Lessons from the Rittenhouse Trial

So welcome everyone to today's learning objectives, which is how digital forensics can make or break your case, things that we learned from the Rittenhouse trial. Our speaker today is Michael Kanup, and he's a digital forensics and cybersecurity analysis at TCDI. He deals with preservation, identification, extraction, documentation, interpretation of data using digital forensics tools. He also Spent 5 years as a detective at the Winston-Salem Police Department doing digital forensics investigations. So he has a wealth of knowledge on this particular topic. And again, if you just put your questions in the chat, we will identify you and read your question to Michael. And then we'll also have some time at the end for questions. So, Michael, if you want to go ahead and get started.

Hello, everyone. My name is Michael Knupp, and I'll be speaking to you today about how digital forensics can make or break your case. I am a former detective who specialized in digital forensic evidence, so from time to time in today's webinar, it's likely that I'm going to pull examples and analogies from my past to help me communicate this complex subject. All right, as with any good training, we need to state some objectives. First, I want to establish some foundational information that we can build off of. Using that information, we'll discuss what must be done for forensically sound collections, and then we can look to a recent public trial where digital evidence was utilized and see what observations we can make. And lastly, I'll discuss mobile collections and the challenges of exporting that data that you're looking for. All right. From this point on, you may feel like you're drinking from a fire hose. Don't worry about that. This webinar is being recorded. You can play it back as often as you need to. And with that, let's get started. All right. And ladies and gentlemen, I confess that I, I did not write this descriptive definition, but let's take a look at it. What, what is digital forensics? Well, digital forensics is a scientific, systematic inspection of electronic devices and the data stored within, utilizing specialized tools and techniques for recovery, authentication, and analysis of electronic data. It's customarily used when a case involves issues relating to reconstruction of electronic data usage, examination of residual data, authentication of data by technical analysis, or explanation of technical features and data device usage. Okay, but I'm going to simplify this just a little bit. Digital forensics is a forensic science. It incorporates the identification, collection, analysis, and reporting of digital data. And that's a simplified version. The only difference from other forensic evidences that you're likely familiar with is that it's digital. Now I want you to imagine that you're actually the lead detective on a homicide scene. You've had only 2 hours of sleep before getting called out to this residence where the deceased was found. You're tired, you're cranky, you got zero leads, but you have a whole house to look through. In terms of digital evidence, you know, what are you gonna look for? I'm sure many of you thought initially about smartphones, laptops, desktops, GPS devices, all the sort of stuff you can see in this image here, and probably mostly stuff that you've seen on TV dramas that so accurately depict the instant collection of computer devices and electronic stored information inside. Hope you caught my sarcasm on that one. But let's change the type of investigation in our theoretical scenario. And don't worry, you're still the lead detective, but instead of leading the homicide unit, you're now leading the fraud unit. $1 million is missing from a major business, and the main suspect is the top sales guy, who of course is out of town. Now, where would you go to potentially find your— where would you go to find your potential digital evidence? You know, in this scenario, it could be servers, it could be backups stored on tape somewhere, or even, as you see here, thumb drives, memory cards. I mean, it could be all sorts of places, right? So when you take a look at this list of the sources of this electronic stored information, if you will, just think in your mind, is there anything else here that you see here that you originally did not think about? And I see somebody's got the CSI effect in the chat. That's exactly right. Unfortunately, it is not anywhere close to being as quick as they can depict on those TV shows. But the reality is that every investigation has potential digital evidence that has to be identified, collected, and analyzed. Now, on this slide, you'll see some examples listed here that are some common investigations that you might have been part of. Some that we see pretty often here, the corporate type, or the general litigation where somebody's just trying to grab all the data that's involved in that litigation and just get it stored into a centralized place like an eDiscovery platform. But, you know, that's just the top. I mean, we can dig a lot deeper. So let's take a look at a standard forensics workflow. The starting point here that we want to highlight is that you're going to have to have a call with your, your person who can handle this type of work. And in that first initial call, you're going to scope it out. We're going to be asking lots of questions and trying to get all of our planning done on the front end. Now then you're going to kind of hand over the reins to somebody like us, and we would image and do the data collection there. And of course, we wanna do that correctly. We don't wanna miss any steps. We don't wanna do anything that would cause that evidence to not be admissible. We're gonna do things like maintaining chain of custody. And then after we have that data, we're going to do some processing on it, analyze it, see if we can't find some findings, you know, make our exports, provide them to the client, and