Forensics Investigators Looking Into Shooters Digital Life For Clues @McAfeeConsumer

Well, back to our top story now, the Connecticut school massacre. And as we await the first funerals for those two young children killed in the rampage, investigators are poring over computer evidence to try to figure out how the murderer, Adam Lanza, planned his killing spree. Joining us now, Robert Siciliano. He's a McAfee online security expert. And Robert, you've done some of these forensic investigations before. Where do you start?

Well, first, uh, just need to please acknowledge the families and the victims. Uh, my deepest sympathies. So our digital lives are a window into our minds, and by discovering, um, a person's digital life, you essentially can map out their life's past and future intentions. And the point of a digital discovery essentially is to find out what happened and essentially how to prevent this in the future as well.

So where, where do you start with the material that you might have in a typical case?

Easily, very simply, as you would with your own device, from the desktop in, you scour the hard drive looking through all different document folders, looking at all the different files and folders, the names of them, the different documents within, and then going through web histories Web history can determine what websites they visited. Also by looking at any forensics in regards to chat logs, any communications that there might be with others.

How far back can you go, Robert, when you talk about some of those histories that you can look through? For someone that's 20 years old, for example, we understand that there is some evidence at the mother's house, but authorities have been very tight-lipped about it. How far back would, would would any device, a typical device in a family's home, provide you? How many years? Are we talking months, weeks? What kind of timeline?

Great question. Think of your own digital devices. For example, within my own home and office, I have devices as old as 10 to 12 years old, and all of those hold history of web traffic and email communications. And so you can go back as long as the device is old., and if there has been any transfer of data from an even older device, then all that history remains. Interesting. So, uh, and then if the person was proficient at clearing their history, then there's less information that can be found. But again, depending on the operating system, uh, and different partitions that might be set up, uh, a lot of data can be discovered with the right technology.

Now, the authorities again have been very tight-lipped about the evidence that they have. We have some initial reports And again, we don't know if these reports are real or not, that the murderer might have destroyed some of the computer. Pointed— the initial reports that a hard drive. Again, we don't know if this is true. If that's the case, though, if that's the scenario you're dealing with, does that limit you in any way?

Well, it certainly does. And the ability of the offender to essentially destroy that device versus the ability of, say, a forensics expert to discover it. May vary. The— a good forensics expert with the right technology can get deleted or even destroyed data depending on, you know, again, you know, it's a cat-and-mouse game. So more than likely, you know, based on what they're already finding and what they will find, they'll be able to determine whether or not this individual had conspired with others, and they will more than likely find what his trigger point might have been in order to basically devised this plan and why.

At the news conference on Saturday, the officials seemed hopeful about the evidence that they found at the mother's house. We'll wait to see what exactly that produces and what answers maybe, maybe it provides in a case like this. Robert Siciliano, great to see you. Thank you for your expertise today.

Thank you.