MORE ABOUT ME & WHAT I DO

​

I'm a consulting Digital Forensic Analyst.

 

Yes, Sherlock Holmes and I have much in common, except I don’t really have to interact with clueless sheep in the world; just ones and zeros most of the time.

 

"Digital" means all things automated by computers that can be represented in binary form. Since digital systems are created and built by humans using digital tools, it means there are defects; as all humans make mistakes or are themselves mentally defective to some degree. These defects create the primary trails I follow. I don't care if you're the smartest computer scientist in Russia or the grandest Imam in Iran, mistakes can and will be made. To compensate for this in the digital world, standard error was devised as a stream for the presentation of error conditions. Now here's the best part. Since Supreme Humans, like the few I mentioned above, feel they can make no errors, they actually propagate the ultimate, global screw-up by insisting that other human units fix their sacred mistakes. These other humans, when confronted by the demand to fix something reported in an error stream, have no idea what led to the error. You see, computer systems are actually quite dumb; they are just slaves to human masters that tell them what to do next. The key point to remember here is that digital systems, like the Internet of all things, are made up of lots of individual computer devices, performing a grand transistorized symphony; passing and capturing ones and zeros at the speed of light.

​

"Forensics" This is where the fun begins.  Given the thesis that all digital systems leave traces of digital-events, I seek out these traces, connect them to other trails, and follow them. This is where the term Internet digital detective enters; to be correct, I should write that as a Digital-detective, but the hyphen just weakens the term. I'm not a "real" detective; they're licensed by political leaders in control of their geographic regions. A licensed detective, whether public in the police or private, must follow political protocol; a protocol enforced by more detectives and legitimized by judicial review. 

​

Oh my, to think of the horror that the US security agency captures and filters (a tech word for review) digital artifacts from the Internet of all things, including US domestic data! Are we so naive to believe Edward Snowden, the mainstream media, and the EFF? Snowden is hiding in Russia; a country we are led to believe that doesn't monitor such domestic traffic. Naive, or just plain stupid we must all be! Not being in the Great US of A, I'm one of the few who has actually spoken to a couple of the Russians, pestering Western businesses on Al Gore’s Digital superhighway. Each were identified and visited by "political-detectives" and told that their activity would be overlooked as long as they didn’t target domestic institutions without authorization or they, and all their associates, would "disappear", or worse.  Russians have an interesting weakness that I may explore further. I'll add one last thought about this: this sort of "condition" is very common in all parts of the world led by Supreme Humans; who are in fear of Trans-Global digital social media for the masses (think: The Great Firewall).

​

I'm stepping off my soapbox for the moment; but rest assured I might climb back on at any moment. Maybe I'm more like a digital-bounty hunter.

​

"Analyst" This should be obvious. I'm given streams of data that I study and report my findings back to the people that hire me.

​

Sometimes that study leads me to more streams of data and discovery of worse things than were initially believed. 

​

Let me be clear about something.

 

I lack respect for the geopolitical judicial systems in most regions of the world; they are but puppets to their political masters.  Oh, yes, they decide and rule on cases that may impact the current power or police, but these rulings are driven by the civil servants or aides of Supreme Humans. As such, I shall not testify in any Court based on the results of my work. I shall report on the results of my work with raw evidence and accepted methods used; so, my client shall be able to trust and act on the results.

​

Unfortunately, some results may actually be inconclusive or only suggest that an act took place. Be assured, I don’t make up facts or conclusions. Conclusive evidence is a preponderance of facts that support a finding. So, if there’s a link or pre-fetch file that says at a specific time, a specific user ran a program; then there is clear evidence that a user executed that program. Simple; well, maybe not so much.

​

In reality, most analysis efforts are inconclusive. This is a condition where the trail goes cold or my Client may have tampered with the evidence. Or, in some cases, the attacker activates security controls to keep other attackers at bay and avoid forensic probes.

​

I must say that I’m rarely so passive that I just walk away from a case as soon as there’s nothing obvious. I’m persistent, if nothing else, and I’m not afraid to do some aggressive snooping across the wire to find my bad guy. When one trail goes cold, there’s always another to pick up and run with. It’s only when you discover that all trails lead to a dead guy, that you may be stopped in doing more. Just depends on how the guy ended up dead.