then you're gonna work back and forth again. There's a give and take. I can't possibly know out of a million-plus files on a computer what is exactly important to every client at every situation, but that communication goes back and forth, and eventually we come up with a report that has the big gotchas, the things that we need to talk about and record. And then, of course, if the litigation continues to go through you know, we can always do expert witness testimony on the findings that we have provided. All right, now you may have noticed that I've been using and repeating several terms, mainly identification and collection. They're definitely critical when we're discussing digital forensics and done correctly. Analysts, forensic analysts, will be focused on not altering the digital evidence so that you can build your case on the findings.. And if you look here in this chart, we're trying to decide where does this really fit in. And you'll notice on the chart that there's bidirectional arrows and stuff like that. It's because a lot of times we can be in a flow of information and realize, oh, there may be another place where digital evidence exists. We need to go back. We've identified it. We're gonna collect it, preserve it. Those can almost be Those are very similar terms. Preservation is making sure that we don't change and alter anything and the collection is actually getting it right. And then there's a process of deciding, you know, what are we going to do with it? We're going to process it so that somebody else can look at it and then eventually review it and then produce it and then hopefully, you know, make it to form a presentation. To finish up our first objective, let's go over some important items that you need to know. Okay? We're going to go over each one of these. Metadata is data about data. It provides information including but not limited to when the file was created, accessed, and/or modified. And I'm going to add to this and just say, you know, don't forget that metadata can be found in multiple locations, including within the file itself. When we talk about hashes, a hash is a digital fingerprint that uniquely identifies any stream of data. It's used to verify images and exact file duplicates. When we talk about images, we're talking about forensic images, and if we're talking about files, we can refer to hashes on files too. And, you know, if a hash can be used to verify the authenticity of a file, it can also be shown to use to show that it's been changed. And then think about artifacts. Artifacts are just simply parsed digital evidence. That includes files, information from items such as registry keys, timestamps, and event logs. Now, some of those may not sound familiar to you. That's okay. That's my job to know what those particular items are and how they're useful to you. Okay, so let's focus on now on our second objective, forensically sound collections. This is where I can talk forever, but we'll try to keep it short. To begin with, I wanna simplify digital forensic collections by discussing 3 general methods forensic analysts refer to. So we have remote collections, which is the forensic analyst will perform the collection through like a screen sharing session. And then we have onsite collection, that's where we actually go out and, you know, arrive at a particular, you know, law office or wherever we can all meet together, and we would bring— have the custodian bring the devices, or maybe the business is where the information is, and we would preserve the data there. And then we have lab collection, which is our favorite. It's because it gives us access to all my resources here and in the lab, and those will give us the most options for getting the overall best view of the data that we can. Of course, now, just remember it's not always possible for us to, you know, do stuff in the lab, but that happens when custodians are reluctant to be without their personal devices like cell phones or in cases where a business, you know, can't afford to shut down the production servers because that would be a financial loss. You know, there's other methods that were developed for collecting the data in a forensically sound manner, but they all come with, you know, their pluses and minuses, and knowing those is what trips up a lot of people. Okay, so let's discuss what forensically sound means. In order to be considered forensically sound, the evidence must be repeatable, reproducible, and defensible. For forensic practitioners, this is becoming harder as technologies evolve, so other factors must also come into play, such as maintaining chain of custody documentation and verifying hash values. And remember, the goal is to preserve the data without altering it. So, of course, that brings up the next question: how do you preserve and collect data without altering it? And can it be done in the same way across different devices? And again, I want you to imagine that you're a detective at a homicide crime scene. Do you collect fingerprints the same way that you'd collect a discarded firearm or maybe blood evidence? Of course not. I mean, each has its own issues that requires different methods and skills to assemble that evidence and in a way that is useful. So digital evidence can be collected and authenticated using hashes. This is still an important process for us, as we've already discussed. The hash values are like fingerprints, you know, they're unique to the file, and it authenticates that the data is preserved. So forensic images or containers include data integrity features such as hashes or CRCs so that anybody can verify the authentic— authenticity of the data within. And these forensic images allow examiners to process the collected data without changing it or altering it. So I hope you guys are starting to see that, man, there's a little bit more to it than just copying and pasting. Now the next example here, a slide, is gonna be the information from an actual