February 13, 2018
Attendees Will Learn About Electronic Evidence Tampering that Evaded Detection by Digital Forensics Experts
Mark Spencer, President of Arsenal Consulting (ArsenalExperts.com) has been selected to open the OverDrive hacking conference in Spain with the most recent version of his award-winning presentation “High Stakes Evidence Tampering and the Failure of Digital Forensics” on April 18. The OverDrive conference is focused on enhancing the camaraderie of the worldwide hacker community by connecting people involved in many different aspects of computer security.
What is Arsenal’s Mark Spencer saying about OverDrive?
“I am honored that the OverDrive team asked me to open the conference. OverDrive was born from the efforts of students and professors at the technical school of Girona who are truly passionate about computer security. I’m looking forward to sharing our passion for digital forensics with the OverDrive attendees and connecting with Spanish law enforcement currently using our digital forensics tools.”
Why attend this presentation?
Discussions about electronic evidence tampering are often academic, which can leave participants skeptical about the practicality of various tools and techniques. Attendees of this presentation will be introduced to the tools and techniques used quite successfully by attackers in a high-profile case — from delivering documents that resulted in the imprisonment of journalists to evading detection by digital forensics experts. Mark Spencer will demonstrate Arsenal’s “Anchors in Relative Time” analysis technique which ultimately revealed that the computers in question were attacked both locally and remotely, including the use of a RAT (Remote Access Trojan) never seen before in the wild.
What are the journalists saying about Arsenal’s work?
“Arsenal’s pursuit in the technical side of our case, and your effort to show the discrepancies in the evidence, was at the heart of what shed light on how unjustly we were charged. Your investigation was vital in demonstrating to the legal community the significance of verifying the authenticity of any and all technical pieces of evidence in any legal process.” Müyesser Yıldız — Investigative Journalist, Odatv
About Mark Spencer
Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon (ArsenalRecon.com), where he guides development of digital forensics tools which include Registry Recon. Mark has more than 15 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of foreign terrorist organizations and military coup planning. Mark has testified in cases which include US v. Mehanna and US v. Tsarnaev (the Boston Marathon bombing). Arsenal is headquartered on the Chelsea waterfront, very close to Boston Logan International Airport.
Please support us, as we work to make maximum exploitation of electronic evidence more accessible, by learning more about the powerful and unique functionality our tools provide. You can learn more about our tools at here. Thank you!
Digital forensics practitioners may not be aware of the nuances of what happens when introducing various BitLocker activities into the mix of hibernation and in-file TRIM.
Once you think through the implications of what can be done not only with multiple document versions extracted from FSD files as ODC Recon has always done, but what can be done with the granular revision information that can be found within FSD files and temporary collaboration data, you should be having a “lean back in the chair” moment.
The workflow for launching virtual machines has been significantly improved in Arsenal Image Mounter v3.1.101! You will now see a single dialog box (rather than a series of prompts) which consolidates important options related to launching virtual machines.
Join our mailing list to arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.
or (617) 277-3625
Terms & Conditions