February 13, 2018
Attendees Will Learn About Electronic Evidence Tampering that Evaded Detection by Digital Forensics Experts
Mark Spencer, President of Arsenal Consulting (ArsenalExperts.com) has been selected to open the OverDrive hacking conference in Spain with the most recent version of his award-winning presentation “High Stakes Evidence Tampering and the Failure of Digital Forensics” on April 18. The OverDrive conference is focused on enhancing the camaraderie of the worldwide hacker community by connecting people involved in many different aspects of computer security.
What is Arsenal’s Mark Spencer saying about OverDrive?
“I am honored that the OverDrive team asked me to open the conference. OverDrive was born from the efforts of students and professors at the technical school of Girona who are truly passionate about computer security. I’m looking forward to sharing our passion for digital forensics with the OverDrive attendees and connecting with Spanish law enforcement currently using our digital forensics tools.”
Why attend this presentation?
Discussions about electronic evidence tampering are often academic, which can leave participants skeptical about the practicality of various tools and techniques. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case — from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Mark Spencer will demonstrate Arsenal’s “Anchors in Relative Time” analysis technique which ultimately revealed that the computers in question were attacked both locally and remotely, including the use of a RAT (Remote Access Trojan) never seen before in the wild.
What are the journalists saying about Arsenal’s work?
“Arsenal’s pursuit in the technical side of our case, and your effort to show the discrepancies in the evidence, was at the heart of what shed light on how unjustly we were charged. Your investigation was vital in demonstrating to the legal community the significance of verifying the authenticity of any and all technical pieces of evidence in any legal process.” Müyesser Yıldız — Investigative Journalist, Odatv
About Mark Spencer
Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon (ArsenalRecon.com), where he guides development of digital forensics tools which include Registry Recon. Mark has more than 15 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of foreign terrorist organizations and military coup planning. Mark has testified in cases which include US v. Mehanna and US v. Tsarnaev (the Boston Marathon bombing). Arsenal is headquartered on the Chelsea waterfront, very close to Boston Logan International Airport.
Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at here. Thank you!
We have an exciting 2021 in store for Arsenal customers. To kick things off, we are extending our educational program (basically, free licenses!) to cover law enforcement and military training.
While we recommend that Hyper-V and AIM be run on “bare metal” (particularly when launching virtual machines), we have recently heard from our customers that they have successfully run both Hyper-V and AIM within VMware.
This article will briefly summarize the features of AIM’s Free and Professional Modes, explain the requirements for running AIM, and demonstrate how to launch virtual machines and mount Volume Shadow Copies (VSCs) from AIM-mounted disk images.
Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.
or (617) 277-3625
Terms & Conditions