who also have traumatic backgrounds. Whether that was a horrific car wreck, domestic violence or being a victim themselves and across some studies that tended to have a stronger impact over a lot, or being a parent.

That’s why we also ask open ended questions about how this work has really impacted them as a person but also outside of work and also what they want from their agencies.

The trauma factor was huge. A lot of the findings centred around, what are we doing in terms of the onboarding of these individuals? How we are getting them into these units?

10 years ago, a lot of investigators were telling me “I didn’t have a choice”. It was like, I drew the short straw. I had to go into this unit. Now, that is not the case. Now we’re starting to realise that, the negative impacts of this work. You really have to go into the unit with a specific kind of mindset and from what I’ve heard, it seems like agencies are doing a little bit better of a job onboarding them and getting them ready for this information.

Even then, what are we doing for their family members etc? I feel like the family members and friends of people who work in this field tend to be overlooked in terms of, providing support and resources.

When, we know across the board, what really helps buffer a lot of the negative effects of this work is social support that is both from colleagues, supervisors, administrators, but also the people outside of work. Whether they are involved in the field or not, they provide a space outside of work where they do not have to worry about the negative aspects.

Paul: And decompress from it.

Patrick: And decompress. So, from these studies, I got really interested in looking at stress and burnout in police officers. Especially those that were working on crimes against children, sexual violence. Cases that are really heart wrenching and complicated to investigate and how that really impacted things outside of work.

I ended up doing my dissertation on burnout among police chiefs to see, if this is happening among the frontline, what’s going on at the top? What I found among American police chiefs is that they experience a lot of the same stressors. They have some unique stressors because of their role.

Administrators are really the ones that can create the work environment. That’s going to help people thrive. So, understanding the negative aspects of not only the job, but the work environment are really important for administrators to pay attention to. Then also, what are we doing to connect family members and friends of our investigators so that they have a semblance of support outside of work.

What I was finding in a lot of the forensic investigators was, when they get off work, they wanted to relax. They wanted to decompress. They didn’t want to necessarily think about everything that’s going on and stuff.

Sometimes that’s really hard because family members start to pick up on the changes in the people that are investigating these cases. That they become both physically and emotionally distant.

That was really interesting in that the investigators were telling us, I don’t want to come home and I don’t want to talk about my day, one because my day was horrible because of the things that we do and two, I don’t want to burden my family members or traumatise them about this information.

At the same time, they become physically distant where they weren’t really hanging out with friends as much. If they were, it tended to be people that they worked with who did the same work.

That made sense because, nobody understands the work like that. The work we do like those who do it. One investigator said, I have to go to parties that my wife brings me to and I don’t like to tell people what I do because it’s it elicits different reactions. Sometimes you have people that are like, really into it and they want to hear everything and they’re like I don’t want to talk about work right now because of confidentiality, trauma.

Or two, it’s that they don’t like the police, or they think I’m a weirdo because I investigate child sexual abuse material, or, they want to tell me about their own story. That’s not the vibe. That’s not what I’m looking for. It seems like it’s very hard for them to get away from it and even though they’re proud of what they do, it’s a different sense of pride that is not always conveyed easily to others outside of the field.

That was really interesting. They just didn’t want to go to a lot of the things that their partners were asking them to come to.

A lot of the investigators were saying there’s a lot of things that I would normally do that I don’t do now. It’s hard to go to malls, it’s hard to go to parks, it’s hard to go to places where kids are playing. Even the sound of a kid screaming, it may be because they fell or because they’re excited and it can be triggering. It’s things that are triggers that they can’t always predict.

They’ll go to a kid’s birthday party and it could set them into a zone where they’re like, this looks exactly like one of the kids that are cases that we had and stuff and they start to see some of the victims in their own Children.

It also starts to impact their intimacy, nothing’s going to ruin the mood more than an image of child sexual abuse material coming in while you’re trying to be intimate with a spouse. There’s so many things outside of work that are so important for us to recuperate and to get our bodies back to a good state of not being hyper vigilant.

A lot of times these investigators and often parents in general are socialised to be a little bit more hyper vigilant and to look at things through a lens that normal people wouldn’t look at because that is how we catch these perpetrators.

Sex offenders are very manipulative. They not only manipulate the child but also their environment. What’s unfortunate for these investigators is they have to always think worst case scenario kind because that’s likely what’s happening.

So, while everyone else may think that this individual seems like a great person, he’s giving back to the community. The cop is looking at this person is like but he’s a boy scout leader. He’s also really involved in the youth group.

In cases they investigate there is a thing called vicarious trauma, which is where it rewires our brains in terms of how they view safety in the world. Not only for themselves, but for others.

Paul: It changes the view of the world completely doesn’t it.

Patrick: Absolutely and I think that is a key thing that we really need to ingrain, not only in policing, but those who work in the field in these high stress types of cases is that there’s no way that this information doesn’t change how you perceive the world. That’s why this information is really limited to a certain number of investigators who have the authority to get access and exposure to it because it is traumatizing.

When we look at studies and asking officers to rank what are your top 5 most frequent stressors, so things that they encounter on a regular basis, versus overall stressors. Overall stressors, are going to be, number one, witnessing crimes against children. Granted, those are not the majority of the calls that they go to, but when they do go to them and it is particularly heart wrenching. Also, it’s like officer involved shootings.

The more frequent stressors were like family violence, which can include child abuse. When cases are involving children, especially younger children and children who are being abused by people that the child is supposed to socialise to believe to love and respect.

So, an investigator, you have to look at things through a worst case scenario. That cannot be healthy, but that might be a better way to pick up on things that the average person would not that the perpetrator is trying to manipulate.

That weighs a lot on these investigators. I was also interested in what are some things that would help them cope with this work? What are some things that you would like your agency to help you with? What I realised is I did this when I was working on my master’s thesis, since then I’ve gone on and got my PhD and a lot better research, like I said, I would use a bunch of different measures now.

Even just the coping mechanisms. It’s hard because coping is very subjective. My takeaway is how you deal with this work. It should be something that you enjoy, that doesn’t always feel like a chore and that takes your mind off of work.

So, whether that is working out, spending time with your kids, doing things that aren’t going to quote unquote, I hate using that word trigger, but that’s exactly what it is. It’s not the fault of the investigators, because the triggers are inherent, right? It’s our amygdala, it’s our lower part of our brain sensing threats before our cognitive part of our brain can recognise it.

Sometimes there are things that the officer is not even thinking about that just triggers it and they don’t necessarily know why. So, one is being able to take care of themselves.

When we are talking about the onboarding process, the people who are applying to this unit, what is their stress management program and do they have one? That should be one of the first questions. If not, what are we doing in the agency? Do we have a wellness coordinator?

Do we have supervisors that are equipped to help officers understand, okay, we’re working in this unit. There’s pros and cons, but a lot of the cons are really going to mess with you mentally. So, you need to get into a routine where you are taking breaks from work etc. That’s taking care of them outside of work and that’s everything that you could think of that everyone else does to cope with work. Running, activities and eating healthy etc.

Internally, these investigators can’t always control their work environment. They cannot control the workload. They cannot control the content that they are exposed to. It is a necessary evil to have people that are investigating these cases to be proactive and respond in ways that we can to protect children.

A lot of that relies on supervisors and administrators. What I learned when I was looking at the research on burnout with police chiefs is that we really need leaders who are focused on the wellbeing of the people that are doing the work for them.

They call this a health oriented leadership. I personally feel this needs to be something that we consider in terms of promotion and people going into supervisory roles. What is your strategy for helping others cope with this information? How do you deal with crisis intervention?

What are some things that you are personally modelling self-care and stress management? What are you doing to improve the work environment? Are you advocating for, maybe some of the advanced software that can help with filtering?

I know there’s a lot more technologies now and they’re advancing so quickly that I can’t even tell you specifics about them, but a lot of AI programming are streamlining caseloads to really narrow down. I.e., if you get a whole cache of images, like AI can identify specific, nudity, child pornography potentially, and things like that.

Granted, we’re still working on the reliability of these aspects, but are there ways that we can save time and not have investigators go through all these horrific images and videos etc. Use technology to pinpoint the aspects of an image or a video that are necessary for a search warrant or for the criminal offense etc. So that officers aren’t constantly exposed to the horrific-ness of this.

So, our supervisors advocating for improvements in technology, improvements in software. To what extent are supervisors conveying to administrators what their unit does and helping them understand that, this isn’t just a picture of a kid in a bathtub. This exploitation material is horrific.

We now have a ton of research which shows that it is an occupational hazard to be doing this work, but because it is a necessary evil, because it violates crimes, we need healthy, competent people to do this work. The competency aspect is hard too, because technology is continually changing.

Paul: And the training has to keep up to date with that as well, doesn’t it?

Patrick: Yes, and there’s an article that was looking at job stress and policing and they were looking at the number of publications over the years. Really wasn’t into 2010 that we started to see so many more publications.

So, the health and wellness of officers in general is now becoming a stronger priority in a lot of agencies that were mostly focused on the frontline officers. Some of us have been doing the work with the digital forensic investigators, here and there but sometimes that’s not even being caught on the radar.

Agencies will hire wellness coordinators etc, they will hire counsellors with the idea that these are for everyone, but also, what are we doing to create specialised preventative mechanisms in terms of what they’re exposed to?

How do we work with officers who are struggling with this information? I’ve noticed that a lot more supervisors and commanders are now requiring officers who work on a child abuse unit or digital forensics to go see a counsellor. They don’t care if they go there and they don’t say anything, but at least once or twice a year, they have to go see a counsellor.

I’m a big proponent of that and as much as I don’t like to force people to go into therapy because ultimately, cognitive behavioural therapy and these different types of modalities, they require people to be in a space where they’re ready to process prior traumas or what’s going on.

How are we preparing officers? To be vulnerable and to talk about, yeah, this information is hard and I’m struggling with this case. I might need a couple of days to take some time. Then again, going to the counsellor’s in, especially in the US across the board, officers are constantly concerned that they’re going to get their firearm taken away.

So, if they are having suicide ideation etc, legally, they could be a threat to themselves or others, even though if they don’t think that. So, a lot of officers are very hesitant on what they convey. Whether it’s to an in house psychologist or not.

The other thing too, is do we have psychologists working with police officers or available to officers in the community or non-sworn officers? There’s the digital forensics investigators, that know the information that they view. Do they understand what child sexual abuse material is?

A lot of social workers, therapists are really good at understanding trauma, how trauma impacts the brain, how to work with it, but not necessarily the indirect trauma that comes from listening, reading, hearing about these cases and being regularly exposed to it.

Even in the 2017 article, one of the strongest predictors was the indirect exposure. Generally, it is not the content that stresses officers out. It’s the things that they can’t necessarily control. Officers understand yes, I have to respond to car wrecks. Yes, I have to respond to domestic violence. I can figure out how to compartmentalise this information.

It’s the indirect exposures where you’re constantly hearing about cases from others. It seems like these cases are never ending. You think you’ve heard everything before, but then all of a sudden, there’s a horrific case or a child homicide that really sticks with these officers and it’s the idea that they can’t get away with it.

That goes back to my argument about the importance of social support outside of work. The other thing is officers are inherently sceptical of the people that they talk to. It’s very hard for officers to be vulnerable, both male and female officer, because of the potential ramifications. Not only from other officers perceiving them to be weak or not able to hack it versus that they might be a liability or that they might get their firearm taken away

Then they’re not going to have enough staff etc. The other thing is that as much as person could be like, listen, we have privilege communications etc, you don’t necessarily know what’s going to be shared with internal affairs or administrators. So, it’s really hard.

I think that goes back to what are we doing from the top down. To what extent do administrators in agencies are they aware of what a digital forensic investigator does on a regular basis?

Paul:  Are they aware of what they’ve seen, you know.

Patrick: Yes, and also do they know that the people that are doing that work? How often are they stopping and talking to them? What drives a lot of stress is the immediate supervisor and the overall administration.

Officers and people that do this work generally are like, if I have a supportive supervisor, I really enjoy my colleagues, you could shovel poop for a job, but if you like the people that you’re working with, and successes and things you enjoy about the job, then, even sometimes the gruelling aspects could be tolerable.

But, if you have a supervisor that is micromanaging, that is more concerned about budget or how many forensic interviews versus the quality of forensic interviews.

Paul: Or number of jobs going through the department.

Patrick: Yeah. That impacts the people that are doing this work. So, what helps officers is having supervisors and administrators that advocate for them, that know who they are, that can pick up on when the person may not be coping adequately or the work might be impacting them.

That’s from police chiefs to the top brass and also to the criminal investigation supervisors etc. Sometimes that’s a lot harder when you work for these larger agencies where it’s almost impossible to know everyone.

I personally feel that the special victim’s units, the vulnerable units. Those are the people that we want to implement strategies that keep them healthy, still enjoying their job and recognise that their work is valuable and that they’re supported in this job.

Paul: Yep. You have to supply that correct support, that correct level of support to maintain those investigators mental health.

Patrick: Absolutely. What’s great now is that because mental health and wellness is becoming a much more common focus in agencies, it’s so awesome to go to trainings now and officers say, I was talking to my therapist the other day and he was saying this.

It’s cool to see. These are supervisors and police chiefs who are engaging in that health oriented leadership while they’re modelling vulnerability in a way. A lot of times policing tends to be very masculine, true masculinity is being, having a good emotional IQ and being able to pick up on how you’re feeling in the moment.

For example, viewing a video of a horrific child rape, we should be more concerned if you weren’t impacted by that video. So, normalizing the idea that this work is hard, and that this will change their perception of safety and society, both in work and outside of work, and not only for themselves, but for their family members and people that they care about.

Supervisors play a huge role in creating an environment where people can enjoy what they do and feel healthy while they do it. Individuals really need to create a work life balance. I’m not saying don’t hang out with other police officers or don’t hang out with people that work in the criminal justice field. That’s not what I’m saying at all.

 It’s finding ways that you’re not constantly talking about work, or if you are, using humour in appropriate ways. I love hanging out with police officers, because all of them could be standup comedians. They have the worst humour and it is so funny at times, just because they know how to pick up on the obscurities of society.

Those are things that are important to maintain wellbeing. Where we start to see the issues is if the jokes use the victim as the punchline. The victim should never be a punchline. That is an indicator of the secondary traumatic stress.

It’s a tough question because we need people to do this work, but this work is horrific. It is so hard and if we are not providing adequate support and resources necessary.

The other thing is technology, right?

So, our supervisors advocating for technology that helps reduce what they’re being exposed to. There’s a technique called face first, where you just have the image of the face and everything else is pixelated. So, if you’re not needing to look for any specific marks or indicators, where you don’t necessarily have to see penetration or nudity in the child. You could just focus on what you need to focus on in that.

But even then, like in policing, we have a bunch of technology in policing, but none of that technology talks to each other and that technology is five years outdated versus this. So even when technology gets updated, are we providing the adequate training necessary for officers to use the updates and know the different features etc? Working with police, they want change, but they hate change at the same time. It’s really hard in that sense.

I think it’s also important to create opportunities and for family members to get to know one another. So that, if they are struggling with something like my partner seems to be a lot more emotionally distant, getting support and feedback from other families being like, hey, that’s a normal thing, it’s a part of this job, have you tried this or different things like that.

Where, they can feel support as well because that’s the thing, when somebody becomes a sworn police officer, we have to realise that family becomes a sworn police officer. They’re part of the police family and we need to be taking care of them.

Paul: You’ve mentioned so much that I want to talk. From my point of view, I should tell you, I served 30 years in the police force here in the UK, and I spent 14 of those years working as a digital forensic investigator. 90 percent of my work was working with child abuse cases.

So, I got it every day and you’ve said a couple of really interesting things there. Firstly, you mentioned the sounds that you hear when you are looking at the videos. I think that’s something that the general public aren’t really aware of and they don’t take into consideration the role of the digital forensic investigator.

They have to sit there and listen to hundreds, if not thousands of children screaming at times. That, as you quite rightly say, has a massive impact on their mental health. The other thing you mentioned of real interest to me, because I think it’s a hugely under researched area, is the effect that it has on the families of the digital forensic investigators as well.

As your studies pointed out secondary traumatic stress, burnout, depression, etc. They are all mental health issues that DFIs can become susceptible to and when they do, that has an impact on the family. The family have to watch that DFI very sadly going downhill. I’m actually going to release an article on forensic focus about that this month.

It’s actually co-written by my wife and it’s her view watching the effects of working in this profession and how that affected me because I just think it’s important to share that.

Patrick: That is something that we don’t have a lot of research on, the family members of not only officers, but people who do this work and the vicarious trauma is real. There are studies where they interview the officer and then the spouse of the officer and the officer is like no, I don’t think this work impacts me outside of work, I feel like I can cope pretty well. I try to keep them separate from it.

Then when you ask the family members and the spouse are like he’s completely different now that he’s in this unit or as a police officer and not necessarily in a bad way, but family members are very receptive, especially if they knew them before they got into policing or before they got into certain units.

They notice a change in the behaviours because these are the people that love and care about you most. They’re going to be the ones that pick up on the burnout and the stress much more than the officer who’s actually experiencing it.

I would love to read that because I think that’s so smart. I would love to do it more studies where we are getting the side of the family members, especially the children of officers who do this.

I think that’s really interesting because one of the things that I found it when I asked them, how has this impacted your relationships with your children? Forensic interviewers would say it was easier when they were younger because they would just say no, you’re not going to do that because I’m dad and dad says so, or I’m mom and mom says so.

When they start to get older and they started to become teenagers, that’s when they want to know why can’t I go over to so and so’s house? Why can’t I go over to the sleepover? Why can’t I have a smartphone?

I collected this data in 2011. So, most of them didn’t have smartphones, but now every kid has a smartphone and the main negative aspect of this with the parent aspect is hypervigilance and being overly protective.

So, the kids start to get really frustrated. Then when other kids start to know that their parent is a cop, there’s like kids that are like, let’s get him drunk. Let’s get him to do drugs etc. So, there’s this additional pressure on them that stresses out the kids.

We had an investigator say, I come home after a hard day and my kids are arguing over the remote and to me that’s a dumb thing to argue about. I just investigated a case where a kid was raped by his dad and that kid is damaged forever. Then I come home and my kids are arguing about something so dumb. They’re almost taking the stress from the work out on their kids as well, and making them so hyper vigilant that it can create negative relationships.

Granted, we found a good number of people that found doing this work actually made them a better parent. It made them much more open with their kids focusing on developing healthy relationships younger in life. So, when they get to the 10, 11, 12, 13, 14, where they don’t want anything to do with parents, they still recognise and respect their parents and know that they can go to them about tough things.

The other aspect that we have to understand is when we think about child sexual abuse materials, a lot of times we are thinking about that 0 to 10. We aren’t always focused on the idea that from 10 to 18, a lot of those perpetrators are their own peers. So, talking to them about healthy relationships etc, trying to build that closeness early on, so when teens do the natural kind of separation, they still recognise that they can go to their parent in their time of need.

But, if they recognise that dad is very quiet, doesn’t want to talk about problems, or mom is really stressed out from work, then they don’t feel comfortable going to that.

At the same time, what are we doing for the officers and investigators that are doing this work? What I learned doing this is that officers had experienced everything I was talking about, but they didn’t know the words to it. They didn’t know what vicarious trauma was. They didn’t know secondary traumatic stress is.

Just like being an alcoholic and recognising what’s going on is the first step into, developing healthier coping mechanisms. We need to help the people doing the work recognise these symptoms and also their family members so that they can be a tune.

Instead of feeling so lost in terms of how to help this person that they love, they have terms and ideas about what’s potentially going on. Not necessarily to diagnose them, but to find support. I’m sure there’s tons of blogs out there from family members of police officers, forums. I would imagine that there are support groups out there where family members can find more information.

Granted, is that information accurate and helpful? Different story. Also, how do we go about doing this in a way that officers and family members would be vulnerable enough to share struggles and conflicts because there’s bound to be potentially some illegal activity etc.

That’s why it’s really hard to do domestic violence studies with police officers etc. Even though domestic violence rates are not higher among police officers than the general public, and neither are divorce rates. They’re all the same. There’s one study that looked all about it. I think it was one in five officers have been involved in domestic violence. It was about 20 percent.

Granted, I’m always concerned that when I’m interviewing a cop’s kid and then there’s like a disclosure that comes, whether it was from the family or another person, and having to navigate that. Granted, we know how to deal with those from the research standpoint. The long story short, what I’m trying to say is we need this research, but that’s a challenging avenue of research, especially getting agencies on board with it.

The legal department, they don’t love my questions about domestic violence or perpetration because they may trust me because we have a working relationship, but they never know if there’s going to be a headline, oh, X percent of these officers engaged in.

I’m really passionate about this in the way I want to hear everything so we can figure out like what’s working, what’s not working etc. Whilst at the same time, understanding that this is sensitive information to be asking about.

Maybe you could shed light on, do officers that do this work feel like they are a lot more in tune with their emotions and recognise that this work is difficult. That it can stress them out? Compared to other officers that might be in the drug unit or community oriented policing or something along those.

Paul: I think they do, but do they know how to handle it? Do they know how to proactively decompress? No, they don’t because there’s no teaching around that. There’s no training given to them around that.

Patrick: Yeah, and I think you’re so right. Do they know how to cope with it outside of drinking themselves to sleep or using other mind altering substances etc?

Because that obviously makes it a whole lot worse etc. We are starting to see a lot of research on mindfulness now. I downloaded the Headspace app because I was talking to a lot of officers about burnout and how they should engage in mindfulness and in the empirical validity of it. But I didn’t necessarily know what mindfulness was.

I have ADD. My brain is going flat out and so it was really hard to sit down for 10 minutes and focus on my breathing etc. Within three months though, dramatic changes. I felt like I was less aggressive in traffic etc. So, how are agencies incorporating mindfulness into this work?

One of the key things that investigators told us that helps is taking breaks frequently throughout work. So, maybe some of those breaks should be like a mindfulness break where they need to do the 10 minutes from headspace. Go for a walk.

Some commanders were telling us they don’t want their officers looking at CSAM material 2 hours before they go home. Taking the breaks, allowing time to take breaks and ending investigators to good trainings, that are not webinars. We have the conference of crimes against children here. It was always in Dallas. Now they have a whole internet crimes against children conference thing.

It’s the same thing with academics. We love to go to these boring research conferences because that’s really exciting, we get new ideas, are able to socialise with people who do this work, can understand the stressors and it’s fun to be able to learn new things in New Orleans or a different area.

These are the individuals that we really should be investing in and keeping them healthy and sending them to advanced training. I understand that officers do a lot of training, but the specialised training, whether that’s Cellebrite training etc. Get them out of the office and into a learning environment.

Another thing is how are we supporting officers in terms of financial wellness? A lot of agencies promote that they’ll pay for you to go to college etc.

This goes back to the health oriented leadership. It is focusing on putting supervisors and administrators in these positions that care about the wellbeing of their employees and by advocating for things that show the employees that they care.

One study that looked at work family policies. What was interesting is that a lot of the people didn’t actually use the policies, but they liked that they existed because it sent a message from the administrators that they care about them. So, how often are administrators conveying, make sure you take time for yourself, or every Friday now, we’re going to wear jeans and then blow bubbles off the building.

That sounds dumb, but it’s something that takes their mind out of it, it shows that the agency is caring and recognises that this information is really hard.

Paul: What’s your views on the stigma within policing around mental health? I know certainly here in the UK, there is an awful lot of research, which identifies that within police forces there is a large amount of stigma relating to it. Officers are worried about seeking help for mental health issues because they’re worried it comes back later on and it prevents them from being promoted or moving to another job.

Is that the case in the States?

Patrick: Yeah, it still is. What’s awesome is we are getting a lot of great research coming out about women in policing and women in specialised units. These are all interviews that happened within the past five years, and it’s still a very masculine environment especially women getting into SWAT. It’s a lot better than it was, and you do have a lot of officers that recognise the value of vulnerability and, diversity and things etc.

But even the women that are going in to this are still being challenged. They’re being tested to see whether or not they can cut it kind of thing. So, granted that may be more of a specialised, unit. But I think the more that we are normalising health and wellness in officers. Officers are so tired of hearing like a self-care plan etc.

But are we doing training and workshops to help them develop a selfcare plan? I think we need to be identifying people who are formal and informal leaders within the agency. Maybe someone on patrol that is not a supervisor in any capacity, but has influence over others. How can we identify some of these?

Influential individuals within an agency, pull them in for training and then train them on secondary traumatic stress, burnout and how peer coaching etc. So, when they go back to their own units, they can influence. They can normalise the importance of doing this by encouraging them to use to demonstrate and model selfcare as well.

In the United States, a lot of agencies are going towards allowing officers to be able to work out on shift and so they get paid to work out. I would like to see that being extended to civilians as well, especially digital forensic examiners who may not be sworn, to also have that opportunity to take a break and go work out, to go engage in mindfulness.

Up in Fort Collins, Colorado, they’ve had an in house psychiatrist for 30 years. He just retired, but everyone in that agency wants to go talk to Dr Dan, that is a normal aspect of it. This is because they have a lot of leadership that is really focused on health and wellbeing.

A lot of the issues in policing in terms of masculinity is you have to be tough etc, but being tough is also being mentally tough as well. Being able to know when you are starting to experience these things and being open to hearing others feedback about, for example hey, I’ve noticed this is going on etc. Emphasizing the importance of that.

Paul: You have just talked there about the psychiatrist who had been in that role for 30 years.

How important do you think the continuity of talking to the same person about mental health issues is? Does that make it easier for someone who is suffering mental health issues to really open up to someone?

Patrick: Yes, I would think so, one is because he has that institutional knowledge. He also has two offices. He has one in the police department, and then he has one that is not connected to any public building. So, officers don’t necessarily have to be seen going to see him.

The fact that he is a police psychologist as his background, he has that unique institutional knowledge that if officers aren’t opening up, he can ask questions in ways that can help them maybe potentially talk about some of the things that they are dealing with. As he’s heard it from these officers and he’s heard everything about how this work impacts them personally outside of work etc.

I think that’s really helpful. Plus, he is not a police officer, but he can understand the unique stressors and traumas that are part of this.

For rural agencies where we’re starting to see a lot more of the telehealth and a hotline that can connect to a therapist wherever. It goes back to the idea of if you’re 25 years in policing, you go to a counsellor and it’s a 23 year old that just graduated with their social work degree and has never really worked in policing. Trying to talk about indirect traumas from child sexual abuse materials like that may not be within their wheelhouse.

People who are in crisis and trauma pick up really quick; this person doesn’t know what I’m talking about or doesn’t get what I’m talking about. But at the same time, I would love to see more officers as social workers where agencies are paying for them to go get their degrees in Counselling and social work so that we have more people that recognise the stressors of policing.

Who are equipped to provide clinical support. They may not be police officers anymore, but they work in these agencies as counsellors and social workers to help officers.

Paul: Someone with lived experience, but who is also qualified to deliver support.

Patrick: This is not to say that people who don’t have a lived experience of policing are not qualified to support. I’m talking specifically about that Child sexual abuse material is a different type of trauma to other types of traumas that can occur in policing.

