FTK 4, MPE+, and AD Triage – Upcoming Interview
April 23, 2011 by Lee Whitfield
Filed under News
On Monday I am being joined by Lee Reiber and Brian Karney of AccessData. We will be discussing FTK version 4, the latest version of Mobile Phone Examiner Plus (MPE+) and their newest product AD Triage.
As with our time with Guidance I’m interested to hear any questions you may have about these products.
If you have question please post them as comments here, post to Twitter (@4cast), or post them on either the Forensic 4cast Facebook page or LinkedIn Group. I’ll try to ask as many as I can.
Get in your nominations!
April 5, 2011 by Lee Whitfield
Filed under News
It may have escaped the attention of some but the closing date for your nominations to the Forensic 4cast Awards is May 1st 2011. This means that you have less that you have 26 days to post your nominations.
This year the Forensic 4cast Awards promises to be the biggest and best yet.
Guidance have made concerted efforts to get involved and have started posting on Twitter and Facebook about the awards in order to persuade their users to nominate and vote.
The last thing I want is the same thing that happened last year when I received email after email asking why they hadn’t won or even been nominated for their specialist category. So please save me the pain of having to respond to these mountains of emails and post your nominations today!
The Forensic 4cast Awards – because even geeks deserve recognition.
EnCase Forensic 7
April 2, 2011 by Lee Whitfield
Filed under News
I hope that, by now, everyone realised that my post yesterday was for April Fools and that I have no intention of quitting Forensic 4cast or becoming a professional wrestler.
The good news is that next Sunday I’m going to be recording a special episode of Forensic 4cast with two people from Guidance Software. They are going to be talking about EnCase Forensic version 7.
You may have seen some of the publicity surrounding the new version of Guidance’s flagship product or maybe even been to an event where it was demoed. This episode will hopefully help us to find out a little more about the new software.
Do you have any questions that you want to ask the Guidance guys about the upcoming release? There are no guarantees that I will ask all of your questions, or if they’ll answer them, but there’s no harm in trying is there? If you have a question please either comment here, post them on the 4cast Facebook page, or message @4cast on Twitter.
Goodbye
April 1, 2011 by Lee Whitfield
Filed under News
I was already in a foul mood this morning because the kids got me out of bed at 5am so when I found that I had received a derogatory email about the latest episode of Forensic 4cast I decided that I’d had enough.
I can only apologise to everyone as I announce that Forensic 4cast is going off the air.
As some of you may know my life has become increasingly complicated over the last few months. I have many responsibilities that take a significant amount of time which gives me zero time to pursue other interests.
There are other reasons for this decision such as the insulting, and sometime threatening, emails and comments that I receive, the equipment that I use for recording has been constantly failing over the last few months, constantly missing important football matches, etc. There are many other valid reasons. Combined, it feels as if the gods of podcasting are telling me that I’m not destined to continue with Forensic 4cast.
After talking it over with my family and my co-host, Eric, we’ve decided that it is time to move on and call it quits.
Episode 35 will be a long-standing testament to a once forgotten golden age of digital forensic podcasting. I realise that this will come as a shock to many people but I ask you to put yourself in my shoes. I dedicate a great deal of time to 4cast and what do I get in return? Nothing. All I get is recognition and approximately £15,000 p/a in sponsorship and donations – It simply isn’t enough!
I’m tired of living the life of a forensic rock-star. The nice hotels, the exotic travel, the pressure to perform at conferences around the world… it has all just become too much.
I’m also taking a sabbatical from work. I’m going to take a year away from Disklabs so that I can pursue my long-standing dream of becoming a professional wrestler – my pseudonym? “The Blue Dongle”.
Forensic 4cast 2010 Statistical Report
March 9, 2011 by Lee Whitfield
Filed under News
I was looking at the website stats the other day and thought that there may be some people out there that would find the stats interesting so I’m publishing them for your review. I’m not a statistician by any means so if anyone has any insight as to what they get from these please let me know in the comments.
