Lee Whitfield, Forensic 4cast

Lee, can you tell us something about your background and why you decided to work in the field of computer forensics?

I used to work in construction law. My father is an expert witness in construction and I worked with him for a large international company. I was originally planning on doing a degree in quantity surveying and had already been accepted to study that subject at university when I was made redundant. It was around this time that Larry Sewell (formerly of Guidance Software) moved in to our community. I’d already thought about going into computer forensics but after meeting Larry, and him telling me more, I realised it was something I wanted to do. I was already looking at changing my degree to computing so when the university started a computer forensics degree it made sense for me to jump ship.I’ve been involved in digital forensics now for just over 6 years.

Can you tell us something about where you work? What type of work do you do there?

I work for a digital forensic contractor in the North West of England. Most of our work comes from police forces around the country but we also see defence and private work come in from time to time. As a contractor for the police we work on cases involving indecent pictures of children, fraud, theft, drugs, and so on. I’ve worked at my current company for just over a year where I am currently employed as the deputy lab manager. I also get to work with my brother, Simon. It’s fun to poke fun at him from time to time.

What inspired you to start recording the Forensic 4cast podcast?


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

I’m a big fan of Leo Laporte from TWIT and have followed his shows for several years. I’ve known about Cyberspeak for quite some time too and have been a listener of that show for a while. Forensic 4cast started off as a marketing idea. I was at my former employer and we’d had a staff meeting in which the marketing team had asked for any ideas to promote the company. I suggested doing a podcast but the idea fizzled. A few months later I got my first Apple MacBook and was introduced to GarageBand. After playing with it for five minutes I called Simon and told him that we were going to produce our own digital forensic podcast. We’ve been having fun ever since.

How do you decide what to include in each episode?

It’s not as difficult as you may think. As we keep saying digital forensic news tends to trickle out rather then come in tidal waves so we don’t have a great deal to talk about sometimes. We just start talking about the latest stories and if we think there is a valid taking point we stop and discuss it. We don’t rehearse anything that we’re going to say we just read the news articles and feed of each other. We’re still trying to find our feet in a lot of respects and the podcast is still evolving. If someone says “Yeah, I’d love to be on the podcast” then we’ll work it in. I’d love to have more guests but the time difference between the UK and the US makes it difficult to arrange especially when I’ve got a young family at home.

What is the most enjoyable aspect of recording the show? What is the most challenging?

The best thing about the podcast is all the people I’ve met. I flick through my email address book now and its a veritable “who’s who” of digital forensics, and the amazing thing to me is that all these people are so friendly. Its incredible that I speak to well known people in the field and they are instantly accepting of me and treat me like an equal. I think it shows a tremendous fellowship. The other thing is that we are starting to be recognised by our voices. I have been practising my signature just in case someone asks for an autograph.

As far as the most challenging aspects of recording the show, there are always critics. Its impossible to please everyone and that sometimes causes people to speak out in a negative way. I remember one person posted a comment on the site which was quite extraordinary. I had to edit out all the bad language but allowed it to be posted. Everyone is entitled to their own opinion so all comments are welcome regardless of whether I like what they say or not.

What trends do you see in forensic computing and what new challenges do you envisage in the future?

This question comes up frequently. Every year we hear about new technologies that will make our investigations so much more difficult in the future. I think its a little like seeing a cloud on the horizon and pulling out your umbrella as a result. When Vista was released everyone was up in arms saying “bitlocker is going to kill computer forensics” but it didn’t. When Truecrypt was released it claimed that no one could tell if data was encrypted or if it was just random. Now we find that entropy testing can tell us if the data is encrypted. The forensic community adapts and changes just like the people that use this technology. We will see difficulties, that’s certain, but I’m confident that we’ll find ways to overcome whatever difficulties come our way. Take a look at Google Chrome for example. The public beta was released and, within 24 hours, the internet was saturated with Google Chrome parsers. I’m not saying that this will always be the case but we have a very responsive community.

Are there aspects of computer crime legislation (either generally or in specific jurisdictions) which you feel could be improved to allow investigators to work more effectively?

I think its important for the law makers around the world to understand our type of work. That is where the potential problem lies in this field. The PI law issue in the USA was allowed to pass in certain states because the law makers didn’t fully understand the role of digital forensic investigators. They were being misinformed by PI lobbyists on a lot of issues. A large number of them have now been educated and have since made better decisions. This is our responsibility. If laws pass that hinder our work we’re too late. We need to take an active role in educating our politicians about what we do.

