Oxygen Forensics Training And Digital Forensics Solutions With Keith Lockhart

Si Biles: Welcome, friends and enemies, to the Forensic Focus podcast. Today I have Keith Lockhart with me, and we are going to see if two IT professionals can get their audio equipment to run in such a way as to do a podcast. Keith is from Oxygen Forensics. And if all things go according to plan, we will have a wide-ranging discussion that will include some aspects of Oxygen Forensics. Keith, we had a brief chat yesterday, and your background to come into the industry is absolutely fascinating. So do you want to introduce yourself and tell us a little bit about yourself?

Keith Lockhart: Sure, but I have to touch on the audio situation that we just experienced to say, yeah, there may be a combined million years of technology experience between us, but boy, I can’t make a microphone work to save my life. And I want to say also that it’s funny, when we talked yesterday, you brought up the fact that SquadCast doesn’t let you change your background.

So I grabbed this three-part moon Earth picture thing here, put some batteries in it because it had been sitting on a shelf forever, and made my own background. But the caveat to that is, I should say the trivia to that is can you imagine a guess to how I acquired this three-part thing?

Si Biles: I’ve got to say, short of a trip on the space shuttle to take it yourself, which would be-

Keith Lockhart: Close.


Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.


Si Biles: Wow. Okay.

Keith Lockhart: Do you remember the SkyMall magazine that used to be on all the airplanes in the sky prior to an economy downturn where the SkyMall magazine went away?

Si Biles: Yeah.

Keith Lockhart: I got that out of SkyMall. So that long ago. It was really cool then. And I thought that would make a great background for this.

Si Biles: Oh, that’s excellent.

Keith Lockhart: And that’s part and parcel to my background. We talked a little bit about that, Simon. I started a technology career about 20 years ago, but it was a law enforcement foray before that. And my career has been one of training primarily. And I didn’t know that that was going to be what I was going to do after university.

I got into law enforcement and got into a position where I was training other law enforcement professionals how to do some work, and it was some crazy work. We talked a little bit yesterday about being undercover and doing narcotics work and things like that.

"I started a technology career about 20 years ago, but it was a law enforcement foray before that. And my career has been one of training primarily … I got into law enforcement and got into a position where I was training other law… Share on X

And the quick story to that was we used to rent out or hire out a whole floor of a hotel and set up all these scenarios and run people through the scenarios, and they were progressively worse or more difficult to complete. And the very last one was one where if you didn’t do drugs, you perished, essentially. I perished in it.

But teaching people how to work through that and watching adults that are usually in control of things and, “I don’t need to know that, I know everything,” have to rethink their entire position on life to make it through that. I was like, “This is really interestingly fun to do this.”

So I did that several years. And of course, computers came around. And when I was working that job and having informants say things like, “Oh, people are keeping all their stuff in the computer in the kitchen,” we started creating warrants to take those computers in the kitchen. But we had no idea what to do with them, so we would send them away and never see them again because our little tiny drug-dealing cases were at the bottom of the list, essentially, so we never got those things back in time for trial.

And then I was very fortunate that a group, the National White Collar Crime Center in the States, which is tax money funding law enforcement education on topics they couldn’t stand. So they came and did a course where I lived. And my chief said something like, “Go there because you always lose your evidence from sending it away and you need that.”

And it was so fascinating. And I was sitting with my… I mean, look at the screen with the both of us. It was like me and my lieutenant. You would be my lieutenant sitting right beside me. And I whispered to one of the instructors in the course, “Hey, how do you get a job with you guys?” And he’s like, “You’re not doing that.”

And I think four months later, I had a job with those guys. I think the comment I made yesterday was, who gives a badge back after you work so hard to get it? But I was going to a job where I could still interact and help law enforcement, and that was key to my existence at the time. If I was going to do anything that would get me off that job, it was that other job.

But that was at a time, Simon, where automated technology wasn’t really kicking it yet. So I was super fortunate to use Norton’s Diskedit to page through sectors at a time and really understand what 512 bytes was and file slack and things like that. It was the grounding knowledge for the rest of my career because when I left National White Collar Crime Center in West Virginia, I moved to Utah in the States to go to this little company called AccessData.

I was employee 13 at the time, and I came out here to build a training program. Spent 16 years there. But as the automated technology boom craze went nuts with EnCase and FTK and ILook, before the current world of Magnet and Cellebrite and things like that. Button-pushing cowboys was the term. Because people would get on the stand and have no idea when they click that button, “Wow, did you just trip an access date for that file? Do you really know what’s happening there?”

I did because that was the career or the timeframe I grew up in and a lot of people didn’t. So the education that went around that to try to make people understand how to get their data and do the right things with it and not trip themself up was immense and crazy.

And of course, it ran the gamut from computer forensics to E-discovery to incident response to mobile. I mean, the technology has been all over the place adapting to the world around it. And AccessData happened to be a playground of everything. We tried to do… Anything that happened, we built software to mitigate that problem, so I got exposure to a lot of things.

And then eventually, Lee Reiber worked there at a time when I worked there, and then Lee went to Oxygen and I ended up at Oxygen. So building training here. You can’t do much of anything good or bad without a mobile device attached to it, one or two or more. I think there are what, three times the devices than there are people in the universe right now. And I’m making that up, but something to that effect.