forensic log. Now, this is not what the log looks like, but it's the information from it. And as you can see, we see like an E01 file path, and that's the forensic file. We call it a forensic container. And as you can see, the acquisition hashes match the verify hash, so we know that in this case we have a forensically sound collection. Okay? So now that we've got a fundamental understanding of digital forensics and sound forensic collections, We're ready for the third objective: Lessons from the Rittenhouse trial. And this trial showcased a lot of digital evidence, mostly in the form of digital video. From a forensic examiner's perspective, digital video is difficult to work with. Simply put, digital video is a series of images and sequences often combined with audio recordings, and unlike film, Digital video includes compression, which is a technique that's used to shrink the volume of zeros and ones of the file down so they can actually fit on the internal storage. It's always been a problem with digital media and storage of it, especially high-quality storage takes up lots of space. So the best that you could hope for, you know, is a raw file when it comes to video, and that you know, you're hoping that the, the image frames that are contained, they don't have any compression in that video file. So most of digital video that I've worked with has come from video surveillance systems or smartphones, and each one's heavily compressed for sure. In the case of most surveillance systems, exporting video from the system compresses the data yet again and changes the file type or both. So if you can imagine, every time we're touching that data and moving that data, we're potentially manipulating it and taking stuff out of it that wasn't there, adding stuff that was never there to begin with. All right, needless to say, but you know, this area of digital forensics is a whole separate specialty, and yet we look at the video and take it for face value. You know, if we can see it, it must be there. And maybe it's a fair and accurate representation of what actually happened, or perhaps it's not. And only a forensic examination of that digital video can provide that answer. I've examined video where half the video presented by the video player doesn't actually exist. I remember the first time I learned about this in training, and I was absolutely just shocked at how much I was taking for face value versus what was actually there. And, you know, but so I don't go down too many stories here, I'm sure that somebody else is thinking, you know, so what, Mike? You know, this is all too technical and what do we care? Well, let's just take a look at the basics. And this slide's got a few of them here. We got an issue with data presented well outside the standard process. In this case, there was video. That was introduced later on after discovery, which is kind of an interesting thing in and of itself, but it was still allowed in. And there wasn't any kind of questions about where did this file come from? What's its authenticity? You know, was it hashed beforehand? And, you know, these are problems that are very basic, but yet need to be addressed, you know. So the question is, you know, what's another issue? It's unknown if the video was forensically preserved or just exported and saved. And I just discussed how, how difficult digital video can be, and nobody brought up anything like that at the beginning. And then no forensic container to verify that the video was actually, you know, a copy of the original. And these are just the basic things that anybody could, you know, throw a flag and scream and yell about and make a really good argument about, because that data, you just don't know anything about it and where it came from. So a few more issues that we saw in this case, and some of them that we're going to identify, is no chain of custody. So who had access to the data? Was the data previously looked at? Was anything altered when they did that? What steps were taken to work with the video file? There were steps taken later on to expand and zoom in to the video, and those things have consequences. They're not free of changes. You know, there are— using just your typical tools that the prosecution was mentioning, like, you know, pinch and zoom, there's a good prob— good probability that it's not a perfect, uh, expansion of the video so that you can look at it further. There's going to be data that was added to it. That'd be a problem. And then there's metadata changes. That would be, you know, changes to any kind of the information about the data. And then, of course, once things are altered and enlarged, you know, the video is not gonna be the way it was originally. That's the one thing is digital evidence is very much like regular physical evidence at a crime scene. Once you touch it, you can't go back to the way it was beforehand. So, and as we noticed, you know, some of this information, the defense went ahead and said, you know, we should do a mistrial. I think if we look at some other issues, you know, there's issues where forensic people are using tools, and they're using tools to do things that would maybe help the investigation. And if you don't explain that correctly to the next group, you know, your client, then there's gonna be chances that you're gonna get side— you're gonna get just totally run over with a question that discusses that sort of thing. And we saw that on display too, right? The person that was responsible for enlarging the video knew that enlarging the video would alter it, but they did not know how that actually worked on the backend. And so they couldn't explain what changes were made and how that was done. They couldn't show where that information had been altered. And in the case where you're trying to use that evidence to make an argument, it's a problem, right? Because you've added something there, you can't describe where it's been added, it's not the original. But as we