1) This table shows the total bandwidth usage per month with the grand total at the bottom.
| By Month | ||
| Hits | Bandwidth (GB) | |
| Jan-10 | 106473 | 61.88 |
| Feb-10 | 90126 | 35.72 |
| Mar-10 | 102493 | 41.72 |
| Apr-10 | 156418 | 63.6 |
| May-10 | 169595 | 88.22 |
| Jun-10 | 174941 | 105.95 |
| Jul-10 | 198779 | 77.78 |
| Aug-10 | 172236 | 73.03 |
| Sep-10 | 154859 | 43.52 |
| Oct-10 | 162438 | 29.87 |
| Nov-10 | 170863 | 57.61 |
| Dec-10 | 160938 | 65.44 |
| TOTAL | 1820159 | 744.34 |
744.34 GB Total bandwidth used in 2010. I was quite impressed with that.
2) This table shows the daily averages of how much bandwidth is used.
| Daily Averages | ||
| Hits | Bandwidth (GB) | |
| Mon | 5420.86 | 2.01 |
| Tue | 5737.21 | 2.588 |
| Wed | 5644.56 | 2.623 |
| Thu | 5472.88 | 2.219 |
| Fri | 4838.89 | 1.706 |
| Sat | 3731.08 | 1.549 |
| Sun | 4064.52 | 1.716 |
3) This table shows the top ten total bandwidth consumed by country
| Top 10 Countries | |
| Country | Bandwidth (GB) |
| United States | 502.08 |
| Great Britain | 80.72 |
| Canada | 37.19 |
| Australia | 18.05 |
| Germany | 14.95 |
| Netherlands | 6.76 |
| Sweden | 6.57 |
| Japan | 6.03 |
| Austria | 2.72 |
| China | 2.27 |
4) This table shows the 20 most popular podcast episodes
| Top 20 Podcast Episodes | |
| Episode | Downloads |
| 26 – Make Mine a DECAF | 3083 |
| 20 – Not Another ‘Kitty Porn’ Joke! | 2854 |
| Conversation with Rob Lee | 2683 |
| 21 – Curveball to the Forensic Field | 2577 |
| 19 – Bullet Holes and Cat Burglars | 2520 |
| 28 – Xerox This! | 2410 |
| Forensic 4cast Awards – Announcement | 2375 |
| 25 – The Little iPhone Worm that Could | 2300 |
| 18 – Standing Room Only | 2252 |
| 23 – The Butt of Everyone’s Jokes | 2209 |
| 17 – Free is not Free | 2132 |
| 32 – The Mecca for Digital Forensicators | 2092 |
| 27 – When RIAA Rules the World | 2082 |
| 22 – Captain Forensics vs. Jonathan Parker | 1872 |
| 29 – #robleeisagiant | 1780 |
| 24 – No Good Crying Over Spilled COFEE | 1773 |
| 31 – They try to send me off to DC but I say R-M-O | 1766 |
| 30 – Amy Winehouse is no Forensic Guru | 1736 |
| 16 – Tool | 1220 |
| 15 – Vacation’s Over | 1176 |
5) This table shows the top twenty posts that are not podcasts
| Top 20 Other Content | |
| Title | Views/Downloads |
| Into the Shadow Presentation | 2530 |
| Forensic 4cast Awards 2010 Voting is Open | 1885 |
| Testing Acquisition Software | 1211 |
| How to do the Worst Job Possible | 1154 |
| Testing Acquisition Hardware Part 1 | 1109 |
| Forensic 4cast Awards – Results #forensicsummit | 833 |
| Extreme Hex Jumping | 832 |
| The Risk of Rooting | 779 |
| Getting into Digital Forensics in the UK | 764 |
| Into the Shadows | 761 |
| Sometimes I Wonder | 752 |
| Forensic 4cast Live Rerun | 671 |
| Shadow Analyser Article by the Register | 649 |
| Where are my Podcasts? | 596 |
| Future of Forensic 4cast | 544 |
| Forensic 4cast Awards 2010 | 532 |
| Forensic 4cast Live | 527 |
| Lessons From Data Recovery Part 1 (repost) | 506 |
| Sneak Peak at the Forensic 4cast Awards | 478 |
| Sans Forensic Summit | 475 |
6) This table shows the top 10 referring search engines
| Top Ten Search Engine Referrers | |
| Search Engine | Referrals |
| 8491 | |
| Yahoo! | 4684 |
| Google (Images) | 186 |
| Yandex | 92 |
| Microsoft Windows Live | 41 |
| Microsoft MSN Search | 18 |
| Baidu | 13 |
| AOL | 10 |
| Ask | 7 |
| Stumbleupon (Social Bookmark) | 5 |
7) This table shows the top 20 referrers that are not search engines
| Top Referrers (Not Search Engines) | |
| Referrer | Referrals |
| http://www.digital-detective.co.uk | 4158 |
| http://www.forensicfocus.com | 1170 |
| http://twitter.com | 1116 |
| http://computer-forensics.sans.org | 422 |
| http://www.irongeek.com | 213 |
| http://youdao.com | 203 |
| http://www.computer-forensics.co.uk | 166 |
| http://borssnack.di.se | 164 |
| http://www.bing.com | 144 |