Si Biles: I was going to say you may be making it up, but if this house is anything to go by, that’s about right, I’d say.

Keith Lockhart: Yes.

Si Biles: You went into law… You said you left university and went into law enforcement. What’s your educational background before this? Is it technical or is it-

Keith Lockhart: So, nothing to do with technology, astonishingly. It ended up being a criminology type of thing. I got a bachelor’s in criminology, which I thought would be the gateway to everything. But the reality is when you get on the road and on the street, that was fun. But you learn everything different and relative to where you are and who you deal with and what you’re dealing with.

Look, my career in law enforcement was very short. It wasn’t really a career. It ended up being a stepping stone. I think I told you yesterday, I grew up in the ’80s, so I wanted to drive a Ferrari in Florida and buy drugs like some famous movie star guys. So I didn’t have a Ferrari. I had a Ford Probe and I think a Pontiac Sunfire. Different vehicles [inaudible 00:07:39].

Si Biles: Oh, yeah. Those are pretty racy cars, though, aren’t they? [inaudible 00:07:44].

Keith Lockhart: Hey, listen, when you have them decked out with microphones, cameras, I was cool in my own mind. In my own mind. My college education was a great college education, for sure, and it was designed to do law enforcement.

It’s like in America, when you talk about or you see the FBI recruiting, they don’t want people that know cop stuff. They want people who are accountants and… They’ll teach you the cop stuff. They want a different knowledge set. Either way.

And then, of course, I went from a criminal mindset to, okay, here’s Diskedit, page down through sectors. You remember this. Go over to AOL and Virginia and figure out how to parse a mailbox and make people understand. You remember how they would send the CDs out by the millions to install software? We would have CD-throwing contests until people got hurt. It was a crazy time, crazy time. But my college career went out the wayside really quickly.

Si Biles: Yeah. Yeah. The AOL CDs were internationally… [inaudible 00:08:51] we’ll have listeners who have no idea what we’re talking about. And in fact-

Keith Lockhart: Exactly right. Yeah.

Si Biles: I used to have a stack of them.

Keith Lockhart: Google that.

Si Biles: But we were just using them as coasters for mugs and things because [inaudible 00:09:02].

Keith Lockhart: Oh, they would come in ornate metal cases. It was just astonishing that marketing campaign. And it worked for a long time. A long time.

Si Biles: So you went through through AccessData. Is it always about the training or is it… Are you doing software development? Have you picked up a deeply technical… I mean, you are deeply… You were just talking about using Diskedit, which again, I remember this. But are you broadly technical now or are we very forensically technical?

Keith Lockhart: Over broadly at this point with the forensic underpinnings of stuff I don’t want in my head that I can’t get rid of. I try. So here’s how this plays out. There’s the technical acumen that you have to acquire to do the type of work where if I’m going to say, “Simon, believe me when I tell you these offsets and these hex values we’re going to translate into a decimal value mean something. I promise you. So I know you want to jump out the window, but hold on.”

So you have to develop that. And obviously, it’s spun around adult education because why are you wasting your time with me? And then there’s the aspect of working for a software company. So that starts to broaden your technical knowledge about development cycles and why can’t I have what I want all the time. Well, there’s the rest of the world that wants… The needs of many outweigh the needs of you, Keith, and your feature requests.

However, as an incredibly forward-facing position at either of these companies that is constantly talking with the public as a subject matter expert or just somebody at a conference or hey, let’s get a beer or whatever it is. That’s the model of if you’re in a police car driving around, you’re that guy. But if you’re in plain clothes undercover talking to people, you’re a completely different guy with completely different information you gather and bring back to the fold.

So if you’re sitting down with somebody outside of class, a user, it’s a famous… At a conference, late-night networking where you sit down and go, “Hey, so tell me what’s going on.” And you gather all these things that are wrong or right or good or bad about products. And if it did this, we’d buy a million of them or we could get this done.

So that was a real key and the turning point in not just training but over broad education about how the process works to make the software better for people. Now, I could say very easily that all of the jobs I’ve done over time have constantly prepared me for the next one; so National White Collar Crime Center and the underpinning technology, AccessData and the push-button world, but knowing what happens so I can properly educate.

And then all those different facets of E-discovery [inaudible 00:11:48] responsible. And then running a training business unit for 15 years-ish, and then coming here. So understanding development cycles and different technologies and how to educate on them.

So at Oxygen now, my title is vice president of technology and training. So I don’t code. I’m an influencer. I gather… So there’s kind of an umbrella with the sales engineering team and the support team and the training team, and we all work together to take that forward-facing information we gather and bring it back to the development group.

Now, I don’t run the development group, but I do hold people to the, “You said you were going to get me that on this date. What’s up?” And then I have to fall back on, “Oh yeah, I get it. Okay. Well, we found this or we found this, or we found this.”

So we just recently added some new quality assurance people on the team so we can make sure things are going out the door as best they can go out. But it’s really interesting. I guess at this stage of my… Is it waxing or waning? Where am I in my timeline of life?

