Links and Updates
Reviews
Eric Huber posted an excellent review of the DFwOST book that Cory wrote, and I assisted on the writing (full disclosure; I'm a minor co-author of the book). Eric has even added DFwOST to his "Learn Digital Forensics" list on Amazon, along with WFA 2/e, WRF, and others. Eric's list is intended to help others figure out which books to get if they're...well...interested in learning digital forensics.
Here's another review from Little Mac (aka, Frank) who apparently went about the review process the old fashioned way...by purchasing the book first.
Jesse Kornblum, the man behind tools such as md5deep and ssdeep (and truly a man with the gift of beard), has kindly posted his review of DFwOST, as well. It's short and sweet, although no less appreciated. As I was reading the review, however, I got to the third paragraph, which started, "There was something I felt was missing from the book." I read this with great interest, as I've written a number of books myself, and I'm working on one know...so anything I could take away from what Jesse said to improve my book, I'm anxious to read. Jesse went on to mention getting free support or work from someone you've never met...that is, the person or people maintaining the open source (and very often free) tool that you're using.
Procedures
Speaking of Jesse, one of the great things he's produced (perhaps beyond his papers and tools) is his "Four Rules for Investigators" blog post. If you've never seen it, check it out. Then think about this list in relation to what you do. Yes, I know that there's many of us out there who say, "I do all of them...every time!" I've heard folks say this...and then a month later the same folks have said, "I was working on an exam and 'lost' the image"...apparently, having forgotten #4.
#3 is a big one, because most of us simply don't do it. Examiners will often say, "I don't know what standard to write to..." as a reason for NOT taking notes. But the fact is...you do. What is the purpose for taking the notes? It's so that you can come back a year later, after having done a couple of dozen other investigations, and clearly see what you did. But...it's also so that if you get hit by a bus leaving work one day, another examiner can pick up your notes and see exactly what you did. In short, if you didn't document it, it didn't happen.
Thoughts on Conferences
I recently attended (and spoke at) OSDFC, and while I was there, I had a chance to meet and speak with a lot of great folks from the community. While doing so...and while talking to folks after the conference...there seemed to be a common theme with regards to the talks and presentations at conferences, in general. OSDFC is interesting because there are talks by developers and academics, as well as by practitioners; in some cases, the developer who is speaking is him- or herself a practitioner, as well. The common theme seemed to be that there's a desire for more meaty presentations; that is, provide someone with a 30 minute time frame where they discuss the problem or obstacle that they encountered, and their thought process/reasoning for selecting the solution at which they ultimately arrived.
Don't get me wrong...I thoroughly enjoyed OSDFC, and I greatly appreciate the effort that the organizers and presenters put into making the conference a success. Brian asked at the end of the conference what the attendees thought could be improved for next year, and ended up saying that he'd just flip a coin. I'm going to go out on a limb and say that there needs to be two tracks...one predominantly focused toward developers and academics, and the other toward practitioners. This doesn't mean that someone can't present in either track, or attend either track...but I met a number of LE examiners whose eyes glassed over when an academic talked about running a tool on 4, 16, then 64 cores; sure, that's cool and all, but how does that help me put bad guys in jail?
So, again...I'm not saying that there need to be conferences that focus on one side of the equation the exclusion of others. In fact, it's quite the opposite...I think that all aspects of the community are important. However, listening to folks after the presentations, there was usually one reference, with respect to a how, that most wished the presenter had discussed in a bit more detail.
This is an approach that I'd like to take with the NoVA Forensics Meetup. At our next meeting on 6 July, Tom Harper will be giving a presentation, and I'm sure that it will be a great success. Going forward, I'd like to have shorter talks, perhaps two each meeting, running about 20-30 min each. To do this, I'd like to ask the folks attending (and even some of those not attending) to offer up ideas for what they'd like to hear about...and for some folks to step up and give presentations.
Tools
Along the lines of the above thoughts on presentations, one of the things about free and open source tools that are available is that they're out there...and that's the problem, they're out there. Now, I'm NOT saying that we need to be inundating each other links to sites for tools...what I am saying is that we should take advantage of the sites that we do have available for linking to the tools, as well as providing use cases and success (or failure) stories regarding these tools.
For example, with the ForensicsWiki site already available, we also have ForensicArtifacts.com site. One of the benefits of conferences such as OSDFC is that, if you can attend, you can find out about tools that perhaps you didn't know about, and see how someone has used them to achieve a goal or overcome an obstacle in their investigation.
So...there are some great tools out there and available, but we need more folks within the community to pass along their impressions and encounters with the tools. It's great that we have folks within the community who blog, but very often, what's posted is missed because most of us either don't know about their blog, or simply don't have time to keep up with our RSS feeds. There needs to be a way to make this information available without having to wait for, or attend a conference.
CyberSpeak
Ovie's back with a new CyberSpeak podcast, which includes an interview with the Kyrus Tech guys regarding their Carbon Black product. If you've never heard of Carbon Black, you should really take a listen to the interview and hear how the tool is described. I've looked at Cb, but any description I could provide wouldn't do justice to the interview. Great job to Ovie for yet another great podcast, and the Kyrus Tech guys for the interview and the information about Cb.
