Timothy Wedge is Associate Professor of Cyber-forensics at Defiance College.
Please tell us a bit about your background and how you started teaching at Defiance College.
After spending 22 years in the US Navy, I retired and started a new career with the National White Collar Crime Center (NWC) as a computer crime specialist. During my time there, I provided training in the collection and analysis of digital evidence to more than 3,000 law enforcement personnel. I also spent my last three years at NW3C as an adjunct at Purdue University as part of a partnership between NW3C, Purdue, and the Indiana State Police. I taught more than a dozen different courses covering everything from basic data recovery and analysis to online investigations. I was lead developer for many of those courses, including one that we developed under contract for the newly-formed Department of Homeland Security. While researching materials for this course, I learned that the majority of terrorist groups through the last half-century have been ended by law enforcement and intelligence investigations (military action was effective only 2% of the time).
This led me to take a job as a contractor for US Army Intelligence, where I worked as a senior media exploitation analyst in Iraq, eventually taking the position as tech lead for all TAC-DOMEX media exploitation analysts in the Iraqi theatre of operation. During my time there, I processed more than 2,000 pieces of digital media, including both new and archaic technology. I also began to learn about human trafficking while I was there, and decided to focus my career on using my skills to combat human trafficking.
During my post-Iraq job search, I was contacted by Dr. Gregg Gunsch at Defiance College, who heard of me through my past colleagues at Purdue. During the conversations that followed, Dr. Gunsch and others at Defiance convinced me that I could work on anti-human trafficking projects while teaching digital forensics at the college. Long story short, I’ve been there 12 years. My efforts in human trafficking have also branched out into efforts to help victims of domestic violence and stalking victims.
What digital forensics courses and research opportunities does your department offer? What can students expect to learn?
Our students will begin their program of study taking courses in basic computer and information security fundamentals, and criminal justice fundamentals. They will progress through courses of increasing complexity, learning electronic seizure and imaging techniques, forensic and security ethics, RAM seizure and analysis, mobile device forensics, and forensic report writing. The program places a strong emphasis on tool validation, ethics, and critical thinking.
We also offer special topics courses in such diverse specialties as tracking cryptocurrency, social media investigations, and the dark web.
Students will be presented with a number of research opportunities as they progress through the program. Two popular, ongoing projects are:
The Digital Evidence Collection Guide For Victim Advocates
In this recurring project, students meet with real-world victim advocates that work with domestic violence and stalking victims to identify the most current and common electronic platforms that are being weaponized against their clients. Students then develop and test methods that can be taught to laypersons (advocates and clients) without special tools for extracting actionable, admissible evidence in court. The guide is updated every year, and distributed at no cost to victim advocates, their clients, and some law enforcement, when requested.
This guide has been used thousands of times in the real world, both to produce evidence presented in court (often to obtain civil protection orders) and to provide clients (victims) effective mechanisms for protecting themselves from electronic harassment. We have been informed by one victim advocate that evidence collected using techniques in our guide was used to help obtain a sexual assault conviction (2019).
Facial Analysis to Gain Information Now (FAGIN)
Developed as a proof of concept several years ago, the project aims to identify missing children that are being trafficked for sex online, by matching pictures from missing persons reports to pictures appearing in online sex ads.
What are your own teaching and/or research interests?
My biggest research interest is the fight against human trafficking, which inevitably evolved into the fight against domestic violence and stalking. I am also very focused on graduating students that not only know how to use a variety of tools, but have the profoundly deep understanding of the underlying mechanics of data storage necessary to thoroughly test these tools. Over the years, I find myself becoming increasingly concerned about practitioners that have learned to use tools, but not how to test them. I feel that real tool validation is a minimum competency for digital forensic practioners.
What digital forensics reading material or resources do you recommend to supplement academic learning?
I recommend membership in relevant, vendor-neutral organizations such as HTCIA (High Technology Crime Investigation Association) and IACIS (International Association of Computer Investigation Specialists), and reading peer-reviewed sources such as the Journal for Digital Forensics, Security, and Law, and oh, I don’t know … maybe Forensic Focus. Attending conferences (especially HTCIA and IACIS conferences) is a good idea, too.
How do you see the relationship between digital forensics and computer security? Should digital forensics students have at least some knowledge of computer security principles?
From the beginning (circa 2006), our program at Defiance College has required students to become proficient in security fundamentals, and some advanced concepts (intrusion detection, for example) as well. Even before we added the cybersecurity major to our program a few years ago, many of our forensic graduates were competing for and getting cybersecurity positions directly out of college. There is, and should be, a strong relationship between digital forensics and information security, in my opinion.
One of the questions we’re often asked at Forensic Focus is “how do I get started in a digital forensics career?” What advice would you give? What qualities do you think are most important for work in this field?
I would encourage young people who aspire to join the digital forensic community to look for a program that has a couple of key elements:
- First, the program should include student chapters of appropriate professional organizations, such as HTCIA.
- Second, look closely at the faculty bios. There should be some real-world investigative experience in addition to appropriate academic credentials.
Qualities I think are important include curiosity, honesty, and critical thinking. I also think that people that want to work in this field should develop a healthy distrust of just about everything (“scepticism” is probably a more tactful choice, but “distrust” seems to get their attention better). That probably sounds a little odd, but it is important that if our findings are going to be used, in whole or in part, to determine somebody’s guilt or innocence, we need to own those findings. “Because the vendor said so”, “Because Microsoft said so”, “Because Apple said so” are all insufficient foundations for drawing inferences about past human actions from the digital artifacts we examine.
Which certifications would you recommend for aspiring digital forensics professionals?
I recommend starting with “vendor-neutral” certifications, such as the Digital Forensic Certification Board’s DFCA and DFCP (Digital Forensic Certified Associate and Digital Forensic Certified Practitioner, respectively). IACIS’s CFCE (for law enforcement) is good one, as is SANS institute’s GCFA.
What do you enjoy outside of digital forensics?
Reading, writing, and gardening. I have written, and gotten published, a few science fiction / fantasy short stories, am working on a novel (progress has been slow), and I have hopes of someday finishing a textbook on data storage principles and effective tool testing (the latter two are in very early development). I sometimes provide pro bono technical assistance to victim advocates and their clients.
If you’d like to connect with Timothy, you can find him on LinkedIn (login required).