saw in that case, it still went through. So you just never know how that's going to play out in the courtroom. So we've covered the pinch and zoom, and then I think the big takeaway here that I want to try to discuss is just that the overall lack of understanding from the prosecution, the defense, and the judge. We can't all be experts in all these different fields. You can't know everything for sure, But there's some really basics that should have been covered that I was really surprised to see how things went. And, you know, I mean, they absolutely could have ended up throwing out the evidence to begin with. Okay, so I, I've talked about what is digital forensics. We've talked about what forensically sound looks like and why that's important. And now we're going to, you know, we discussed a place where that did not happen and forensically sound was definitely missing in a particular trial. But I'm sure you guys are wondering how in the world does that affect other things. So I know we've been talking about digital video footage, but what about mobile collections and how does all this fit into that? So like digital video, mobile collections and analysis is really its own specialty with its own set of challenges. And almost everyone here in the good old US of A has one, and most people have multiple mobile devices. So mobile devices and collections are a common place to find digital evidence and as such are increasingly collected in litigation. So therefore, it's important to know the basics. Mobile devices, specifically cell phones, are definitely a common place for all sorts of data. It's not just text messages and call logs. There's GPS data, there's all sorts of, you know, potentially you can find information about how long that device has been on, when it was powered on, how long certain screens have been on. Location information, just a whole plethora of stuff, and we're still finding things as technology moves along. So this is going to bring up some common pitfalls, right? You know, I'm sure you guys are wondering what some of those are with mobile collections, and there's a lot, and they're especially important to understand as I know a lot of people trying to go to self-collection and maybe use some tools that are being released. And while it sounds like it's convenient, without the proper training and the tools, you know, you could change metadata and potentially overwrite important evidence, and it's as easy as clicking on a button. So there's a few things with all these digital devices, but with mobile is definitely that, you know, the data is volatile. It's, it's a It's a trait of the storage media that is put onto. Your device is always interconnected, so it's always networked. It wants to be networked. It wants to communicate constantly, whether it's with your cell phone provider towers, with Wi-Fi networks, Bluetooth to other phones. And this is not even talking about all the privacy problems going along with Apple and Google as they they pull data from everybody's devices. Um, we have issues where your data is changing dynamically. There's two ways that this is happening. It could be, let's say you're storing text messages and stuff are being stored in a database. You know, we don't have any control over when that database cleans itself up. They call it vacuuming and whatnot. It happens We don't know when it happens, but it happens often. So if you delete stuff, you just never know. It may be there, it may not. And then the storage medium— I talked about that for just a second earlier. It is literally part of how that piece of hardware works. It's constantly moving data around where it is stored inside that memory chip, and that is just so that you can use that device for years and years and years. Otherwise, you'd have whole sections of the membership that would stop to function correctly. And then, of course, you know, here's another pitfall that kind of brought you guys to us and us having this conversation, specialized knowledge. Where are you going to learn all this stuff? I'm fortunate. I got to take a lot of government-funded training. I also got to take a lot of vendor training. It's relentless. Every day I'm learning something new, and every day I realized there's something that I never knew about that could have helped a previous case beforehand. So just think about all those different things that could happen as you're thinking about this type of digital evidence and how it relates to your case. And so this is where you start. We're gonna identify the devices and what evidence you believe is on them to collect. We've listed common artifacts to look for, but there's just so much more that you can analyze. And the details here actually help the forensic examiner determine what options are available to collections. So this is a good foundational starting point for moving on with your investigation and bringing in that digital evidence for mobile devices into your case, okay? So you want to do things like, we want to know what the make and model and the operating system are of the device. We want to identify what are the key date range times. Is there any kind of filtering we need to do for maybe key terms? Are you worried about contacts? Are you curious about GPS information? Do you know any of that stuff exists? The big thing here is that you want to be clear with your forensics team and let them know what you're hoping to find off that device so that they can know what they need to be looking for. That information on the front end helps us so much to determine what the proper set of steps to go, uh, to take are going to be. So this brings us to the different, uh, options here. And after identifying the device and the type of digital evidence you're looking for, The forensic examiner will utilize one or multiple methods listed here. Each has its pros and cons, but you need to be aware that the make and the model of the device, it can limit our options for sure.