It’s helpful to have people that are very aware of that. I would question how many trauma programs are really focusing on the indirect aspects of it, because I think that so many times, we are dealing with clients that are victims of crime. They have the PTSD versus someone that is has never been directly exposed but every day I have to hear the sounds of these children etc.

How can we train people to specialise in that? I feel that every station should have a station dog, which is a support dog that just hangs out and go and walks around. Not even a therapy dog, just more of a support dog.

It’s a trained dog. It’s not just a lab running around doing nothing, but it’s a therapy or support. I know that there are differences. I’m not entirely sure, but we’re starting to see a lot more agencies get small grants to have a dog in the station to help especially in the dispatch area, which are our emergency 911 callers.

I just read a study; it was an experimental design to see whether having a dog in a child forensic interview helps reduce stress. They took cortisol samples of children before and after and those that did and did not have the dog. They found that stress levels were dramatically decreased when they were able to be in there petting a dog.

I feel like that would be really important for officers as well. I need to go see, the psychiatrist, but if he had a dog there and can be petted, that might be more encouraging or helpful for that officer to open up.

Paul: It’s very interesting you say that, because I now work as a psychologist within the NHS here in England.

One of the things I’ve just finished is a therapy dog evaluation with patients within the facility where I work. The early outcomes from that, because I haven’t finished analysing all the data are incredibly positive. Incredibly so. The difference it makes is really significant.

How do you think your research can influence policing on the type of support that they provide?

Patrick: I think it provides more credence to the normalisation of the importance of taking care of ourselves and our families. I think the message is something that officers can resonate with.

Sometimes it makes sense on face value that this information and this material would be hard, but actually to show them data. I always like to do the mixed method studies where you have the numbers, but then you also have the quotes to help support it.

I can send you the slides that I do in my burnout training that has some of the quotes from other studies that we’ve done. Which speak to individuals and their experiences. I was interested in this topic and when I started doing this training it was like a light bulb moment realising that’s what it is or okay, it is a thing.

I think this research that you’re doing and others are doing in this area is really important because it’s empirical science to help the administrative naysayers who are not concerned to show that this is an occupational hazard. You, as an employer have an obligation to keep employees as safe as possible.

This is a risk factor for severe mental health issues and burnout. We already have an issue with recruitment, retention and policing. If we are not investing in our investigators and our officers who are working these cases, we are just going to have burned out officers. They’ll serve in this unit for five years, rotate, but the body keeps score of traumas, right? Everything that happened to them now travels with them to the next unit and it doesn’t fix things outside of work.

If we are not investing in preventative aspects from onboarding as well as asking, what are we doing when officers retire? This is very similar to officers getting out of the military where so much of their life was identified within the military. It’s the same with policing.

When you’re doing this work, I quickly had to realise that when I started working with the sex offenders, I’d be like, oh my God, this crazy thing happened. I’d start talking about it, and I just see the faces of others. I’d realise not everyone wants to talk about child abuse at the Chilli’s.

I had to quickly realise there’s a time and a place and not everyone is thrilled about this. When that is so much of your life and then all of a sudden, you’re done, you’re retired, you have all those thoughts and it’s a big transition.

What are agencies doing to help people when they are retiring and developing support systems after because it could be very lonely after policing. Especially when you’re not surrounded by a lot of other officers.

Paul: But the other thing is, are agencies supplying that mechanism where they wind the officers down, decompress them and give them the coping strategies they need to continue? I don’t think so.

Patrick: No, not to the extent that they need to be. I’m comfortable saying that because I definitely have seen good examples of agencies doing well, but that’s not the majority of agencies. Policing is a government agency resources are limited.

The other issue too is with staffing, especially officers that have the investigative skills to do this work. It’s hard even if you had programs to help, Officers wind down before they go home for work, there may be so many cases that the officers are like, I can’t engage in this right now because I have so many cases and it’s overwhelming, it’s hard.

I honestly feel like it it’s going to take a whole culture change within policing which I’m very optimistic about. Especially younger officers, because the people that are going into policing now are the most educated that they’ve ever been. They very are attuned, but it’s Gen Z and below, it’s all the anxious generations.

These are individuals who are coming into policing, are already addicted to screens, have overprotective parents etc, and they already have these anxious, depression aspects of it.

So, even though they’re educated and they understand the importance of wellbeing etc, how are we ensuring that people are taking care of themselves without violating personal privacy etc? I’m optimistic about it, but I would like to see a lot more.

But I am an academic who sits in an ivory tower being saying, it’d be great if they had a therapy dog, right?

It’s easier said than done. I love talking to people in the field because they’re the ones boots on the ground that recognise what would and would not work. That’s why I don’t feel like academics can solve this alone.

We have to develop these researcher practitioner partnerships that are about trust and mutual goals in figuring out things like how do we reduce suicides. How do we improve the wellbeing of officers so that we can have people who are competent doing this. That also deserve their life outside of work, being healthy and with family and friends, enjoying life.

Paul: What specific changes would you recommend for law enforcement to support digital forensic investigators?

Patrick: That’s a good question, because I’m a researcher, I definitely think that more government support for research with digital forensic investigators and agencies being willing enough to work with researchers to help figure out what works so that we can develop polices or programs. Something that other agencies can adopt and adapt to help their officers as well.

I think more funding for training outside of the office and out of the state, potentially. More specialised training where they can go and mingle with other forensic investigators for a weekend, learn some new skills and bring that back.

I think promotion needs to have a health orientated leadership component of it. A lot of times, during promotions, they ask about their leadership style and their strategy. I’ve added that too, in terms of the promotion. That’s something I always put in there. For example, this is the only candidate that even mentioned anything about mental health or health of the officers etc and the others were focused so much more on physical health versus the mental health.

I feel we need to have more supervisors that are well rounded, not only understanding leadership, but also how do you be a leader among individuals who are likely to be in crisis and/or easily triggered by some of the information because of the nature of the content.

Then what does that look like in their agency? How can we help those supervisors learn from other supervisors? So, definitely more support. My last recommendation would be more support for family and friends. People who do this work to the point that they don’t necessarily have to know everything that they’re exposed to, but they know that it is traumatic information that potentially can change their personality and behaviour.

What can we do to be a supportive person in that role? We collected data with police chiefs and asked them if they were in a relationship and whether they were in a relationship with another police officer, someone that worked in the field of criminal justice or someone that didn’t deal with this at all.

I wanted to see if that impacted stress and burnout. It didn’t. What impacted stress and burnout was being single. Granted, with police chiefs it’s already lonely at the top, I couldn’t imagine, dating is hard enough, but dating as a police chief in a small town would probably be even more rough.

It’s the same for officers. We need human interaction. We need support from others. What I got from that is it didn’t necessarily matter about whether they fully knew what was going on. They were a partner that could provide different types of emotional and social support. Helping them realise, helping them feel more human in a world that doesn’t always feel human.

Paul: Do you think there’s adequate resources assigned to supporting DFIs?

Patrick: No, I don’t think so. That’s hard, right? Because the bulk of a police department’s budget is personnel and so everything on top of that is really trying to figure it out.

I think that speaks more to the government’s role in providing funding not necessarily things like research grants, but grants for agencies to develop a wellness program. Try different things out and we’re seeing that now. Every RFP that comes out for federal funding now has some officer safety and wellness aspect of it, which I think is great.

I want to see more of it. I want to see more efforts to help grant writers and people within agencies to write these grants so that they can get it. Writing grants is insane and it takes a lot of time and officers aren’t always grant managers etc.

I just think if society is concerned about turnover and policing, we need to start investing and streamlining trauma within agencies. Focusing on the units where trauma is most likely to be present.

That’s going to be your elder abuse, your vulnerable victim unit. It’s not picking favourites but providing additional resources to those units. So that they have the adequate software, they have the adequate technology, they have the training and also have the support both inside work and outside of work.

Paul: I think one final question because I have taken up quite a bit of your time.

Patrick: I’m on break. I don’t even go back to work until two weeks. I could talk to you for hours.

Paul: What further research do you feel is needed in this area?

Patrick: Definitely perceptions of family members. Perceptions of family members, but also longitudinal research. We need to measure these factors from the same individuals over time and isolate the things that they’re doing that reduce and increase that stress. That goes back to a recommendation about increased funding for research with these agencies.

I’ve been very lucky. I really have not come across a supervisor or commander that doesn’t agree with the need for research. So, it’s nice that a lot of these agencies are becoming more willing to work with researchers in those areas and the longitudinal aspects of it.

I would love to do a lot more focus groups with people that do the work to address social support, what that is, what that looks like and what they want.

Paul: And how they can use that.

Patrick: Absolutely. What are the strategies to implement that? I would love to interview people who score very low on burnout and secondary traumatic stress to see what they doing, that might be unique.

I always love to ask officers whatever I’m studying. What would you tell yourself, when you first started, about this? Usually it’s about stress and burnout. What would you have told yourself when you were getting into this unit to help cope with the reality? Knowing what you know now, what would you have liked to tell yourself?

How would you help onboard future officers getting into this role, kind of thing? I don’t want officers to scare others away because some officers were straight up, I don’t want anything to do with the crimes against Children. I fully understand that, but the ones that are interested in doing it, hopefully for the right reasons, let’s build them and get them the experience and training. Also, the reality to understand that this is not a walk in the park, this is intense.

So, definitely more research to understand the social support more and research on perceptions outside of it. I would even love to do a survey of just administrators of agencies that have a child abuse unit or a ICAC unit to see, do they even know what they do.

Paul: Yeah, what’s their understanding of what’s going on at the coalface.

Patrick: Yes, because I feel like that is the kind of research that’s really going to be enlightening for other administrators. Other administrators, they may think I thought I knew what they did or how often are they checking in? Do they even know their digital forensic investigators etc?

Granted, it’s not their job to be their counsellor, but it’s even just stopping by showing face, helping them recognise that they are valued and supported within the agency. Those are the leaders that we want. I don’t think the majority of administrators would know the nature and extent of the work that you do.

That’s no shade on them. They have a lot of meetings. They’re busy. My recommendation to all police officers is to never become a police chief. That sounds awful but those are necessary positions. More research in general is needed.

I would love to figure out a way that we can help officers who are struggling with suicide ideology that doesn’t require them to relinquish their weapon. I know that’s easier said than done and that’s not really my wheelhouse in terms of the ethical aspects of all that. But I think the more that we implement leaders who care about the wellness of their employees, the more that we’re going to change cultures within agencies.

That’s the thing across the board, across the world, every single agency has their own unique culture that is so different to the town over. It’s one of those things where you have to be realistic.

I’m good with one agency at a time. One agency changing something to improve the lives of the officers that are working for those agencies. Hopefully that information spreads throughout the state, throughout the world. Making research more digestible to people in the field.

Paul: In plain language as opposed to complicated language that people don’t want to read.

Patrick: Yes, and easy, like a one to two page handout for administrators, because everyone’s busy. We want a summary. Now that we have AI and different etc, there’s so many ways that we can make information digestible to officers. I think roll call training would be really helpful as well.

Every now and then just reminding officers these are the two components of burnout. These are the symptoms. Here are some things to look at. That could be a five minute video. It could be a corny animation, but it would be something that helps officers remind them. The other thing too is officers are interested in this.

Even though they don’t necessarily think about stress management, some officers are really healthy. They like to work out, but every person who’s probably held a badge and a gun recognises the dangers and the stress that can come from this job. I would imagine that they’re all open to solutions and suggestions that seem realistic and feasible to actually help them cope with this job.

Paul: It’s actually quite interesting. One of the things that you’ve just mentioned again, there was the training within the sort of role call time when cops are coming onto shift.

One of things that I’ve done here in the UK is create a booklet. Which explains what the signs and symptoms are that DFIs may become susceptible to. What they look like, how they affect you and how you can deal with them. I’ve distributed that to various forces and companies within the UK.

The feedback I’ve got from that has been really positive because, as you are quite rightly identified, many people don’t know how to put a label on it or what to do. I found that quite cathartic doing it. I’ll be honest.

Patrick: Good, because it’s hard. The other thing is finding correct information because still at this point in 2025, we still don’t have consistent definitions on what secondary traumatic stress is, compassion fatigue etc.

That drives me nuts. Even though I try to outline it in that article, there are succinct things, I’ve been burnt out before, and it’s very scary because you feel like your life’s over, you don’t know how to do this work.

Specifically from doing this research, it really can get to you. Then you go on vacation, you come back and you’re still exhausted. Burnout is a lot harder to deal with than we think.

That’s why I feel we need to be a lot more proactive getting people to help everyone else in the agency. Look out for one another and recognise. For example, if you have an officer that you think is crappy at their job or irritable, things like these are all indicators of potentially some type of stress that’s going on. Do we have supervisors that can hold them accountable but in a respectful way that encourages them to take care of themselves, go see the therapist etc?

Paul: But do we have the supervisors who are qualified enough to recognise those signs and symptoms and the, direct that person to the help that they need?

Patrick: And do others respect and support that person that gets the supervisor role because the distributive justice is another predictor turnover in policing.

So, if officers feel promotion is big among officers and a lot of the consistent complaints across police departments is that they feel like supervisors play favourites, the people that get into these roles are the friends of others. So, there’s not due process or easy way to do that kind of thing. I feel like there’s better criteria.

Especially if this person scored 10 out of 10 on the health and wellness, even though you don’t like them, this is the kind of person that cares about the unit.

It’s easier said than done. That’s why I like being an academic, saying thanks for having me on your podcast, please do all the things I say.

Paul: Before we stop the recording, I’ve noticed that you have recently been doing an awful lot of research around stalking?

Patrick: Yes.

Paul: I would love to do this again but target it at the research that you’ve been doing around stalking because that is a very big, very hot topic over here right now.

Patrick: Don’t you threaten me with a good time because that’s another topic that I love to talk about. Another thing that I’ve realised too is that I’ve done so much training where the officers come in to do stalking domestic violence training and at the end it’s a line out the door.

We cannot be upset about officers doing something that they’re not getting adequate training in. So many officers don’t get adequate training in stalking, but what’s awesome is the UK, England, Wales, Australia are 10 years ahead of the research. Not only this, but stalking domestic violence. I’m learning so much from you all.

I would love to talk to you about that in terms of the investigative standpoint, why victims contact the police, why they participate in the cases, what the motives of offenders are, how we can identify stalking cases and help officers put the pieces together. But that’s for another time.

Paul: I’ll arrange that. I’ll come back to you and I’ll arrange that for another time. Professor, I want to say how grateful I am for the time that you’ve given me today. I’m sure the viewers in Forensic Focus will really appreciate the advice, the guidance, the knowledge that you’ve shared. Thank you very much.

Patrick: Of course, and if any of your listeners want access to the articles, I have no problem. They can contact me; I can give you my information, I have no problem sending that to them because sometimes they’re behind paywalls. That’s another frustrating thing about making research digestible and accessible to the people that need it the most.

Paul: I’ll make sure the readers are aware of that.

Patrick: Perfect. Thank you so much.

Paul: Thank you.

Crypto Crime – No Such Thing?

Si Biles: Hello everyone and welcome to the Forensic Focus podcast. Today we have with us Nick Furneaux, very well known in the UK, and apparently quite well known abroad now, I see from the fact that you’re consulting for American companies and doing international lectures and all sorts of things. But well known in the UK for his forensic work.

He’s worked in some forensic software development and is well known in the cryptocurrency world. We are going to talk about a lot of that. We do know each other, we’ve met before, somewhere. I have very little recollection of where. F3 or something like that. We’ve met before.

You popped up in my LinkedIn feed because you’ve got a new book out and you, yourself, admit that it’s clickbait title from your talks. It’s a good clickbait title because it’s entirely true that there’s no such thing as crypto crime.

We’ll come to that in a minute, but just before that, tell us about yourself a little bit, how you got into this crazy and lovable world we like to call digital forensics.

Nick Furneaux: Oh, my goodness, there’s lots of ways of telling the same story really. In my CV, that the police always look at and curl their nose up at, I always say that I was playing with computers since I was about 12 years old.

Had a ZX81, Sinclair with a 16K RAM pack that you had to hold on with Velcro. There will be people that remember that who are of a certain age. I have always just enjoyed tinkering with computers. I don’t enjoy being in the limelight actually. I don’t mind this terribly because it’s just you and me, even though I’ve spent more hours than I care to remember on conference stages, panels and training.

Training thousands of police officers in different forms of forensics, specifically memory forensics and cryptocurrency investigations. So, I’ve always been playing with computers.

I then fell into forensics. I’m not going to do the boring story, but we were writing tools for the covert extraction of data for those types of people that would need to do such things. That then led us into the more computer forensic stuff. I found myself in Florida, at the University of Florida a large number of years ago now. I was a much younger man with a terrific guy called professor Haniph Lachman, who was head of physics at the university of Florida.

He showed me this thing that at the time was called Expert Witness. Which of course in no time at all became EnCase. I think he was on Clinton’s task force for education at the time and they were involved in the investigation of computer crime and how we could do online training when we had 28k modems and all this stuff.

I remember looking at Expert Witness thinking this is ace. I want to do more of this. Then I found people like F3 eventually, but I’ve always been a little bit left of centre. Some people will remember Helix. It was written by Drew Fahey. Drew and I became good friends back in the day we were teaching the Helix course of that live forensic analysis.

I remember speaking at F3 with Jim Gordon. Some people might remember Jim, West Mercia police, about doing live forensics on a live running machine. And, I remember the old guard sat at the front with their arms firmly crossed.

Si Biles: Tony and Brian there.

Nick Furneaux: These men are giants in helping us form process and if anyone did the old Cranfield take the three and a half inch floppy disk apart thing and find your way through it. I was much more interested in the analysis of live machines because that’s where I come with the covert data extraction stuff. That was the interest, what can we get from a live running machine?

Which took me into memory analysis, because we started pulling memory from machines using Helix. So, some people remember me from teaching, memory analysis, volatility and that sort of thing.

If you want me to square up the circle, brings me up to about 2015. A good friend of mine, a good forensic investigator from a police force in the UK, called me and said, we’ve got a computer here with Bitcoin on it. How do we carve the Bitcoin off? I thought to myself, that is such a logical question for a forensic person to ask, but absolutely the wrong question.

If you don’t know why that’s the wrong question, go and do some training, read a book or something. I thought this is probably something we should try and build some training around.

I started to get a few cryptocurrency oriented cases in, working with some of the big companies like Chainalysis at the time. Then, in 2017 my mum got really ill and died and I didn’t feel like working. Wiley had been chasing me, the publisher in the US, to write something and I thought I’d write something about cryptocurrencies. That’ll be good.

In 2018 I published Investigating Cryptocurrencies and my entire life then went hard right into the investigating of crimes that involve the use of crypto. Six years on and in some ways, nothing has changed. In other ways, everything has changed and it was time for a new one.

So, the new book, there’s no such thing as crypto crime is much longer, almost double the size, and is written for a much broader audience. Is that a fair CV?

Si Biles: It’s a wonderful Pressie. Yes, absolutely and you’re absolutely right.

It’s the way the industry has changed in the time. It has gone from that concern about Dead forensics through to live forensics and memory analysis through to, things that don’t even exist on the computer anymore and now somewhere floating in the ether, in blockchains.

Nick Furneaux: Don’t get me wrong on this. Do no harm forensics is always what you’re aiming for. You’re always aiming to make as few changes as possible. I always used to argue that if you pull the plug on a computer and you’re going to lose some registry keys and some income data, but I’d say yeah, but you’ve just deleted Four gig of memory.

But you can’t get anything out of memory. which proved to be utterly untrue so there is no way of steady state forensics, do no harm forensics, because when you kill the power, you eradicate most machines. Probably 16 gig of intelligence and evidence. So, you should always make as few changes as you can.

We did some work at one point and we found that actually pulling the plug on a machine made very little change to the hard drive, just stuff that hadn’t updated page file stuff and that malarkey. But obviously, you killed everything in the memory.

Now, if you had left the machine running, as long as you didn’t suddenly have antivirus run, or this was some terrorism suspect with a kill switch on their computer. Plugging a USB key made a couple of updates to a few registry keys, not too much, few other little bits. I think we were looking at something like 128 K of changes in order to plug in a USB key and run a command line tool. It was very small.

For me, the offset of the risk of keeping a machine running, taking your eight gig of memory and having the skills to be able to drag all the amazing evidence and intelligence you can get out of memory was always worth that offset for me.

Si Biles: I think that’s enshrined in the ACPO guidelines, isn’t it? Which is don’t change anything, but if you do, tell us what you’ve changed and at least know what you’re doing. If you’re making a conscious choice at that point, then it’s a win.

Like you say, if you’re picking up eight gig of additional, network connections, passwords, unencrypted files, it’s a huge amount of additional information that can add to a case.

Nick Furneaux: I always argue with the traditional forensics, you do no harm, but there’s no way of entering a crime scene and not making changes to it.

Si Biles: Well, in MeetSpace forensics, and this is a phrase that makes some of my colleague’s wince, there are DNA exclusions. You send your lab techs in and they’re all excluded by DNA, which is great if you’ve committed murder. So, that’s a known change.

If we’re saying effectively, we’re just going to remove our DNA from that scene and look at everything else, then we’re no worse than any other traditional forensic science.

Nick Furneaux: I’m sure it is still a debate of interest. Of course, it’s getting harder as machines now are almost all encrypted now and it is getting a little bit harder to get to live running machines and to be able to extract data. Memory is becoming a little bit trickier to analyse and so, we may go around in a big circle.

Si Biles: Well, it’s the perennial every time we make a better mousetrap, nature makes a better mouse, isn’t it? It’s the same as finding a loophole in something and then somebody will close it because it’s a security issue. If you can do it, it’s a security issue.

My background was information security before this, so I was rapidly trying to close up all of the things that other people were finding as ways of getting data out and stuff, in similar organizations to you.

Nick Furneaux: It’s interesting because it is tricky this whole do no harm thing. It looks like I’m looking at something, doesn’t it? Actually, I’m just being thoughtful. That’s probably a tell, that when I’m looking, I look up to my left or something.

Si Biles: It is, looking up to your left as you’re telling the truth and looking up to the right as you’re constructing a lie or something, I don’t recall.

Nick Furneaux: That’s interesting actually, because if I look to the right, I don’t feel as comfortable. Somebody would build something into that or read something into my personality. Anyway, let’s move on from that.

Si Biles: So obviously you’ve pivoted. I’m sure there’s still plenty of normal forensics around what your cryptocurrency cases are.

Nick Furneaux: Actually, that is a really good question in its own right. We have a real problem at the moment. There’s three parts to an investigation that includes a cryptocurrency. The one that everyone thinks about is the middle one, which is track and trace.

Everyone’s into following the funds on the blockchain, where have they gone, go into an off ramp, go into an exchange, finding an attributed address. This is all really good. But that’s only one of three.

The first one is discovery. I remember a couple of years ago talking to a very senior police officer from a country in South America saying have you started buying tools in like TRM labs, who I represent a few days a week and others, and he said no we don’t come across it. No, we don’t see crypto at all. The only reason when the rest of the world is seeing it in almost every criminal category, is they simply weren’t looking.

We do have a problem at the moment in that there aren’t really aren’t really any tools that define themselves on discovering crypto use and extracting the appropriate intelligence and evidential stuff from a phone, from a hard drive at that discovery level.

Don’t get me wrong Magnets tools are always really good and they do a little bit. I was kicking Jad, I mean everyone will know Jad at Magnet, about building more in.

There’s a really good company called CAT labs that are doing some really nice discovery software, but what we are missing is what we had at the back in the early days of forensics, when we had those freely downloadable fire and scripted tools that would do that when you don’t have the 20 grand tool on your desk.

There are just hardly any cryptocurrency oriented discovery tools around, that a forensics lab or an individual investigator could download and run and find Bitcoin addresses, Ethereum addresses or carve seed words, private keys and things like that.

So, if anyone fancies having a bit of a right, there’s a real gap in the freeware market for that at the moment. We could really do with the forensics community stepping up and realizing that there’s crypto now using every single criminal category and the discovery tools for phones and hard drives are really not very good or very good, but very expensive.

Si Biles: I predict a student, MSC project on that in the future from me.

Nick Furneaux: They can reach out if anyone wants to work on that. I have just about every greppable of almost every cryptocurrency on the planet. I certainly could. I’m not a great programmer. I don’t know about you, Simon. I’m a bit of a tinkerer. I put something together, but it’s a bit crap, if I’m honest.

Si Biles: My code is somewhat like my Russian. My wife’s Russian, or was Russian. I can listen to it and understand what she’s saying, but if I try and construct a sentence, I will A, mispronounce it, B, structure it wrong, and probably say something horribly offensive.

That’s I like my programming. I can read other people’s code, and I can make sense of what it’s supposed to be doing. I can do that, but if I sit down and try and structure it myself, it will turn out to have the wrong grammar and to be spelt wrong.

Nick Furneaux: It’s just the world of errors, isn’t it?

Si Biles: That’s absolutely right. So, my code writing is very limited. Scripting, grep and command line stuff, I’m quite familiar with. I’ve been the Unix was happening when I was a sysadmin, before I was anything else. Stringing together commands, that’s fine. That’s not programming.

Nick Furneaux: Although, actually I always feel that anyone that can write regular expressions has something just slightly wrong with them.

Si Biles: That is true. There is a slightly deranged, unhinged thing in getting a good regular expression.

Nick Furneaux: I can write a regular expression for that. You shouldn’t be able to do that. That’s not a life skill that should be a good thing.

Si Biles: I think the thing that put me off to start with was back when I was a sysadmin, it was like can you write a regular expression to parse an email address? The answer is no, you can’t. It’s not possible, because the way the email address is structured just means it’s not possible and you’re like, okay this makes no sense at all. I can’t do it, it’s fine. I’ve got the book up here.

Nick Furneaux: Was it like anything, at anything dot anything?

Si Biles: I’ve got the grep one kicking around somewhere as well for the reference, because you can’t do without them. It’s impossible.

Okay, first of all, the next person in the forensic focus forum that asks, has anybody got any suggestions for an MSC project?

You’ve, you’ve heard it here first.

Nick Furneaux: Put them in touch with me seriously, or reach out. Nick Furneaux on LinkedIn and send me a connection request and DM me about it. Or reach out to Simon for my email address or something. I’m more than happy to help and support because we really do need these discovery tools.

I say, this is no disrespect to Axiom, to Cat Labs, who are doing some really good stuff, but not everyone in the world can drop four digits on a tool. So, back to the old freeware tools that we all used to enjoy. Don’t get me wrong, I’m not sure you can always go to court on this stuff, but at least it’s a starter for10 in an investigation.

Si Biles: Yeah, absolutely. You can start to get funding if you’ve got something to follow up on.

Nick Furneaux: That is absolutely right. We all know this stuff. This is back to not being able to go to court and the judge says, how did you find that JPEG? And you said, I’ve absolutely no idea, FTK did it for me.

You still have to be able to recreate key findings. We can’t just rely on the. The old big red button. So actually, some of these tools that use regular expressions that we can actually look at. We can reconstruct or write an end script or something to say I wrote a tool which extracted that and we found it at this offset and so on.

You do need that. Again, that is in no way, dissing think tools like Axiom, which are fabulous and needs to be in every lab that can afford them.