Si Biles: I can never remember which one’s which anyway, so whichever [inaudible 00:12:55].

Keith Lockhart: Are You Smarter Than A 7th Grader? My daughter and I just did that last year. However, I’m more technology-oriented now than training, and I’ve got a great training team here that takes care of… They go do their thing. And if they need anything from me in that regard, I’ll certainly help.

But now I’m really focused on gathering outside information to bring it inside and make our technology better. So it’s really interesting. That’s a great question because it makes me introspectively look at where I was and where I am now and how I got there, which is good to do every so often.

Si Biles: Yes, yes. Yeah. I get the impression that your background in subtle interrogation has gotten you a long way in getting information out of customers. It really is such an important thing for a company to actually move with the times and deliver what it is that clients want as opposed to… Unless you’re Microsoft who can deliver whatever the hell they want and we all have to live with it.

Keith Lockhart: That’s right.

Si Biles: If you aren’t delivering what the customer needs-

Keith Lockhart: Well said.

Si Biles: … then you’re not going to succeed. So, for you, that must be fantastic.

Keith Lockhart: It has to be… And like I’m not doing right there, I’m interrupting you, Simon, but you got to be a good listener, right? I talk a lot. And people that know me over time will say, “Okay, you have 50 minutes. Hey, 50 minutes.” I’m like, “Yeah, yeah, yeah.” I’m like, “Don’t ever ring the bell [inaudible 00:14:24].”

So there’s that aspect of it. But if you can properly manage the, I’ll listen really well and talk a whole lot to the right people, not the wrong people, meaning the development people, that works. That’s a great model. So subtle interrogation is a great way to do it because you’re always listening.

You hear across the room somebody will say something about the tool you’re working on. You’re like, “I got to go.” And you run over there. “Hey, what are you guys doing? I heard you. Tell me about that.” So yeah, excellent point. Subtle interrogation, I’m going to start using that myself.

Si Biles: I’m going to say, I work in education as well in a slightly different scenario [inaudible 00:15:00] universities. And the ability to talk consistently in front of a bunch of students who aren’t listening… well, who overly are listening to you but aren’t interacting with you necessarily for hours on end does tend to lend itself to the ability to stand on a soapbox and continue talking if you don’t reign yourself in occasionally. So yeah, I have sympathy for that. But it is an important skill in training.

And in that regard, how did you find the transition to training? I mean, you went from criminology to being a police officer, which okay, in your particular role involved dealing with people a lot. I mean, every police officer deals with people a lot, but in perhaps a slightly more psychologically proactive way to make sure that they didn’t take you out the back and shoot you. So how did you find the transition into training? Did you train in training or did you just bring… or were you thrown in the deep end and learnt it like some of us?

Keith Lockhart: No, that’s a great point and a great question. So the transition point was doing those scenarios where I realized helping people understand something was a good feeling. I mean, it was a, “Oh, wow. I’ll sleep better tonight because I showed Simon how to survive that. That’s really cool.”

So in the back of my mind, I was like, “I like to do that.” So every time that opportunity came up, I would go participate in that. Then when I went to the computer crimes specialist job, which is what that was called, make no mistake, it was terrifying the first year to sit down because here’s the scenario.

You had all these law enforcement professionals brought into a location and forced… I mean, 95% of them were forced to be there because they were coming across computer crimes and they had to deal with them. Something happened and we would call it the APE case, an Acute Political Emergency, and nobody knew what to do. So somebody’s going to learn what to do.

And you’re saying, “Here’s this thing called Diskedit. You want to throw up this morning? Let’s go reconstruct a master [inaudible 00:17:08] or master boot record.” And people just… they’d threaten us. And it was a five-day event. And oh gosh, we’d dress up in a suit on the first day.

But even today, if I’m so complacent that I’m not a little bit terrified if I’m going to go speak somewhere, then I probably shouldn’t be doing it anymore. Right? There is that aspect of it because you got to stay on your toes. I literally sat here last night for an hour setting everything up because I want to have a good time with you.

And if I didn’t care and just showed up and my microphone didn’t work right out of the gate, you could argue my point, but with me especially. But the transition to training was… It’s a feel-good, I guess, to make people understand something. And then when you really take people that don’t want to learn something and after five days they go, “Okay then. I get it. I’m going to go home and try it.” And you’re like, once again, “Wow, okay.” So that was really great.

There was probably a little bit of a turn going to a… Because that was a tax-funded event where people came in. It wasn’t about revenue and it wasn’t about software sales. Running a training business unit inside a software company is always its own dynamic because it’s a software company first.

Obviously, I want to make sure everybody knows how to use it and get the best bang for their buck, and that’s the primary mission statement of any kind of training business unit inside a software company. But when sales of things get involved… I never did sales, and I would never want to do sales because I would always educate you for free given the choice, which is probably a point I want to talk about before we part ways today.

But that took a little bit of a different twist. So I had to adapt everything I knew and liked about educating adults and technology to educating adults and technology for a fee. As a company would say, “Well, yeah, we got to charge people for that, so make it work. Make that model work.”

