Arsenal Consulting’s President Selected to Open the OverDrive Hacking Conference

Mark Spencer

February 13, 2018

Attendees Will Learn About Electronic Evidence Tampering that Evaded Detection by Digital Forensics Experts


Mark Spencer, President of Arsenal Consulting ( has been selected to open the OverDrive hacking conference in Spain with the most recent version of his award-winning presentation “High Stakes Evidence Tampering and the Failure of Digital Forensics” on April 18. The OverDrive conference is focused on enhancing the camaraderie of the worldwide hacker community by connecting people involved in many different aspects of computer security.

What is Arsenal’s Mark Spencer saying about OverDrive?

“I am honored that the OverDrive team asked me to open the conference. OverDrive was born from the efforts of students and professors at the technical school of Girona who are truly passionate about computer security. I’m looking forward to sharing our passion for digital forensics with the OverDrive attendees and connecting with Spanish law enforcement currently using our digital forensics tools.”

Why attend this presentation?

Discussions about electronic evidence tampering are often academic, which can leave participants skeptical about the practicality of various tools and techniques. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case — from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Mark Spencer will demonstrate Arsenal’s “Anchors in Relative Time” analysis technique which ultimately revealed that the computers in question were attacked both locally and remotely, including the use of a RAT (Remote Access Trojan) never seen before in the wild.

What are the journalists saying about Arsenal’s work?

“Arsenal’s pursuit in the technical side of our case, and your effort to show the discrepancies in the evidence, was at the heart of what shed light on how unjustly we were charged. Your investigation was vital in demonstrating to the legal community the significance of verifying the authenticity of any and all technical pieces of evidence in any legal process.” Müyesser Yıldız — Investigative Journalist, Odatv

About Mark Spencer

Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon (, where he guides development of digital forensics tools which include Registry Recon. Mark has more than 15 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of foreign terrorist organizations and military coup planning. Mark has testified in cases which include US v. Mehanna and US v. Tsarnaev (the Boston Marathon bombing). Arsenal is headquartered on the Chelsea waterfront, very close to Boston Logan International Airport.



Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at here. Thank you!

Related Articles

Arsenal Image Mounter and Virtual Machine Inception

Arsenal Image Mounter and Virtual Machine Inception

While we recommend that Hyper-V and AIM be run on “bare metal” (particularly when launching virtual machines), we have recently heard from our customers that they have successfully run both Hyper-V and AIM within VMware.

Arsenal Image Mounter (AIM) Walkthrough

Arsenal Image Mounter (AIM) Walkthrough

This article will briefly summarize the features of AIM’s Free and Professional Modes, explain the requirements for running AIM, and demonstrate how to launch virtual machines and mount Volume Shadow Copies (VSCs) from AIM-mounted disk images.

Arm Yourself!

Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.

Chelsea, Massachusetts


or (617) 277-3625

Site Map



















Privacy Policy


Terms & Conditions


Cookie Policy

Follow Us




Share This