Si Biles: There is a reason that it’s this way. I’m going to say conjecture as a whole, but is it change of pace in cryptocurrency? Is it the lack of knowledge of it? Is it the unfamiliarity? You were saying about that we’re not finding it, well, yeah, that’s because you’re not looking for it. Somebody said the same to me. A friend of mine was like nobody ever finds steganography. Well, who’s looking for steganography? Nobody’s looking for it. It doesn’t mean it’s not there.

Nick Furneaux: There’s plenty of detectors you can download online, but who the heck is ever doing it? It was interesting actually, when we used to write some of the covert tools, and I can say this because they’re not in circulation anymore with those agencies, but there was always this really big question as to should we be removing the USB entry from the appropriate registry key?

It was quite interesting, actually, that I had a three letter person once say to me, if we do the broader job right, that covert method of entry job right, there is no reason why anyone would ever look. If we do that covert method of entry badly, then they might go we need to do a complete forensic analysis of the computer and see if anybody has touched it.

But the reality is, I know how to pull registry keys off the computer to my write to see if anyone has ever put anything in it that I don’t know about. And I’ve never, ever done it.

So as Windows moved on, it became very difficult to actually remove entries from some registry keys and not have the operating system drop it back in again. Eventually, they were like, don’t worry we don’t think anybody will ever look. If you just call it generic USB.

So, I think sometimes we think these things are security issues, and they’re not really depending on the opponent to whom you are giving your attention.

Your question was more around the why don’t these tools exist? I think the problem is, is that cryptocurrencies are considered to be a track and trace issue. Don’t get me wrong the MET now have a cryptocurrency team, the NCA and others they’re all have their trained people, but that is very much related to following funds on the blockchain, tracing through contracts, through mixers, all this specialist stuff.

We do need those skills, but it comes back to the fact that if you haven’t found it in the first place, then that job can’t be done. It hasn’t traditionally been seen. When I wrote Investigating Cryptocurrencies in 2018, I wrote it for forensics people, because cryptocurrency has got the word crypto in it, from cryptography.

So, I assumed that it would absolutely be all my buddies at F3 that would be going, we need to get into this cryptography related to currency thing, and understand how elliptic curve cryptography worked, and all the maths around it. And actually, I’ve proven to be utterly and completely wrong. One of the reasons for the second book actually.

The reality is, is the people that are investigating this stuff are the financial investigators. They recognize money laundering schemes and they recognize it in banking. The patterns are very similar when you’re looking on a blockchain, they recognize how the financial things work within an investment scam.

So, when we started teaching digital forensics people I began noticing, around 2019, that there were all these people sat in the back of their arms across when we were doing some python scripting. They were all the financial investigators.

When we got to the track and trace stuff, they were just on fire. They were all over it. I think the problem has been nobody has sat down with the forensic teams around the world and said, you need to have some tools that discovers crypto.

A really good example, there was a drug dealer that had been under surveillance in central London. True story. Three years ago. They eventually moved in for the arrest. There’d been surveillance on him, they’d seen the deals go on, and they’d seen the supply deals happening. When they moved on the guy, they expected him to have around 40, 000 in cash on him. When they lifted him, he had nothing or anecdotally 10 quid in his wallet.

So, his phone is seized, the house was done, computer seized, that thing. It’s only because a Metropolitan Police mobile phone investigator looked at an app on the phone and went, what is that? Googled it. Oh, it’s a cryptocurrency app. We’re able to get into it.

There was a quarter of a million pounds worth of crypto and they realized that actually all of the deals were being done phone to phone, crypto to crypto. When he was doing cash deals, he was then popping into the local corner shop to the bitcoin ATM, chucking the cash in, paying the 17% or whatever it was and then just moving it up the line.

Suddenly cryptocurrencies were involved in street level drug dealing, which rolls us into the title of the book, There’s no such thing as Crypto Crime. Is that drug dealer a cryptocurrency criminal? No, he’s not. He’s facilitating his criminal enterprise by empowering crypto to do that job. We just haven’t caught up on the discovery. It is still individual forensic investigators going, I don’t know what that is, and going and doing the job.

I think we’re missing private keys. That then takes us to the third part of the investigation, that if we can then find those funds and we see an off ramp, we can freeze and seize. Which means we actually get money back either for the public purse or most importantly for victims. And we’re not doing a good job of that at the moment.

Si Biles: It is that knowledge, that that awareness and the full process of it. I do have your book and whilst I was reading through it, it struck me, this beautiful quote on page 36. Quoting from King Solomon’s minds, and more importantly, Ecclesiastes, my biblical knowledge is a bit abbreviated, and Shakespeare. What has been is what will be, and what has been done will be done again, there is nothing new under the sun.

My desire to get into computer forensics was to do with reading A Cuckoo’s Egg by Cliff Stoll. Which is about, effectively, it’s a hacking thing.

It was hacking for the purposes of espionage, but it was computer crime. The only computer crime that really exists is hacking. Although that’s usually done for some other purpose. The more I’ve done forensic cases and worked over time, it’s drug dealing, it’s crimes against the person, it’s murder etc.

There isn’t anything really that people are doing now that wasn’t done a thousand years ago, by someone to someone. It was just they were doing it with a pen and paper, and now they’re doing it with a computer.

For those in the UK will have heard of Wolf Hall. Those of you who aren’t in the UK may have heard of Wolf Hall because it’s been doing very well, it’s an adaptation of a book by Hilary Mantel about Henry VIII and one of his advisors, Thomas Cromwell.

One of the reasons of the expected downfall of Cromwell is that he presented Henry VIII with a painting of his wife to be, that was a little too photoshopped. When she turned up, apparently, she didn’t match particularly well and it pissed Henry off, which, fundamentally undermined his belief and trust in his advisor.

But you’re talking about photoshop and forgery of, of things. In his case, in order to get a match which suited his Protestant views versus the Catholic Catholicism at the time.

Nick Furneaux: in 1500.

Si Biles: Exactly. It’s astonishing, isn’t it? And so, there isn’t anything new. and, and it’s just another tool in the arsenal of somebody who wishes to carry out a crime.

Nick Furneaux: I said on in a conference the other day, actually, that if you receive a phishing text, trying to get you to supply some details for something. Is that a telephone crime? It’s not, it’s a mechanism. The reason why this is important is that there are lot of countries around the world that are siloing cryptocurrency teams. We train these people in track and trace of crypto assets, like we used to do with forensics people in putting them in the broom cupboard.

I don’t know if you ever went to Avon and Somerset Police back in the day, but they were literally in this like, long, old broom cupboard and siloing them. That is a mistake, because there is never a cryptocurrency crime.

There is a mistake that we miss stuff. An example I often use, sorry for people who’ve heard it before, but we’ve had a couple of cases now where known cryptocurrency traders have been kidnapped. There was one specifically in London where the guys walked up at the guy’s front door and pistol whipped him, tied him up and forced him to send them all his crypto.

Is that cryptocurrency crime? Let’s step back a minute. These people got to the house somehow, so there’s probably going to be some NPR, there’s going to be CCTV in the street, there’s going to be doorbell cameras, there’s going to be DNA where they press the doorbell of the house or whatever.

All of that is before you get to the movement of the funds. So, siloing cryptocurrency teams is a real mistake. That mistake stems from thinking that there is something called cryptocurrency crime because it’s new and it’s shiny. They’ve been hearing about it on the news and stuff, but it’s not.

I’m not saying we shouldn’t have specifically trained teams. We should, but they shouldn’t be siloed. They should be part of the bigger investigative picture because they only form part of that investigative picture ever. Even if you look at something like the mango hack and stuff like that.

These hacks against cryptocurrency environments and investment schemes and DeFi schemes. Those funds, they use hacking techniques that we’ve been using for years. Or market manipulation techniques that have been around in the fiat markets forever and then they tend to move that and it then moves into fiat currency and is laundered off from there.

So again, it’s only part of the investigative picture and that was really the reason for calling the book, there’s no such thing as Crypto Crime. Clearly there are many crimes that are related to cryptocurrencies. Almost every type of category of crimes we are seeing in crypto involved with.

Si Biles: I’m going to say, we’ve seen this happen with digital forensics. We were siloed into broom cupboards and occasionally would be handed a laptop.

Now everybody carries a computer around with them, in their pocket as their mobile phone that’s tracking them on GPS. Every murder squad knows that they’re going to phone the phone examiner and ask him where this guy’s been because that knowledge has suddenly become more prevalent.

Sooner or later there will be a tipping point, but it’s obviously it’s material like yours, training and things like that will enlighten the investigating officers to the point that they’re going let’s integrate this.

As with running any good team, you should be able to talk and communicate within your specialists and SMEs anyway. Siloing is an issue of management, my wife’s a project manager and she would definitely agree that not having SMEs involved in the process of planning something is a guaranteed way to fail a project.

That’s true, it’s the same in an investigation. If you’re not going to go and ask your examiner, what could we get out of this? Then you’re going to be in a lot of trouble.

Nick Furneaux: Yeah, you’re missing a trick. I’ve always felt the investigative teams that hold all of those key SMEs, the non-law enforcement agencies. How they run teams in that way, where they have that group of polymaths to a degree, but they’re all SMEs. They all know their specific subjects. I think investigative teams work like that extremely well. Investigations are no more Morse turning up on a scene flashing his badge, going under the tape and looking at it.

Now there is this huge group of specializations now that work into murders and I think it doesn’t make good television. So, we get really good TV about forensics, but we often have to have the key characters solving the crime. And, of course, that’s just not real. That just doesn’t happen.

You have these broad teams working multiple cases, working with multiple other teams, they do their specific bits, they produce their paperwork and their intelligence pack and their evidence packs off of that.

You still get the Morse character that runs the operation, but he’s not the one under the tape looking then going off and solving the crime. It is just not a reality.

It’s exactly the same with the crypto stuff. Don’t see it as a standalone thing. There is no Morse character that can jump online, find the assets and solve the crime. It is part of a team of capability and expertise that can do these types of investigations.

Si Biles: Now, there’s a lot of publicity around very specific types of crypto crime at the moment. There’s been a couple of television shows recently and I wholeheartedly admit, I haven’t seen. It’s like the pig fattening, pig killing, pig slaying.

Nick Furneaux: Pig Butchering. There is a woman called Erin West who is extraordinary, look her up on LinkedIn, Google her. She was Assistant District Attorney in California until just recently. She is running something called Operation Shamrock, which is a desire to take down the global scam machine and refocus on getting funds back to victims.

She is brilliant. She wrote the forwards of the book. She’s right on top of the book there, but she is doing amazing work. She actually likes the phrase pig butchering because it sounds awful and it makes it sound really awful and terrible, which it is. I don’t like it because pig butchering refers to romance scams, fattening up the pig before you slaughter it.

The problem is with people that fall for romance scams is that they’re victimized twice. They lose both funds and they lose something of their heart. I don’t say that with like a squishy emotional side to it, but I have known people to have taken their own lives on the back of it. I have known people’s lives be ruined, because they fall in love with these people. They really do.

I once sat with a woman who I explained that she was being scammed. Look, you’re being scammed. This is all the reasons why. I even put in an envelope what would happen next. Then when it happened, I said, look at the envelope, you’re being scammed.

Still sent money to the guy the next day because it was heart. She actually then went to the guy and said, are you scamming me? He said, oh my goodness. No, actually I haven’t told you this but I’m being scammed. And on it goes.

I was telling this story on a webinar last week, recently a guy contacted a woman on social media and they get talking. He’s a big strapping Ukrainian guy and he’s fighting on the front lines against the great Russian evil as he’s describing it. He’s got terrible body Armor. He could die at any moment and if only he had two thousand pounds to be able to buy proper body armour, maybe he would survive to be able to come to the Midlands and whisk her off her feet.

She just fell for the whole thing. But of course, he can’t receive money through the bank. There are no banks, which sounds completely reasonable, doesn’t it? In Eastern Ukraine. There’s no banks open. The only way I can do this is through crypto and then I can use the crypto to buy a thing. So, she was converting money into crypto through normal cryptocurrency exchange and sending this money out.

Her family figured it out really quick. She wouldn’t listen to the family. Family got me involved. Could you help? I tried to reason with her. She was not interested at all. Why? Because the heart got involved.

Actually, even with not straight romance scams, just our trusting nature, there was a lady, a broadcaster, a known name, who had been making investments with an investment company.

Her family again felt she was being scammed and again she just wouldn’t believe it. This was an intelligent, very likable woman. Although she wasn’t being taken in by the heart, she really believed that her investment advisor was absolutely on the level. She was literally going to invite him for Christmas dinner and of course, never got to meet him.

The only way we convinced her is that we did all of the open source stuff around the back and got a family member to take her to the address to show that no one was working there of that name. Even then she was like, maybe they just used that address, it’s extraordinary. And this was an intelligent, hugely likable, otherwise extremely sensible woman, but because although it wasn’t romance, her heart was now involved in what she was doing.

So yeah, pig butchering. I hate the term, but it’s that nasty and it ruins people’s lives. To segway on, the problem is now, is that a lot of the people that are carrying out these scams are themselves victims.

So, Erin West has just come back from the Thai Myanmar border. Where they are building these vast scam farms. I mean, there’s cranes up where they are putting four figures of people, human trafficked into these scam centres. We’ve got reports of torture and rape when they don’t hit their targets.

They’re not allowed to leave. Terrible things happen to these people that are on the phones and on the text and on social media, trying to find victims because if they don’t, there’s threats against themselves and against their families.

We’ve now got this bizarre situation where the perpetrators are victims. Where do we start with that? We need our international agencies to be kicking the right doors in those countries. We need to be putting armed teams in and taking these places down. Showing appropriate care and to the people that are being victimized.

We’re really going off a forensics topic here.

Si Biles: I mean, that is the point, isn’t it? That we don’t operate in a vacuum.

I was going to say can say much as it’s nice to get a nice, neat little hard disk and go this is my job, it’s not. This is at best, somebody’s life who’s been falsely accused and we can say no it wasn’t them, or it’s somebody who has hurt somebody else, in some ways quite horrifically and there’s a knock on impact. Assuming they are guilty, you’re going to be taking someone potentially away, from their parents, from their family etc.

Everything we do has a human impact. When you’re talking about Drug dealers or like this, whereby they are running chains of people, money mules, the county lines operations in the UK and the equivalents worldwide of those things.

You’re talking about huge networks of people who are suffering. Certainly being manipulated, certainly being made to do things that are at best without their knowledge and understanding, at worst coerced physically, violently. We shouldn’t be so blase to assume that our little forensic examination over here is not impactful in human terms.

It’s a hugely important field that we’re in.

Nick Furneaux: We can’t win Simon. I mean, this is the reality. We’re not going to win, but that doesn’t mean we shouldn’t fight.

I was on the Seize and Desist podcast last week and I said to them that we’re never going to stop the boats coming across the channel. We’re just not, someone is always going to get in a boat and try, but that doesn’t mean we shouldn’t be sending lifeguards out to pull people out of the sea before they die. We should still be trying to save people, even if we’re never going to win overall battle.

I’m pretty apolitical but I actually feel for whatever government is in power on this particular subject, because it’s only going to get worse as it becomes harder and harder economically and environmentally to live in sub Saharan Africa.

If we see an extension of conflict, it can extend much more, but more extension of conflicts in the Middle East. The potential for things going worse in Eastern Europe, the movement is only in one direction. The movement is into Northern Europe. There’s no government can stop this. It’s, it’s all about management.

So, coming back to actually what we’re talking about is that people are going to run these scam farms because they can make vast amounts of money. Another question, of course, is where are these hundreds of millions going? You can only buy a certain number of Lamborghinis and boats. One has to start looking up the chain at governments and all the rest of it that are tacitly or actively supporting these things.

We know that North Korea has been doing that for years, the vast half billion pounds hacks and scams that rolling into North Korea go to the government there. I think there are other governments that have somewhat learned from that lesson and realize that they can tap in. They can still leave the scammers with their tens of millions to wave their dollar bills on social media and have their yacht in Dubai.

Actually, let’s not talk about Dubai, but the reality is we’re never actually going to win. We need people at the high levels going after the governments trying to get them to play appropriate ball. We need to be taking out the serious organized crimes. Then, we need people focusing on the victims and trying to get funds back to them.

I feel quite passionate about it.

Si Biles: It’s very fair. Especially where international law doesn’t currently have the teeth to deal with this.

Nick Furneaux: I think it’s been said a few times now, when you have an American president, this is not a political point, just blatantly letting their son off. This wouldn’t have happened 10 years ago, would it? There would’ve been this vast uproar and everyone now just goes yeah, they’re all just doing it. They’re all as bad as each other.

Just coming back to the point, we shouldn’t not fight just because we’re not going to win the bigger battle. Right at the end of my book, I reach out to the scammers because there will be those that will read this book. There’s an awful lot left out, a lot of capability that law enforcement have and governments have in this space.

But to say that sometimes that I unravel scams and I’m like, this is blinking brilliant. I mean, it’s hard enough to unravel it, but to have come up with it in the first place, I mean, high five.

Si Biles: I love cases like that.

I mean, obviously, it is horrible, but wow that was really ingenious.

Nick Furneaux: I say in there some of the work that you are doing to defraud people is hardly short of brilliant. But how do you want to feel about your life? when you are X years old and on your deathbed that everyone will get to, what do you want to look back and see yourself as a parasite on humanity? Or someone that actually did good for others?

Some of these people are brilliant and if they use their powers for good, could make a difference. There’ll be plenty that enjoying their Lamborghinis and their lifestyle and that’s their life choice. But maybe there are some that think actually, maybe there’s a better way to use these extraordinary skills.

For some people they see it as the only way out. We don’t have to agree with that, but we should understand it.

Si Biles: There’s a famous joke in computer security terms, which is if you can’t quote, Art of War, you’re not doing it right.

Nick Furneaux:  Have you ever tried to read it? It’s really hard reading.

Si Biles: It’s hard going, isn’t it?

But, if you don’t understand your enemy, or you underestimate your enemy, you have no hope. You’re not going to get there. We are all motivated to do things for a reason. I’m motivated to keep a roof over my head and look after my children and put food on the table. I can do that here by doing something legitimate.

In other countries that may be a different thing. It’s difficult to judge somebody else whose world you don’t understand.

I mentioned earlier, my wife’s Russian, the cultural differences between two countries is vast, even though they are a modern first world developed country. There are huge, huge differences stemming from language, literature, religion and all sorts of things. Fundamentally that means that there are always going to be things that you just don’t get as a Brit, as an Englishman.

Some of these other countries are even further removed than that from us. What is and isn’t acceptable to them and what is and isn’t to us. The norm is, is hugely away from our level.

Nick Furneaux: What we see is appropriate behaviour. It doesn’t necessarily make us right and them wrong.

I watched a conference years ago and they called it the loaf of bread protocol. They gave the example of someone, like me, stealing a loaf of bread. Then, the example of a homeless girl, 14 years old on the streets of London, starving, stealing a loaf of bread.

The law sees it exactly the same. I’m walking along with my Apple watch on and a nice car in a car park, very fortunate to have a reasonable standard of living. Although, I hardly own any crypto, by the way. It was criminal.

The view, of course, is we would see that poor 14 year old girl as a victim and actually stealing the loaf of bread is completely understandable. The poor thing is starving. Yet for me to steal the loaf of bread, somehow that would be risible and completely wrong. The reality is the law, in many ways it’s useless because it doesn’t look at the individual, just says all bad.

So, when we look at scammers, we might decide that we look at the guy with the Lamborghini waving his wads of dollars on social media as risible, but actually the person that is scamming in a scam farm, in Southeast Asia, under the threat of physical violence. It’s the same scam, the same thing but it’s a different environment. But the law is the law and how do we deal with those things?

I mean, we are going way outside my paygrade. We should just go back to the fact that I never bought crypto.

Si Biles: I had a little bit and I bought whatever it was Bitcoin for a few pounds and I sold it and I made 600 quid and I was so chuffed. The acceptance of if I had just held on to that I could have retired by now. You just got to let it go, don’t you?

Nick Furneaux: You do. I think I’ve said on the Seize and Desist podcast last week. It’s a good podcast by the way, it’s to do with seizure, it’s to do with the other end. So, we’re at one end, the Seize and Desist podcast is about the other end.

Si Biles: We’ll put a link in the show notes so that other people can go and listen to.

Nick Furneaux: I said in there that I read the Bitcoin white paper. If anyone’s a coder out there, honestly, the Bitcoin code is some of the most beautiful code ever written. Never been hacked. It’s utterly beautiful. If you go of course it’s been hacked, it’s been hacked millions of times.

No, it hasn’t, what’s been hacked are the systems that have been put around it with the exchanges and social engineering attacks and things like that. The Bitcoin code has never been hacked. Tiny problem in the first year that it came out, but that was solved. It’s never had a problem since. It is an amazing thing, the Bitcoin code, but I looked at it and went a conspiracist and criminals, that’s who it’ll be.

For the first few years, who was using it? Conspiracists and criminals. Mostly it was preppers and it was criminals thinking this is quite cool. So, when it was at 300 bucks, I was like, this is a waste of time. Then a mate of mine called Chris, when it was about two and a half thousand dollars, phoned me up and he’s said how much of this Bitcoin should I buy mate? I think it’s going somewhere. I

‘m like, dude, don’t bother. It’s conspiracists and criminals.

Now we’re near the hundred thousand dollars, aren’t we. He was like, dude, that’s the worst advice I’ve ever been given, ever. I’m like, mate, don’t take investment advice from an investigator.

I think it’s in the book that story. But I’ve been wrong and I wish anybody that is into crypto as an investment vehicle all the best.

I think at the recent high point, I’ve now got about 10 grand’s worth of crypto. Woo! So, I’m doing fantastically well. It is one of those things I look back and I’m like, man, why didn’t I just buy a dozen when it was 300 bucks, I wouldn’t be on the podcast now.

Si Biles: Yeah, well, this is it. I’d be sunning myself on the Bahamas.

I hasten to add, there is no financial advice included in this podcast. I’m making no recommendations in any way, shape or form. In terms of, crypto, we’ve seen Bitcoin come and stay. We have seen Ethereum and dogecoin, so many you can’t list them.

Do you think that? We will continue to see a plethora of Sub things? Or do you think it will normalize in the way that we have dollars and Pounds and we’ll end up with a stable set of normalized cryptocurrencies? 

Nick Furneaux: Oh man, I can rattle on this. Here’s the problem.

We don’t currently have a cryptocurrency because fees are too high. Nobody is holding Bitcoin so that they can go out and buy a few beers tonight.

There is the lightning network, which is supposed to let you do that, but no one’s using it. It works. Don’t get me wrong. It’s a clever piece of technology which enables you to make transactions at very low cost in the Bitcoin network, but nobody’s using it.

So, there’s no real currency until somebody comes up with a cryptocurrency app that 15 year olds start using to pay their mate for the vape that he’s just bought for them. Phone to phone. That’s the pattern of all our social media. 15 year olds started using it, then the parents started using it, and then the 15 year olds grew up and now we’ve got grandmothers on Facebook. That’s how that happened, that’s how tech tends to be absorbed into the psyche of community.

Someone needs to come up with something that is basically free in transactions and that can act as a highly secure currency.

Now, the people that tried to do it was Facebook. What happened was the, Senate went bonkers. Then, the EU went bonkers. Why? Because they realized if every Facebook user changed $10 into the Facebook cryptocurrency, it would be the most powerful currency on the planet by a factor of about eight or something ridiculous. The almighty dollar would now be very much in second place. They all went crazy and Facebook had to step back.

However, on the flip side, I don’t see it going anywhere. Blockchain technology. If anyone tells you blockchain is complicated, they’re trying to sell you something. Blockchain is just a spreadsheet with some crypto tacked onto it. It’s very effective at having secure transactional record keeping.

I don’t think the technology is going anywhere. I think Bitcoin is now a little bit too big to fail. It is an asset class. It is not a currency. People are holding Bitcoin like they do gold now and silver and I think it will continue to be an asset class. Where that technology goes, I’ll be honest, I’m not bothered. I’m an investigator. I don’t care.

I will only ever be interested when something is being used to carry out some criminality. I think it’s going to go somewhere. I think it’s going to continue to be a thing. I think someone’s going to suddenly hit the viral market.

A lot of currencies are talking about having the E pound, and the E dollar and this thing. It’s pointless. That’s just a sop to the public that want to think they’re using some cryptocurrency. That’s rubbish. There’s no reason for it really. I think any company that tried to globally have a cryptocurrency that people started to use globally would just be stomped on by every legislature that realizes that they’re losing control of finance within their in their country.

The US can’t allow the dollar to be trumped by a social media network with its own currency. I’m not seeing a global currency at the moment, but I think this is here to stay.

Crime pays. Crime pays for both the criminals and the investigators. I’m very fortunate that I’ll continue to make a perfectly pleasant living to put a roof over the head of my family because the reality is that I don’t think the criminals are going anywhere anytime soon.

We’ll continue to play that tit and tat game. They’ll continue to come up with awesome schemes that I’ll look at on my computer and go cool. If a scammer is watching this, then do some cool stuff, but the problem is the victims at the other end are decent, ordinary people. Use your powers for good.

Si Biles: On that note, we’re coming to the top of the hour. I didn’t realize that the top of the hour was an American expression. Somebody pointed this out the other day.

Nick Furneaux: Oh, everything’s an American expression now.

Si Biles: We invented the language.

So, we’ve been, we’ve been chatting for an hour, which is the time that we have.

It’s been wonderful, I’ve really enjoyed it. So, I’m going to say, on the note that cryptocurrency isn’t going anywhere, I would recommend the next book. I’ve, I’m not far into it, but I’ve done the thing that everybody who’s about to plan to do an interview does, which is flick through it, open random pages, try and find something to catch the interviewee out on.

It’s all very well written and very interesting. I’d thoroughly recommend it. Also, as you pointed out, you’ve pulled in several other people to include information.

Nick Furneaux: You only know what you know, Simon. I realize that there were some aspects to do with sanctions avoidance and things like that, that I just didn’t have expertise in.

I’m very fortunate now to know some really good people in the space. I’ve been able to pull in world leaders, in this world, to provide contributions. The guy who was running crypto for the MPCC, has done a thing on running crypto teams.

Ari Redbord, who was ex department of justice, now at TRM labs, who I work with, part time. He wrote the section on sanctions avoidance. Aaron West wrote the forward. Carole house, who’s head of cyber at the white house, wrote the outro. Some really great people in there that brought their expertise to fill the holes where, you only know what you know. Can’t pretend to know everything.

Si Biles: It’s a great book and I thoroughly look forward to getting through the rest of it. Thank you. Thank you for agreeing to come on and talk about it.

Before I interview someone, I have a look at their LinkedIn profile. I noticed that you live, fortunately in beer. 

Nick Furneaux: I do. Little fishing village in East Devon with a great name. It’s fantastic. Everyone loves a drink as well. We’ve actually got a pub here called the barrel of beer. You can get a t-shirt that says, I’ve had a beer in the barrel of beer in beer. Got to be done.

So, I’m very fortunate, I sit here and I can see the sea. It’s very beautiful. I pass three pubs and a wine bar in the 400 meters from here to the beach. It’s a great.

Si Biles: The bit at the back that says you enjoy running is a little bit of a misnomer. Running at the clifftops of South Devon. Runing down via the pubs to the beach.