Well, then let me add this third thing into it. It has nothing to do with your question. There’s a philanthropic side of this because when I start having to do things for a fee, somewhere in my mind, I have to reconcile that so that… You’ve heard of IACIS? I-A-C-I-S.

Si Biles: Oh, yes. Yeah.

Keith Lockhart: The International Association of Computer Investigative Specialists. So I spent 10 years putting time back into the industry as a volunteer for that. I mean, being a row coach, coaching a table of four or five people for two weeks in the BCFE class.

And then, gosh, I was director of training on the board for a while. I was president for a while there. So while I was being forced into a revenue model world, I could still do that other… I still got my fill of feel-good by volunteering in a law enforcement education capacity all over the world. At the time I was, in the 10 years I think I spent with IACIS, doing full-time stuff. So to transition in, to transition out, to transition around, and you’re always trying to make all the ends meet when you’re still doing the same thing.

Si Biles: I think philanthropy is… You brought it up, and I’m glad to hear it. I think everybody… I was just going to say this with my slightly liberal tendencies coming out, but I think everybody should give back to the communities that they’re a part of. And how you do that is up to you, whether it’s picking up litter on the street or dealing into a major society like that, it’s a very different thing.

But the attitude quite often in forensics is that there’s inside and then there’s everybody else. And we quite often feel that by gatekeeping the knowledge that we have, we’re making the world a better place. What do you think about that?

Keith Lockhart: I’ll tell you exactly what I think about that. It’s a great point. So there was a time when I was exactly that. Right? And that was probably more fresh out of the early law enforcement-influenced life to… there was a point when we had a client, a customer that was not law enforcement and not corporate, but defense.

So I pondered that and swallowed that pill, and here’s why. When I finally came to my conclusion, I swallowed that pill and forced other people to swallow it too. It’s like, take the red pill or the blue pill, either one. Because if you don’t gatekeep that knowledge and you share it willingly, here’s what happens.

If Simon’s the bad guy and I’m the prosecutorial side, and I share everything freely with the defense and the defense reads it, discovery, what we call it here, and the defense looks at it and goes… And they’ve had the education to understand what I’m giving them, that’s the key.

They look at it for about three minutes and say, “All right. Forget it. Simon, we plead. We admit.” And that saves everybody time, money, effort, and life is just better. Maybe not for you as the bad person. But when you educate both sides, life is just better like that.

So I willingly make sure everybody knows, everybody’s on the same playing field. Because that’s not the point in that scenario. The point is what was bad. If we’re trying to put somebody that did something bad in a spot, well, let everybody have the same information.

So that education is key to that. Because if they don’t understand what that information is, “Oh yeah, I’ve got this unallocated space.” And they’re going, “Yeah, okay. I guess I got to go find an expert of my own.” Well, that just derails the process.

So I teach everybody the same, freely. I mean, obviously, there are things where… not my criteria, that say, hey, this is a group-specific event, or you have to be this member or whatever it is, but I don’t gatekeep anymore. And the teams I build don’t gatekeep anymore for that very reason. Does that make sense?

Si Biles: Yeah, absolutely. And as a defense expert, I totally laud it. I think it’s an interesting one, and I’ll get on my soapbox for a bit. But in this country and in America, we talk about the court system being an adversarial system. And people take the adversarial bit but forget what the court is there to do is actually just find the truth and to deal with it.

Keith Lockhart: Exactly. Right. Right.

Si Biles: And actually, we’re both trying to do that. It’s just that we’re being paid by different people. But ultimately, actually, the job is exactly the same. The duty is to the court. We stand up and tell the truth, the whole truth, and nothing but the truth. I assume you have a similar, if not identical oath in the dock.

Keith Lockhart: In addition to… I’m not here to render an opinion. In my experience, in my findings, here’s what I found. Decide what you want on that. So that’s very similar. Very similar.

Si Biles: Seeing as you are now with Oxygen and you’re listening to the requirements of the clients, what’s Oxygen bringing to us that is delivering on what we need?

Keith Lockhart: It’s funny. While I have the moon and the earth in the background, I do have my gratuitous plug when my…

Si Biles: I don’t have it here with me because I’m drinking coffee and I use the bottle. But actually, it’s the best free gift I’ve gotten out of a stand at a conference was a beautiful… It’s exactly that color, but water bottle. But metal, gorgeous. Very, very happy.

Keith Lockhart: It looks almost like a bowling pin, a miniature bowling pin.

Si Biles: Yes, that’s it. Yeah. Yeah.

Keith Lockhart: Yes. I love them. I have one upstairs. Yeah.

Si Biles: Yeah, they are. They are [inaudible 00:24:59].

Keith Lockhart: Here’s the problem. And the company will be mad at me for this because I complained. I had an old ceramic mug that the logo had worn off of. And I said, listen, I’m just going to leave the company if I don’t get a new mug. Okay? So for Christmas, I got this new mug. It’s one of those arctic ones.

Si Biles: [inaudible 00:25:15].

Keith Lockhart: But the problem with this is, like I said to you yesterday for a minute, there’ll be days when I’ll set my coffee down. Four hours later, I look at it, it’s ice-cold. And I would go put it in the microwave or something, heat it up.

