All actions undertaken during the manipulation are fully audited allowing for repeatability, as per the ACPO guidelines for computer based evidence.

Click to download (PDF)

Nexidia Vice President, Jeff Schlueter flew in from the United States to present on the phonetic search technology which took the industry by storm.

Jeff demonstrated impressive capabilities of the audio searching product, showing examples of searching transcripts for key words and phrases. Attendees were highly impressed with the speed of searching thousands of hours of transcripts and the sheer user-friendliness of the software. Jeff was quizzed on the capabilities of the software with regards to recognising regional language differences, and he discussed how language packs are available for many different dialects.

Jeff and Gregory Houston (kCura) were able to show the audience the widely talked about integration between Nexidia and the popular eDiscovery review tool Relativity.

7Safe’s Senior Consultant Stuart Clarke discussed data storage of applications on the iPhone before moving on to demonstrate the security issues and forensic artefacts relating to cloud storage, with a focus on Dropbox.

Some were left stunned as Stuart explained how the acquisition of a single database file from one user’s Dropbox could allow another individual to gain full access to the content of the Dropbox not belonging to them, including deleted files, even allowing access to the Dropbox web portal without knowing the username and password credentials.

If you would like to find out more about the services discussed above, or hear about future eDiscovery events, please contact: events@7safe.com

The illegal acquisition of multimedia by downloading streaming multimedia is one of the most common new developments in piracy but is yet to be responded to by the forensic community. YouTube Downloader (YTD) is currently the most prevalent software choice for illegally downloading multimedia content, assisting and supporting illegal downloading and multimedia piracy.

YouDetect uses statistical classification data mining principles as part of the evidential marker process. Developed from Undergraduate research at the University of Northumbria, YouDetect will be an effective additional resource in allowing 7Safe to provide a unique and revolutionary service to our clients.

Click here to download the Whitepaper

Stuart revealed how currently a third of all eDiscovery matters require forensic collection of desktops, laptops and other electronic devices, and that this is growing all the time due to more proportional costs alongside heightened awareness of preserving electronic data. Additionally, Stuart demonstrated how in taking forensic images from computers and tablets and mobile devices, a lot of data is overlooked by typically focusing on only email and document data. A primary example of this is Skype, yet it is hugely popular operating a host of platforms from Windows operating systems to the iPhone and with 650 million registered users to date. The audience learnt how Skype logs by default, and this includes details of file transfers and instant messaging. However, Skype isn’t currently unused in eDiscovery, primarily due to the non-friendly way in which data is stored.

Interestingly, a solution to this issue was revealed to render the data in a format familiar to everyone being email. Stuart went on to demonstrate how the data extracted from email allows it to be pushed into virtually any review platform or processing engine. The same theory as demonstrated with Skype can be applied to other popular chat applications such as Facebook and Yahoo.

Stuart also covered the use of audio forensic analysis using Nexidia, plus so called “private browsing” in a widely used web browser that generates more data in private browsing that most users would be comfortable with. Some examples of the data found as a result of private browsing sessions included clear text usernames and passwords from many well-known web based email providers.

Furthermore, Stuart stressed the value of backups associated with devices including iPhones and iPads. During the presentation a vast array of different data sources were shown including details of app usage, GPS location data and huge amounts of data stored by 3rd party apps. This included social networking apps like Linkedin and Facebook, where details of contact lists and messages were revealed, as well as applications associated with online storage, password keepers and planning proved again to be a goldmine of data, to the surprise of many. With traditional eDisclosure / eDiscovery focusing on conventional email and Office suite files, the clear point was made that supplementary relevant and often crucial information exists on every hard drive.

The file itself is not readable to the normal user and typically a normal user will not be aware of its existence. From this file we are able to identify the eBay user ID and a host of other information, which can become voluminous when investigating a heavy eBay users, including but not limited to:

• Item Title – title of the item listed on eBay
•  Image URL – the URL to the thumbnail of the master item image
• Item ID – the unique eBay ID of the item
• Start & End Time – The start of the eBay listing and when it is   scheduled to end. This data is stored as a   Windows file time
• Bid Count – number of bids on an item
• Buyer/Seller ID – the user ID of the person who purchased or   sold the item

There is approximately 20 fields of information in the file, and therefore to many to go into in any detail. In summary, it is possible to identify buyer and seller information, the item information which includes the item ID, listing dates and the eBay title it is even possible to extract details of the currency in use. 

The eBay toolbar in its raw format is not a huge help to investigators, therefore I have developed a script which will run across an eBay toolbar file and extract various information, including a summary of the data found and details of each entry listed in the file e.g. a selling report, a bidding report or an unsold items report.

This eBay toolbar file is not an artefact you will come across regularly, but it is always worth checking for in investigations involving eBay as some of the artefacts may prove vital in your analysis.

Senior Consultant & Forensic Manager/Team Leader, Stuart Clarke will be engaging visitors with hand-on demonstrations of document hosting technology including Relativity and Nuix on the iPad. Visitors will also have the opportunity to find out all about 7Safe’s wide range of Forensic and eDiscovery services.

With a choice from over 110 session led by the world’s foremost experts in Computer Forensics, E-Discovery, Cybersecurity and Enterprise Investigations, 7Safe are looking forward demonstrating as well as previewing the latest technology and services from other leading providers.

To find out more visit http://www.ceicconference.com/about.htm or for those of you attending, email stuart.clark@7safe.com or tweet at stuartclarke07

ebay Toolbar in Forensic Investigations

The eBay toolbar is a very fruitful forensic resource, in particular when dealing with fraud investigation. Discover some of what we have found

Scanning for Primary Account Numbers (PANs) with 7Seec

7Seec PCI scan is a forensic software tool that 7Safe has developed over the past two years for use in investigations to search for unencrypted . It finds credit card data in both allocated (live) and unallocated (deleted) disk space at tremendous speed

iPhone Bypass Revealed

A recent bug in the Apple iPhone version 4.1 operating system has been revealed, allowing a locked iPhone to be bypassed.

Watch the video  to find out all about this latest iPhone exploit.

7Safe would like to congratulate Paul on his impressive achievement along with fellow delegates of this week’s course. Overall the CFIP Course saw all delegates gain their certifications with merits or distinctions. A positive end of the week for all!