Nick Furneaux: Yeah, wine bar, then the dolphin, then the barrel of beer, then the anchor actually in that order. But no, I was out running over the cliffs this morning, and it’s a very beautiful place to be, I feel very fortunate to be here.

Si Biles: Well, I’m very happy for you, and it’s a great place to be running your cryptocurrency investigations from and long may it last for you. Thank you very much for joining us.

For the podcast listeners. You can find us in all the places that you can find podcasts and if you’ve ever listened to this podcast before, you’ll know that I’m going to remember none of them.

LinkedIn. We do post on LinkedIn. I was thinking Spotify, Apple Podcasts, YouTube, all of the good stuff, but most importantly, on the Forensic Focus, website, we will put through a whole bunch of links to Nick’s book and to the Seize and Desist Podcast Nick was on the other day.

You can have a listen to the final end of that because obviously we’re more loaded to the front end of the cryptocurrency process. but it’s been an absolute pleasure. Thank you. Lovely to see you again.

All right. So, all the best. Thank you very much everyone. Bye. Thanks.

Detecting AI Fakes: Forensic Image Analysis With Cellebrite

Si: Hello everyone, and welcome to the Forensic Focus Podcast. Today (as was being briefly discussed before I pressed the record button) I have the first forensic married couple that I have ever interviewed. And we’d like to welcome Heather back, who’s been with us before, and Heather and Jared Barnhart, who are both from Cellebrite, and who have come on today to talk to us about some work that they’ve been doing with regard to AI and image analysis on the basis of forged and fraudulent images created by AI.

So, first of all, thank you very much for coming back. Obviously, we didn’t manage to put you off last time, so that’s a good sign! And also, thank you for coming to talk to us about something which is incredibly topical at the moment. I mean, I was away last week at a conference in…I got to go to Europe. I went to Luxembourg. It was fun for me.

But the conference on AI and the law and criminal cases and certainly the idea of bringing deep fakes and things into the courtroom is a huge worry and concern to lawyers and in the criminal law academic community and we’ve seen some cases already whereby…perhaps not necessarily if the actual material has been present, but people are sort of starting to try and use the AI defense as opposed to the Trojan defense, and we’ll touch on that in a minute. But you know, obviously working together and being married wasn’t enough for you, so you decided to go off and do some research. What prompted this? What brought you onto this? 

Heather: I would say my whole RSA talk last year on sextortion and then the Taylor Swift deep fakes. That was kind of a huge thing in our house. We have three little girls and Taylor Swift is queen and you don’t do wrong to the queen. So I think just the fact that we started generally…AI is huge. Everyone is like, “oh, you must talk AI.” And this is sad, but true. I knew if we threw an AI topic into techno security, we’d get accepted. So it was like the guarantee in, but then we didn’t know what to do with the research because we truly didn’t know what we would find.

Jared: Yeah. I think in the last 12 months or so, we’ve sort of lived this fun, watch a video and think, “is that real?” You know, just that casual feeling and of course it’s real. And I was like, “no, that’s definitely not real. Look at the…”, and then you start to pick apart visually some of these things. And now it’s, I guess happened so quickly that it’s almost a zero trust of…I can’t even believe what I see. And so it just kind of worked, I guess. 

Si: I mean, obviously it came at a very pertinent time. And, you know, for listeners, this is being recorded the week after the results of the US election were announced. And we won’t go into politics, because that’s something that it’s best to steer clear of, I think, for various assorted reasons. But, you know, there were suggestions on all sides that created media was being there. And the fact that you…I mean, we’re professionals and we look at something and we have natural skepticism built into us! But it is getting so good now that the lay person isn’t going to pick up on it straight away.

So, you know, raising public awareness is definitely a thing. So, I mean, has that sort of tainted your view of it as well? Or did you finish off on…or I was going to say the Taylor Swift stuff was clearly related to the election itself anyway. So some of it, some of it other stuff. So what do you think the biggest sort of risk is now? Is it that people are so unaware or is that it’s so good? Or is it just…where is the actual problem? Is it that we are so trusting of media or is it that we are not, you know, not critical enough. Or what do you think?

Jared: We actually had this talk in the last few days of…as consumers, we get our own flavor of the internet and flavor of whatever we are choosing to participate in. So her feed on a certain social media platform is strikingly different than mine. And as we would discuss, “I didn’t see that, or I didn’t hear that.” And it’s sort of got us thinking about not just trust of, like, is this one thing real, but that we’ve fallen into this, I guess funnel as consumers.

And some of the truth that’s out there will never even hit my platform that I’m choosing to live on. So it’s not just true or not, but which version am I getting of what’s out there and then the thing that I see is that thing even believable? So it’s become quite complicated as individuals to understand what truth is. And I think that is going to…

Heather: And our kids (so think of the next generation), our kids range from 7 to 12. They believe everything they see. So it’s like, “oh, I saw this thing, this is true.” Or “did you see…?” It could be…they love Benson Boone too, it could be Benson Boone broke up Travis Kelsey and Taylor Swift and they saw a video, so it is the truth. And now all things must occur. But kids have no idea. And I think that is also…oh, I say kids: my dad, my dad has no idea. I have no idea half the time.

Jared: Yeah, I mean, less technical people or those who maybe aren’t as skeptical as some of us in the forensic cybersecurity arena, they just accept that what hit the screen is a lot of times a fact. And it’s a wild environment right now as to how different those things are.

Si: I was going to say, it’s interesting because it’s a sort of a bit family folklore, but my youngest daughter, I mean, she’s 18 now, so she’s well past…well, she’s not well past receiving media…that’s very true, but she’s…I’ve built a healthy skepticism into her over the last 18 years that at least makes her question things. But once upon a time, you know, for her, she went with her mum to a cash machine and tried to swipe on the screen on a…so an ATM. Because for her, touchscreen was such a natural interface.

Do you think we’ll get to a point where the next-next generation perhaps are so media savvy that they don’t believe anything? Or do you think it’s curable? Do you think it will reintroduce skepticism? When they realize that, you know, what they see isn’t necessarily true?

Heather: I personally fear it will get worse. I think that they don’t even take pictures and share photos unless it has a filter. They’re immediately changing everything about themselves. Like our two oldest have phones. They will rarely take a picture that is not filtered or something added to it nonstop. So that is their reality. Like, they never had to develop film and wait for doubles and…remember all that? Like, it was crazy you get one shot and then you get two copies and that’s it .

Si: Yeah after waiting a week as well! That’s the other thing, yeah.

Jared: I think that we’re definitely trending in a direction where we will perhaps focus instead of on maybe like large networks of, “I prefer this network versus that network” that we will actually tune into individuals. And I think that’s been a thing for decades of a certain host of a show that you engage with better than someone else.

But I know for me in the last few years of a lot of sort of misinformation, disinformation, obvious campaigns to lead people in one direction or another, whether true or not, that I have latched on to certain people in the media that I believe that I can trust as, you know, doing due diligence and things like that. I do worry that the generation that we…ahead of us is all in on the network and the generation behind us, I have no idea. I mean, what will they…what is true to them?

As Heather said, we have a Snapchat generation that every…the first picture they ever took, they thought it would be fun if my face looked better. You know, and that’s, you know, a terrible thought. But not just better, but now., “I want to, you know, have some other feature.” And so everything has been some sort of AI spun improvement or change. And that’s the normal, much like you’re swiping at the ATM screen. Like, her normal is that that screen is supposed to behave with her finger and it’s, you know, it just didn’t so…

Si: Yeah, I think it’s interesting because I think you’re absolutely right. And also, I think there’s the sort of the insidious back end of that, which is the computational photography that’s built into certain devices. It infuriates me. I have some fantastic cameras. I still have some film ones. I still develop film. So I’m very aware of that. I do it myself and it’s fun to do of a weekend, but my wife will pick up her phone, an Apple phone and we’ll take a far better photo than I do with my thousand pounds worth of camera because it has the computational photography built in that does that. But obviously that’s not 100% of true representation of…or is it? I mean, that’s a…it’s a philosophical debate as much as anything else really.

But what I’ve certainly seen people asking is that where people are using phones to take pictures of injuries that are then being cited in domestic abuse cases, is that is that a real bruise or is it enhanced by the fact that the color has been, you know, jumped up, popped, to make it pop? And, you know, that sort of issue is definitely prevalent as well as the, you know, deliberate attempts to distort or to auto enhance, but…to make things look that way.

So, you know, in terms of the research that you’ve done so far, how are you getting on with detecting these sorts of things, especially once it’s been put into something like Snapchat or Facebook or Instagram, or one of those where they’re actually removing a lot of the metadata from the imagery during their processing so that when, you know, when somebody else is able to look at it, a lot of that sort of, you know, EXIF data is vanished?

Heather: You want me to start? All right, so on the originating device, if I take the photo and then share it with you or put it on Snapchat or whatever, Android or iOS, there are databases that know everything about the images. So on iOS, you have photos that SQLite on Android external.db R2 that will tell you the application that was used to create or take the photo.

So if it was a AI generated picture, it’s actually tracked in that database. The issue is it doesn’t just carry into the EXIF. So even if you had EXIF and you were just looking quickly, it’s not going to be with the image, it’s going to be in the database that has information about the image, which makes it a little bit more complicated because the tools don’t do a good job saying, “I know this from over here, I know this from over here.” So it requires manual forensics.

Si: And I mean to be fair, you’re both representing Cellebrite today so is that something that you’re looking at in terms of device forensics? If I plug in the phone, is it going to…is that something that’s that you’re either able to do or going to be able to do soon?

Jared: Yeah, so one of the one of the features that we did somewhat recently, it was called Media Origin, and it took, I would say, one of the most commonly asked questions and simplified it, but the simplification was actually extremely difficult. “Was this photo taken with this device or not?” And, “oh, well, just go, go look at the DCIM folder and you’ll know.” Well, no, that’s not how that works, because if you send me a photo and I save it to my gallery, it hits that same folder, right.

And then we’re digging into metadata to understand like which type of camera and as you describe being a photographer of sorts, if you take this pristine photo somewhere in the world, you don’t want to post it and then have someone say, “look at this picture that I took, it’s mine, it’s not his,” right? And so they’re the metadata and that signature of me, the photographer matters. I’m not really sure that we have a clear answer on the easy button.

So Media Origin was fun as it solved the problem of like, “hey, this…taken by this device,” that’s really important to my investigation, a really fast filter, or not, right? And so to say what, what things may have been received from someone else that are resident on this thing and filtering that big chunk in or out can make analysis quite fast. An easy button for detecting AI is, I think, even more complicated than the previous, but it is definitely something that we’re working on. One of the really common things that we see as we dig into the file system and understanding how these different applications are behaving is the file path, like path to file, as simple as it sounds, like file names, file paths. A lot of the applications that we tested created some pretty grotesque file names.

Heather: Like whatever you typed in…

Jared: Like your prompts plus, you know, dot web P or whatever the file type was, right? So some obvious indicators that can get you there quickly. I think the arena where we have the biggest problem with this is not necessarily the slow on device forensics. If you really have to figure it out, you can probably dig in and take, you know, a week to be sure of something. But we’re making this analysis up from online platforms where it’s, “real or fake? Real or fake?”

And truly the thing that was posted, so taken with whatever application, modified with AI, and then posted where everything gets stripped off to the internet, and then law enforcement or whoever is going to seek that file and say, “give me that, that’s the bad thing, I think.” And when they get it, they have this really disconnected version of where it started. So it really always brings you back to that originating device. And so I think that investigative approach is very solid to determine what happened on this phone versus another, and then file paths and file names are sort of a quick win. There’s some other stuff coming for sure, but there’s like the staple quick wins, I think that we’ve found so far.

Heather: And I think from the investigator perspective, similar images. So if you found…if we walk back through what Jared just said, and you find the AI one in Snapchat, but then there’s two other iterations of it, similar images in things like Pathfinder, could also help a lot.

Si: Yeah, no, I mean, again, you step outside of the technical sphere and into the investigation sphere at that point, don’t you? It’s like, you as a human being are able to say, “okay, you know, I found three variations of this particular type of image obviously being created and using a similar prompts to get to this point. Therefore, this one is probably not…or probably like that.” So yeah, no, I appreciate that. I mean, there’s been a lot of talk about the AI companies. And it’s in the AI Act in the EU as well about putting watermarks into imagery. What are your thoughts on that? I’ve got some fairly strong thoughts on that, so I’d interested to hear what your opinion is.

Heather: One: they should have to do it. But you can pay your way out of it from what we’ve seen so far for like $6 US dollars. You flip a switch and you pay them money and they take their watermark off. So that has to stop. Like, if it’s a forced watermarking to keep people safe, that’s not good enough. You shouldn’t be able to pay your way out of a label.

Jared: Yeah. I think philosophically, I love that obligation placed on those generating the content. It clears up the whole dispute of real or fake. Like, “if it came through here, we modified it in some way. Just letting everyone know.” And that would just clear up so many things. At least to have a flag or, you know, a skepticism mark. “This isn’t the original thing.” And, you know, if my face on this video, you know, has less lines up here than it really does in real life, we all click that button to say, “please, just fancy me up a touch.”

Heather: I don’t know where that button is on here though, so if you want to give us that button, I’ll press it!

Si: Yeah, sorry, this isn’t Zoom, it doesn’t have the smoothing effects and there are no Snapchat filters for here. If we talk to Zoe nicely, she might do something for us in post. I, unfortunately, I had some dental work and I can see now in this bloody video the gap in my teeth far worse than I’d noticed in the last two weeks when it was sorted out. But anyway, so yeah, we might be having words about that! I think, certainly from my side, I think watermarking is fascinating, but I could…my…it strikes me that it’s almost, I mean, apart from that, I didn’t…I wasn’t aware you could pay to get out of it. I mean, I think that’s horrific.

But it’s almost impossible to enforce because I can download open source software that will allow me to generate stuff and a) it doesn’t come with watermarking anyway, and b) even if it did come with watermarking, it’s open source. I can recompile it, or somebody competent could recompile it without the watermarking included in it. Leica put out a camera that I can’t afford that has watermarking built into it to generate a watermark for genuine images. Do you think that’s something that we might potentially see rolled out into things like Apple devices and Android devices, whereby instead of authenticating things that have been created by AI, we actually authenticate things that are genuine? Is that a concept you think that holds water? 

Jared: Okay. So…but I think I would just challenge even your foundation of that question with what you said before, of that what the device is doing for me as I press the button to take that photo, and is it real, is that the real thing? And you mentioned the domestic assault injury. And I think back to being in law enforcement and looking at that arm with a bruise or the red mark, and then trying to capture that with the cheapest digital camera that was assigned to me. But think of even just the simple thing of lighting. Too much light on that thing makes it look like it didn’t even happen. Not enough light makes it look like, “I can’t really tell.”

And it would have to be some version of perfect. And we hope that when the flash goes and that it captures that it’s the correct thing. I think from what you said, I would love a feature as a Apple iPhone user that just puts even the simplest small Apple emblem to basically say, “the native camera on this device took this picture.” I don’t know how they would police…I now take that picture to the next thing and modify it at an auto strip off the watermark because it’s been changed now. I don’t know. But I like the idea. And they very proudly have commercials and everything to say, “filmed by the iPhone 6 Pro”, right? Like, they’re proud of it, but I don’t know about the visual so that everyone else can say, “that was just simply taken with the camera.”

Heather: And it’s in the metadata, but think about how many people don’t look at that. When they’re just scanning images quickly. If you have…if you’re working CSAM investigations and you’re looking at hundreds of thousands of images, you’re not looking at the metadata of every one. You’re trying to see how it exists. So I think that’s tricky too, for the push button examiners. We’ll have to call them that. We’re going to call them…

Si: Yes. I think…I mean…I think it’s that…I think what…you call them push button examiners. I mean, there’s obviously various schools of thought about how one approaches this and on the one hand, you want people to be as thorough and as detailed and as technically knowledgeable and as, you know, evidentially sound as they can possibly be when you’re presenting evidence that obviously is of critical importance. Conversely, we also know that there are hundreds of thousands of phones in the world and there aren’t that hundreds of thousands of police officers to look at them.

And therefore some of these police officers aren’t going to be as highly trained as others. And that’s where tools such as Cellebrite that can do this consolidation piece to say, “okay, this is…there’s enough evidence to suggest that this is AI versus not AI.” Not that it makes any difference in this country, certainly on CSAM anyway, because, you know, it’s an offense to have either generated or real.

Heather: Yeah. 

Si: Slightly different offenses, but you know, it’s still charged very similarly. Do you, I mean, I believe if I remember correctly…and I did read the…I haven’t read obviously your original work, because that was in…you presented that at the conference. But did you touch on, sort of, sensor noise as well? Is that something that Cellebrite can look at? So image ballistics, as other people have referred to it as image ballistics, where, you know, a given electronic sensor creates, you know, known noise patterns. And also those noise patterns are reflected across multiple devices of the same type. So, you know, there are similarities between the sensor noise on one Apple and one and another Apple.

Jared: Yeah. So I think our approach…I haven’t…a while ago, I heard someone say media ballistics and they were sort of talking about what we did already with Media Origin. And so Media Origin allows you to say, “this device or another device or an attributed account of the owner of this device.” So Jared’s Snapchat username is this, and we see that that’s the logged in account. So these photos are also attributed to this person. That’s sort of an approach. Not necessarily the way you’re describing as the media ballistics, but I think as we move forward with our AI detection, it will fit in nicely with the Media Origin.

To say, you know, we’re checking all these other, the semantics of all these other things, and now we think that taken with this device, but also this one here, label it as AI, gen AI, modified AI. I think another difficult part is: was there an original thing that was touched up or was this a prompt that became a file? Right? And that’s a big thing to tackle because there’s so many avenues on the device for one or both of those things to happen. 

Heather: And we actually…we just finished a CTF at Cellebrite, and it was our biggest one ever. It’s always fun to create. But we had a little mishap where I was two people at the same time on a Disney cruise and I left the other phone on the cruise. And I was like, “I just ruined our entire timeline, our entire scenario.” But Disney shipped it back to me. I filled out a lawsuit and I got the phone back. I was like, “excellent!” But in our chats, we had already kind of murdered him. So we’re like, “he’s dead. Now what?” So I was the girl he was dating.

So I was like, “you know what? I’m going to use AI and I’m going to become him.” And this was like to generate images, to put Facebook posts, like all the things. And then Physical Analyzer parsed all of it as a chat. So you could literally see what Jared was just saying. If it’s gen AI created, if I said, “create a picture of a man with headphones on a podcast,” it showed exactly what I asked for in the response as a chat, and I was actually kind of annoyed because I didn’t want it to be that easy. I was so impressed. I was like, “I guess it…”, and then I was kind of put off on it’s not a conversation, but it is. You are talking to an AI chat bot asking for something and it’s giving you the return. 

Si: You’re getting back into the semantics and philosophy of AI as a whole. I remember…I’m was going to say, I am older than both of you, I suspect, both by a reasonably large amount. But you know, if you may have come across Eliza as the therapist chatbot purely because you’re in IT, and therefore you may have come across it. But the idea of the Turing test of, “am I talking to something?” is obviously one of the…talking to a computer or to a human being?” is one of the fundamental pre premises of AI as a field. So to hear you say that you’re considering these things to be a conversation, it is quite fascinating, really. I was going to say that I totally lost my train of thought, which I really like because it’s always fun. Totally different rabbit hole! Oh, yes.

So, in terms of AI detection. Okay. I mean, obviously we’re looking at things like metadata and we’re, you know, the sensor noise is another option, but quite a lot of people are leveraging other AIs against images to get results. So effectively adversarial neural networks that are going, “is this a real image or not?” Is that something that you’re using and Cellebrite at the moment, or is that still a stage away in terms of you’re looking at the hard data rather than throwing it into another black box to ask it questions that it doesn’t necessarily know how it’s answering.

Jared: So, I’ll talk not Cellebrite for a second. What you just suggested is I need to ask AI to tell me if something is AI. How would you…what if…so, and I think this is the foundational challenge that we have right now in digital forensics is…you alluded to it before: volume of devices, volume of data, not enough trained people to do the work.

So we are certainly on a path of how fast can we get the job done? And we have this conversation somewhat frequently of saying, “look, the speed of that job can only be as fast as we can do it while being forensically sound.” We can’t just pipe straight to an end product and everyone just throws their hands up and says, “I don’t know. I didn’t really look at it, but that’s it.” So to ask AI to do something for us, I think, we certainly have a lot of things that are being considered. We have to do it safely, right? We’re not just gonna jam stuff in that’s not carefully being used. But to increase efficiency, I think there’s a lot of things, and we already have some. So our Cloud Solution Guardian.

So, storage of evidence, but also a SAS based analysis platform. So instead of your hardware powering everything, AWS is behind, you know, full throttle. So sort of a faster way to look at data. And within that we see things like chat summary. So to say, “here’s a thread and within this thread, we see a conversation about eluding the police while discussing potential drug use and weapons.” Something like that, right? Now, if that thread is one of 1000 threads in the queue and on the other side of it is a chat with my mom and down here with my wife.

And that one in the middle is the one that I truly need to find as an investigator. I’ll take that. I’ll take that summary that points me in the right direction. That doesn’t put someone in jail. It doesn’t output an auto report of saying, “here’s why we think this person’s guilty.” Like, none of that. But it got me to what I’m ultimately going to be looking, and so trying to find ways to integrate safely into product AI, it’s definitely happening. But with that, we are definitely faced with a challenge of: what is AI to the court? Like, I always throw this example: when I was a police officer in Maryland, they said, “texting and driving is really, really bad. We’re going to make it illegal.”

And the first thing that hit the books was you cannot send an SMS text message while operating a vehicle. Well, that’s great. But as I sit here and watch the phones glow and the driver’s hands going by, I have no idea if they’re surfing the web, on YouTube, like all the things that you didn’t make illegal. So you put me in a pretty tough spot, right? We’re sort of at that moment with AI, of the courts are now going to start to see the use of AI that led to something that hits the court. And the analysis of that is sort of something that we’re going to be waiting for at least for the next few months.

And we’ll start to see initial cases that potentially deal with the issue. But we’re at the very beginning of what this looks like. And as a company, we’ll have to react a bit to what is palatable by those triers effect.

Heather: It will require a human. That’s what I think everyone has to realize. You can’t go from AI to court. You need human eyes on it in between.

Si: I think essentially what you’re saying is that there’s a big difference between an investigative lead that’s generated by a tool that helps you to find the evidence that you’re looking for that you then examine, and pressing a button that gives you answers to everything that you then presented court, not actually having reviewed it in any way, shape or form. I think…I mean, I agree with you. I think we’re at a fairly critical stage in…somebody sort of said the other day in this conference I was at, is that we sort of we had, you know, various revolutions over time of, you know, stone age, iron age, whatever…industrial revolution.

This is probably one of the larger revolutions that we’re going to face, possibly even more so than the digital revolution itself. You know, the information revolution happened thousands of years ago at the Library of Alexandria before it burned down and then, you know, okay, so we’ve made it a bit quicker, but fundamentally there’s not been a huge amount of change in some things.

This will generate comments if nothing else does. But this lack…this point where we are effectively handing over understanding or deep understanding of what’s going on inside the black box and then allowing it to make decisions is an interesting turning point in the world and therefore is something to be watched with a great degree of interest as to the way the courts will judge it.

And I mean, it certainly has come up in…there’s a couple of US cases that were cited the other day, whereby somebody had upscaled and enhanced a video and then asked if they could admit it as evidence, which obviously (I’m not going to say, obviously), fortunately, the judge decided was a bad idea. But he only decided it was a bad idea because he couldn’t explain how it works, not because it in and of itself was clearly obvious to anybody thinking about it that he’d just created a bunch of stuff and stuck it in a video.

So I think we will see some interesting case law that happens over the next, like you say, months, years, couple of years to set the standards on that. So, I mean, obviously, this is a not insubstantial piece of work, and on the one hand, it’s never going to be finished because every time you build a better mousetrap, the…nature built a better mouse. So your AI hunt will continue ad infinitum. But what is the next step for you guys on this one?

Heather: So we…when we did techno security, I feel like we left it as, “you must look at the metadata you understand and then focus on the gaps” on the ones that just are missing stuff, which is terrible. It’s not good enough. And then we just did this presentation again. And that’s when we found photos that SQLite and external DB tracking the app that was used to create it.

But I think, honestly, testing the tools that are starting to release AI assistance (that’s what I’m going to call it), AI assistance, because it’s not the answer, will be next. I plan to (and it was actually Jared’s idea), for RSA this year, I’m going to submit the idea of doing the misinformation/disinformation, but even have different countries, like where you are and what’s created and try to get people thinking on what’s real and what makes those things target you in different ways. So I think all of that is going to keep us really busy personally. 

Jared: Yeah. The…as you said before, the volume of data that is, you know, everyone is facing today, we’re going to see AI applied in a good way. As everything adjusts and allows it to be used. But at the same time, the speed with which people can do things that is creating more data is amplified in a great way. “Hey, write this email for me with this tone,” and it’s done in seconds, right? So the faster we’re creating data, we’re still not dedicating the proper resources to all the police units and the people that have to deal with it. And I think that’s one of the biggest challenges that I’ve seen in the digital forensics community over time, is very few places have paid attention to the volume and resources around digital forensics.

Everybody’s happy when you find a deleted message that incriminates someone, or prove the case with whatever picture, video that you find. Like, everyone is super happy for that, and they expect, you know, this, “give me everything, make it fast, and be able to explain it perfectly later in court.” But we’re not scaling those units as we would everything else if it saw the same volume. Any crime that happened, if it started happening 10 times more within 3 years, you would have that many more investigators applied to go investigate it. Digital forensics has every single case doesn’t matter, big, little, everyone has some sort of digital footprint and it has not been prioritized by resources. So I think we’re hopefully going to see that challenged, that fixed, because we’re headed for a really tough few years of the volume is going to go crazy big.

Si: Yeah. And on sort of just again, taking what you’ve just said and going off on a complete tangent…because I’m good at that, and Desi’s is not here to keep me in check today. I’ve heard an interesting…so I’ll do a background story on this one first. In the UK, we had a huge problem several years ago with something called mad cow disease. Okay, mad cow disease is a disease called bovine spongiform encephalopathy. There you go. That’s random things that I know.

But actually what it is to do with is the fact that we were feeding cows cows. Okay. They were…we were taking dead animals, turning them into food, and then feeding them back to vegetarian animals, which is not a good way to go. It’s the way of horror movies. We should have seen it coming. If you just watched a couple of things, you’d know this is a bad idea. We did it anyway. We weren’t alone in it, but we did it anyway. But there’s this concept that we’re getting a whole bunch of AI generated imagery, putting it onto the internet, and then the internet is scraping that AI generated imagery and using it to train AI generators. What do you think might be the outcome of this in the long run?

Jared: So we have a, I’ll say a great colleague, Dan deBeaubien, that works at the SANS Institute, and he’s very good at explaining AI, because it’s complicated. But also pushing forward some of the proper guardrails that need to be applied to some of the models and how it behaves.