Si Biles: No.

Keith Lockhart: Can’t do it. So I’m like, this looks really cool, but the functionality. So yeah, you have to have to find a way to edit that out of our recording.

Si Biles: It’s about listening to uses. That’s what it is.

Keith Lockhart: Let me talk a minute about training and pain points because like you said, we’re gathering the feedback and getting the right locations. One of the points we brought up yesterday in our short conversation was when economies go bad, the first things that go are training and travel money.

And that’s a problem for my feel-good lifestyle because it makes it harder for me to educate you. And even prior to COVID, when the first big economic downturn happened, we initiated remote training back at AccessData. And it’s ironic because our very first attempt at it was from Utah to Australia.

And I can remember leaving… I won’t rat him out, but I can remember leaving a great guy with one of those big bucket carafes of Starbucks at about 5:00 PM in this training venue and saying, “All right, buddy. Go do it.” And I went home and I logged into the same training session and said, “Hey, everybody. Have a blast with this person.”

And I think I was probably rude enough to go, “Guess what I just did? And you guys are going to be up all night. Okay, see you later.” But it worked. And that was the predecessor to… I mean, it got so bad during that economic time that that’s probably the only reason you and I are still sitting here having this conversation today is we adapted to those pain points.

I think I made the joke yesterday that once people realize they can sit around with a bottle of wine in their nightgown and pajamas and take class, we don’t enforce a camera rule, but you don’t have to travel. You stay home, you don’t spend the money. You do it… It’s much more pain-point-addressable.

So that was a huge revolution in my training career to divest our delivery methodology from just, okay, everybody fly and meet somewhere and we’ll spend all this time together. It just wasn’t feasible like that anymore, so we adapted or pivoted. Take your pick of words there.

But then it became the learning management system style, on demand, where I don’t have time for your calendar. And when the E-discovery world came around and a lot of attorneys got involved, they don’t have any time for anything except what they have time for in their own life. Well, when you’re trying to learn review technology and you’re trying to redact things electronically instead of paper and then scanning, the world of scanned documents, ugh…

Overcoming humps like that and making it so people could actually still get education on their own time was, okay, let’s make… I won’t rat her out, but a great friend of mine once introduced me to the term “knowledge nugget.”

Here’s a little five-minute thing on redaction, or a little five-minute thing on Bates stamping, or a little five-minute thing on creating a matter. And you could go watch those in the learning management system whenever you wanted, instead of having to afford time for class and sit down with somebody. And you could just go get what you need. And it became an incredible method to acquire knowledge.

Not to mention, if you did go to a class and six months later you come across a point you forgot, you could just go back and watch that module instead of having to go back to the whole course. So a training offering like that was not crème de la crème, but really upfront knowledge absorption and then long-term residual ability to get back to it whenever you needed it.

Your question was what’s Oxygen bringing to us right now. And that was the one point I want to make sure we covered here is for 2024, when people buy Oxygen software, they get access to our LMS full of our recorded content for classes. Not instructor stuff. You still come to class instructors like you used to, but you have access to the on-demand content.

Because look, it’s still… I mean, in the States today, the mortgage rates, the interest rates are so high and the economy fluctuates quite crazy and it’s still hard to travel, and it’s still hard to budget for training because other things come first. Again, I’d give everything away for free, so it’s not quite free.

But look, as long as your subscription is current essentially to your software, you have access to that, which is fantastic. And it eliminates the calendar problem, eliminates the travel problem, and still gets you access to a ton of information to hopefully keep you successful.

What was the analogy I used? The sales team would say we want somebody to buy it and renew it. And I would say I want somebody to adopt and retain it. Just simple terminology changes that are more user-friendly. Look, adopt the technology because it can help you, and retain it because you can keep learning all the new things about it.

And Simon, at this company, we release software a lot. If it’s a mobile-focused company, we have to. We’re not keeping up with the Joneses and we’re doing you a disservice, as compared to an AccessData world where we used to release FTK four times a year. So people would, once a quarter, try to… So subscription holders would feel like they’re getting their money out of it.

But there’s no way we could not… I mean, it has to be more here because applications and firmware and devices and methodologies, we’re always updating things. So what better way to get information to you is here’s a new knowledge share, here’s a new nugget, new video, let’s get it up there so Simon can go get the latest and greatest info. So it’s a long answer to a short question, but it’s a great conversation for 2024.

Si Biles: No, no, it’s a good answer. It’s a good answer to a question. You’re not replacing your instructor-led courses with this. How do you see them sitting together? Is there a direct [inaudible 00:31:20]?

Keith Lockhart: No, no. There are still people that are like, “Yeah, to heck with that. Come down to our place. We’re not coming to headquarters. We’re not watching those. No. Come do it in person for us.” Okay. I mean, people still buy those just like before. I mean, everybody’s learning style is different, for sure.

Si Biles: Yeah. Absolutely.

Keith Lockhart: And there are some courses… We have a course called Extraction in a Box. Oh, hold on. Hold on. Forget where I am and I could do this. We ship out a kit full of phones. So you can sit remotely with an instructor and you get your phone out and I get my phone out, and we do the hands-on work together. Because again, travel and time.

