Defcon 18 and Black Hat

Anyone else getting excited (although it is really early) for Defcon 18 and Black Hat in Las Vegas?  I am!  I'm also working on a presentation with Sam Petreski on a new approach to forensic methodology, which I feel is really interesting.  I haven't presented at Defcon or Shmoocon in a couple of years, although I have good stuff that I am working on.  FOLLOW-THRU!

It gets away from the classic framework methodologies like:
Classic DOJ PEIA
Classic B Carrier
Fantastic whitepaper comparing methodologies
(Unfortunatley all PDF's so be careful with your patches)

But instead focuses on the analysis phases of the forensic specialist, from the initial information gathering to preparing to develop the report - i.e. when the "man" sits in front of the forensic PC loaded with tools and the images to examine.

Here is the abstract which helps develop the methodology.

A new approach to Forensic Methodology and !!BUSTED!! case studies.

Imagine the following experiment, a unique case is given to three digital forensic analysts and each is given the opportunity to engage the requester in order to develop the information needed to process the case.  Based on the information gathered, each of the three analysts is asked to provide an estimate to complete the investigation and can proceed with up to 20 hours to process the case.  The analysts are then measured based on the total findings, the time required to process the case, the initial information gathered, and the estimated time to process the case.  The expected result is to be varied based on experience and individual characteristics, such as organization, discipline, and the attention to detail of each analyst.  Imagine this same experiment but with only 8 hours to process the case, because that is the way it happens in real life.

David Smith and Samuel Petreski have developed a methodology that fits within the Analysis phase in one of the standard Digital Forensic Analysis Methodologies - PEIA (Preparation, Extraction, Identification, and Analysis), to provide a structure for consistent results, better development of the requested goals, increase efficiency in fulfilling the goals, and develop an improved estimate of the time required to complete the request.

This methodology involves the generation and validation of case goals, the evaluation of methods used to achieve the goals, a structure for estimating the effectiveness, time required, processing results of specific methods, and generalized organization and time management.  The primary goal of this methodology is to address the structure and optimal path that would allow a digital forensic examiner to perform an examination with a high level of efficiency and consistent results.

This presentation provides an introduction to this methodology and applies its key concepts to real sanitized digital investigations, such as tracking down a suspected executive's adult craigslist ad, performing an analysis on a compromised system involving social security numbers, and making the determination of intellectual property theft.

Interested in more?  Here are some books Amazon recommends - don't worry, I won't put a book out that I haven't read and think is worth it.

Don't ever get called into a deposition or court without reading this book!  It is the bomb-bay and after understanding the concepts, it will be you go-to-book when you have a follow-up.










Uh, yea.  Another must read.  I have it on my kindle now for quick(er) reference as well.  I seem to absorb more each time I read it and really like the 2nd edition.