And so I think surface level consumers, I think of AI as: I open up a prompt, I type and it does something for me. But as we start to apply it to commercial products and enterprise level things, I think if we’re extremely careful about what it’s intended to do, we can avoid what you were just describing, which was a digital forensics mad cow disease. But you’re right, you know, if the thing is supposed to go out and scrape everything and just know, if what’s been scraped is already terrible and wrong, then it’s going to start to produce that as the correct thing.

And that’s why Dan’s name popped into my mind is because I’ve heard him speak about, you know, there is a good proper way to do this, and to do it safely. And I know that in the US there’s some government directives around AI and making sure that as it starts to be applied to lots of different things, that it’s done correctly because we don’t want, well, the targeting system decided based on the decision tree that this thing had to explode.

And well, there was a mistake. We wish that there was a human there to make that decision. And there wasn’t. So there’s a lot of things in the balance. And, you know, when you’re talking wartime decisions, it’s very different than digital forensics. But I like what you said, because you’re right. If there’s a junk out there and it’s the only thing we train it on, then it’s going to produce junk, and that is unfortunately…

Heather: Yeah, but the negative side of that…yours was very positive: your AI response was…

Jared: I killed the wrong person!

Heather: The negative is what you said earlier: it’s open and you can have smart programmers do whatever they want and change it and still provide access. And that’s what we have done AI generated CSAM talk several times and people were like, “isn’t it protected? Aren’t there things in place to prevent it?” But you can’t prevent someone smart downloading it, training it on what CSAM looks like, and then it’s out there. Now other people can search for it and use it. So we will have nice things that people will always do terrible things with. That’s what happens, right? So you will, like, have a little bit of a mad cow in there.

Jared: Yeah, sure. I mean, it’s…I think as a company, we’ll do the opposite, right? So one approach that we have was training a model based on a large amount of child sex abuse material to basically say, “if we can understand what these images and videos are, we can flag potential hits for our users.” Much as what I described before of that investigative speed of not saying, “hey, this is illegal,” but saying, “hey, take a look at this one specifically because we think that it might be.” Yeah, and if you…

Heather: …and preserving mental health.

Jared: Yeah, right. Like, I have to scan through, you know…my screen’s disgusting all day long, but if I can save myself a bunch of time and be efficient with viewing some of the disgusting stuff, then I think that we definitely preserve some mental health along the way, which a lot of times gets lost in the speed and demand.

Si: Yeah, I mean, I couldn’t agree more in that regard and…I mean, the counterargument to this is always, “well, what if it misses something?” But it’s not as if human examiners are devoid of…especially when you are scanning…I mean, I’ve certainly done cases where I’m reviewing somebody else’s work and I go through their stuff and I find another five images because they didn’t find them. Or something like that. It’s not an unusual thing for a human to miss it as well.

So there is some argument for a degree of false negatives to be allowed. I think the problem is always around false positives and false negatives whether it’s, you know, human detection or not. And I think the area where I personally have the biggest concern is the idea of…somebody told me the other day that they have a…oh, actually, a couple of things…one came up, which was to do with…it’s the largest supplier of body worn cameras in the US, actually, it’s Axon. They now have AI technology that writes police reports on the basis of what it sees in camera…

Heather: My goodness!

Si: …for you. So, to speed up the reporting process, so that scares me slightly. I mean, again, if it speeds it up and somebody then actually properly reviews it and goes, “well, actually, you know, that’s not correct, or it needs this added,” I’m okay with that. But we all know what happens to process when time is on the line and money isn’t. And there’s that.

But the other one is the aging of CSAM because, you know, it is a subjective process anyway. And I don’t understand how an AI can have any subjective idea of what that is, in my head. But you know, that’s just me and my nightmares. So that’s fine. And then…but the idea of anything that could help out mental health is definitely a good thing. Now, while we’re on mental health, I’m just going to be completely personal and ask you: is it easier for you to be able to talk to each other about it?

Heather: I think so.

Jared: We have a really healthy relationship. We try really hard to keep this solid. So, and, you know, we’ve had a lot of personal stuff coming at us in the last few days. And we’ve sort of, you know, taken a moment to say, “glad we have a solid foundation for this one. We’re great.” But you know, we take a lot of action and efforts to take care of us first.

So I think, from my time in law enforcement, it would have been taboo for me to raise my hand and say, “I feel…I’m feeling (really anything) like I’m feeling like, I’m struggling to do this work anymore,” or like that would have been…I don’t know that that would have been laughed at. I had an amazing organization and administration, but it wasn’t normal then. Mental health wasn’t a conversation. Barely, within ICAC units, the crimes against children specific people. I think we’ve come a long way since I left law enforcement in 2018, come a long way for mental health in that arena, for sure.

But also we’re talking about it, right? There’s platforms to…right here. We’re speaking about it, that it is okay to not be okay. And that was again, not something that was ever really said. Law enforcement in general shows up. They see terrible scenes, not just crimes against children’s stuff, but just terrible, terrible things that they’re supposed to walk into their house later that evening, kiss your husband, wife, kid and pretend like everything’s fine.

And then tomorrow the same thing can happen again, right? Like, it’s…what would shock some and, you know, send them crying for a week, law enforcement is expected to deal with on the fly and to keep making good decisions no matter what. So, definitely a challenging task. I’m glad that things have changed a good bit to be able to prioritize mental health and I know a lot of…when things happen now, it’s like an automatic task of, “you experience that you’re now going to go…you don’t have to say a word, but you have an opportunity to, and you actually have to go,” and then, you know, “if you need more, we’ll take care of you.” But it’s better, but I’m sure not great. And I’m sure there’s many that still struggle quietly. There’s one person units of “I look at CSAM all day.”

Heather: Yeah.

Jared: And no one…no, you know, sounding board, no mandated walk outside to clear the air, right? Like, I don’t know.

Si: No, it’s back to that issue of there’s more and no more resources being allocated. And, you know, even if we assume that it’s just more people and the percentage of CSAM doesn’t increase or the AI doesn’t generate more images that you have to work through, it still means that there’s just more. So yeah, no, you’re absolutely right. So, you know, correct funding is obviously a hugely important thing. Is that (and not getting too political), but is that something that the new administration has any interest in? Improving is funding for law enforcement. It struck me that perhaps that was something that they might invest into.

Jared: I don’t know so well what is coming next. I believe that the early sound is that I think law enforcement funding specifically (and I don’t want to go down a whole bunch of political rabbit holes, I’ll just stick with it as we’ve been talking) I do believe that law enforcement funding will be solid or increased, but they’re not going to see a defunding moment here. Where…how that gets prioritized, at least for the United States, unfortunately…you know, Heather took the stage at RSA this year and talked about sextortion and about, you know, some of the resources that are available to everyone to educate your kids and to make it normal to talk about very uncomfortable things.

As we come out of the election cycle, I think the only thing that everyone’s screaming about is border security and, you know, sextortion, as reported by the National Center for Missing and Exploited Children, has seen a phenomenal increase, which is terrible. The numbers are massively increasing and we don’t hear enough, in my opinion, conversation from those who are choosing where the money goes. Ultimately that money needs to go to digital forensics, it needs to go to regulatory functions around social media to mitigate some of the activity that ultimately causes children in their teens to be preyed on, and entrapped by these people from wherever in the world whose whole job is to fish for that next victim. Without consequence. So while law enforcement may be funded adequately in this next cycle, I worry that the priorities may be missed with that money.

Si: A very good answer. Thank you. I appreciate your candor. It’s interesting because in the UK, we changed government recently, earlier this year, and they have done some things to the legal system that have not necessarily made a lot of sense. But one of the things they’re mooting at the moment is the idea of banning social media for under 16s. It’s just been done in Australia. And they’re looking at that now to see whether that’s something that we could roll out here. And that would probably have a huge impact on quite a lot of this, this as a concept because if you can’t do sextortion, you can’t get, you know, images, you can’t do grooming of somebody who’s under 16 because they’re just not on social media. Obviously that makes a huge difference, but we’ll, you know, we’ll see what happens. 

Heather: You’ll have to be in the video games too, because they’ll get them through those chats.

Si: Yeah, absolutely. There’s…something you can rely on is that criminals will be very inventive about ways of carrying out their crimes!

Jared: I think we’re trending in the other direction. Instagram just released, like, Instagram for teens. So very specifically targeting, “here’s a platform just for…”, and you’re targeting a group that doesn’t have a photo ID or some qualifier to say, “I’m definitely not an adult.” You know, maybe they do a great job. And I don’t mean…I have a tremendous amount of respect for most social media companies trust and safety groups and what they try to do while participating in the obviously bigger machine that is the platform, the ads and all the other stuff. But to say, “let’s sign up all the 13 year olds and let them share pictures and have chat…”

Si: Yeah! How to create problems for yourself? Yeah, absolutely. 

Jared: And will very surely generate just more content, which is bad. 

Si: Yeah, it’s bad. If nothing else, it’s just purely more volume for everybody. Yeah. So, thank you so much for your candor and your honesty and doing the research because obviously it’s an incredibly important area that we need to address and, you know, nobody really wants to do it, if we’re brutally honest! It’s really nice when it’s a theoretical pictures of fluffy ducks, and it’s a lot less pleasant when it’s…

Jared: We have development teams that are focused on doing a good job with this. Like, it’s a task that is assigned and being worked. Don’t take just our, “hey, we want to look into this and we want to determine, you know, what’s the easy button? Is there some really easy way to detect AI as people start looking at pictures and seeing things, you know, every day in their analysis?” We have other things that are really actively being worked to do better, faster. But this…sort of our first splash in 2024 was let’s just figure out what we can see. And it just so quickly went down these rabbit holes of every application behaved a little differently and so it wasn’t a red flag, “just go look for this thing”, which we hoped for. It wasn’t.

Si: Yeah, that would have been nice, wouldn’t it? But I mean, it’s really important because you’re…I mean, you know, you work for a commercial company, and you are out talking about it. You’re coming here to talk about it. You’re talking at events. You’ve got, you know, publications online that talk about this. You’re not keeping it to yourselves. And I think that’s a big mark of your integrity and shows the integrity that you’re operating within. That it’s not just about, you know, doing it better for Cellebrite, it’s about just doing it better. And you know, I’m hugely grateful to you for your work on that. And, you know, thank you very much. And it’s fascinating. And it’s an absolute pleasure to talk to you both.

Jared: You as well. Thank you for this.

Si: And, no, it’s been wonderful. And hopefully Desi will be back with us the next time we have this opportunity, if you’re willing. I mean, Heather’s done this once and you’ve now done this twice.

Heather: It’s great, it’s fun!

Jared: I mean, I love this.

Si: So you might come back another time, maybe with two headphones, maybe with one. I think this has worked really well! We’ll see how it goes, but thank you so much for coming on. Everybody who’s been listening to the podcast, thank you for joining us. I hope you found this as interesting and as exciting as I did. You can find the podcast on (and I wish Desi was here because he knows all of these), it’s on Spotify, YouTube, you can pick it up on the Forensic Focus website. There are other things, Apple…Apple i…podcasts. I don’t know.

But anyway, thank you very much for joining us. We hope that you’ll be back soon in the near future to listen to the next interesting thing that we come up with. But again, thank you so much for both joining us. And I’ve thoroughly enjoyed this and come back in six months and tell us what the next great thing is. Because I’m really looking forward to it. But in the meantime, thank you so much. Honestly, and, I’ll say goodbye, goodnight and stop the recording at this point.

Heather: Thank you. 

Jared: Thanks.

Si: Pleasure.

How To Solve Digital Forensics’ Biggest Challenges With Oxygen Forensics

Si: Hello, everyone, and welcome to the Forensic Focus Podcast. Today, we have Matt Finnegan joining us from Oxygen Forensics. Oxygen, as you know, we’ve spoken to a few times in various guises, specializing predominantly, in my understanding, in mobile device forensics. Matt knows something about this and we’ll quiz him about that in a little while. But starting off, Matt, how on earth did you get into this wonderful game that we enjoy and love on a daily basis? 

Matt: Yeah, so, I think like a lot of people, I actually fell into digital forensics a little bit by accident. I got into it through the military. I joined the Navy when I was about 20 and originally in the Navy, I did other things, not directly related to digital forensics, but I was in a technical role and and the military was doing some digital forensics things and they they don’t, you know…there isn’t a dedicated branch or you know job for that. So as a techie, one day I was put into a job where I needed to do digital forensics in support of the military. So I really kind of fell into it by accident. I never really knew anything about digital forensics in detail before I was told one day, but that was now my job and I had to learn it.

Si: “Congratulations! Here you are. Here’s some kit, go do this.” 

Matt: Yeah. And it’s like 15 years later and I’m still doing it. So, I enjoy it. It’s super interesting.

Si: Were they good enough to give you any training in it? Or was it really a baptism of fire of…? 

Matt: No, I was pretty fortunate actually. I got sent on quite a few external commercial training courses. There was a lot of, you know, in team, you know, the more experienced people talking people through, you know, how things work and what everything is before you go and kind of do it live. So I was very fortunate. I went on some of the SANS courses, I did some in internal training and then we were quite fortunate to get kind of follow on training.

So, you know, external courses again, maybe more SANS courses or vendor courses or things like chip off courses, ISP courses. So, I was very fortunate in that regard actually. But to be honest, I’ve always said, you really do learn more in your first day actually ripping phones or extracting phones than on any of those courses, right? You know, the first day you’ve run into something that you’ve never seen before and you start to learn from day one on the job as well. 

Si: Yeah, no, I couldn’t agree more. And so is it mobile phones that you’ve been doing from day one or are you a computer examiner as well? 

Matt: Definitely started with mobile phones, and that was always the main focus, but, you know, stuff that was coming off the battlefield…it could be anything. You know, predominantly mobile phones, and, you know, way back then, it was a weird mixture of maybe a lot of feature phones, a few smartphones. Although not as many back then. But it could be computers. Drone forensics became quite hot a few years into doing that, or sometimes you just get the weird stuff like a router or, you know, some servers that have been pulled out of some racks somewhere or something like that. So it really could be anything, but definitely with a focus on mobiles, that’s where it, you know, most of the information came from. 

Si: So, I mean, obviously you being at Oxygen now at some point decided that the military was coming to an end and you moved on. Did you do anything in the middle or was it straight over to Oxygen?

Matt: So I went from being a practitioner, UK military UK government, directly into Oxygen in the job that I’m doing now. So, you know, practitioner on the Friday and, you know, my current job was a solutions architect on the Monday in Oxygen. 

Si: So, what’s the definition of solutions architect? Because I mean, I’ve worked in IT and strangely…actually, is reasonably variable depending upon the organization you’re working for as to what a solutions architects actually does day to day!

Matt: Yeah. It’s one of those grand titles that gets put on you and then you have to try and explain what it is. So there’s…what we tend to do as solutions architects…the best way I can describe it is really just trying to, you know, explain what our software does to people that, you know, maybe looking for forensic solutions. But I think just as important to that is explaining where it fits because forensics is a toolbox industry. It always will be. You know, no matter any…how hard anybody tries to change that forensics, digital forensics will always be that industry of, you need a number of different tools.

So also trying to explain to people, you know, where we might fit in their existing toolbox, you know, listening to, you know, what people’s pain points or problems that they’re having and then trying to see how you know any one of our pieces of software might be able to help with that, whether it’s you know a particular type of extraction or a particular analysis problem or an analytic or anything really. So it’s trying to assess what people need and then trying to kind of see if we can help and explain how we can help, is probably how I can put it into a nutshell.

Si: And in that regard…you’re dealing with customers obviously all the time to whether that…are you involved in sort of development side of things as well?

Matt: Yeah, we definitely have a big input into development because, you know, digital forensics is constantly changing. And what people need, a lot of the time, you know, they can put feature requests in through, you know, support mechanisms, etc, etc. But a lot of the time some of the best information that the development teams and product teams will get are actually from the solutions architects, because we’re going out and meeting people, and people that are still actively doing digital forensics every day.

So we do build up quite a good understanding when we, you know, we have calls with people or we go and meet, you know, even current customers for a day, just to, you know, get a feel for how they’re using the products. And, you know, really importantly is there anything that we’re missing? You know, where should the development of the product go? Because, you know, developers can, you know, have a vision or, you know, the product team can have a vision, but there’s no point putting time and effort into that if it’s not what people actually want.

So definitely our feedback is really valued by the development team. And we’re really, really appreciative actually when, you know, either people who aren’t customers or especially existing customers take the time to, you know, give detailed feedback about what direction should we go in and the reasons for that, because it really, really helps to focus that development and we don’t waste our time and we don’t release something that isn’t useful. 

Si: No, absolutely. And you alluded to what I imagine is probably the biggest problem in…well, in forensics…in digital forensics as a whole, but certainly in mobile forensics, even more than, computer based, which is the speed of change is, you know, hugely rapid. I mean, versions of Windows is bad enough, but, you know, versions of phones, versions of Android. And again, you know, that…we got Windows machine…okay, yeah the hardware may be different, but that generally doesn’t have that much of a necessarily an impact on the forensic analysis. Whereas the different hardware in all of the mobile devices that exists, can be hugely different. How…what sort of impacts is this actually having on the way that we’re approaching extractions from mobile devices? 

Matt: Yeah, I mean, I think you touched on kind of two things there. One is the speed of change, and the other one is fragmentation, right? The number of different types of devices. And I remember when I started to do digital forensics and mobile forensics, it was much simpler. It definitely was. You know, the places that we tended to work, for a start, we saw a lot of feature phones or old Nokias, which were quite trivial to extract. And even the feature phones, which were those kind of weird, off brand, you know, straight out of Shenzhen, China type things, they were usually like one of maybe three chipsets.

It was, you know, Spectrum from MediaTek or CoolSense. And when you understand the, you know, how they work and how the extraction methods for those work, whether it’s a commercial tool or a flasher box, which is, you know, what we used to turn to quite a lot, it was pretty trivial to get extractions from those. And then, you know, things became a little bit more complicated with smartphones and Android. But, you know, at the start it was still pretty simple.

You know, even if you had a locked device, in particular Android, you could just do, you know…if there wasn’t a tool method of doing it, you could just do a chip off or an ISP or maybe a JTAG. And there was definitely a…I would say kind of a golden age where like nothing would stop you getting into that device, especially if it was an Android, because you had those hardware methods available to you. But then, like you said, speed of change, encryption came in and there was a big panic, you know, “encryption is here”. But at first you had to enable it by default, and nobody did that.

And then it became enforced and there was a little bit more panic. But then it turned out that they were using a default password. So it was harder because of the hardware backed encryption and things like that, but there were still ways around it. But then things just keep evolving. So, you know, Android and iOS, they moved from full disk encryption to file based encryption, which again made things harder, but not impossible. It just gets incrementally harder and harder. And to kind of talk to your question a little bit…and I’m aware that I’m going off on a bit of a tangent here, maybe so interrupt me if you want to refocus me in…

Si: No, we welcome tangents, it’s fine!

Matt: …in a particular direction. You know, the state of things at the moment, I would say, with, you know, locked mobile phones, Android or iOS to use the two main examples, you know, with…and I’ll talk more about Android because in some ways it’s more interesting to talk about because iOS is a little bit more black and white. Obviously we’re talking about file based encryption.

Nowadays that means that the user password is almost definitely, you know, 99.9% of cases going to be tied to the encryption on the device. And there’s going to be that hardware backed element as well. So there are really, you know, two main, I would say, methodologies to go after those, you know, get into those devices. The first is at the operating system level. So the device is booted up and it’s, you know, more of a screen lock bypass and an exploit to get, you know, escalated privileges and then extract the data, which is already decrypted. Because, you know, if the device is in that AFU state…so I guess what I’m talking about here is the sort of BFU/AFU type methodologies that work at the operating system level and then the other…

Si: So just for clarity: AFU, BFU? 

Matt: Yeah, so, with the…I’ll almost go back a little bit, with the introduction of file based encryption, which is, you know, one of the things I didn’t actually mention is a lot of the evolution in device security is actually driven by user experience. You know, in the start, a lot of these devices were full disk encryption, but it didn’t use your password for the encryption unless you turned on something like secure start. Not great for the user experience because when you turn the phone on, it means that it doesn’t really do anything until you put your password in.

So you’re not going to receive calls or WhatsApp messages, etc etc. So quite secure, but not good for the user experience. And vendors, you know, they’re thinking with two hats on. They’re thinking with the average, you know, general user’s hat on, “what do I want my experience to be like?” And they’re thinking with that security focused hat on, you know, the tinfoil hat, if you like. And that really, I think, is what drove the adoption of file based encryption, because it meant that you could pick and choose what is automatically decrypted when you just turn the device on.

So you can turn the device on and it will be able to do some stuff like receive calls or, you know, various different things. That means that some stuff is decrypted automatically. And the stuff that is decrypted automatically, is the things that we would deem to be available in, you know, what’s termed as a before first unlock encrypt extraction.

So you just turn the phone on, it will decrypt some stuff. And if you’re able to get around the screen lock, that’s the stuff that you’d be able to get in a decrypted format. When you put your password in and you know, everything (or maybe everything) becomes decrypted on the device. And when you lock the phone again, generally speaking, that data will remain decrypted, all those keys will remain available after you’ve locked that device if it’s been unlocked, at least at least once before. So in those instances, you know, and this isn’t actually, you know, one of the approaches that we use at the moment, it’s really a case of getting around the screen lock, and then some form of privilege escalation to, you know, be able to extract data from the device. The other methodology, which is one that we use more heavily, is the ability to do offline decryption.

So, you know…not always offline decryption, but quite often, so, you know, just extract the…all the data from the phone as a physical image, and, you know, whichever hardware keys or hardware values are used in the encryption on the device so that we can decrypt it offline and, you know, brute force or guess the user password if we need to.

There is also another method, which is kind of a halfway house, where you let the device do some of the decryption stuff, but maybe I won’t, you know, go into that at the moment. And both those methods are valid. Both, you know, both of them work in certain scenarios. You know, the offline decryption works better if you have a device that’s already switched off. The, you know, the AFU method might work better if you have a device that is in AFU mode because you might not need to recover the user password. But, you know, things are always moving quickly.

And actually, you know, there was quite heavily in the news recently, though, there was this story about, iOS had introduced a mechanism that will reboot an iPhone if it’s locked for three days. I don’t know the exact details, but that’s specifically to combat the use of AFU style methodologies. So vendors or developers are always obviously looking at how digital forensics companies are kind of breaking into these devices and introducing mechanisms to get around that.

And if I recall correctly (and I might be wrong on this) I don’t think iOS were the first people to…or Apple were the first people to do this. I think this is something that was introduced in GrapheneOS, which is a security focused derivative of Android that usually runs on Pixel devices. And I don’t think it will be long before, you know, that’s introduced into Android as a mainstream update. You know, whether or not all the vendors will choose to implement that, but I can see it coming. And there’s other things as well. (And I apologize, this is a really, really long answer to your question!)

Si: It’s fine!

Matt: You know, one of the other things that I can see happening is the fact that normally once you unlock a phone and then re-lock it, data remains decrypted. That could also change, right? There is already I think an API call in Android that allows app developers if they want to, and if they’re using the key store to, which is an Android subsystem that allows app developers to encrypt their apps data with hardware backed keys. You know, there’s already mechanisms in there that allow developers to only make that data decrypted when the phone is unlocked. They’re just not used. They’re really, really rarely used. In fact, I don’t know of any applications that use those.

And, you know, it may be that more applications start to make use of those. But again, you have to think about the user experience. Would that impact the user experience? And it’s always that trade off. And you might be able to implement that kind of thing in a way that doesn’t really impact the user experience, but it’d be interesting to see if that sort of thing comes into play, you know, eroding the effectiveness of some of those methods.

But if it does, it probably…it won’t be like universal. Like we…there’s always this panic when a new security mechanism or type of encryption comes out that this is the end of the world. There’s going to be no way around it. And either the uptake of that feature will be very low because it impacts the user experience, or there will be a way around it that you know, people will be able to find.

So it’s never the end of the world, but I guess kind of in closing to your your question, we’ve gone from that golden age I think where you could just do a chip off or an ISP or JTAG and it made you look really, really good because you could get it any phone and and people were always impressed, to the age where, you know, exploiting a vulnerability has become necessary and exploiting vulnerabilities that exist in ever decreasing attack surfaces, you know, that’s becoming harder and harder to find the things that we can interact with on these locked devices are becoming smaller and smaller.

The attack surface is ever decreasing. So, you know, maybe we’ll reach a point where it’s kind of the end of the world, but I don’t think we’re there at the moment. And actually just one last thing I would say just before I hand it back to you, because I’m kind of hogging the mic here, so apologies for that. I think what’s kind of come into focus as devices have become harder to extract data from, particularly if they’re locked, you know, the amount of data that people has has expanded so much that actually there are other places that we can look for it.

You might be able to find the data that fills in the gaps in the cloud or on a computer or get some credentials from a computer that you can do a cloud extraction from. So, because, you know, the data volume has bloomed, you know, the amount of data that people have associated to them is much bigger, it means that you might be able to get some of that data and fill in the gaps from somewhere else. So that’s kind of come more in a cloud forensics is only ever on the up in terms of importance.

Si: I mean, you’re lining these. I mean the…my only objection to you hogging the mic is the fact that you steal the question before I have an opportunity to ask it. I’m not serious! So, I mean, yeah. And, you know, again, Oxygen has capabilities for cloud extraction and it’s certainly a more prevalent thing that I’m seeing in cases. I try generally not to deal with mobile phones. It’s not my expertise. I don’t have the equipment and I leave that sort of thing to professionals.

But cloud is cropping up more and more often as components of cases that I see. Let’s move on to that and talk about, sort of, cloud. What…are are we able to extract, sort of things like encryption keys and other stuff, or is it purely other evidential material, because obviously everything’s…if it’s being backed up to the cloud, you just pull the cloud copy and you don’t worry about what’s on the phone, you just go, “this is a backup of that, and therefore…”, that way. Or can you use it as a, you know, a plain text to try and break a ciphertext? Is it…what are the sort of things that we’re gaining by doing this cloud analysis?

Matt: There’s so much data that could be in the cloud. It’s kind of all of the above to be totally honest. It could just be, like you said, the content that was on the phone, it could be the messages from…whether it’s WhatsApp or Telegram or Viber or, you know, any number of different messaging applications. It could also be like you say, there’s a chance that there could be stored passwords in some of these cloud services. You know, there could be just entire backups of devices.

There could be an entire iCloud backup of a device, which not only gives you, you know, data from the device, but it also potentially gives you that historic snapshot of data that was there a week ago or a month ago, but might not even be there if you did do a successful mobile extraction today. And it’s loads of other stuff as well. It’s like a hundred plus support services in the cloud extractor that we have. And it could be Uber, it could be geolocational data. It could be, you know, the MapMyRun or the Adidas running applications that again is geolocational data. It may not even be that you need to know where somebody was at a particular time, it could be just useful to build up a pattern of life. You know, “what does somebody normally do on a Monday morning?

They normally go for a run, but on this day, they didn’t go for a run on Monday morning.” It could be the absence of data that, you know, helps. So it’s a really, really wide variety. If you think about any of the apps that you have on your phone, with the exception of some that may not, you know, store data in the cloud, you will probably be able to extract data from any of them if the cloud extractor for that particular device existed.