Si Biles: So hang on, you will ship me a box of phones-

Keith Lockhart: That’s right.

Si Biles: … to practice with?

Keith Lockhart: That’s right. And we get it out.

Si Biles: Oh, that’s so cool.

Keith Lockhart: That one’s kind of empty. Hold on. Say I don’t promote, but check it out.

Si Biles: That’s brilliant.

Keith Lockhart: There’s a bunch of phones, there’s a little PPE kit in there, some wipes, some USB devices, tweezers. Yeah. So you get to do it with the instructor instead of traveling to headquarters where you can sit down at a table. You’re going to do it like that. So it’s been super popular. I have 10 of these out all over the world right now. And some of them are stuck in customs somewhere right now. But that kind of thing-

Si Biles: Well, yes, that I imagine this is, yes, a bit of a nightmare. Yeah, but that’s brilliant.

Keith Lockhart: Trying to address the pain points, right?

Si Biles: Yeah.

Keith Lockhart: And it’s kind of like, well, where are you in your career? Are you just starting out? Because I can’t sell you an automated tool without showing you how to get data to put into it. So if you’re just starting out, you need a course like that. And maybe you don’t have budget to go somewhere. So I have to show you how to get data from phones to put it into the tool. So we do that to address that kind of pain point.

Si Biles: That’s really cool. I love that so much.

Keith Lockhart: I’ll ship you one and you can just put it in the background in your…

Si Biles: Yeah, just up here somewhere would be perfect.

Keith Lockhart: That’s right.

Si Biles: And it’s a nice blue Peli case as well, which is quite striking and company-branded. I like it.

Keith Lockhart: Well, so one of the guys on the team… Now, listen to this. One of the guys on the team goes, “Hey, check this out.” And he had, on his own, went and made one of those, including the logo, and showed it to me on a camera and sent a picture. I’m like, “What? Where in the world did you get that? Who made that?”

And I thought our marketing team did. He goes, “Oh, I just made one.” I’m like, “Oh. Well, hold on a second.” And I think in the last year’s budget or something, I put a budget in there to make a bunch of those. And people were just going, “What in the world?”

Because we used to ship little cardboard boxes. And I think the guys in the team were like, “Yeah, okay, Keith, you need to step it up a little bit. We’re going to step it up for you.” And they made that. So now we have a whole new game going.

Si Biles: Oh, that’s perfect. I love that.

Keith Lockhart: So the evolution of the XIB world has been great.

Si Biles: That’s so cool. So I’m just going to go back to something you said earlier. And your role has changed. So with the advent of online courses and the ability to ship people phones in the box and the knowledge nuggets being continuously available online, has that been detrimental in your ability to get customer feedback in the water-cooler, coffee-collection, hallway scenario that we see in-person training and the conferences and stuff like that?

Keith Lockhart: Not that I’ve seen. Not that I’ve seen. And we meet regularly to deliver feedback from the field. And I’m not seeing any change at all from that because you’ll still get a comment… I mean, you look at the chat transcript of a daily… We use Vonage for that I think right now.

And just the questions and the things that come in there. Every so often, you get a class of people that don’t say a word. So then you got to put on your, “Say some words, Simon. If you don’t speak now, I’m going to kick you out of class and you’re not going to get your continuing education credits, and you’re not going to get a certificate. Speak.” So sometimes that happens.

But the same people that would be at the water cooler would be in this event, and they’re the same way. Like, “Hold on. Put that in the chat. We’ll do it on a break or at lunchtime. We’ll come back a little early and we’ll work on it together.” So all that still occurs, just a different medium of communication.

Si Biles: Because it was something that we were talking about in the show earlier was to do with whether online conferences were as good or as valuable as in-person conferences. Because actually going and listening to a speaker is great, but actually, it’s a lot of the interaction that you have with your fellow conference-goers that is valuable in those scenarios. And I think the online conferences haven’t quite got it right yet, but I think the online classes seem to be a better bet.

Keith Lockhart: Distinct difference. I’m glad you bring that up because conference is totally different. When you have an en masse group of people and they’re doing their phones or talking to each other, just watching somebody on the screen as a talking head, completely different environment for feedback especially, versus a dedicated classroom environment.

It’s still remote. We don’t enforce cameras, but everybody’s in the same room. You get to know each other after a few days of… We still get the same feedback in a classroom environment. But a conference, I agree with you, having done several, especially during COVID when that really came to light and everybody started doing that.

I mean, it’s easy to post a bunch of events, a bunch of time slots, but people that show up or don’t show up, man, much rather be there in person. And somewhere probably 10 years ago I think, the model was, look, unless you get me on a stage, I’m not going. That’s my own issue. But look, if I’m going to go somewhere, I want to talk to people and show them things that can make their day better for peace’s sake. Yes, I can stand at a booth and talk to people there, but that’s not the most effective use of my…

Si Biles: Yeah. I think it’s interesting because along with the… As you said, training gets cut, travel budgets get cut, conference budgets get cut. So I think there needs to be a shift in the way the conferences are presented in order to enable this break room kind of discussion.

