What You Can (And Cannot!) Do As Digital Investigators - Dr. Catherine J. Ullman | CypherCon 7.0

### Overview In this CypherCon 7.0 presentation, Dr. Catherine J. Ullman breaks down the digital forensics process through a narrative murder investigation involving fictional characters Alice and Bob, alongside detectives and forensics analysts. Rather than focusing solely on specific tooling, the talk illustrates each stage of an investigation—scoping, data gathering, data analysis, data correlation, timeline analysis, and post-incident review—highlighting where assumptions, cognitive biases, and lack of context can derail an inquiry.

### Key Topics - **Traditional vs. Digital Forensics**: Traditional forensics often alters or destroys physical evidence (such as DNA processing or fire investigation), whereas digital forensics strictly prohibits altering data without rigorous documentation. - **The Digital Scoping Call**: Avoiding poor forensic questions (such as asking "why" or trying to prove someone's guilt outright). Establishing clear, objective, and testable questions. - **Data Collection and Handling Constraints**: Addressing encryption (e.g., BitLocker, VeraCrypt), permissions, storage constraints, and the divide between lab analysts and field collectors. - **Data Correlation and Context**: Integrating digital evidence with physical findings and external records to avoid premature conclusions. - **The Attribution Challenge**: The fundamental limitation of digital forensics—proving what occurred on a machine versus identifying the physical person typing at the keyboard. - **Post-Incident Analysis**: Applying the scientific method, conducting cross-team retrospectives, and ensuring complete documentation.

### Technical Details Through the fictional homicide investigation of Bob Bite, the speaker steps through practical investigative obstacles: - **Scoping**: Initial law enforcement requests tasked the team with "proving Alice killed Bob." Dr. Ullman points out that "who" and "why" are flawed starting points prone to confirmation bias. The objectives were revised to identify device activity, timeline correlation, and relevant communications. - **Gathering & Analysis**: bob's encrypted laptop required a live logical acquisition due to lack of passwords. Mobile extraction (referenced via Magnet GrayKey and Axiom) recovered threatening text messages between Alice and Bob, and a Lyft receipt suggested Alice traveled to Bob's address. Other forensic tools mentioned in common workflows include Autopsy, Eric Zimmerman's tools, EnCase, FTK, X-Ways, and Nuix. - **Timeline & Attribution**: All timestamps must be standardized in UTC. While Alice's fingerprints and threatening messages initially pointed to her as the killer, closer inspection of the timestamps revealed the Lyft trip took place an hour after Bob's estimated time of death. Furthermore, Bob's machine had active web searches after his death. Alice later admitted to using Bob's computer after finding him dead, proving that machine activity does not automatically prove who was behind the keyboard. - **Hidden Artifacts**: Analysts spotted an encrypted container via registry clues indicating VeraCrypt. Using the Python script `TC Detective` and `ShellBags Explorer`, they discovered a mounted encrypted folder called "secret stuff." Passwords recovered from a sticky note unlocked encrypted ledgers and photos of folded banknotes (used in illicit trade for identity verification via serial numbers). This uncovered communication with "Charlie Cyber." Ring camera footage and cell records ultimately proved Charlie entered and killed Bob.

### Takeaways - **Forensics Cannot Solely Prove Identity**: Digital artifacts show system activity at a given time; they cannot place a specific human behind the keyboard without corroborating physical evidence or witness context. - **Always Standardize to UTC**: Time zone discrepancies and unadjusted timestamps cause critical errors during event reconstruction. - **Context Overrides Assumptions**: Focusing narrowly on a prime suspect leads to tunnel vision. Investigators must consider alternative hypotheses, document negative findings, and conduct thorough post-incident reviews. If an action or finding is not documented, it did not happen.