So it’s incredibly broad and sometimes these cloud extractions can get out of control a little bit. I’ve spoken to people in the past, more than one organization that has done cloud extractions and they’ve said, “yeah, we should have date ranged the extraction because it’s like two terabytes and it’s still going.” So it’s a ridiculous amount of data. It can be in the terabytes. It could be way more than what you would get from the device on its own. 

Si: Yeah, no. I, again, I’ve been…my experience of them has been fascinating. And yeah, I’ve had one where I’ve definitely…where I’m still downloading it and come back two or three days later and it’s still going and you’re wondering why on earth you started this whole thing. But for things like, let’s say WhatsApp. WhatsApp is a fantastically prevalent and incredibly commonly used in criminal offenses, for some strange reason, I don’t know.

Anyway, it’s the idea of time limited messaging, I’m assuming. But what sort of differences are we going to be looking at if…depending upon the way that we go about extracting a WhatsApp? So, what am I guessing from…what are the problems with doing…what am I going to miss if I do a cloud extraction? What can I get more by doing it directly on the phone? Or, you know, is there a best way to approach it? 

Matt: So WhatsApp is an interesting one actually, because it’s more a case of data being synced between different devices that there could be messages sat in the cloud, but generally they’re the messages that haven’t been delivered yet. And it kind of opens a can of worms actually if you do a WhatsApp extraction you could get via the cloud, you could get messages that were actually sent and never actually received on the phone because maybe it was put into airplane mode or switched off, when it was seized. And we tend to see actually that the chat history for WhatsApp, when you extract it from the cloud tends to go back about a year.

And it could even be, you know, syncing those messages from other devices, that the WhatsApp data is on. So it’s a…WhatsApp is a bit of a weird one, and I probably don’t even understand it as much as I should. But, as I understand it, it’s not even necessarily that the data is held in the cloud, it’s more that it’s being synced from other WhatsApp devices that have that data on them.

As far as I know, only the queued messages are actually held in the cloud. And there is an interesting capability within the cloud extractor in Detective around WhatsApp, which is not actually doing a WhatsApp cloud extraction as such, but if you do get a…because if you set WhatsApp to encrypt on a device, whether it’s an iPhone or an Android, it will save those backups periodically, however often you tell it to to make those backups in the WhatsApp app.

And those could be in the Google drive, they could be in iCloud backups or they could just be on the SD card of the device itself if it’s set to save locally. They are encrypted and normally to decrypt them, you need a key that you can only get from a full file system or a physical and then decrypted extraction. There is an interesting capability in in the cloud extractor actually that if you have one of those encrypted backups and you don’t have a full extraction with that decryption key, you can actually, effectively authenticate with the WhatsApp server as that user, and get it to send you the key to be able to decrypt those backups.

So again, it’s…that can be really, really useful and maybe even sometimes more useful than doing a normal cloud extraction because you could get snapshots. You know, if somebody’s making a weekly backup, you’ll get that perfect snapshot of all the data that was there a week ago, two weeks ago, you know, three weeks ago. And there could be deleted records that are deleted now, but they weren’t deleted then. So you’re not even having to do that kind of recover deleted records to be able to get some of that old data. It’s just there in the backup. 

Si: So how…I mean, obviously, you know, you’ve got a mobile phone…or you’ve got a case. Let’s go with a case. It’s easier to think about an individual. And they probably have at least one device, possibly two, maybe…well, probably two. Possibly one! Seems to me people have more mobile phones than I do. But I mean, you’re looking at an iPad, an iPhone, maybe another Android phone, if they’ve got something, you know, if they’re business people…there may be multiple phones and things like this.

And you’ve got cloud extractions of all of that. You’re talking…and you’ve got snapshots of something over a long period of time. How do we manage that amount of data and how do we reconcile it against itself? I mean, if you’re talking about snapshots, obviously you’re going to have multiple copies of…potentially have multiple copies of the same message across several backups with some that have some messages, some that don’t have other messages. And it becomes a jigsaw puzzle with overlapping pieces.

Matt: Yeah, it definitely can. And you’re right, everybody…pretty much everybody now has…probably has a couple of devices. They might even have the same accounts on those devices. And there’s also that draw that everyone has in their house with all their old phones in it as well.

Si: Mine’s behind me. It’s got about 12, so yeah!

Matt: You can always tell when you’ve been given the contents of that draw. But it’s actually really, really useful because a lot of the time, you know their Android device from 10 years ago has the same pin code as their, you know, current brand new iPhone 16. So, you know, password reuse always really, really helps. But to kind of go back to your point about, you know, you can have an overwhelming amount of data and how do you reconcile that?

I think having the ability to put different data sources and multiple devices or extractions in a single case, which is something that we do do, and it’s kind of for that reason is really important. And, you know, one of the kind of ways that I would go normally to look at that data in a little bit more sense, is (and I’m talking about Detective here), you know, if you go to a case level timeline.

So you’ve got, you know, maybe 10 different extractions of different types in a case, if you look at the case level timeline, you can deduplicate, you know, identical results or messages and just have a timeline with kind of one of each in there. So it does make things easier, but yeah, you’re right…I mean, even just, you know, loading huge amounts of data, big extractions, is something that is also a problem in digital forensics nowadays because, you know, a lot of this software was written when you had a Nokia that you got a few text messages from, and it wasn’t going to take long to load. I think one of the challenges that vendors have at the moment is, you know, it doesn’t matter if you have a super powerful workstation, if the parsing code is relatively inefficient, then it’s still going to take a long time (and a bit of a plug, so apologies) and that’s kind of the reason that…

Si: No, this is fine. You’re from Oxygen. I expect these things!

Matt: …was rewritten actually with kind of, you know, a view of making it as fast as it can be on the parsing and analytics side a few years ago, because data volumes are just getting bigger. You know, an average phone extraction is probably over a hundred gigabytes nowadays, which is pretty wild when you think back to when it was four or eight, maybe sixteen gigabytes. And then you add in all the cloud stuff and then you add in stuff from computers and it does get difficult to manage. So having an efficient piece of software in terms of processing, but also having the ability to look at data on a case level, and be able to deduplicate and timeline things is really helpful when you have, you know, a lot of different extractions.

Si: In…I mean…so with regard to the ability to process huge amounts of data, I mean we talk about it on the workstation basis and we’ve talked about the cloud, but we’ve not talked about the cloud as a analysis platform. Is that something that you’re able to leverage? Obviously, with, you know, instantaneous scalability to throw a million processes at something, many hands make light work, kind of stuff. Is that something that you do? Or is that something…because I’m aware of various products that do make use of the cloud, and I have personal opinions on the security and the implications of uploading forensic evidence into the cloud. But, you know, what are your sort of thoughts and opinions on it? 

Matt: Yeah, I mean, if it’s…you do raise an interesting point around, you know, if you’re using the cloud, that could mean two things. It means that, you know, the first is that you’re using something that you’ve set up, whether that’s in a commercial provider or if that’s just kind of your own mini cloud effectively, or it’s something that somebody else is hosting. And anything that somebody else is hosting or is hosted in a commercial provider that there is always going to be a concern around data integrity and data security. And I can’t see us going in that particular direction. Although I’m definitely not the boss, and I can’t speak, you know, with certainty around that.

I think what would be quite interesting would be more just generic distributed processing. Like you were saying, whether that’s in a different cloud somewhere or in something that, you know, you’ve set up, being able to distribute it. We are looking at, you know, maybe adding capabilities around being able to automate processing (and I’m not even sure if I should be saying that, so we can cut this…)

Si: I won’t press the point!

Matt: But yeah, I think actually…like I said before, it’s fine to throw a million processors at something, but I think equally important or maybe even more important is actually how is the code written that’s doing the processing? If it’s a program that is not as efficient as it should be or could be, then you’re always going to be fighting a losing battle.

I think it’s, you know, important to get the kind of framework right and and the ground works right in terms of, you know, this is a fast piece of software, and then look at the question of how you do the distributed processing afterwards. Because actually if it’s, you know, fast software then actually it will still load extractions relatively quickly. Even if it’s something that you have to leave running overnight. I think for most people, if it’s the case that it will be done by the next morning, that’s probably acceptable. And if it’s there, when you come in in the morning and ready to go.

I think what’s increasingly adding to the overhead of processing is that we’re not just, you know, pulling the WhatsApp messages out of a database and pulling files out of a file system anymore, increasingly people are expecting other analytics like OCR, speech to text, translation, even malware detection. Those things do all take longer. So, you know, being able to again GPU accelerate those…actually, if you can GPU accelerate something, like speech to text, you probably don’t even need to distribute that. You know, one GPU is probably going to be enough to do that very, very quickly.

So, I guess I’m kind of with you, I’m a little bit of a skeptic on the really massively distributed things. If nothing else, not just because of the security implications, but also the complexity. You know, when these kind of systems are kind of built, they tend to fall over quite a lot in my experience. You know, as things become more complex, it looks brilliant on paper until it breaks and you have to get a specialized engineer in to figure out why it’s gone wrong. You know, suddenly you’ve got a big amount of downtime. So again, I think there’s a…when I was saying before security is trade off of, you know, user experience versus security, I think with processing, it’s also a trade off of complexity and reliability, you know, versus speed. And actually we might be able to achieve what we need with just single workstations still. Long answer. Sorry. 

Si: No, no, it’s an excellent answer. And actually, I’m going to challenge you on this. Now you sound…and, you know, your background is clearly technical. And you’re coming across very technical. And we’re talking about legacy code bases and how they’re not well written. Is there an opportunity, do you think, for refining forensic tools in general by moving to a better designed operating system? Windows itself is a large piece of legacy code, and it’s quite often a limiting factor in writing high performance stuff. It’s not designed as a high performance operating system, unlike…well, Linux isn’t necessarily designed as a high performance operating system, but at least Unix is designed as a high performance operating system, and therefore there are opportunities for more performant code to run on alternative operating systems than Linux. What do you reckon? 

Matt: So, you sound like much more of an expert in this than me. I think that you’re probably right. And I guess, you know, as an example, which is not directly, you know…it’s not a direct parallel, but if you look at any supercomputer, right, it’s not going to be running Windows, it’s going to be running some form of Unix or Linux. Yes, I think you’re probably right. But again, I would worry about the complexity. That would be some sort of really complex bespoke type system that it’s not going to be the case. You just download the Windows installer from the software portal, and then, you know, within 10 minutes, you’re up and running.

For organizations with huge amounts of data or that want to do clever analytics across huge amounts of data, yeah, I think something like a different operating system probably would be useful. And to be honest, they’re probably the type of people that are looking at cloud, and they’re probably not even thinking about Windows. They might even be running their own custom analytics and software to do it.

So, you know, can I see a forensics vendor implementing a kind of, you know, processing engine on a different operating system? Maybe, but I think more likely they would probably host it themselves, and then we would be back in that, “you’re going to have to upload all your data to the cloud for it to be processed,” type question. And it definitely is taking longer to process data, but I’m not sure that we’re at the stage where that’s absolutely necessary at the moment. Although for, you know, some people data processing speeds are more of a priority than others. So kind of a half answer to your question. I think, Si. I’m not really sure!

Si: No, it’s fine. It was an unfair question. I mean I do majority of my work on…I use Linux, I use Windows and I use MacOS. My background is as a Unix systems administrator, so for me, I’m very comfortable in Linux and MacOS because I can go to the command line and do whatever I want and it usually works!

Matt: …actually install programs on Linux, which I think stumps most of us at times. 

Si: And it’s interesting what you said, because actually I…one of the things I’ve done in a past life, was set up what was called a Beowulf cluster, which was actually commodity desktop machines repurposed with Linux to run as a large parallel processing machine. So it was about 32 odd PCs sitting in the rack, each of which obviously is a standalone PC, but they’re all talking to each other to do distributed processing. And that was for cancer research and doing, you know, distributed computing on cancer simulations and stuff like that.

So there’s a lot of technology that exists in other parts of computing that we haven’t really come around to leveraging in forensics yet, in some ways. So I kind of feel that, you know, there’s opportunities still for speed increases. And the funny thing about Beowulf clusters actually is that they were fundamentally sold as the workstation you’ve just retired off the desktop, as opposed to the one you’re actually using goes into the cluster, okay. And then, you know, that just gradually keeps expanding and it doesn’t…it kind of matters less how performant each chip is when you’ve got more of them over time. It’s an odd model, but it does work. 

Matt: That’s a really noble use case as well. It’s better than Bitcoin mining or something like that! Yeah, I mean, it’s an interesting concept, right? If you’ve got 20 examiners that each have a workstation, why not be able to tap into everybody else’s resources when they’re not using them, right? Like you say, it’s technology that exists, so it’s…

Si: Well, it’s the whole fundamental design principle for virtualization is that…you know, certainly in a data center whereby, you know, one machine wasn’t running one web server all the time and therefore you could run 50 web servers and they would probably be okay, on a single machine and you virtualized it out. And, again, we don’t really see…well, to be fair, if we’re running forensics jobs, we tend to be taxing the process to the top of its ability while we are doing it.

But like you say, in a lab full of 20 people, 10 of them are writing reports at any given time, and 10 are actually, you know, doing something. So, there may be some room for shared or distributed computing. But like you said, GPUs are a fascinating thing in so much as it is such a significant processor in and of itself, or more to the point, so many cores in and of itself that it’s churning through some stuff so quickly now. And burning so much energy. 

Matt: Yeah, that’s an interesting consideration. What is the common footprint of digital forensics, right? 

Si: Yeah, yeah. 

Matt: …voice to text transcriptions. 

Si: But I’m going to circle back to something you said earlier, and it got me thinking because obviously I have my drawer of, you know, 50 phones behind me or whatever it actually is. I don’t know. Too many! But what I do is, is I actually…I do a factory reset on them before I chuck them in the drawer. Well, most of them. I’ve got a couple that are still running apps that I have to go and find the charger for to pull them up because I haven’t figured out how to get the one time passwords off the bloody things. But, how effective is a factory reset? Is there anything that’s recoverable after that? Or is it easy to…good, solid, reformatting, with a couple of overwrites that we would consider for a hard disk? 

Matt: You know, I always say digital forensics people are like politicians. We don’t give straight answers. You won’t get a yes or no answer from a digital forensics person usually. So I’m not going to give you one! The answer I’m going to give you is: I think it depends. You know, it depends on a whole host of factors really, you know, what generation is the device, what’s the operating system, what version of the operating system, but I…probably most importantly, what is the encryption type on the device?

You know, in years gone by, if you…before, you know, the Android devices were encrypted. Yeah, if you did a physical extraction of a device that had been factory reset, you were going to get loads of messages and photos and all kinds of data back. Nowadays I think it’s much, much less. And I can’t remember looking at a specific case myself. I’m trying to think back…iPhones. There may be some indicators, but in terms of, you know, actual indicators that something was factory reset possibly. But in terms of user data, I wouldn’t really expect to find anything, especially with file based encryption being quite prevalent nowadays, I would be surprised if there was much left. But I’m not an expert on that, so I’m going to say: probably not much. 

Si: Okay, so what I’m taking away from that is for the older devices, shred them, but anything more modern, you’ll probably be fine. 

Matt: Yeah, I think so. Just don’t forget to delete all that data out of the cloud as well, right? If you do want to get rid of it permanently.

Si: Oh, well, this is it, isn’t it? This is how on earth do you delete the footprint that we’ve created now? And I wouldn’t even know where to start. It is terrifying. I mean, I could write to…go to the Google and sort of hit the, “please delete all my data” button, but I’d have no clue about whether they did or didn’t and the extent beyond that. And, it was the thought the other day is…we were talking about AI generation and as everybody is at some point sooner or later, in any sort of forensics conversation, but it was about voice simulation. So you know, taking someone’s voice. And it’s like, I’ve now done half a dozen of these (more than half a dozen of these) podcasts. And there’s more than enough voice data to turn me into a simulation. And can I get it back? No. There’s no hope. It wasn’t a consideration when I started doing this, but could I go back and pull that in now? No. No chance. So as soon as you’ve got to kind of accept that we are now part of a digital world, which is…it’s just going to be what it is.

Matt: Everybody’s immortal in a small way now, right? 

Si: Yeah. Although I do…I have come across this wonderful cheat, okay. And I don’t know how well it will work out for you. But for me, the thing that made me vanish from the internet most effectively was having a very, very similar name to a very successful gymnast in the US. Because now anybody who searches Simon Biles actually gets automatically corrected to Simone and she gets…she is the top search for everything that you try and put my name in for. I used to come up on the top…on the first page of Google, and I don’t think I even show to about page 30 now, so it’s an interesting technique to get oneself removed from the internet. And quite hard to reproduce.

Matt: There’s a…I think there’s a writer for like a PC World magazine or something that has the same name as me. So I think that’s what normally comes up when you search my name. I don’t know though, do you want to be on the first page of Google or are you quite happy…?

Si: Well, actually, to be honest, at the time when I was on the first page of Google, I was fine with it. Now I’m very happy to be on page 30! I’m quite glad to have been pushed back. It’s not a big deal for me. I do not have sufficient vanity to care, but I do find it amusing. So, I mean, I’ve touched on AI, but I don’t want to talk about it anymore! Not in a bad way, but I think it’s starting to sound a little cliched. But what else is coming in our future of…well, let’s talk about mobile devices. But what’s coming in the future for us that’s going to present a challenge, do you think?

Matt: Well, you’ve mentioned AI, but we’ll skip over that one. I think that the…some of the biggest challenges are going to be around extraction. And I think I’ve covered some of them already. And I think it’s going to be…I think two things. I think the first thing is that vendors are becoming much more…not even much more, but they are taking note of what digital forensics companies are doing. You know, they’re actively, you know, patching vulnerabilities. But they’re taking steps that are quite specific to how digital forensics tools extract data.

You know, the example with iOS (and I think GrapheneOS already does it automatically does it) rebooting after three days. That’s very targeted at digital forensics, right? There is an argument that, you know, some malware is probably not persistent and it’s probably good hygiene to reboot your device every few days just to clear any malware out of RAM that might be sitting there. But that’s quite edge case. That’s quite niche. I think that is very, very focused at digital forensics companies. And, you know, that’s the top level. That’s the Android and the iOS of the world.

I think as app developers become more security focused and may also start to take note of, “how do we mitigate tools that are using AFU extraction methods?” What I was talking about before where, you know, there are APIs available (or API calls available) to developers now that allow them to say, “this data: once the phone is locked, re-encrypt it.” You know, “don’t make those encryption keys available anymore.” And that, at the app level, could also be a problem as we go on.

And it may be that stuff like AFU extractions just decrease in viability, and we have to look more to those hardware key extractions or kind of, you know, lower level beneath the operating system level extractions and do, you know, either offline decryption or on the device, but not when the devices is fully booted. But even that’s becoming harder because those attack surfaces are quite small as well. You’re looking at boot ROMs, which are, you know, tiny code bases, or boot loaders, which again are quite limited code bases that…I think if Samsung or if, you know, Xiaomi, or whoever wanted to go through the, you know, low level boot ROM/boot loader code bases with a fine tooth comb, I reckon they could patch everything in a few weeks. If there are vulnerabilities there.

You know, some vulnerabilities are more complex to find, you know, than really simple ones. You know, some of them, you might have to put the device in a certain situation for it to…but I do worry that the attack surface is relatively limited. There are the mitigations that, you know, the top level vendors, if you like, like Android and Apple are putting in place, but I think that will trickle down into the app developers as well.

So, I think that…and it’s kind of a cliche just to say extraction, but think that that’s only going to get harder, especially with what we’ve seen in the last few weeks around some of these new security mechanisms. Which are actually not even that new, you know, they’ve been around in some operating systems for a little while. It’s the fact that they’re actively taking note of what digital forensics tools are doing and effectively targeting us in a way to mitigate against those specifically, is quite interesting. We’re on the radar, should we say. The entire industry is on the radar.

Si: Well, you’re doing…going back to the military, you’re doing free pen testing for them, effectively, is what you’re doing. You know, software vendors in…if you’re trying to create a secure solution, you know, you have to pay somebody to come and test it for you to make sure that you know that it’s locked down properly. You guys are doing this for free for them, and then producing it. And there’s this interesting sort of issue that presents itself at that point, which is what we do, we have to be able to go into court and explain.

Therefore, we need to know what we’ve done and therefore you need to tell us what we’ve done by doing it. And therefore anybody else is also able to get that information themselves. You know, Samsung could come and buy a copy of Oxygen, possibly under a different name, but they will get the training. They’ll be able to look at the tool and they’ll understand it. There is a company out there who we both know starts with “gray” and ends in “key”, that don’t share this information and keep it sort of locked down. And there’s this interesting problem that it presents, which is, okay, so we get Graykey obtained stuff. How do we actually defend that in court by standing up and going, “okay, I’ve got this, I have no idea how I got it or how it came out of that, but it’s here and I want you to trust it.”

We’ve got this lovely war going on whereby, okay, so the vendors keep…the phone vendors keep improving their stuff. You guys keep doing your jobs properly by finding the opportunities to get in and then telling people how they work so that you can justify it in the court of law. And then there’s these other guys who come along and ride slightly roughshod over the whole concept. What do you reckon? 

Matt: The black box, quite literally, right? You know, it’s interesting. In some regards, I get it, right? Encryption is the problem, right? And if you go way back to like the start of encryption, you know, it was the case that governments didn’t even want the average user to have it because it is such a powerful thing. And it, you know, good encryption is inherently strong. You know, you’re not gonna brute force an AES key in trillions of years.

So you have to find, you know, ways around it. Which, you know, we have to have, you know, methods that can help us. I say have to, you know, it’s just my opinion. So, you know, if a vendor does find a way around a screen lock to get the decrypted data, I can see the reason for wanting to protect that method because it will be patched in a heartbeat. I think there’s the wanting to protect it so that examiners can get the data and there’s also the, you know, the business…the commercial side of wanting to protect it because you’ve probably, you know, it’s taken a while to find, it’s not cheap to do these things and you don’t want it to go away tomorrow, which they always can. You’re always on an eye fetch.

So, you know, there are reasons to protect the methods. But you’re right, you know, anybody could say, “well, you don’t know what happened on that device. It may be that you never…you were able to get the data, but you were never able to unlock the device to actually, you know, verify what was on it.” So how do you know that even if the tool is good that it hasn’t even been tampered with to put, you know, fake data on the device, or does it give you the ability to put fake data on the device? Or when it’s extracting, you know, is it extracting valid data or is it manipulating it or changing it in some way?

And I…you know, I don’t have a good answer. You’re absolutely right. Anybody could challenge that and say, “if it is literally a black box that you have no idea how it’s gaining access, or, you know, how it’s extracting data, how do you know that it’s correct or that it’s even working properly?” And I don’t think that you can, I think you just have to trust. I think people just rely on the trust of the reputation of the companies, that they’re not doing anything untoward. But it does create a problem, I think around where…I don’t know if there’s any cases where it’s been challenged specifically, because people that are using the tools don’t 100% understand how they’re working. It’s definitely a Pandora’s box. Or, an interesting question, but yeah. 

Si: An interesting question. Well, I’m going to draw a line on that because we’ve literally just hit the hour. And I’ve run out of questions and…but it’s been an absolutely fascinating discussion. And thank you so much for coming on to the podcast to have a chat and tell us all about yourself and your thoughts, and to enlighten us as to what Oxygen is up to and what they’re doing. I’ve thoroughly enjoyed this. So thank you again.

Listeners, obviously you are listening to this, so you do know where to find this in some way, shape or form. But if you have a preferred podcast player such as Spotify and/or Apple Podcasts and/or whatever podcast thingy that Desi always remembers and I always forget…but we’re also on Forensic Focus website and on YouTube, and please, we’d be delighted if you came and listened to us at any point again in the future, because we have, like Matt, so many fascinating people who come on and tell us all about amazing things that are cutting edge in the industry…in the, you know…they’re experts, we aren’t! It’s absolutely wonderful. So, thank you very much for joining us, Matt.

Thank you so much for coming in and talking. And, it’s been an absolute pleasure. And I hope you’ll come back again in future, and tell us about something else and what’s going on.

Matt: Well, thank you very much for hosting me, it’s been really good to talk to you. So thank you again, Si.

The Impact Of AI On Video Forensics: Insights From Amped Software

podcast title graphic video forensics

Si: Welcome everyone to Forensic Focus Podcast. Today we have with us our friend of many occasions now and we see Amped often because their stuff’s brilliant. But we have with us today Martino Jerian, CEO of Amped, and we’re going to have a nice, interesting conversation today about some of the work you’ve been doing with relation to AI and regulation and presenting to the European Parliament and all sorts of exciting and amazing stuff that you’ve been doing, getting your hands really dirty at the legislation end of things and where AI is taking us and what problems we’re going to have and what advantages we’re going to have and how you’re going to solve all of this single handedly and it’s going to be brilliant. I’m really looking forward to it!

Martino: No pressure!

Si: No, none whatsoever. We expect deliverable outcomes by the end of this meeting to actually achieve some sort of common sense in the industry.

Martino: Thanks for having me again.

Si: It’s always a pleasure. So tell us, I mean, you have been talking to the European Parliament about things. What exactly have you been talking to them about?

Martino: Yeah, it’s been…we did the two meetings, one was in 2023, the other in 2022. I actually delivered a kind of broader document. I mean, AI is just a small part of it, but kind of the starting idea was…there is a lot of discussion, I mean, there’s been for a few years about cybersecurity and AI, you know, face recognition, privacy: usual stuff. But when it comes to video evidence, even without thinking about AI, which is a big deal, there are more, let’s say, foundational issues, in the way video evidence is used. The biggest problem probably is the kind of educational literacy. The fact that…I’m at the point where I bore myself with this thing because I always say the same thing.

Everybody is able to, I mean, take pictures, vacations, watch a video on YouTube. So everybody believes to be a forensic expert. And so sometimes video and image evidence is a bit taken for granted. That’s at the bottom of all the work we’ve done. So we’ve prepared a set of principles, both for kind of very high level institution chiefs, even journalists or laymen people, just to point them into the major issues and topics and things they should be aware of. And then some more kind of technical principles for practitioners. And we didn’t reinvent the wheel.

We kind of summarize together in a document what are, let’s say, the usual guidelines that are available in the community. Like there are these SWGDE documents, the MC document from US and Europe respectively. There are also a lot of regulations in UK. So it’s a kind of, I consider them a kind of trailer, a kind of advertisement for the action guidelines because people should be more aware of them. And I mean, more of a general introduction about the big topics.

Desi: Is that document that you’re referencing there…I was doing a bit of reading in preparation for this interview, was the…that’s the essential concepts and principles of the use…?

Martino: Yep.

Desi: Yeah, okay, so it was like you said, like it kind of covers big topics and we’ll link that for our listeners in the show notes as well if they want to go and download that from Amped’s website and have a read themselves.

And so it’s interesting, I think we’ll get into it as we go through, chatting with you now, but I guess there’s two sides to the coin with AI in terms of, you’ve got the…quite a lot of images that you’ll be getting these days may have been influenced by AI, and I think that’s something that I read in, in one of the articles that may have been on your website that I want to jump into, but I guess the other side of it is the impact of AI in using it in tools, like whether…because we’ve had an interview before, with the deep plate interview, with the enhancement of the license plates, where it was kind of like we talked about how you throw up a warning, like it’s not there to replace the investigator at all.