One of the questions we're often asked at Forensic Focus is "how do I get started in a computer forensics career?" What advice would you give? What qualities do you think are most important for work in this field?

I started working in the field the Monday after my final exam at University. Some people think that was lucky, I choose to think that people create their own luck. I started my search for a job several months before my exams. I blitzed as many forensic companies as I could find and cold called them to ask if they were offering graduate positions. I wasn’t concerned about where I worked, or who I worked for, I just wanted to get started. One of the companies I called was CY4OR. I scored an interview with them and the rest, as they say, is history. I’ll always be thankful to them for the start they gave me.

I think it is important to make sure that people remember you. If you’ve written some digital forensic software put it on the web and post a link to it on Forensic Focus. It’ll get your name out quickly. Write a blog. Record a podcast. Talk with people from the field. Potential employers will always be more impressed with someone that can hit the ground running.

What are your plans for the future?

My immediate plans are to continue working at Zentek. We’ve just moved to some fantastic new offices where we have room to expand. It’s an exciting time for us and I feel like I’m helping to grow the business.

Long term? My wife is American and she misses her family. We’re looking to get things in order for us to be able to move there within a couple of years. This should be an interesting experience as I’m going to have to relearn a lot of what I currently do as I’m sure that procedures and practices will have subtle (and not so subtle) differences from here in the UK.

What do you do to relax when you're not working?

My family is my life. My two children (aged 5 and 2) take most of my free time. No matter what I’ve had to deal with at work I know that I can come home and the stress of it all disappears when my kids run up to me and try to hug me to death. We often go to the park or play on the Wii together and they love it.

I’m also a big reader. I’ve got a huge list of books that I’m currently trying to work my way through so hopefully I can find the time amongst my work load and producing the podcast to do so.

I cannot stress enough how important it is that people in this line of work find something to hang on to. Its easy to get caught up and become very cynical and even depressed with what we see on a regular basis. Things like family and hobbies help to keep us same and well balanced.

Lee can be contacted through the Forensic 4cast website.

Leave a Comment

Latest Videos

Throughout the past few years, the way employees communicate with each other has changed forever.

69% of employees note that the number of business applications they use at work has increased during the pandemic.

Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.

Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.

Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.

With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.

Join Monica Harris, Product Business Manager, as she showcases how investigators can:

- Manage multiple cloud collections through a web interface
- Cull data prior to collection to save time and money by gaining these valuable insights of the data available
- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box
- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee
- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

Throughout the past few years, the way employees communicate with each other has changed forever.

69% of employees note that the number of business applications they use at work has increased during the pandemic.

Desk phones, LAN lines and even VOIP have become technologies of the past workplace environment as employees turn to cloud applications on their computers and phones to collaborate with each other in today’s workplace environment.

Whether it’s conversations in Teams, file uploads in Slack chats, or confidential documents stored in Office 365, the amount of data stored and where it is stored, is growing quicker than IT and systems administrators can keep up with.

Corporate investigators and eDiscovery professionals need to seamlessly collect relevant data from cloud sources and accelerate the time to investigative and discovery review.

With the latest in Cellebrite’s remote collection suite of capabilities, investigators and legal professionals can benefit from secure collection with targeted capabilities for the most used workplace applications.

Join Monica Harris, Product Business Manager, as she showcases how investigators can:

- Manage multiple cloud collections through a web interface
- Cull data prior to collection to save time and money by gaining these valuable insights of the data available
- Collect data from the fastest growing cloud collaboration applications like Office365, Google Workspace, Slack and Box
- Login to a single source for workplace app collection without logging into every app and pulling data from multiple sources for every employee
- Utilize a single unified collection workflow for computer, mobile and workplace cloud applications without the need to purchase multiple tools for different types of collections – a solution unique to Cellebrite’s enterprise solution capabilities

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_g6nTjfEMnsA

Tips And Tricks Data Collection For Cloud Workplace Applications

Forensic Focus 8 hours ago

In this episode of the Forensic Focus podcast, Si and Desi explore the cutting-edge technology of deepfake videos and image manipulation. In addition to discussing the latest technological developments and efforts being made to detect manipulated media, they also examine the associated legal and ethical implications.

