February 13, 2018
Attendees Will Learn About Electronic Evidence Tampering that Evaded Detection by Digital Forensics Experts
Mark Spencer, President of Arsenal Consulting (ArsenalExperts.com) has been selected to open the OverDrive hacking conference in Spain with the most recent version of his award-winning presentation “High Stakes Evidence Tampering and the Failure of Digital Forensics” on April 18. The OverDrive conference is focused on enhancing the camaraderie of the worldwide hacker community by connecting people involved in many different aspects of computer security.
What is Arsenal’s Mark Spencer saying about OverDrive?
“I am honored that the OverDrive team asked me to open the conference. OverDrive was born from the efforts of students and professors at the technical school of Girona who are truly passionate about computer security. I’m looking forward to sharing our passion for digital forensics with the OverDrive attendees and connecting with Spanish law enforcement currently using our digital forensics tools.”
Why attend this presentation?
Discussions about electronic evidence tampering are often academic, which can leave participants skeptical about the practicality of various tools and techniques. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case — from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Mark Spencer will demonstrate Arsenal’s “Anchors in Relative Time” analysis technique which ultimately revealed that the computers in question were attacked both locally and remotely, including the use of a RAT (Remote Access Trojan) never seen before in the wild.
What are the journalists saying about Arsenal’s work?
“Arsenal’s pursuit in the technical side of our case, and your effort to show the discrepancies in the evidence, was at the heart of what shed light on how unjustly we were charged. Your investigation was vital in demonstrating to the legal community the significance of verifying the authenticity of any and all technical pieces of evidence in any legal process.” Müyesser Yıldız — Investigative Journalist, Odatv
About Mark Spencer
Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon (ArsenalRecon.com), where he guides development of digital forensics tools which include Registry Recon. Mark has more than 15 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of foreign terrorist organizations and military coup planning. Mark has testified in cases which include US v. Mehanna and US v. Tsarnaev (the Boston Marathon bombing). Arsenal is headquartered on the Chelsea waterfront, very close to Boston Logan International Airport.
Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at here. Thank you!
You may find (like Allan did) that immediately after launching disk images from Windows servers and workstations on the same network into virtual machines, they start talking to each other normally… or, much less often in our experience, you may find that they do not.
At Arsenal we know that questions can not only be dumb (we are reformed offenders), but given our experience in litigation, misleading and even weaponized to harm… without answers ever being involved. Lawyers know this, and if you are a digital forensics practitioner, you should too.
We have been working aggressively for the last month on an extension to our Windows authentication bypass that some of our colleagues in digital forensics will find quite shocking. While we continue this work, we have decided to launch another version of AIM with some new features requested by our customers.
Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.
or (617) 277-3625
Terms & Conditions