How do you see that now, like now that we’re having this talk, because that was quite a while ago, but how do you see AI influencing tools now?

Martino: Yeah, it’s…I mean, each image and video forensics is a very broad field. It’s a niche, but very broad niche in the sense that we have all kinds of application we can have the most spectacular one, the mother of all CSI effects: enhancement. We have authentication, we’re very popular with deepfakes, but there are also the old so called ‘shallow fakes’ or ‘cheap fakes’ nowadays, CCM detection, there are image content analysis, “find all images with drugs, weapons”, and so on. Video content analysis, like summarizing videos, “find all instances of a red car in all the videos”, stuff like that. Okay. And different applications have different potential and challenges.

So, I’ve been studying the topic of AI for video forensics for quite a long time. I think there is a blog post that has been quite popular on our blog which is from 2021. And I, over there, I actually outlined a kind of, let’s say, framework, on how to deal with image and video forensics in relation to AI. And I see that that’s been a kind of an inspiration for a few people.

And I also started recently… did a deep dive into the AI act. I read it entirely multiple times. And I see that, of course, it’s much broader, much more generic, but the overall philosophy for our kind of application is more or less in line. Let’s say that’s…the overall idea is use it, but with caution. Sometimes people…I think I’ve been kind of addressed as an AI skeptic, but I think I’m more an AI pragmatic. I mean, I enjoy chatting with the ChatGPT and not trusting him or her, whatever! I enjoy a lot doing pictures with Midjourney, stable diffusion and stuff like that. But, yeah, as all the tools and innovations that are things to be aware of, especially if we play with the freedom of people, that’s very important. Sorry, I was too long!

Si: No, you’re absolutely not. We’re here to listen to you, so you talk as much as you like! You and I have talked previously, and I know that Amped has worked with universities to do research yourselves. But I mean, AI is such an immensely, I’m going to say popular (I was going to say buzzwordy).

It’s very easy to get research grant if you put AI in the title at the moment, and therefore there’s a lot of AI heavy or AI centric research that’s being done. And I know that Amped is integrating some of this, but it’s…how are you guys finding the (I’m going to use this in two different ways, in a sense), but the adversarial nature of the amount of academic research that’s coming out, that’s enabling people to do truly amazing things? But also there’s certain aspects of academic research about adversarial neural networks, which are being able to deal with the technology that we already have that detects, you know, certain things and then…and manipulate it. How are you guys getting on with all of this volume of data?

Martino: Oh yeah, it’s crazy. But at the end, I think…I mean, a lot of research, in my opinion, and it’s always been like that. It’s kind of research for the sake of it. I mean, even when we were studying, let’s say, image authentication and tampering detection without AI, like 10 years ago or more, a lot of paper, you just skim them and say, “okay, they just reason in things that are very interesting in theory, there is a lot of very nice math, but at the end, they are not useful in practice.”

For example, I remember people studying tampering detection with the CFA, the patent, which is on the sensor that was only working on images without compression. Every image has compression, I mean, JPEG, HEIF, whatever. So the same, probably, I mean, you…there is a lot of work to keep up, but it’s a kind of a wave…I mean, there are definitely trends, which are going in a certain direction and you can follow that…there is a lot of things that is useless. And it’s not even…and a bit of a triage. The first triage is easy then testing and understanding what actually works and what not that’s harder, of course. But I think you can always see a kind of a trend of what works and what not and focus on that.

Si: So what trends are you seeing that are interesting at the moment?

Martino: Oh yeah, some of the deepfake detection techniques that we have implemented in Authenticate, for example. So for the diffusion models, which are…we started with the GAN, Generative Adversarial Network Detection, like thispersondoesnotexist.com a few years ago. Now they still exist, but now the most popular ones are diffusion models like Midjourney, Stable Diffusion, Dall-E, and the various similar technologies.

And one of the techniques that we started implementing, we saw people started publishing and there are different variations of course, everybody’s doing their own stuff. But more or less, the idea is that it seems like a bit of cooperation [inaudible] at a certain point things become, I cannot say obvious, but obvious to who is very much inside the community. There is a tool, a technique that emerges and people trying to go into that direction until something better emerges. So that’s more or less my feeling. So I’m not the person directly working on this technical stuff, but I try to keep up. I mean, I have a few Google scholar alerts popping me and try…at least I tried to scheme what’s coming up.

Si: No, that’s very fair. And you said you messed around, you dabble yourself. What’s your favorite image generation one?

Martino: I like Midjourney. I really like it. If you’ve seen on my LinkedIn profile, I’m sharing the principles that we spoke about, each one together with a kind of comics image, kind of summarizing the concept that I did it with Midjourney at the beginning of this year. It took quite some time because to get exactly what you want in the style that you want, it’s not easy. Especially, I mean, you need to accept the kind of trade off, but even with a kind of a graphical designer, you have to communicate. So we have been working with graphical designer before, and we still are from time to time, because you cannot do everything with AI, of course! But, yeah, it’s a lot of fun.

Si: It’s kind of an interesting metaphor really, isn’t it? Actually, the, you know…AI is that sort of preliminary level of doing something, but you still need a professional to come along and actually deal with it at the end of the day. And there’s been a lot of talk about whether, you know, it will do professionals out of a job. And I think what we’re going to see on the sort of design side and even sort of photography sides, I think you’ll get a lot of the poorer quality people will disappear from the market. And yes, it will result in job losses, but the really good people will now be able to charge three times as much to be able to take on the pieces of work that are required to tidy up at the end and to truly do it.

And, AI always, you know, it lacks human creativity. So unless you as a creative person are able to tell it what you want creatively, it’s just going to regurgitate the same old tap that it does for everyone else. So it’s quite an interesting field in that regard. And for forensics, it’s kind of the same in so much as we’ve…it seems to be being targeted at that low level of getting stuff processed because we are suffering from such a glut of data to look at on a, you know, terabytes and terabytes of data coming in, which is manually unreviewable, but that then we’re into those kinds of things. So yeah, I think it’s an interesting thing that you brought it up that way.

Desi: Well, that was actually a nice segue into the question that I was going to ask is that AI is fledgling and based on your research and what your company does, like, where do you see that AI is currently really useful to law enforcement and the criminal justice system? And where do you see it going in the next, say, five years? Versus kind of the hype that is around that is just AI will do everything for us?

Martino: Yeah. I speak about image and video, which is my focus because yeah. I can have ideas on the others, but I’m not that informed. So I think it can be really huge for the automation of what a human could do, given enough time and capacity. So like the image and video indexing, summarizing, search for all instances and things like that, probably for CSAM cases could help a bit diminishing the psychological burden on people to watch terrible stuff.

On the other hand, we must be aware on not over rely on these tools. Because if we just rely on the outcome telling, “okay, yeah, I found all the instances of the car that you’re looking for.” Of course, the AI can, as a person, but probably even more in this moment, can miss stuff. So, I think it’s a trade off, of course. We cannot watch like, 20 cameras for one month and get all the stuff. But how can we verify the fact that all important information has been detected? And either we do a manual review, which is a bit pointless, or we try with another system or change the parameters to the system. But that’s a big problem, getting the stuff done without over relying on it. And it depends on the amount of data.

The other important field is for, yeah, deepfake detection. I think anyways that there are challenges there in the fact that I cannot only trust, at least with the current level of technology, I cannot go to court and say, “I’m sure this is a deepfake because this software told me it’s a deepfake.” Okay. In fact, in our Amped Authenticate, we give you some, let’s say, classification or whether an image has been generated with some tools or not, and the confidence of the network. That is a confidence, not a probability means that as a person, the network can give you a result and be confident to be right, but actually wrong. Okay. I can be sure of something that’s wrong and still be wrong!

Yeah, so the situation is different with the traditional tools like analyzing the image compression in a kind of model based, traditional way. Because if I see traces of manipulation, I’m pretty sure that the image is manipulated. So for this reason, we say, “okay, an AI based image deepfake or tampering detector is not enough to show evidence that the image is tampered”.

You always need to look at the image or the video from multiple points of view from the format, the metadata, the content and the statistics of the pixels. And then, of course, AI tools that essentially have been trained on classes of images, fake, real, from a software, from another software, from a camera. They can always be wrong. And the problem for forensics is that we are not able to explain in the work.

So unless we will move to what is called interpretable or explainable AI for forensics, the use, it’s somewhat limited. Luckily, I think for deepfakes specifically, it’s probably more interesting the opposite: showing that the evidence is original, passes integrity verification. Because that probably what is going to happen more often. I go to court and the defense say, “oh yeah, that’s not my client because that’s a deepfake,” and probably is more common than the opposite, I think. In that case, showing that the evidence is the very original file is somewhat easier than reliably detecting that a deepfake that may have been on social media, transcoded, converted multiple times is actually a deepfake or not.

Si: I’m sure you’ve…I’m a hundred percent confident you’ll have heard of Leica’s embedded authentication stuff.

Martino: Yeah.

Si: Do you think we’re going to see…Sorry, I’ll clarify that for everybody else now: Martino knows what I’m talking about. Leica is a camera manufacturer, an incredibly expensive one that I can’t afford, and they have decided to embed into their raw files when you take a photo, a watermark, a digital watermark or a digital checksum or a hash or something, I don’t know exactly how it works. But effectively that to show that a picture is authentic at the point it’s been taken, effectively moving that hashing process that we all do right up to that image creation process. Do you think we’ll see that become more common for cameras because of…and video cameras as well, because of the idea of deepfakes, or do you think that’s just too processor intensive and too complicated to do cost effectively?

Martino: I think they also try to embed it in some Android phone a few years ago. They included the…one of these [inaudible] in the chip. So, on some phones (I don’t remember the brand) there was kind of, you know, as the settings that you have for a photo, like a portrait, landscape, yeah, panoramic, there is also secure photo, which embeds this stuff. I mean, it gains ground. It would be very important, of course, and would be the best way to tackle the issue, but there are some challenges associated with that.

First of all, as any technology, it can be hacked. And in fact, I remember showing up at my very first trainings in Authenticate and many years ago, they were, I think, both Nikon and Canon, at the beginning they launched some similar kind of digital certificate for handheld cameras, like 15 years ago or so. And the next day pictures…their method has been exploited. And I think it was one of the…what was the name? I think it was Elcomsoft, if I’m correct. They released on their blog a picture, for example, of the…some obviously fake images like the landing on the moon with the Russian flag or stuff like that, that was passing the Nikon digital signature verification. So everything can be happened.

The second thing is that, of course, unless we reach 100% coverage in device that produces this, and also in some way, we embed these in the various tools, social software that modify the picture, because at the end, how often are you seeing an original image from your phone? Most of our picture are coming from, yeah, websites, social, friends sending through WhatsApp.

Only the pictures that I produce are actually the original version normally, unless you are very careful about transmitting the original. And there is a third point which is very sensitive. The fact that nowadays, there is also a lot of AI processing in our smartphones. So even though the image can be original, there is a lot of computational photography. And there are a lot of tricks that you can do even in real time. So, it’s a lot of challenges. And in general, the idea is that you need to understand technology, how images form and understand what are the risk associated to each situation.

Si: So, the computational photography one is particularly interesting, I think, because there’s no intent to manipulate the image. You know, somebody takes a photo of something happening in the street, and all of a sudden it automatically becomes a manipulated image purely because it’s been taken on an iPhone with those settings by default. How critical do you think it is to have an understanding of that when you’re giving evidence in court? I know you guys do a lot with training, when you’re giving training, to help that out, but is that something that you guys are addressing at the moment?

Martino: I mean, we mention it, but we’ve seen, for example, this computational photography impacting the PRNU so the sensor noise that present on all images and allows to do a kind of camera ballistics. I think the point is that the situation from a certain point of view didn’t change. I want to make a practical example. Even before AI computational photography and everything, there was still a lot of processing happening in the camera, doing white balancing, interpolation and stuff like that, before you can actually have the image you’re seeing. Okay.

So one thing that you can see very often is artifacts due to image or video compression. So many cases we have been dealing with where, I mean, you can somewhat get the number of a license plate and you are guessing, “is this really a license plate or an artifact that my eyes are perceiving like a letter because I expect there to see a letter?” Or, I mean, there has been cases with kind of scars, moles on the face. Can you trust this or not? And it was for a technical reason. Usually of compression or many other artifacts can happen on the camera. Even the simple fact that depending on the length of your optics, the shape of the face of a person can change. Okay.

And these are all things that we should be aware of. So from that point of view is very similar with AI. The problem with AI is that when you have a low quality image. You have some perception that…there is not much you can rely on. With AI, even if you lose this, kind of, idea that the quality is off, so you cannot trust much. It kind of makes up details, improve things, and actually your perception is that of a good image, even though a lot has been kind of added or could be similar to the original, the hypothetic original, I mean the actual scene or different, and there is no way to know.

In fact there has been reading recently a paper where they suggested a way to embed into the chips or the firmware of mobile phones, putting together with the image generated a map of the areas that have been changed during the AI post processing inside the camera. And that would be quite interesting. Not sure if it’s really feasible or of interest for the big producers, though.

Desi: I wonder about the use, because we spoke briefly at the start with, I guess the magic of AI enhancing images, and obviously that’s not great from a legal standpoint because we can’t explain it. From any of the research you’ve been doing, have you seen that move or shift of desire to make more explainable AI? So that…because I imagine that’s going to be the first step in being able to use AI in a process that could be used in a court of law for forensics, is you need to be able to explain it first. Is there any kind of uptake in the community for any of that? Or everyone’s kind of like, “let’s just make all these large learning modules and not worry about trying to explain it.”

Martino: I didn’t see a lot of work on interpretable, explainable AI for enhancement. Maybe I missed a bit, but I think the kind of trend has been, okay, you see this amazing project with this, to do everything. And I shared a few examples of things that can and go wrong there. Even there was one of the various tool, really impressive results on their webpage. But even there, you see that they completely made up the license plate of a car and also they transformed the logo of a car that was I think a Nissan was transformed in the logo of a Dacia or the opposite. I mean, I’m not a car expert, definitely! But I remember it changed visibly in the low resolution image. You see one brand and the high resolution, see the other brand, which was pretty funny because it was their demo.

And so I think the forensic community…I mean, who was take things forensically pretty much agrees that at the current moment doing the image enhancement with AI is not a good idea. As in the blog post I mentioned before, I essentially did divide two situation: when you’re using it for investigations or when you are using it for evidence. Okay.

So for investigation, just when you don’t have any clue about who can be, do some test, even with AI enhancement could work if you don’t abuse it, if you are sure that it doesn’t become evidence because, I mean, sometimes between evidence and, let’s say, intelligence that, I mean, the border is very blurred sometimes, and also people does not rely too much on it, because they need to be aware of the risk. And in fact, if you remember about talking about the deepplate.

Even though we could provide the announced image, we didn’t because we don’t want to buy us the person into believing something, which is actually, I can say that AI enhanced image, technically speaking, is a deepfake because that’s not a processing of the original image, is a new image created taking the input image as an example, and then to that example has been applied a huge data set of what the network has been trained on. So that’s the complicated stuff.

And a few months ago, there has been a big case in the US. There was, if I remember correctly, was…I don’t remember if it was at Robert or Fry State. There was a hearing where essentially they disqualify evidence that there was a process enhanced with AI. And for various reasons, first of all, the fact that this technology has not been accepted and validated by scientific community, they disqualify the evidence and say, “we cannot use this.”

Desi: Yeah, I do remember reading that. I just can’t remember where I read that.

Martino: In the Washington State was…the most common article is on a NBC, I think.

Si: Yeah. I mean, I think it’s kind of interesting because if you actually think about it, it becomes somewhat self evident, is that if there’s not enough data in the picture for you to read it, if more data has been added so that you can now read it, data has been added and if we were to go along and say, “well, you know, if this was a computer and all of a sudden we’ve added, you know, some CSAM material to it so that you can find CSAM material,” we would all be going, “that’s totally ridiculous.”

So it’s getting that understanding over is a challenge. Do you think that from the conversations you’ve been having and then you’ve been talking about, you say, you know, since 2021, you’ve been talking about AI and you talk to wide people about video evidence. Do you think there is a better understanding out there of it now? Or is it…are people still as ignorant as they were four years ago?

Martino: No, I think it’s improving. It really depends from, let’s say the current context of different countries. I mean, for example, I think in UK there have been a lot of challenges, but also improvement in the situation with all the problems with the ISO certification and the…I mean, it becomes more complicated to work definitely, but also things are taken more seriously, so there are pros and cons. And it really depends on the country, on the organization, on the individual. And I mean, in one of these articles mentioning about, speaking about this case where AI enhanced evidence was disqualified, some of the people interview commented, “oh yeah, it’s these technologies use all the time, just people don’t tell.” So that’s a bit worrisome. But overall, I think the situation is improving. Yeah.

Si: I think it’s a wonderful topic, and I could sit here and talk about it forever. I actually read artificial intelligence at university and having had a conversation with you about how old I was earlier on, you can figure out how long ago that was. And it’s interesting to a certain extent how little things have changed. And yet how much has changed. The only real difference is the amount of stuff we can get through per second on a processor, but the principles actually haven’t changed all that much since I started.

It’s going to be a continuing problem for us going forward. In other areas as well, because we know we’re talking about video and image and obviously because that’s your field. But I heard somebody else telling about all of the problems about audio. And in fact, audio seems to be somewhat easier to do. I mean, I heard about a case whereby, you know, somebody got phoned up, or got a phone call and heard their daughter’s voice on the other end of the line pleading for money to be sent because they’ve been kidnapped, or something along those lines.

And it had just been sort of…an AI had been trained from so…and to be honest, you know, we’re all lining ourselves up with these lovely podcasts that are putting our voices out to the world with huge buckets of training material out there. So anybody if you get a phone call from me, it’s not me. I don’t use the phone! You’ll get a text message or something. Not that I’ll prove it! But you know the range and creativity of people in using stuff is getting wider, so we’ve got the idea of deepfake images and deepfake audio, we’ve got the lining up of that defense case that…it used to be the Trojan defense, “it wasn’t me, it was a virus.” Now it’s “it wasn’t me, it was deepfake.” Have you seen anything truly innovative in the way that people abuse image AI yet?

Martino: No, not really, but I want to comment on the fake voice of the kidnapped lady with a very recent case. Maybe you heard about the…that involved the CEO and an executive of Ferrari, the luxury car brand. And it was pretty interesting because these executive, when he was a requested, I think, to sign a contract or something very urgent, of course, he something was ringing a bell. So he asked him, this supposedly CEO, something about a book he recently recommended to him. So he verified that it was a deepfake, not his real voice. So this highlights the importance that no matter what the technology, everything, the education and the human is always, I mean, the strong or the weakest string in the chain.

Si: Yeah. I hadn’t heard about that. We’re going to go and look that up afterwards so we can share that in the show notes. That’s brilliant.

Martino: Yeah. It’s from last week, I think.

Si: Oh, perfect. So yeah, and actually that comes around to the full circle to what you were saying earlier about the difference between authentication of an image is an image authentic, is it true to what it purports to be? Versus, edited. Because obviously you can edit an image because we do the enhancement on them and bring them up to scratch and that authentication step is all about that chain of custody and all that sort of thing, which would be lacking from deepfake, kind of…well, yeah, so no, it’s an interesting thing. So where do you think we’re going next? I mean, in terms of Amped, have you got some cool new AI detection and/or use features coming up?

Martino: Yeah, AI is a big part of our research and a small part of our products because we like to understand and test and see what it’s worth, what is risky, what is acceptable or not. Maybe you’ve seen, we did a research that we published a few years ago about the…how useful is enhancement to recognize faces. We tried with celebrities. Okay.

So we announced it with AI or with the classical algorithms like bicubic and see which one was more successful in having people recognize these celebrities. And basically, the result was the same. So because in some cases, okay, it actually improved the quality. In other cases, it improved the quality, but creating another person, people who was not even able to recognize the celebrity that everybody should know. So that’s probably the biggest part.

I mean, studying and researching and on various aspects, like not only the technical, but also the regulatory one. I think we shouldn’t underestimate the AI act because it’s very constraining. As I told you, I read it and try to study it entirely focusing, of course, on things that are of interest for our field. But, yeah, if it’s implemented, deepfakes to an extent from a lot of people should not be a problem anymore because they should embed a watermark in all the system that creates.

Of course, that will not be universal because they cannot control open source free stuff, stuff like that. On the other hand would be very [inaudible] by anybody else, there is a lot of compliance to do if you are inside the specific cases, which is called the high risk cases, which some aspects of law enforcement belong to, not all. In that case, there is a lot of paperwork you have to produce, which describes how the AI is supposed to work, how it’s supposed to be used, what are the risk and a lot, a lot, a lot of information about the data sets, which is the biggest problem with AI now because you need to show which data set you use that they are being collected in the proper way.

And I mean, most of the system that we see now use data that is being scraped without an actual clear legal consent regarding privacy, copyright and stuff like that. So, I think it would be interesting to see how this thing evolve. I mean, we can create great tools, but if…I mean, the AI act does not allow us to use some data set, it will be very difficult to make them evolve. Yeah, there are still a lot of gray areas, but it’s a significant challenge and it’s an important thing to regulate because you cannot just scrape images of people randomly without any permission.

Desi: I’m wondering with the…like, we’ve covered quite a lot in this and we’ve had multiple kind of interviews with Amped and the technology and AI with other people as well. There’s so much information out there and so much to learn. So where would you say for forensic experts, if they need to stay on top of this stuff or need to start their journey on learning AI and obviously being aware and stuff, where is the best bang for buck for them to kind of start upskilling themselves, whether that’s…they’re part of your ecosystem using your tools or, or just interested in general and need to stay on top of it for their job?

Martino: Ask ChatGPT. No, I’m joking!

Desi: Use AI. Excellent!

Martino: Yeah. I don’t have a single source. I actually spend a good part of my day reading. Yeah. I subscribe to various RSS feeds. There are interesting stuff shared by people on LinkedIn. There are, of course, colleagues sending me stuff. I set a lot of Google alerts, so I cannot point to a single source of truth. It’s a lot of work, definitely.

But the problem is usually understanding where is actually this potential and still there is people who say, “oh yeah, AI will eat all the jobs and we’ll do everything, we won’t work anymore.” And there is people, “yeah, it’s just a bubble, AI is not able to do anything.” And probably the reality is in the, middle as usual. And of course when you are getting information you always need to be careful understanding if you are reading from one side or the other and interpolate the reality, and that’s not easy. But it’s important, I think, to be pragmatic and not to just be in a bubble where you just believe what you want to believe as usual.

Si: I’ll help you out on that one. Obviously, you know being incredibly modest, the Amped blog is a fantastic source for all sorts of discussions about AI and using images and video forensics at least, and I know that you reference and have been consistently excellent in referencing the academic papers that you are talking about. So that would be a good place to start if you are truly new. And it’s a good place for us all to go and keep on up to date with. So I’d certainly recommend that one. And we’ll put a link in the show notes.

Martino: Thank you. Also a lot of…I share more, let’s say regularly and shorter bits on my LinkedIn profile. So, most of these news I mentioned, like the Ferrari, the Washington case, and I usually comment over there because, I mean, they are not worth a long blog post, but still interesting. So if you go to my LinkedIn profile, you can see a lot of these small bits here and there.

Si: We will put that into the show notes so that you can be bombarded with connection requests of…

Martino: Fake people, because that’s also a problem!

Si: Yes!

Martino: You know how so many, it was like from two years ago and actually I was testing Authenticate on connection requests because there was a period where we had all these images done with thispersondoesnotexist.com or similar, then there was a period where I got like three connection requests per day from full stack developers, which…all more or less with the same kind of bio, not the same, but similar and always a picture of that with diffusion models with…now I think LinkedIn did something because they have less. Not the zero, but less!

Desi: Yeah, I did go through and read your blog on can AI be used for forensic investigations, and that was an awesome one to read through, which is one of the others that we’ll link. And it has a very nice in a nutshell summary. That was my favorite part about that, because I got to the end and I was just like, “wow, this was like a lot to take in,” and then it kind of summarized it all again. I was like, “oh, this is all the stuff that I learned at the start. I don’t have to go back and read it twice!” But yeah, a lot of good stuff on here. So, Si any more questions from you, mate?

Si: No, I don’t think so. I mean, I hope honestly that you’ll come back and talk to us again in, I don’t know, given the pace of change, probably six months would be more than long enough for things to be completely different, and for us to have an entirely different worldview. I mean, there’ll certainly be another election that’s have happened and a whole new bunch of fake and/or not fake news that we’ll be trying to filter through.

And of course, you know, these events that cause usage and detection then cause enhancement and refinement, and we’ll see things move on politically and in world stuff. I mean, it’s all exciting here at the moment in the UK, where…obviously again, making this is how the sausage is made, but you know, we’re currently experiencing riots here because of fake news, which is kind of scary. So yeah, but in a few months, we’d love to have you back and to talk about this and Amped and all of the work that you’re doing with legislation and video and image evidence going forward. So it’s been an absolute pleasure having you thoroughly look forward to having you again in the near future. My cat is now disturbing. (Excuse me. We’re in the middle of a podcast, please stop!) So that would be wonderful. So Desi, do you want to take us out because you seem to remember where all the podcasts are and I never do.

Desi: Yeah, which we should always put up the front, but thanks everyone for coming and joining this week. We always love having you come and listen to our podcast. You can grab it from anywhere you get your good podcasts from. You can watch the video on the YouTube and also our website, forensicfocus.com, where you should also be able to grab a transcript of the show as well. But we’ll put all the show notes and links kind of on all the platforms, so you’ll be able to get all the stuff that we’ve been talking about, get to the blogs and of course Martino’s LinkedIn, whether you’re a real or fake person, for sure. So, thanks everyone and we’ll catch you all next time.

Si: Cheers.

Martino: Thank you! Thank you. Bye.

The Impact Of Traumatic Material On Well-Being In DFIR

Desi: Welcome all to the Forensic Focus Podcast. I’m Desi. Si is away this week. Before we jump in and introduce our guests, if you want to look at our podcasts, you can catch it wherever you get good podcasts from or on YouTube. Or also on our ForensicFocus.com website, where there are transcripts and show notes available for everyone. But I want to welcome Paul Gullon-Scott. Did I get that right?

Paul: Yeah, you did.

Desi: Awesome, awesome. So, welcome to the podcast, mate. It’s a pleasure to have you.

Paul: I’m really grateful to be here. It’s really good to have the opportunity to actually bring mental health and digital forensics to the forefront. It’s something that has been under-researched for so many years, but has a huge impact on digital forensic investigators out there.

Desi: Yeah, and it’s definitely fallen onto, we were just talking before we started recording, but we’ve had a bit of a trend with mental health, especially in digital forensics. We’ve seen it come along quite a lot with a lot of high-profile people who have been in the industry for a while talking about it. And I was saying as well, I came from an incident response background, which is different, you deal with different stresses, but it’s definitely started to be more talked about as the industry kind of matures more. But before we jump into the research, do you want to just give the listeners a bit of background to yourself and how you’ve come to where you are now doing this?