Eric Huber posted an excellent review of the DFwOST book that Cory wrote, and I assisted on the writing (full disclosure; I'm a minor co-author of the book). Eric has even added DFwOST to his "Learn Digital Forensics" list on Amazon, along with WFA 2/e, WRF, and others. Eric's list is intended to help others figure out which books to get if they're...well...interested in learning digital forensics.
Here's another review from Little Mac (aka, Frank) who apparently went about the review process the old fashioned way...by purchasing the book first.
Jesse Kornblum, the man behind tools such as md5deep and ssdeep (and truly a man with the gift of beard), has kindly posted his review of DFwOST, as well. It's short and sweet, although no less appreciated. As I was reading the review, however, I got to the third paragraph, which started, "There was something I felt was missing from the book." I read this with great interest, as I've written a number of books myself, and I'm working on one know...so anything I could take away from what Jesse said to improve my book, I'm anxious to read. Jesse went on to mention getting free support or work from someone you've never met...that is, the person or people maintaining the open source (and very often free) tool that you're using.
Procedures
Speaking of Jesse, one of the great things he's produced (perhaps beyond his papers and tools) is his "Four Rules for Investigators" blog post. If you've never seen it, check it out. Then think about this list in relation to what you do. Yes, I know that there's many of us out there who say, "I do all of them...every time!" I've heard folks say this...and then a month later the same folks have said, "I was working on an exam and 'lost' the image"...apparently, having forgotten #4.
#3 is a big one, because most of us simply don't do it. Examiners will often say, "I don't know what standard to write to..." as a reason for NOT taking notes. But the fact is...you do. What is the purpose for taking the notes? It's so that you can come back a year later, after having done a couple of dozen other investigations, and clearly see what you did. But...it's also so that if you get hit by a bus leaving work one day, another examiner can pick up your notes and see exactly what you did. In short, if you didn't document it, it didn't happen.
Thoughts on Conferences
I recently attended (and spoke at) OSDFC, and while I was there, I had a chance to meet and speak with a lot of great folks from the community. While doing so...and while talking to folks after the conference...there seemed to be a common theme with regards to the talks and presentations at conferences, in general. OSDFC is interesting because there are talks by developers and academics, as well as by practitioners; in some cases, the developer who is speaking is him- or herself a practitioner, as well. The common theme seemed to be that there's a desire for more meaty presentations; that is, provide someone with a 30 minute time frame where they discuss the problem or obstacle that they encountered, and their thought process/reasoning for selecting the solution at which they ultimately arrived.
Don't get me wrong...I thoroughly enjoyed OSDFC, and I greatly appreciate the effort that the organizers and presenters put into making the conference a success. Brian asked at the end of the conference what the attendees thought could be improved for next year, and ended up saying that he'd just flip a coin. I'm going to go out on a limb and say that there needs to be two tracks...one predominantly focused toward developers and academics, and the other toward practitioners. This doesn't mean that someone can't present in either track, or attend either track...but I met a number of LE examiners whose eyes glassed over when an academic talked about running a tool on 4, 16, then 64 cores; sure, that's cool and all, but how does that help me put bad guys in jail?
So, again...I'm not saying that there need to be conferences that focus on one side of the equation the exclusion of others. In fact, it's quite the opposite...I think that all aspects of the community are important. However, listening to folks after the presentations, there was usually one reference, with respect to a how, that most wished the presenter had discussed in a bit more detail.
This is an approach that I'd like to take with the NoVA Forensics Meetup. At our next meeting on 6 July, Tom Harper will be giving a presentation, and I'm sure that it will be a great success. Going forward, I'd like to have shorter talks, perhaps two each meeting, running about 20-30 min each. To do this, I'd like to ask the folks attending (and even some of those not attending) to offer up ideas for what they'd like to hear about...and for some folks to step up and give presentations.
Tools
Along the lines of the above thoughts on presentations, one of the things about free and open source tools that are available is that they're out there...and that's the problem, they're out there. Now, I'm NOT saying that we need to be inundating each other links to sites for tools...what I am saying is that we should take advantage of the sites that we do have available for linking to the tools, as well as providing use cases and success (or failure) stories regarding these tools.
For example, with the ForensicsWiki site already available, we also have ForensicArtifacts.com site. One of the benefits of conferences such as OSDFC is that, if you can attend, you can find out about tools that perhaps you didn't know about, and see how someone has used them to achieve a goal or overcome an obstacle in their investigation.
So...there are some great tools out there and available, but we need more folks within the community to pass along their impressions and encounters with the tools. It's great that we have folks within the community who blog, but very often, what's posted is missed because most of us either don't know about their blog, or simply don't have time to keep up with our RSS feeds. There needs to be a way to make this information available without having to wait for, or attend a conference.
CyberSpeak
Ovie's back with a new CyberSpeak podcast, which includes an interview with the Kyrus Tech guys regarding their Carbon Black product. If you've never heard of Carbon Black, you should really take a listen to the interview and hear how the tool is described. I've looked at Cb, but any description I could provide wouldn't do justice to the interview. Great job to Ovie for yet another great podcast, and the Kyrus Tech guys for the interview and the information about Cb.