Because the advantages of doing online conferences are exactly the same as the advantages of doing online training. You can bring trainers from all over the world. You can bring conference speakers from all over the world. You can get your class from the entire world. And then you can deliver it at will, which is a thing. But yeah, the interactions are different.

In regard to delivering to the entire world, Oxygen is an American company. It is an American company, isn’t it? Yes.

Keith Lockhart: [inaudible 00:38:09].

Si Biles: Are you delivering entirely in English or is there some foreign language provision for delivery?

Keith Lockhart: So we have, from a training perspective… So the tool translates into several languages that we don’t have the immediate bandwidth without hiring some contract translation. I mean, we can do any language by simply hiring the translation.

And that extends the length of the course a little bit because I’ll say something, you’ll translate it, the classical feedback. Versus just the two-way street, it becomes a multi-directional conversation. So we can do that. But we have employees that do one, two, three, four different languages just natively. And we can contract translation anywhere else.

Si Biles: Brilliant. Brilliant. So what are those four languages? English, Spanish, French?

Keith Lockhart: Well, I don’t want to be biased and make anybody mad at me. “Well, why don’t you have this language?” So let me say this. Part of the job of running a training unit is building an effective contract training program around the world with our partners.

Without even contracting translation, we have many languages covered just because of the regionality of the partnerships, and that includes… So if you’re going to be a CTP, that would mean you would have to come to education from the mothership and then be certified in the tool. And so you do a train-the-trainer event with us, which is-

Si Biles: Perfect.

Keith Lockhart: … going to the course, but then spending a little extra time learning all the instructor nuances like, “Hey, Simon, here are the 100 questions that everybody asks all the time that you need to have background on. Here’s how we deal with this.” Look at software. There’s some bugs in it. Any software, we don’t want showstoppers, but here’s what’s going on right now. And just to prepare you to deliver solid education.

And if you’re certified, we stamp you as an OFCI, an Oxygen Forensics Certified Instructor. And then you can represent us and sell your own classes anywhere in the world like that. So we routinely tap that group. Hey, we need this type of thing or do it yourself in that language, and it fills in most of the gaps.

And it’s funny because when we talk about this on-demand system for 2024, we had a great partner conversation around that. And they’re like, “Well, okay, can you make it all in different languages?” I’m like, “Oh my gosh. Don’t know if I have that bandwidth.”

We may subtitle the English ones in different languages. Help us with that. But that’d be a massive undertaking to have just a Google Translate that live did it. Yeah, not right now. So the whole world is on the level playing field of English right now for that. But at an in-person class, as the need presents it, we go find the language that we have or the language that we need.

Si Biles: So you talked about certification for the OFCI. Yeah. Is there another level of certification below that? I mean, can I just be an OFC?

Keith Lockhart: Yes. Oxygen Forensics Certification is what it’s called. And that’s based around detective for the people that need it.

Si Biles: And in terms of training for that, is that something that I would be able to use the online resources for, sit an exam online, and then be certified? Or is it, I have to come to a classroom or I have to go to a training center?

Keith Lockhart: Here’s how I’ve done that in my time in training, so I’m curious to your opinion because people call… I’ve seen others, other vendors that have done it differently. And they charge for the certification and they enforce prerequisite training. I never have because I never want the excuse.

Because if you say to me, “Well, Keith, I have to go to court. And if I don’t have a certification, I’m no longer credible, but I can’t afford that fee.” Okay, that’s never going to be an excuse you’re going to have in my situation because that will never prohibit you.

And I don’t enforce prerequisite training, and here’s why. So here in the States, we have the DMV, the Department of Motor Vehicles. So when you think you’re ready to get your driving license, Simon, you come to me and I’ll test you. Get whatever car you want. I don’t care where you think you learn to drive. Come to me and I’ll test you to see if you can.

So I don’t care where you learn detective. If you think you know how to use it, come sit the certification and I’ll tell you if you do or not. We don’t want to encumber people with cost. Or if you know how to do it, that’s great. Now, people will come and try it and they’ll fail, then they’ll go back to class.

"I don't care where you learn detective. If you think you know how to use it, come sit the certification and I'll tell you if you do or not. " Share on X

Okay, great. What class do I take? Well, start you out in bootcamp. That’ll prepare… And look, I’ll just tell the world that listens to this that the certification is based on all the objectives in the modules of the bootcamp class. I’m not trying to trick anybody. The class is designed to show the things you need to learn.

And there’s a certification prep thing where… Go back and rehash these modules and the objectives. And if you look at one and go, “What’s that?” Go figure that out because you will possibly see that in the certification.

It’s designed to make people successful and not encumber them. I want people to have their credibility if they need it. Some places don’t care, but some places, it’s essential. Or for employment, if there’s Keith and Simon looking for the same job with the same technology and Simon’s certified and Keith’s not, who’s going to get the nod first? Right?

Si Biles: Yeah, yeah. I’d say that’s actually a remarkably novel approach in the industry, I think. I don’t I can think of another provider that would say that. Having had conversations recently with another provider about their newly certified thing, I can absolutely assure you that there’s at least one other provider that isn’t saying that.