Show notes:

Boris Johnson image - https://www.theguardian.com/politics/2023/jan/10/spot-the-difference-boris-johnson-appears-scrubbed-from-photo-posted-by-grant-shapps

Deep Fake Neighbour Wars - https://m.imdb.com/title/tt21371376/

Stalin image - https://www.history.com/news/josef-stalin-great-purge-photo-retouching

Nvidia eye contact AI - https://www.polygon.com/23571376/nvidia-broadcast-eye-contact-ai and https://www.youtube.com/watch?v=xl87WTDrReo

Birthday problem - https://en.wikipedia.org/wiki/Birthday_problem

Same frightening woman in AI images - https://petapixel.com/2022/09/09/the-same-frightening-woman-keeps-appearing-in-ai-generated-images/

Inherent mysogeny of AI portraits - https://www.theguardian.com/us-news/2022/dec/09/lensa-ai-portraits-misogyny

Midjourney - https://www.midjourney.org/

Deepfake porn legality - https://www.theverge.com/2022/11/25/23477548/uk-deepfake-porn-illegal-offence-online-safety-bill-proposal and https://www.technologyreview.com/2021/02/12/1018222/deepfake-revenge-porn-coming-ban/

AIATSIS - https://aiatsis.gov.au/cultural-sensitivity

Fake tiger porn story - https://www.dailydot.com/unclick/tiger-porn-britain-law/

Group photo with no blinking - https://www.countrylife.co.uk/comment-opinion/curious-questions-group-photo-179102

Emma Watson deefake audio - https://www.thetimes.co.uk/article/ai-4chan-emma-watson-mein-kampf-elevenlabs-9wghsmt9c

Domestika - https://www.domestika.org/en/courses/981-introduction-to-interviewing-the-art-of-conversation

Investigative Interviewing - https://www.amazon.co.uk/dp/0199681899?ref=ppx_pop_mob_ap_share

Forensic Focus events calendar - https://www.forensicfocus.com/events/

Si Twitter - https://twitter.com/si_biles

In this episode of the Forensic Focus podcast, Si and Desi explore the cutting-edge technology of deepfake videos and image manipulation. In addition to discussing the latest technological developments and efforts being made to detect manipulated media, they also examine the associated legal and ethical implications.

Show notes:

Boris Johnson image - https://www.theguardian.com/politics/2023/jan/10/spot-the-difference-boris-johnson-appears-scrubbed-from-photo-posted-by-grant-shapps

Deep Fake Neighbour Wars - https://m.imdb.com/title/tt21371376/

Stalin image - https://www.history.com/news/josef-stalin-great-purge-photo-retouching

Nvidia eye contact AI - https://www.polygon.com/23571376/nvidia-broadcast-eye-contact-ai and https://www.youtube.com/watch?v=xl87WTDrReo

Birthday problem - https://en.wikipedia.org/wiki/Birthday_problem

Same frightening woman in AI images - https://petapixel.com/2022/09/09/the-same-frightening-woman-keeps-appearing-in-ai-generated-images/

Inherent mysogeny of AI portraits - https://www.theguardian.com/us-news/2022/dec/09/lensa-ai-portraits-misogyny

Midjourney - https://www.midjourney.org/

Deepfake porn legality - https://www.theverge.com/2022/11/25/23477548/uk-deepfake-porn-illegal-offence-online-safety-bill-proposal and https://www.technologyreview.com/2021/02/12/1018222/deepfake-revenge-porn-coming-ban/

AIATSIS - https://aiatsis.gov.au/cultural-sensitivity

Fake tiger porn story - https://www.dailydot.com/unclick/tiger-porn-britain-law/

Group photo with no blinking - https://www.countrylife.co.uk/comment-opinion/curious-questions-group-photo-179102

Emma Watson deefake audio - https://www.thetimes.co.uk/article/ai-4chan-emma-watson-mein-kampf-elevenlabs-9wghsmt9c

Domestika - https://www.domestika.org/en/courses/981-introduction-to-interviewing-the-art-of-conversation

Investigative Interviewing - https://www.amazon.co.uk/dp/0199681899?ref=ppx_pop_mob_ap_share

Forensic Focus events calendar - https://www.forensicfocus.com/events/

Si Twitter - https://twitter.com/si_biles

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_i41eg24YGZg

Deepfake Videos And Altered Images - A Challenge For Digital Forensics?

Forensic Focus 13th February 2023 10:30 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...