From—

we'll do this in order from what I would love to have. I'd love to have every single collection of a mobile device be a physical. It's a bit-for-bit copy. I get everything on the device, even stuff that may be deleted and may be stored elsewhere on that actual memory chip. But unfortunately, nowadays security's gotten much better on these devices, and that's not really an option probably more than half the time. So we have to default to, you know, trying to get a file system. And a file system is important because it's not just getting the logical data that we could just ask the phone for to provide to us and the stuff that the user already has access to. We're looking for not only that data that the user has access to, but where is it stored. If I could get that database out of the device, there's a much greater likelihood that I'm going to have a better understanding of the context around those stored in that database that isn't often required to run, you know, your text app so that you can see the text message. And then the one I don't like to talk about is when all these methods fail and we have a device that is just not one that's going to connect to a computer for some reason. Maybe it's physically damaged, or, um, but you can still use a screen, or maybe it's a flip phone. And a lot of times we do have the tools to work with most of that stuff, but every once in a while we have to go to the good old taking pictures of it. Sometimes that's really the only way to get the data out. Especially with encrypted apps and that sort of thing. So let's look at an example. Let's say you identify a phone, an iPhone and Android phone, that both have text or chat messaging that needs to be preserved. Let's pretend both are relatively new devices and encryption is utilized. Collection here, uh, an iPhone backup will likely include the messages Unless the messages are set to store in the cloud, there are some settings that people can do to kind of mess up a standard backup. And depending on the Android make and model, where the message is stored, it could be different, and the tools that you use and the methods that you use to grab that data are gonna be different. So it'd be good to determine if either phone has made any backups previous to the collection because sometimes it's the best source that we have of where to collect. And so we're kind of moving our way to, to the big question that everybody loves to ask me. And the common question that we hear is regarding deleted data, you know, can you get these text messages that my client deleted 3 years ago on my iPhone, and then they smashed it and threw it in the toilet? You know, the truth is, is that it just depends. And I've had times where I've been able to successfully get deleted data off of devices, and there's times when there hasn't been a chance. And so here are the things that we're going to have to consider on this. The make and model of device, you know, some of the older devices we can get away with some methods that took advantage of the lack of security, and so we may be able to actually get a physical of the device and then be able to search through all the unallocated space, the deleted space, and try to carve out whatever information we can from that memory source. The device operating system plays a huge part in this. Android used to be great, for getting physicals until they started changing the security settings. And next thing you know, you have to root the phone or potentially jailbreak it if you're talking about iPhone just to get more information from the phone that you as the owner probably ought to be allowed to get anyway. And then the application where the data was deleted. If it's a text message, it's stored somewhere different than it is with, say, WhatsApp or Signal or, you know, some of these encrypted messaging apps. Those encrypted messaging apps store data usually in a protected area on the phone, and that protected area, even the user can't just ask for access to it. It's only accessible through a certain pathway. So a lot of times we'll ask, where else can we find this, you know, this data? And luckily there's backups. You know, people do back up their phones to their computers. People do back up stuff to the cloud from time to time, and the big thing is just asking the right questions to be able to determine whether those things are available to you. So to kind of wrap up here, you know, what, what lessons have we learned from the Rittenhouse trial and other examples where digital evidence just wasn't on display very well? And The big thing is you just have to have a basic understanding of digital evidence. It's here, it's been here, it's been here a long time. I know people are reluctant, especially judges, to, you know, really dive deep into it and have an understanding, but it's what we have to work with, and it's definitely something that we're all gonna have to deal with. Make sure you have a chain of custody. This is basics, right? It's no different than some other piece of evidence that may have been picked up and relevant to your investigation. And regardless of the media, you know, whether it's a video or text message extraction, you remember the metadata is easy to overwrite without the proper knowledge and training. I'll jump down a rabbit hole just a little bit here. I will say that I know of an example where a detective shows up to a questionable homicide scene and looks at a computer that's online, the screen's up, and they see that there's an interesting document on the desktop and they just could not help but open it up. Well, as soon as they did that, they stomped on the metadata of that file. You know, you could not possibly know some bits of the data that were changed, And it's a good example of— I know the intentions were right, but they did all the wrong things. And then once it's done, it's done. It's not something that we can go back and fix. So I hope this kind of gives you guys— I hope this gives you guys another idea about it's really super important to engage somebody who knows what they're doing. You want to make sure that you find somebody who's got experience. You wanna find somebody who's knowledgeable, who's maintaining, you know, continuing education on these subjects. It doesn't hurt to ask, and anybody who does this work for a living loves to be asked these questions because it shows that, you know, there's a concern there for the data. And at the end of the day, forensic examiners and analysts, you know, we're taught over and over. It's pounded into us, you know, don't change the data, don't alter the data. And, you know, there may be some times that the data is not accessible in that way, and we may have to do a logical collection of sorts where we're doing a type of copy and paste. But a copy and paste is, is just rife with problems unless you do it a very certain way. And with hashing and with checks and balances for authenticity and all that sort of thing. So I've rambled on for long enough here at this point. I guess, does anybody have any questions?