That’s absolutely brilliant. I think we’ve covered off a hell of a lot actually in the last 45 minutes, which I think is brilliant. So I’m going to say. You said the online training is definitely a focus for 2024, but what else is Oxygen bringing to the table in the next 12 months that’s exciting that you want to talk about? And let us know.

Keith Lockhart: Boy, don’t get me started because we’ll be here another 45 minutes.

Si Biles: That’s fine. That’s fine. Let’s go.

Keith Lockhart: So we’ve matured our two new technologies. So what was just a forensic detective company when I got here is now a triumvirate technology of Detective, Oxygen Corporate Explorer, called OCE, and Oxygen Analytic Center, we call it OAC. And it’s a combination of collaborative review on a web platform for OAC, where I think this is becoming kind of a standard where there’s so much data, even in mobile.

"So what was just a forensic detective company when I got here is now a triumvirate technology of Detective, Oxygen Corporate Explorer, called OCE, and Oxygen Analytic Center, we call it OAC." Share on X

Obviously, we do cloud and we’re doing computer artifacts. It’s a ton of data. So to be able to take a first pass at it and cull it down to some more responsive stuff and then distribute it out amongst a group to, hey, Simon, you do this aspect of it. Keith, you do this aspect of it. Bob, you do that. Mary, you do this, whatever. And collaboratively work in real time, that’s super cool. So that’s the OAC product.

And then the OCE is one where we take a Detective-like interface but also have an agent system where we can collect from workstations and mobile devices, Androids and iOS devices, which is really cool. And it’s addressing the pain points like the old school…

Think of an enterprise technology 15 or 20 years ago, where an IT professional, instead of flying from San Francisco to New York to get a machine, find out what’s going on, let me just deploy agents all over my company network so I don’t have to go do that. Same kind of concept but includes mobile devices as well. And that’s really hot because of technology.

So that’s the two new things that are in front of Oxygen users anyway for 2024 that really are where they need to be. And from an LMS perspective and education, the training team has their work cut out for them, keeping up to speed with that. Because I don’t know if they’ll have the exact same release frequency schedule that Detective does, but it’s certainly new, awesome technology that we want to get in front of people when they get their hands on it.

Si Biles: No, that’s fantastic. Yeah, I’m going to say the corporate space is not where I primarily operate. But through Forensic Focus, it’s been fascinating to see the way that that’s been building out over time.

To a certain extent, it’s a bit funny for me because I started off as a Unix systems administrator, so I was dealing with Unix systems. And yeah, I could connect to any Unix system, find out everything I ever wanted to know about it. 25 years ago, this was not a problem. And all of a sudden, Windows has caught up that this might be a good idea. But there you go.

Keith Lockhart: Well, it’s funny, Simon, because there are people in my groups now that are, “Look, if you don’t give me a command line, I’m quitting. If I can’t work at a command line interface.” I’m like, “Okay. Okay.”

But a lot of the corporate space that becomes clientele for our vendor world, not just Oxygen, but anybody that’s in this industry side, a lot of it comes from the law enforcement world. They take an investigative mindset, they retire out of that, and the corporation’s like, “Oh yeah, come do that here for us.” So, different but same. Right?

Just like we would say, if I talk to a law enforcement environment, it’s a case, it’s a target or a suspect, and it’s a crime. If I’m talking to an E-discovery group, it’s a matter, it’s a custodian. Terminology changes maybe, but largely the same conversation. We’re trying to find things that make a case, but they just have to adapt like that.

Si Biles: The access is still the same, just different names for it all.

Keith Lockhart: Yeah, exactly. Exactly. A lot of that stays the same.

Si Biles: Yeah. Just rewrite the training slightly. The same as the Google Translate again, isn’t it?

Keith Lockhart: Yep. There you go. There you go.

Si Biles: Oh, fantastic. I don’t know when this podcast will ultimately come out, but I’d just like to say… It’ll probably come out next year and this will sound totally anachronistic. But thank you very much for joining us. We’d like to wish you a Merry Christmas and Happy New Year, which, when this comes out in mid-February, will be brilliant. And just thank you so much for coming along [inaudible 00:48:48].

Keith Lockhart: Here we will have had Valentine’s Day and… I think what else will be coming up by then? So we can future-proof ourselves by…

Si Biles: I hope you’re looking forward to Easter.

Keith Lockhart: Yes, there we go. Perfect.

Si Biles: So anyway, thank you very much for joining us. Listeners, you can find us everywhere that you can find podcasts; Spotify, Apple, whatever the podcasty thingy is, and all of that good stuff. Take care.

And if this does come out before Christmas, I wish you all a very happy Christmas and New Year. If it’s come out after Christmas, I hope you had a good one. Keith, pleasure talking to you. Thank you very much. I hope you’ll come back and join us again sometime in future when you have a chance and Oxygen’s doing something new and exciting. And again, yeah, thank you very much.

Keith Lockhart: Ditto to everyone and thank you also, Simon. I really appreciate your time.

Si Biles: Cheers.

Leave a Comment

Latest Videos

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:46 pm

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:14 pm

Digital Forensics News Round-Up, June 12 2024 #dfir #digitalforensics

Forensic Focus 12th June 2024 5:51 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles