Notifications

Clear all

Please, help to resolve this.

MickArneke · 2017-07-01T16:29:21Z

Hi all,Thanks everyone for this wonderful forum. I’m working in one private forensic lab, EU country. I ‘m deeply disturbed by the events, and I wish some colleagues here to share their experience and advice. It is time for me to make my decisions. In the first days of May 2017, high ranking police officer from one Mediterranean country (in big financial trouble from the end of 2009, Rep. of Turkey on the right side of the map) calls my boss. The officer needed help and advice, how to “sort” and “iron out” some “problems” of his two cyber crime officers. My boss asked me and one of my colleagues to form a team, and to help, and be in touch with this officer, to solve the problems.Their case is from the end of April 2014 - the high officer’s unit accused one man, pediatrician, of possession of CP, and divulged to the press information about the case. But this is not the end, and not the main problem they have –it is just the beginning of the story. Their “case”End of April 2014, the two above mentioned officers make live acquisition of the pediatrician’s computer (one). There is no chain of custody papers (of any kind!!), and no hash on acquisition, and the officer, who works on the suspect’s computer, not using any blocker, attach a USB stick, and works directly on the original data, extensively opening files there. After that, they “collect” the suspect’s HDD’s in one open supermarket nylon bag, and put the bag in their rear seat’s jeep. There was no sealing of the bag, either electrostatic enclosures- just plain HDD, in one open plain supermarket nylon bag. The same day, the chief of the national cyber-crime police unit (now fired because of incompetence) divulged to the press various “case details” [we checked all of them- all of them proved to be shameless lies] and on the same evening, the chief was manifested himself in flesh on all national TV channels, milk the event. We ask the high ranking officer “Why?”- he answer “In scope immediately to nail the bastard [i.e.- the defendant], and to ask the prosecutor for publication of his personal data in the press. With such press coverage, the whole judiciary is obliged to be on our side, unconditionally. And they do not dare to take the other side” laughingly he said.On the first trial in front of the judge, the two officers plainly confess all the details of their, actually, illegal methods of acquisition! Nobody in the court even care, or even gives a slightest attention what’s going on! When we ask the high ranking officer, how all this is possible to pass in one civilized court, his answer was -“The judges here hate all these crimes, and they swallow whatsoever we present to them without a grumble”. And laughing at the end, tells us, that “…the judges here does not possess the needed grasp about forensic details, neither are much interested to learn them”. This officer also tells us, that on the first trial, the two officers extensively lie to the court, and this is a real, and became big problem for them -the defendant is a foreigner, and he contacted his embassy and his native country authorities, and pledges them to intervene on his behalf. In court, the defense team was very, very competent, and the defendant himself nails the two officers virtually on the wall- in reality the defendant himself proves to be, this is not a joke- a computer geek, with profound and extended, deep, deep knowledge. We ask for more details, and some of these are- No chain of custody of any kind exists, no hash on acquisition. On the day of the acquisition, they worked on original data – they confess this in court!- There is not a single photography of the confiscated HDD! In their “confiscation’s protocol” there is one HDD serial number and number‘s model invalid! They forged the defendant signature there too.- There is a big confusion about the right number of the confiscated HDD –the 2/3 of the judicial documents is with one number, the other 1/3- with other. We investigate- the two officers manipulate the disks and their numbers when they traveling to the capital.- Actually, they confess in court, that they manipulate the disks contents AFTER the confiscation took place, in scope to “investigate” further.- The official police forensic examination on these HDD was made 4 months later – almost half of the HDD are officially presented from the lab without any kind of digital hash whatsoever, the rest – with one hash value of unknown origin- the copy, or the “original” of the lab?- There is no comparing between the hash values of the acquisition and the hashes of the lab [where they exists], because hashes of the acquisition simply do not exist. - Because of the complete lack of proper hash, the defense is, objectively, unable to obtain copy from these disks- there is no forensic digital warranty whatsoever, that the contents there is the original one. Or will be the original one. Actually, and legally, this fact made all the evidences inadmissible in court, and the case ...

Page 4 / 9 Prev Next

General (Technical, Procedural, Software, Hardware etc.)

Last Post by jaclaz 6 years ago

90 Posts

11 Users

0 Reactions

10.8 K Views

RSS

RolfGutmann

(@rolfgutmann)

Noble Member

Joined: 10 years ago

Posts: 1185

27/07/2017 3:44 pm

It was foreseeable, with money you always find some one…

ReplyQuote

MickArneke

(@mickarneke)

Trusted Member

Joined: 8 years ago

Posts: 53

Topic starter 08/08/2017 1:30 pm

Strange things… in this post, jaclaz wrote

https://www.forensicfocus.com/Forums/viewtopic/t=12994/postdays=0/postorder=asc/start=7/

"…and both parts have access to verified disk images.".

But here, jaclaz endlessly try to play down this subject. Hm, may be the hot Italian temperament? )

Anyway- the topic above was very helpful- another person from Greece talks openly about the rampant incompetence there. The subjects, he cover, are identical. The man above even post on Microsoft page his question

https://answers.microsoft.com/en-us/windows/forum/windows_vista-files/forensic-report-createdmodifieddeleted-date-of/708aef1d-65b4-425f-8633-5e714a78b5d2

ReplyQuote

RolfGutmann

(@rolfgutmann)

Noble Member

Joined: 10 years ago

Posts: 1185

08/08/2017 3:31 pm

Lessons learned? Could you please summarize what your conclusion is out of this experience e.g. Indicators of Corruption IoC? I want to learn from you

ReplyQuote

jaclaz

(@jaclaz)

Illustrious Member

Joined: 18 years ago

Posts: 5133

08/08/2017 5:22 pm

Strange things… in this post, jaclaz wrote

https://www.forensicfocus.com/Forums/viewtopic/t=12994/postdays=0/postorder=asc/start=7/

"…and both parts have access to verified disk images.".

But here, jaclaz endlessly try to play down this subject. Hm, may be the hot Italian temperament? )

Sure, but not only that.

There are a lot more stereotypes that you can try using, you have no idea how tiring might be living among moustached dark skinned people, smoking, singing and gesticulating at all times, and eating pasta and pizza on a red/white checkered table clothes everyday.
And don't forget the attention we must pay to all the bad guys speeding on their Lambretta's and Vespa's when taking a walk!

jaclaz

ReplyQuote

MickArneke

(@mickarneke)

Trusted Member

Joined: 8 years ago

Posts: 53

Topic starter 01/10/2017 5:07 pm

Last info.

The other laboratory will sue them in court, here. The personal info of all persons, involved in this shame are now fully identified.

Soon, the EU organs will be informed in full also.

The judicial organs of the man's native country are already informed in full- we learn, that their outrage was enormous, and they will sue all peoples involved too in their own court.

I speak with some very polite peoples from the man's (defendant's) native country- they are astonished that the man was not contacted them early. They speak with the defendant- but the man was very agitated and unable to speak coherently because of deep depression- they wish to take him out of Greece, for recuperation, if this is possible.

That's all for the moment.
Thank all of you, which read this and are able to help with advice or just human understanding.

ReplyQuote

RolfGutmann

(@rolfgutmann)

Noble Member

Joined: 10 years ago

Posts: 1185

01/10/2017 5:24 pm

Your personal clonclusions for the next similar case?

ReplyQuote

MickArneke

(@mickarneke)

Trusted Member

Joined: 8 years ago

Posts: 53

Topic starter 01/10/2017 5:28 pm

Your personal conclusions for the next similar case?[/quote

Apply white and black list.
Thank you Rolf! )

ReplyQuote

RolfGutmann

(@rolfgutmann)

Noble Member

Joined: 10 years ago

Posts: 1185

01/10/2017 6:33 pm

Everybody can come in a situation like yours. The question is where and how to do it differently the next time. Not better. Differently.

Please tele-transplant your experience to me -)

ReplyQuote

MickArneke

(@mickarneke)

Trusted Member

Joined: 8 years ago

Posts: 53

Topic starter 29/10/2017 7:47 pm

Everybody can come in a situation like yours. The question is where and how to do it differently the next time. Not better. Differently.

Please tele-transplant your experience to me -)

Will be useful to you? You already saw so much.

Major scandal erupted in two EU bodies, after the home country of the defendant make the needed judicial steps. There are much more details about how unfairly the man was treated… on all levels.

Is the institutions of this country there are really EU institutions ??

We already apply black list…"by experience", and by the "exchange" of black list data between us.
We blacklisted and some private forensic experts from THERE- they played double games, secretly divulging defendant's data to the prosecutors, and more curiously- to the same cyber-crime unit in question, they were "very curious" about some details, obviously.

The second lab give us much more details, and some copies.
More details soon. We are very busy here… .

p.s. I see, the number of the readers of this topic are skyrocketing…

ReplyQuote

RolfGutmann

(@rolfgutmann)

Noble Member

Joined: 10 years ago

Posts: 1185

30/10/2017 10:55 am

Thank you for coming back and let us participate your 'story'.

Focussing on the highest risk danger its always worth thinking again and again, which IOD Indicators Of Danger (including low-risk and even irrelevant aspects at-the-time-of-occurence) where hard to forsee or should have been worthy by 'putting on radar'? Retreat is not-fancy but can save to survive, sometimes. To act based on super-worstcase is very, very resource-draining. But a losing-process has non-visible unique advantages.

Completely! not in charge to instruct you. You know best.

ReplyQuote

Page 4 / 9 Prev Next

8 Forums
15.7 K Topics
92.3 K Posts
179 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed