You're listening to the digital Forensics Files podcast with your host Tyler hatch from DFI forensics. Hello everyone and welcome to the digital Forensics Files podcast. I'm your host Tyler hatch from DFI forensics. This is the very first episode of the podcast. So I want to talk about what it's going to be about what my vision for the podcast is and what you can expect from future episodes. DFI forensics is a digital forensics and incident response firm based out of Vancouver British, Columbia, Canada. We have some satellite offices across the country and we service clients across North America, so I'm in Italy we're going to be talking about digital forensics and cyber crime and cyber attacks and how we want to plan and respond to them and try to avoid them. But also we want to have on some guests who might use our services. So I intend to have on some lawyers who use forensics in their litigation practices and some businesses who use technology to increase their business and their brand and just really talk to some really interesting people because there's so many interesting people out there. They're doing so many amazing things. I want to talk to them on this program and I'm going to always bring the conversation back into my world at some point but really the focus will be on the guest when I have them. I also intend to have some informational sessions where I will just be discussing some relevant topics about technology and digital forensics and all of those kind of things. So at times you're going to be hearing me. On for 10 or 15 minutes. All right. So what I notice about this field when I talk to people and they ask me what I do and I tell them I have a digital forensics company. They are really drawn into the conversation immediately that I think it's super cool but almost immediately. They always ask me what exactly that means nobody seems to know precisely. So I thought it would be a great idea to start this session by defining digital forensics because even for me when I listen to other people talk and I Google it for a simple definition. It seems to be quite evasive people put on these really convoluted definitions onto the field. I personally don't like the term digital forensics. I don't think it does a very good job of explaining what we do. But basically we are investigators. We want to tell a story when an event occurred and we do that by acquiring evidence and examining it from sources that are digital in nature. So we Look at things like computers and cell phones and tablets and servers and you know file system logs and operating system logs the internet and Cloud accounts and all of these things are enormously helpful in helping us to determine facts to a very high degree of probability. So when we report to our clients who want to know something they tend to be very satisfied with our findings as long as there's evidence on the device or the source that were examining because in this field we tend to look at things and determine things to a very high degree of probability as I mentioned things tend to be very black and white. There's not a lot of interpretation in this field like you might find in say other fields like maybe a doctor commenting on a soft tissue injury might have some higher degrees of variance in opinion when they're looking at the same patient. So what we have is very strict Protocols and very high-grade law enforcement based tools to do our work. And the reason for that is because this whole field developed from law enforcement the law enforcement agencies around the world started to see that a lot of crime and criminal activity was occurring through the use of computers. So originally the field was called the computer forensics and some people continue to refer to the field as computer forensics, but that's obviously a limited definition now that there's other sources of digital evidence out there like cell phones and the internet and tablets and all of these kind of things. So really the field is now is now called digital forensics. Most people when they're looking on Google according to the analytics from Google search for the term it forensics, but basically as long as you have forensics in there, you're going to connect with somebody in our field to help get you what you need to know the people who use our services. Those tend to be lawyers and exclusively litigation lawyers because they're going to court and they're proving facts before the court or the tribunal or whatever preceding their find themselves in and specifically much of our work takes place in the category of employment law and workplace disputes. So when an employee has or is being disciplined or dismissed many companies rely on digital evidence. Stu to ground their decision in so an employee who has communicated in a way that may offend workplace policy or result in a finding of just cause for dismissal maybe that action maybe that communication can be proved by looking at a source of digital evidence like a cell phone. Maybe they texted somebody inappropriately. Maybe they took a contract opportunity from their employer and did it on the side and maybe They communicated with the client for that purpose on their cell phone. And so the evidence is there. So a lot of these things happen and in addition to that you have a lot of harassment claims and bullying claims and sexual harassment claims specifically many of those Communications take place on sources of evidence that would would be described as sort of communication apps and text messages. So communication apps means things like not necessarily through a service provider that's providing cell phone signal. So these would require you to be connected to some source of data, but not exclusively by your cellular service provider. So a lot of these apps work when they're connected just to the Wi-Fi network in the place of employment or public places all of these kind of things and in the home, so these would be things like WhatsApp and Facebook Messenger signal Telegram All these things come up from time to time we chat is a very big communication app. It's probably the biggest one in the world and the most certainly the most widely used communication app in the world. And so these things tend to come up now. We also work with family law lawyers in their dispute. So when in our experience what we've observed is that when couples experience a breakdown of their relationship They tend to communicate through text message and communication apps. They stopped following each other by and large. I suspect the reason for that is because it avoids some awkwardness in having a conversation with somebody who you're no longer with who may be seeing somebody new. You may have some feelings of resentment or you know, some hurt feelings when you're talking to them. So sometimes it's just easier for these people to Kate through text message on the flip side to that when you are reading words as opposed to hearing them the potential exists to a greater extent to misinterpret what is being said and what we find is that people occasionally misinterpret what's being said or react to words more harshly than they might in a face-to-face conversation or even a telephone conversation and the the conversation gets escalated very quickly. He did things are said and sometimes those heated things can be construed as threats or inappropriate words that become relevant to put before the court when the lawyers are determining or were battling over which partner should be ruled the primary caregiver of the child. For example, so many of these forms of evidence gets tendered as evidence in the course of a family law proceeding There's also a lot of spying and harassment that takes place following the breakdown of relationship and in my experience. It's exclusively males spying on females. Through their devices so you can you know install spyware in certain cases. Generally the spouse is no the others password while they were together to their phone things like that. So if you have physical access to the phone, you can install something like that pretty easily and fairly quickly and they are remarkably invasive and they communicate not only location, but basically everything you're saying every phone call every text message your browsing history. They're keylogger. So everything you type into the device gets recorded and transmitted to a third party and they're just commercially available. You can buy them and install them very easily and you pay like a monthly fee. I've installed them on my own phone just because we work so many of these cases that I wanted to be very very familiar with how they work and and what to look for and how we find them when a client comes to us with this kind of a suspicion so that we can help them better. So we've actually we work a lot of these cases and We become very very good at finding them when they're there. Now in a lot of cases, they aren't there and that for some people that provide some comfort and for some people they continue to feel that they're experiencing symptoms of being spied on even though there's no evidence of any kind of malicious program or software on their device. So it becomes a bit of a challenge to prove something isn't there. Logically, trying to prove a negative is always difficult. So so that is something that we have to contend with and we try to address that upfront with people in terms of managing their expectations what everybody's clear that there is a possibility that we won't find something if it's not there and that we may have a conversation about you know, whether what they experience as a breach of privacy or an invasion of privacy is maybe there's maybe another explanation for that so that comes up a lot in family law people can also hide assets digitally when You know trying to hide assets that you have may be offshore or globally the chances are you've got some sort of record or evidence of that asset or property on some sort of a computer device. They just tend to be really well hidden. So sometimes a spreadsheet can indicate some Property Holdings can be disguised as an image file. So it takes somebody with a lot of skill and care to investigate that and determine what's going on and find the evidence. Now another area that we're starting to see a lot of cases in is the area of estate litigation and that involves disputes legal disputes that are going to court following the death of somebody who's left on a state behind for some beneficiaries and sometimes those beneficiaries don't act very nicely following the death of their family members. So, you know what we might see for example is Maybe a grandson who during the life of his grandmother borrowed a sum of money and maybe they executed some sort of promissory note or a contract and that contract is being held on the device the contract being held on the device. But now that his relative is deceased. This person may want to disguise the fact or hide the fact that he owes that money so he may access Grandma's laptop or her computer and delete that That file and hopefully get a you know in his mind. He might get away with paying back the money that tends to be things like that that we tend to see may be deleting, you know, some sort of instructions to gift certain property or funds to a type of or a beneficiary and maybe one of the other beneficiaries wants everything so they will kind of mess with some of the digital evidence and try to hide things and that's where we come in because the Of cases particularly with Computing devices less so on cell phones and tablets we can recover a lot of deleted information and we can through the examination of operating system logs determine who accessed the computer and when and what files were accessed and maybe things that were deleted we can recover those files. So it tends to be really quite interesting and valuable work to our clients. And then one of the other areas where we generally work is I would say broadly speaking. I would Define it as commercial litigation. So lawyers who are representing businesses who are in some sort of dispute following a transaction or a business deal that has gone bad and now they're in court fighting about their rights and who has to do what now that this unanticipated event has occurred and somebody is out a sum of money or something like that. So what we see a lot of is an Nation of metadata. So there tends to be electronic documents that one party might say, you know, I drafted this agreement on this particular date or I provided a notice letter on this date. And here's the here's the document to prove it and that's fine. We've looked at things like that for many many years, but now we can look at the digital copy of these documents and we can look at things like creation dates and revisions and these are the embedded information about the digital file that we call metadata metadata is data about data. So it tells us the history of the file itself. Now there's a lot of variables with metadata. So you have to be really careful and know what you're doing and you have to have a really good source of the evidence for those kind of Investigations, but they tend to be enormously helpful to a lot of people in the commercial litigation context the other area of our business that we have developed is Area of incident response to cyber attacks. So if anybody is remotely operating with a pulse and drawing breath from day to day you're probably well aware that cybercrime is a very large-scale Global problem that is affecting businesses government organizations individuals. Basically anybody who uses technology in any way can be a victim of cyber crime. The people who are behind the highest level of the cybercrime game are without question organized crime individuals and organizations, and they have really executed a massively scalable business model to make just incredibly large sums of money from these attacks and scams and criminal Acts. They're making a lot of money and because of the use of Technology allows them to attack people in other countries or other parts of the world where we find jurisdictional issues. They tend to not be caught in a lot of cases in almost all cases actually and given the nature of the internet and the use of the internet people are permitted to be anonymous so you have at best Can track these people down to an IP address on Internet Protocol address and it's a string of numbers that may indicate the somebody is in a certain location. It doesn't tend to be very specific and they're very easy to disguise through the use of VPN or virtual private Network, which allows you to run your connection through a virtual private Network. In other words a server in some other part of the world and maybe the signal bounces through other. Firs every so often every 15 seconds every 30 seconds. So you track somebody down to to Switzerland or Israel or China or North Korea and its really meaningless because we don't know if that person is actually there they could run that signal through a VPN and very easily hidden their tracks. So the focus doesn't tend to be on who is doing it Focus tends to be on how it occurred and how Stop it from happening. Again that tends to be the focus for much of our clients and many of our clients want to know if they are now legally obligated following an attack to report the incident to their clients and the only way to determine that is if they know the factual basis upon which their lawyer can inform them of their legal obligations, so they are required if they want to get a solid legal opinion. Ian's to do some sort of investigation and determine some facts and that's what we do so we come in and hopefully we've been brought in at the time of the attack or shortly thereafter when we're working with a really cold body. So to speak it becomes enormously challenging and you know, we want to work with fresh evidence and the most detailed records that we can to tell the story accurately as accurately as possible. For example a client that The ransomware attack due to a compromise of their it Network. You know, they may want to know if their clients data was accessed because if they have in Canada, you have a duty now to report that to your clients and that was a change in the law that we observed almost a year ago now in late 2018 and that has caused a lot of businesses to pay a lot more attention to cybercrime and their security practices. And their actions following a security incident. Nobody wants to send a notice to their client informing them that their confidential information and data has been accessed by an unknown party. That's bad for business. So nobody wants to do that and when we're talking about accountants and law firms and engineering firms anybody who keeps Financial records on their clients or credit card information, you don't want to receive that kind of Is when you're a customer or a client and the business doesn't want to have to send those things because it means a drop in Revenue most likely because a lot of clients will choose to do business with somebody else who they feel has more adequately secured their data. So that's why a lot of people need to respond to these incidents. And then also just figuring out what happens, you know, maybe somebody clicked on a link or downloaded a file that they shouldn't have and maybe that person Nin within the organization needs to be educated on better security practices. So there's a lot of value and figure out exactly what went wrong and planning for the future to not let it happen again. So that's a basic overview of our field and an introduction to the podcast. My name is Tyler hatch. I'm a former litigation lawyer who's now found his way into this field. I personally love being involved in this field because we get to work with the evidence when we get to tell the story and get the get the Crew for the legal community. So I love being involved in lawsuits, but not from the perspective of a practicing lawyer. That's something that I don't do anymore and I'm quite happy not to do it anymore. But I actually really really love the law one of my great passions in life and so is technology so blending the two is a real privilege and pleasure for me and that's why I founded this company DFI forensics about a year ago. And yeah, it's just a really great. Great pleasure to be here and be doing this kind of work for the clients that we have and the future ones that were going to work with. It's just a really exciting prospect. So I hope everyone who's listening now has a better idea of what we do and I invite you to come back to future episodes and TuneIn maybe follow us leave some comments. This podcast is hosted on anchor FM and anchor dot f m has a feature that allows Stu receive voice messages from listeners. So if there's a follow-up question about something you've heard in the show or you're interested in certain topics for future episodes by all means, please send us a voice message. I would be really cool to interact with everybody and anyone who might be listening around the world. So I encourage everybody to do that tune back in will will line up some great guests and some interesting topics and will continue You to explore this digital world, and hopefully it'll be nice and interactive with everybody. Who's about thanks for joining me until next time. Have a great day.
When I tell people that I have my own digital forensics firm, they generally say, "Cool!! ", then immediately ask, "What does that mean?" People don't tend to know what exactly digital forensics is until they have a need for our services. In the case of lawyers, many of them are thankful they have someone to use after they've experienced a properly and professionally conducted digital forensics investigation. With that being said, let's jump into what digital forensics is and set the stage for the topics and format of The Digital Forensics Files Podcast! Digital forensics is an investigative process in which digital forensics examiners collect evidence from electronic devices and digital sources and examine the evidence to determine a fact or set of facts, often in the context of computer crime or unlawful activity, for which the findings are reported to clients and/or presented in Court. Sources of evidence often include computers, cell phones, tablets, servers, email accounts, mobile device app data (Facebook etc. ), cloud accounts/storage and the internet. Digital forensics examiners use digital evidence to answer  "who", "what", "where", "when", "how" and "why" during an investigation and report the findings to a client. Sometimes, the findings and evidence needs to be presented in Court during a criminal or civil trial. My name is Tyler Hatch and I am hosting this podcast. I am a former litigation lawyer, who practiced in Vancouver, British Columbia, Canada, prior to becoming a certified mobile and computer forensics examiner. In July, 2018, I founded my own digital forensics and incident response firm, DFI Forensics Inc.  We serve clients across Canada and in the U.S. and have offices in Vancouver, Langley, Calgary and Toronto. I hope you enjoy the podcast and provide lots of feedback to make it better! 