Mueller? So I have dumb questions. I know that if I upload pictures from my phone and I add some additional columns in Microsoft's Windows Explorer, I can see other information. But you're telling me if I do that, it's likely that I've already kind of wrecked the metadata because it'll tell me what, what camera it was taken on and the date it was created. And it even shows modifications. But that's not a good idea, huh?

Well, this is one of those, it depends. When you're moving images from one device to another device, so we're going from a mobile device to a computer, and the computer has a completely different way of storing data than the mobile device does. I mean, they're similar in some ways, but they're different file systems at the underneath the hood. And so the XF data, which is kind of the data that you're talking about, the metadata that's embedded in the file, that data will be okay. But you can expect that the data that landed on the computer to have different information. So like the created date should be changed because they Actually, I saw something the other day. I'm gonna try to start using it. The born-on date of that file on that system is when you— when it shows up and arrives there. It's because that file system is keeping track of a new file versus the file that's on your phone that has its own set of information. So I hope that's not too confusing.

No, I actually had just written an article about how to remove metadata for attorneys But of course, that is the exact opposite of what we want to talk about in a litigation and forensics perspective. But lawyers who are sending files to other people want to, if, you know, in permissible settings, remove the metadata. And the other day, I didn't think that— I thought Microsoft had fixed this, but the other day I created a file that, The file name, it just is something to be aware of, the file name and the document name were different in the metadata because either you pull up an old file and it keeps the file name from the actual first line in the document, and that is identified as the document name, and then where you actually store it and the name that you store it under is different. So metadata is a whole topic in and of itself. Like I said, what I'm trying to do is help attorneys remove it before they get in trouble for what's attached to it, but not in a— and then when you get into any discovery, it's the exact opposite. You need to know that you need to request native files and all that kind of stuff otherwise, and then it has to have that chain of custody and preservation. That you were talking about. So it's all, it's pretty complicated. Does anyone have any questions for Michael?

I'll just make a quick comment, Catherine. I'm aware of a case in which the metadata, the documents that was recovered, may very well lead to sanctions, if not potentially disbarment of an attorney involved in the case. It's a pretty extreme case, but This is a whole area which I think the bar is woefully ignorant about, and I appreciate Michael's presentation today. Thank you, Michael.

Michael, I muted you because you were— you had some feedback.

There you go. Sorry about that. Yeah, so I appreciate that information. The one thing I will say to piggyback on what you were saying earlier is that if you on the front end get your forensic collection done, what you do after is completely fine because you have an original, you know, copy that can be authenticated as being, you know, a perfect copy of what you were working with or looking at. And now you can do all sorts of stuff with it. If you want to remove metadata, remove metadata. If you want to put it into a review platform, that's absolutely fine. If we want to put it into forensics tools and process on it and work on it and really look at all the little bits and parts of the files, that's okay too. It's safe to do it in that way. If you do it outside of that order, then that's when you run into problems.

Right. Well, We appreciate your time today, Michael, and thanks to the TCDI team for getting us hooked up with him today. I'm going to stop the recording. If anybody has additional questions that they don't want to be immortalized on, I'll leave this open for a little while, and we'll send you the recording this afternoon or tomorrow. Thanks so much.