Paul: Yeah, sure. So, I was a practitioner myself, a digital forensic investigator for about 14 years in a police force in the UK. In total, I spent 30 years within policing, as I say, 14 years as a DFI, during which most of the work that I did was around child abuse investigations. During that time, I completed two psychology degrees, one in general psych, one, sorry, the first master’s was in general psychology, the second master’s was in forensic psychology. During my studies, I approached the then unit manager and suggested to him that we start thinking about introducing a wellbeing framework into the unit. Because over the years, I’ve seen many really highly qualified, really good investigators walk out of the lab door and never return. It just got too much, and at the point it gets too much, it’s too late.

So I began researching studies which had been done and had been published, and I spent a very long time doing that. I mean, I’ve been researching the area now for about seven years. Even though I’m not practising anymore, I still actively do research in the area. And one of the things I realised was all of the studies which had been done had been done outside of the UK. So the majority had been done in America and some in Canada. But there were very, very few, and I’m talking, you know, you count them on one hand, which had actually been done in the UK.

So, I went back to the manager and I explained this and I said, “Look, there are stressors which are common across all of the studies. Why don’t we test for them using psychometrics?” so we did to establish a baseline.

So long story short, I wrote a wellbeing policy, a grading policy and a wellbeing booklet for DFIs. The booklet identified the most common stresses a DFI can experience. It also went into details of the signs and symptoms, so they were able to recognise it in themselves and others, which is, for me, equally as important, because when you do succumb to these stresses, you don’t necessarily see the signs and symptoms in yourself, because they’re cumulative, they kind of creep up on you.

So, I wrote the booklet. I wrote the grading policy, which adopted a much more proportional approach to exposure to traumatic material, namely child abuse images and videos. And because of the proportional approach that it adopted, it massively reduced the exposure to the traumatic material, but it also sped up those investigation into the CSAM jobs.

So it basically had a twofold attack, if you like. It reduced the exposure by adopting the CPS guidelines. Because here in the UK, the CPS consider a large collection of CSAM material to be either 250 category A images or a thousand images across all three categories. Now, historically what we were doing is we would categorise everything and that could easily run into the tens of thousands of images and videos. Now, you can imagine the impact that that level of exposure to those images and videos has on you as a person. We are only human. So, by adopting the CPS’s guidelines, we massively reduced exposure.

And when you take into consideration the use of CAID as well, there were quite often cases which, once they were categorised by CAID, met the threshold. So the only thing left to do after that was to go through the unconfirmed images and do a check for first-generation material. So, following that, the job’s done. You just report on it. So, it made a massive, massive reduction in the impact that DFIs were experiencing.

Desi: Right. So the CPS guidelines themselves, were they introduced out of the guidelines or they existed previously and they just weren’t being adopted?

Paul: Those guidelines existed previously. I was completely unaware of them until I started doing some research,

Desi: Right. And were the CPS guidelines meant to be adopted by kind of units like yours, or were they just for material in general when it was something that just wasn’t aligned to units that look at CPS material?

Paul: Well, the guidelines themselves were there for direction for judges, barristers the legal system, as it were. They weren’t directed at digital forensics, so we were unaware, or certainly I was unaware, that these guidelines existed. Now, when I spoke to CPS about this, they explained that once that threshold is met, all of the sentencing options are open for the judge, should the person be found guilty. So it just made even more sense. I mean, why go through tens of thousands of images when you can adopt that proportional approach?

Desi: And so I’m thinking then, when you were saying, kind of, once you’ve reached the threshold and you’re then just looking through the remainder of the pictures for first-generation material, you’re then just using hash matching to cancel out anything else or some other technology that’s out there to cancel a lot. And then you may only have say like, 10, 20, 50 images to look at rather than 10,000

Paul: So, when you’re looking for first generation material, you use a really good piece of software called Griffeye DI Pro. And within there, you can set filters. So you can filter everything else out that doesn’t have, say, EXIF data, for example. EXIF data contains things like GPS location data times, dates, camera maker model, that kind of thing. So you filter the entire contents of the images down using the EXIF data search, if you like.

So, say, for example, if I take a photograph of my iPhone, it will have the date, time, location, make and model of my iPhone. So, if you get a suspect and the suspect’s been arrested and he has an iPhone 11, you could filter all of the images and videos down to an iPhone 11, the main model of the suspect’s phone to see what pictures he’s been taking, and that can be done very quickly.

Desi: Yeah, okay. And then, so going back, because there was so much to kind of like unpick here, going back to, you were saying when you started your research, there was a lot of research in the US, or a handful, Canada on one hand, US and Canada, and reading your article, it says it’s the first of its type into this particular area of research. Did you find any differences between Canada or the US and then with your own research? Or was it just validating the commonalities between the research that had been done in other countries?

Paul: That’s a really good question, actually, because I have compared it with a study by Borg & Krohn, which is arguably the largest study of its kind in this area.

Desi: And was that with DFI? So, DFI, I don’t know whether we’ve explained the acronym for our listeners, but Digital Forensic Investigators. Did it look at DFIs or was it a different area?

Paul: It was looking at digital forensic investigators. So they had over 600 participants. It was a massive study done right across the United States. I found that when I compared my study to their study, both studies found really high levels of secondary traumatic stress among professionals exposed to CSAM material. So Borg & Crohn, and similarly, my study also found the same results.

I should explain to the listener, secondary traumatic stress is often referred to in several different ways, like vicarious trauma, secondary traumatic stress. It all now under the new DSM-5, it all now comes under post-traumatic stress. So you’ll quite often hear it being referred to as vicarious trauma, secondary traumatic stress, or post-traumatic stress, but it all now comes under post-traumatic stress.

Both studies confirmed that frequent exposure to CSAM material is absolutely a predictor of secondary traumatic stress. My study looked at how distressing someone finds looking at this material, and that revealed that for every one point increase in distress, they were seven times more likely to become susceptible to secondary traumatic stress, which was quite a striking finding, really.

Desi: Yeah, and does any of the research point into or indicate how often someone can be exposed to material like this and not raise a point into that stress area to then develop secondary stress? So, is it maybe someone has to work for six months, but then take three months off working CSAM material, or?

Paul: Yeah, there was one paper, which I read, and I think it was by Turan in 2009, and she actually did touch on the idea of tenure in the post. And there have been other papers which have considered a sort of rotational approach to digital forensics. So, you might spend a month doing CSAM jobs, you might spend the following month on drugs, you might spend the next month doing something else. But in reality, does that happen? No.

Desi: Yeah, because I think towards the end of your paper I was reading, that you didn’t find any difference between tenure or the wording.

Paul: Length of time in the job as a DFI wasn’t necessarily a predictor of secondary traumatic stress. You’re right in saying that. But the key findings from my study were 68.8% of DFIs reported experiencing secondary traumatic stress with nearly 30% reporting high to severe levels. So the impact of that is the high prevalence suggests that DFIs are at substantial risk of mental health issues, which could lead to decreased productivity, burnout, higher turnover rates. Employers might struggle to retain skilled personnel, especially those who have repeated exposure to distressing content like CSAM. And it just underlines the need for mental health screening and support systems in place to prevent this.

Desi: Did any of the research, I just want to touch on there because you said, struggle retaining staff, people leaving the job suffering this stress. Has any research, and not just your own, but any that you researched into this paper delve into secondary jobs? So if they’ve left, do people more likely to struggle to retain follow-on employment because of this stress?

Paul: That’s a very interesting question. To my knowledge, I don’t believe that research has been done. I certainly haven’t read that. But I think that will be highly dependent on counselling and the therapeutic process that individuals go through because obviously if they leave digital forensics to go to another profession, for example, if they don’t address the underlying issue, the stressors caused by the job, which could be secondary traumatic stress, it could be burnout, it could be depression and anxiety, it could be a combination of them. If they don’t address those underlying issues, then those issues will continue no matter how hard you try and mask them. And I speak from experience here.

To share with the listeners, I did break eventually. And it took 13 months of counselling, working with a fantastic counsellor, I hasten to add, to get me back to a fit state. So it can be quite a lengthy and really difficult process to take part in. So, in answer to your question, I don’t think the research has been done to look at that, but I think it would largely depend on how the DFI deals with the underlying issues.

Desi: Yeah, and I guess how much support they’re either receiving or have gone out and seeked themselves as well post suffering that stress.

Paul: Exactly, exactly.

Desi: So with the kind of research that you introduced or the booklet and the identifying factors that you’re using, how widespread is that across the UK now? Is it just limited to the unit that you were at, and a few, or is it spreading out further and further now?

Paul: Absolutely not limited to the unit that I was working in. The study that I published, absolutely shows it is across the country, DFIs across the country.

Desi: Because you were taking in participants from other units.

Paul: oYeah, I did a national study to support my paper, or to write my paper, I should say. And that national study showed that it was absolutely across the country, the reported symptoms of depression, anxiety, burnout, and secondary traumatic stress. It was all across the country.

Desi: All these symptoms and indicators that are being reported, are these all from self reporting, or are some of them from a diagnosis standpoint? So, people have been diagnosed with depression, and they’ve linked it to this, and then that’s been part of the survey or was it all just, answer these questions?

Paul: It was all based on clinically valid rating scales, so I hosted scales like the secondary traumatic stress scale, malice burnout inventory, and a few others. And they were hosted online so anyone across the country could log in and fill them in and complete them. And I realise, obviously, the clinical skills, they’re an indicator, they’re not a diagnostic tool. So, you know, for each person who reaches the cut off points of a tool such as that, there would have to be further investigation by a clinically qualified professional to see if that person was actually suffering from those signs and symptoms.

Desi: Yeah, and going back to the key findings, were there any other key findings that were in the report? And I’m also interested to know, were there any key findings that were unique to the UK?

Paul: Yeah, so going back to the key findings, the key predictors of higher secondary traumatic stress included difficulty viewing CSAM material, mental disengagement, which was a negative coping strategy employed by some DFIs. Younger age were all key predictors and the impact of those were investigators who found it emotionally difficult to handle CSAM resort to disengagement coping strategies, so trying to avoid thinking about what they were actually doing at the time, were found to be at higher risk of mental health deterioration.

Younger DFIs were also more vulnerable, likely due to the lack of experience or established COBRA mechanisms for dealing with that traumatic material. Employers could respond by offering targeted mental health support to both of those groups, promoting positive coping strategies and providing emotional resilience training for the younger, less experienced investigators by using a sort of graded exposure approach to CSAM material.

Female DFIs scored higher on the arousal subscale of the secondary traumatic stress scale. And this relates to physical and emotional distress, but statistically, and this is important, statistically, the difference between them wasn’t significant. So that suggests that male and female investigators are impacted equally and are equally at risk of succumbing to the known stresses for DFIs.

Desi: That’s interesting. Did you look at any of the statistics into, I guess, maybe the age imbalance between male and female investigators? Were there more older male investigators doing the survey versus maybe you had a younger split and the majority of the females sat in there?

Paul: I did look at the percentage of males versus females and thankfully, and it was really good to see, about a third of the participants were female. And that was really good to see because when I first started in this role, it was a very male-dominated area. So it was very nice to see. But, given a third of the participants were actually female, I think, and the results show that there’s no real difference between whether a male is more likely or a female is more likely to succumb to these stresses, it just suggests that, you know, like I said, they’re equally at risk.

The small increase that I did find in the arousal subscale might suggest that it could impact the female DFIs around their well-being and performance, especially in prolonged investigations. So, again, something that hasn’t been looked at by the research is gender-specific interventions for females and males. So, different types of counselling, for example, different stress management programs, all of which could help mitigate the effects. But again, I’m not aware of any research that’s been done around that, but it’s something, it’s an idea I’ve got.

Ineffective coping strategies, surprisingly, positive coping strategies like social support or planning didn’t significantly reduce secondary traumatic stress levels in my study, which actually is different to the Borg & Crohn study because they found social support significantly reduced levels of secondary traumatic stress.

Desi: Okay, that’s actually really interesting. Is there a difference in social support?

Paul: Well, that’s what I started to think about. I wondered whether DFIs in the UK are less likely to rely on social support outside of work to reduce the secondary traumatic stress and discuss what they do.

Desi: That was an interesting point you make because that is something that I think we covered with, it might have been Sarah Morris, actually, but about how you default into this behaviour of not discussing your work because it’s classified, or it is talking about these horrific things and people fall into that and they don’t want to take it to their family and they don’t want to take it to an outside support network, just because maybe they can’t or they just don’t feel comfortable.

Paul: Precisely. I mean, I do actually know Sarah, so it’s something that Sarah and I have actually discussed. We were discussing the likes of, so out there right now, you’ve got a specific group for men called Andy’s Man Club. And that’s a safe space for people to go out there and discuss stressors that they’re experiencing. And I turned to Sarah and I said, could you imagine a digital forensic investigator attending a safe space like that, and then offloading what they’d seen that day? Can you imagine? I mean, you run the risk of traumatising the people within the group. And I think that’s an important point to make, because again, to my knowledge, there are no similar groups like that where DFIs could go and offload.

Desi: Right, so there’s a chance that the US-based DFIs may have groups like this and this is why that could have reduced the stressor in itself.

Paul: That’s exactly what I was getting to. I’ve looked at the US sort of culture around counselling and seeking mental health support and they are a lot more open to doing that than we are here in the UK. And especially within policing. There’s a lot of research out there which has looked at police staff in general and whether they would or would not seek mental health support and the reasons around why they either would or wouldn’t. And what is abundantly clear is there is still a lot of stigma around seeking mental health support. And there is a lot of worry about if they do, how will it affect them in the future, say, for example, when they go for promotion?

Desi: Right. So they’re worried that speaking up could affect, oh, you’re not mentally tough enough, so you’re not going to handle this promotion.

Paul: Exactly that. Exactly that. And there’s a lot of research which has been done around this.

Desi: Yep. Okay. So then, from the findings of this study, or even other studies, are DFI employers on board with providing that kind of support or is there any kind of movement in that space to provide DFIs that space?

Paul: So, I am aware some forces in this country do offer the chance for group discussions if you like. So they bring the whole team together and they will discuss all the cases that they’re working on and if there’s anything particularly difficult to get the chance to gain other ideas from the peers on how to deal with it. But at the same time, it allows them to decompress almost because they’re talking about what they’re doing. But that isn’t common practice..

Desi: Depends on the unit and the work culture.

Paul: Exactly.

Desi: Okay, yeah. So that’s a very interesting big point between, I guess, your study and then the studies that you researched for the paper as well. Were there any other differences that you found in your key findings?

Paul: Yeah. So, differences, obviously we just talked about the role of social support, et cetera. There wasn’t any across in America in the Borg & Crohn Study, they didn’t find a difference at all in respect of genders. So whilst we, well, I found a sort of small difference, they didn’t find any difference whatsoever. But really they are the only places where my study and the American study differed to any great depth, you know?

Desi: It’s a very interesting concept. Did you find any studies that were, I guess non-Western cultures? Because I guess this would be a common problem in all policing around the world that everyone would face. And I wonder if there are studies done in South Korea, Japan, anywhere like that, that showed any differences.

Paul: It is. I didn’t find any. It makes you wonder whether this has actually been considered over in those countries or indeed whether they’ve got a problem, you know?

Desi: Yeah, well, I guess your point with the UK still having that stigma around seeking social help, maybe research isn’t driven because of social stigma around this kind of area, but it would seem to be a huge problem for everyone if you’re not finding a difference between genders, or a smaller, non-statistically significant difference, and that it is nationwide that it’s affecting. So you would think that it would affect all policing DFIs.

Paul: I think the biggest impact that has is on staff themselves and the longevity that they have in that post because, I’m not saying this in all cases, but in some employers. they don’t have that mental health support. Now for me, that doesn’t make sense because as an employer, you spend tens of thousands of pounds training that individual to become highly qualified and highly skilled to do that, to carry out this job. And then to not support them from a mental health perspective simply doesn’t make financial sense to me.

Desi: Yeah, not at all. And you would think that if you supported the individuals now, they then provide the foundation for your juniors to come in and have that support amongst their peers as well, which in the long run would make things significantly cheaper than constantly training the staff.

Paul: Precisely. Precisely my point. By providing the correct support, you’re increasing the resilience of the individual and prolonging the longevity of them in that role. So it just doesn’t make sense by not providing the right support for them.

Desi: Yeah, was there anything in your research, and it probably isn’t the focus, but anything that you read that provided indications for people who were less susceptible to the stresses or had other than having this wellbeing support and a way to decompress and talk about and seek counselling, but were there any indicators of individuals that just were less likely to develop STS in their role?

Paul: No. I think, you know, at the end of the day, although we’re highly qualified and highly skilled, we’re human. And I think everyone has a breaking point. Everyone has a ceiling limit that they reach where they can just not do this anymore.

Desi: Yeah, yeah. Did you come across similar research in different areas that weren’t CSAM? So things like maybe ER doctors seeing horrific crash accidents all the time or first responders getting to a scene and suffering the same kind of STI?

Paul: Really good question, actually. I’ve done a similar study on general policing in the UK. And that looked at the effects of just generally being a police officer in the UK. And I measured, again, depression, anxiety, burnout, and found similar findings in that study also up to a point where I did some analysis which showed that when a cop reaches 15 years, then the reported levels of depression, burnout, and anxiety start to reduce. And I hypothesised that, you know, at 15 years, those who stayed have developed really good or much stronger coping strategies than their younger selves.

Desi: Yeah, yeah, it’s interesting, right, I guess, because that study was done at a snapshot in time. So you’re capturing the ones that made it to 15 years versus researching them one year into the job, five years into the job, 10 years into the job, and their peers are maybe dropping off.

Paul: Yeah, exactly.

Desi: Yeah. Yeah, okay. That’s interesting then. Like, I guess it goes to show, again, we’re all human and that any kind of stressing situation can lead to this.

Paul: Yeah, absolutely. I mean, you know, I’ve read similar research studies about social workers, for example, social workers who deal with children on a daily basis. And again, there’s similar results with them, but they also become susceptible to mental health stresses if the correct support isn’t in place. But research also suggests that the likelihood of becoming susceptible to these stresses is much higher than the general population. And that’s an important thing to take into consideration when you’re thinking about this.

Desi: Yeah, yeah. I guess it makes sense, right? Like, the general population isn’t exposed to these kind of stressors, but you would have outlying cases, I’m sure, but talking about the general population of each group, policing would have a high level of stresses imposed on them to then lead to this kind of thing.

Paul: Absolutely. Absolutely.

Desi: Yeah. It reminds me of, there have been a lot of studies into at least internally, sometimes at least, to military members and the suicide rates compared to the general population versus in the military due to different stresses. And it’s always much higher in the military for the same kind of reason. It’s just you’re exposed more to different kinds of scenarios than the general population.

Paul: It’s interesting you talk about the military because I’ve often wondered whether personnel in the military adopt a similar approach to coping with the things that they see and deal with on a daily basis. Because one of the things I found is one of the coping strategies that DFIs do use is mental disengagement, which, although gives them temporary relief from what they’re seeing and dealing with, long term, it actually promotes secondary traumatic stress, and I’ve often wondered whether military personnel use the same kind of approach.

Desi: Well, I think, from memory from the study, and I might send this out to listeners, I think it ended up being released, there are two that I kind of always think back to. One was that the stresses of the job lead to things like alcohol abuse, so trying to disengage through the use of a substance. And then the other one that was interesting, so when you’re deployed, normally there’s a full decompression process, and you’ll go through wellbeing to come back and get into society. Now, that doesn’t always work because it needs to be more, but when they introduced the initial program in the US I believe for drone pilots, because they were controlling the drones from the US, and they were leaving the job and going straight home. There was no decompression, and they found that had an increase in stresses, depression, aggression in some and it was just kind of this unregulated thing so that people were essentially in a war zone, then just leaving the building and going straight back to their homes.

I think they ended up fixing it. It was early on, but it ran for like five years and then they were like, “Oh, we’ve got all these problems” and did some research and they were like, “Oh yeah, we need to treat this like they’re being deployed.“

Paul: You really do. You really should be. That’s true.

Desi: I guess it’s the same as policing, right? Like, you kind of go to work and you’re in this completely different life. Like, you’re not going to the shops., you’re not like working your normal 9-5 job, you’re in this. criminal world where all these horrific atrocities are happening. But then you just finish your job and go home. There are probably some very similar parallels there.

Paul: There absolutely is. And again, that’s a really good point to make. Because when you’re in that world, it becomes normal and it completely changes your view of the world. I remember making a comment to my wife while I was still in the role, and I said to her, “You don’t live in the real world.” Having moved out of that role now into the role that I currently do, it wasn’t her who didn’t live in the real world, it was me. My view of the world had completely changed, but I couldn’t see that at the time.

Desi: It’s also, and this is I guess why you can’t talk to people who don’t have a concept of what you’re dealing with because I guess it is subjective for each person what the real world is. And so your wife is probably never going to relate fully to that because she’s never experienced it, but someone else is in your peer group could. Or now yourself with the younger generation coming through and doing it, you can relate, I guess, because you have experienced that and come out the other end.

Paul: Yeah, exactly. I think the experience that I went through, actually, because I did succumb to the stresses, and as I explained earlier, it took me quite a long time to get over that. But having been down that path and experienced it first-hand, it gives me a whole deeper insight into how this can be prevented and how it shouldn’t happen, you know, just how it shouldn’t happen in the first place. Because when it does get to that point, it’s too late.

Desi: Yeah. Yeah, it’s really good to see. I guess you’ve moved into a role where you can give back and start directing this into a place that can help people not reach that point that you went through just to protect those people that are doing that job.

Paul: Exactly.

Desi: Yeah. So, before we jumped on the podcast as well, you also mentioned about something that you’ve been looking into recently: the neurodiversity within, was it DFI?

Paul: Yeah, so I’ve just started to look at this and it’s becoming, for me, a really important issue to consider because there is a high proportion of neurodiverse individuals who work in digital forensics. In a recent publication, well, I see a recent publication, a publication by KPMG in 2021, a third of their participants in the study that they ran considered themselves to be neurodiverse. So, I think it’s an important point to consider, certainly in respect of the type of support that’s delivered for mental health issues, because they may not necessarily react in the same way or find, say, a particular therapy as effective as a neurotypical individual would.

And also, something I’ve recently discovered, the clinical instruments which are being sent out by support services, let’s call them, to DFIs, some of them aren’t actually validated for use in neurodiverse populations. So, that has the potential of either throwing up false positives or false negatives. So either identifying someone as meeting the clinical cutoff, for example, for PTSD, or it could also have the reverse effect of not meeting the clinical cutoff for PTSD when they actually do have it. And I find that really worrying.

Desi: Yeah, so it’s a twofold issue of not being able to diagnose or measure correctly whether someone’s suffering PTSD, and then once they do meet that threshold or they’re approaching that threshold, then the therapy is not working for them because they are neurodiverse and not going to respond through treatments that way.

Paul: Exactly that, exactly that. So for example, there are, let’s talk about CBT, cognitive behavioural therapy, for example, which has been shown to be really effective for DFIs and dealing with the stresses that they experience. I have read research which indicates that adapted CBT can be used to reduce these stresses within the neurodiverse population. But if they’re not being identified at the point of the clinical instruments, for example, if they’re not being identified at that point, then how do they get identified later on down the line to then receive the correct therapy that they need?

Desi: Yeah. So it seems almost like, and maybe it’s because the understanding of neurodiversity and how different quite a lot of us are compared to each other, is that it’s almost an individualistic approach, especially for people who are in this role, who there’s already been research showing that you’ve got quite a large portion that are going to suffer PTSD from prolonged exposure that would be worth investing in individual programs for people to diagnose that and then provide an individualistic treatment plan.

Paul: Yeah, exactly that. Exactly that. But right now, that’s not happening. And that in itself is really worrying.

Desi: Yeah. So this an area of, I guess, the next kind of research that you’re going to be doing into this neurodiversity?

Paul: Yeah, well, our plan behind the scenes, I recently joined the team with Professor Morris down at Southampton University, and we plan to do some really good, collaborative work together. And this is going to form part of that work. I feel going forward, it has to be explored and raised so people become aware of it and it then hopefully gets incorporated in the support that DFIs are provided with.

Desi: Yeah, yeah. And has the initial research shown, I’m guessing this is the first in the UK, similar to your last study? Are there other studies in the world that you’ve found that are similar?

Paul: No. All of the research that I’ve read to date, I haven’t found any of the studies which have explored neurodiversity in digital forensics and the differences it creates. So this will be a really, really groundbreaking, I suppose, piece of work that Sarah and I are going to do.

Desi: Yeah, no, that’s awesome. I’ll be looking forward to it, and I know Si will, as well. And it would be awesome to have you both back on with the research once it’s done to have a chat about it because that sounds really interesting.

Paul: Oh yeah, we’d love to come back on and discuss it when it’s done. Yeah. Yeah.

Desi: Yeah. Yeah. Awesome. So, we’re kind of at the hour now, but before we wrap up, were there any kind of final points you wanted to make in the research that you’re making or anything that you’ve noticed from any of the research that you’ve read?

Paul: I think the most important thing to take away from the talk that’s going on now just in general about mental health and digital forensics is, it’s okay not to be okay, you know? If you do some research and you read about the signs and symptoms of depression, anxiety, secondary traumatic stress, post-traumatic stress, any of those signs and symptoms resonate within you, don’t think about finding help, go and find help, speak to your GP, speak to any employee assistance program that might be out there, because this will not go away unless it’s treated by a professional trained to do that.

Desi: Is there any kind of advice around, because I guess that’s interesting, you’re saying that you did a national study and it started with your unit. Do you have any advice for DFIs that might not have those employee services offered at their unit or wherever they’re working and are potentially worried about going to talk to a general GP? Like, can you recommend any way that they could reach out and just have that initial chat with maybe finding someone who is trained to work with DFIs?

Paul: My recommendation initially would be if your employer doesn’t supply that kind of support or that level of support, my advice would always be, please go and talk to your GP. You have no idea how resourceful those guys are.

Certainly, I know, in my area, we’re incredibly lucky. I know it differs massively, but we’re incredibly lucky. I went to speak to my GP and within two weeks was on a talking therapy program. And that’s incredibly quick. I know it’s a bit of a postcode lottery. But my advice, please, please, if you are experiencing any of these stresses, please reach out to your GP in the first instance. They are a wealth of knowledge and resources.

Desi: Yeah, yeah, definitely. In echoing that, definitely don’t don’t do it alone. Don’t just try and push through it. Reach out and get some support.

Paul: Absolutely.

Desi: Yeah. Well, Paul, it’s been a pleasure having you on, talking about mental health and neurodiversity, DFIs, it’s always a very interesting topic and affects everyone that’s in this field. So, thanks so much for coming on and sharing with me.

Paul: Thank you for the opportunity. Thanks for allowing me to come on and share my views and experiences.

Desi: Yeah, no worries. And I’m really looking forward to having you on again once you get through the next lot of research to talk about that, as well. Because that’ll be even more interesting, I’m sure, building on what you’ve already done.

Paul: Yeah, absolutely.

Desi: Well, thank you to all of our listeners. We’ll put as much as we can in the show notes. The transcript will be there, you can get that from forensicfocus.com or on YouTube as well, or wherever you get your podcasts, but thanks everyone, and I’ll catch you all next time.