| http://ericjhuber.blogspot.com | 121 |
| http://www.facebook.com | 115 |
| http://www.macosxforensics.com | 112 |
| http://longurl.org | 102 |
| http://viaforensics.com | 100 |
| http://www.binint.com | 78 |
| http://www.digitalforensicsmagazine.com | 67 |
| http://twitturls.com | 65 |
| http://windowsir.blogspot.com | 60 |
| http://iconfactory.com/twitterrific | 55 |
| http://www.macosxforensics.com | 50 |
| http://aimtrust.com | 44 |
| http://www.podfeed.net | 41 |
| http://samouprav.ru | 26 |
| http://www.irongeek.com | 25 |
| http://happyasamonkey.wordpress.com | 25 |
| http://www.pryaniki.org | 23 |
| http://www.energetic-news.ru | 23 |
| http://www.firstlink.ru | 22 |
| http://theinvestblog.com | 20 |
| http://www.znaki-textile.ru | 20 |
This table shows the top 10 search terms used to find the website
| Top 10 Search Terms | |
| Term | Number |
| forensic 4cast | 841 |
| forensic4cast | 276 |
| encase portable | 249 |
| forensic 4 cast | 94 |
| forensic podcast | 62 |
| facebook forensics | 66 |
| encase pricing | 61 |
| forensics 4cast | 58 |
| mac forensics | 7 |
| android forensic toolkit | 5 |
Forensic 4cast Awards 2011 – Nominations are Open
February 11, 2011 by Lee Whitfield
Filed under News
***NOTE*** You can nominate as many times as you want, even in the same category if you wish.
That time of year is upon us once again. It is awards season and, as such, the nominations for the 2011 Forensic 4cast Awards are now open.
We’ve made a couple of changes this year that will, hopefully, make the whole process fairer to everyone involved. We not only ask for who you want to nominate but we also want to know why. When filling out your nominations please provide a reason for the nomination and bear in mind that the awards will only be given for work from the last year.
We’ve also added a couple more categories, namely “Best Law Enforcement/Military/Government Forensic Team” and “Best Civilian Forensic Team”. This brings the total number of awards to fourteen.
The nominations will remain open for a few months and voting will only be open for a shorter period of time leading up to the awards ceremony.
Details about the awards ceremony will be published in due course but, in the mean time, have fun nominating.
Forensic 4cast Mini-Shows
January 6, 2011 by Lee Whitfield
Filed under News
Happy new year everyone. I hope everyone had a wonderful Christmas and has made some good resolutions for the coming year (and. moreover, that you have not yet broken them).
We, at Forensic 4cast, like to come up with fresh ideas once in a while to stop the old show getting stale. Some of these ideas are widely heralded as brilliant (the Forensic 4cast Awards for example), others don’t get the kind of backing we’d like and they fall by the wayside (may the forum rest in peace). The latest of these ideas came to me a few days ago. I’ve spent time thinking about it and came to the conclusion ‘Why not?’
Each episode of Forensic 4cast gets, on average, 1500 downloads per month. Its not a huge number but it is a good start. Sadly, due to family and other commitments, I’m not in a position to record and edit a new episode of 4cast more than once per month. However, I do have a near-unlimited amount of storage and bandwidth for others in the forensic field to use. Do you have something to say? Do you have a microphone? Why not record something and send it my way. If its good, we’ll put it in the feed for everyone to download and listen.
The kinds of things that I’m looking for are:
- product reviews
- cheap investigation methods and software
- forensic news
- research results
- new techniques
- interviews
Do not think that, just because your idea does not fit into any of the items listed that I won’t consider your input. Far from it.
I don’t want to get bogged down with too much so I kindly ask that any participants limit these mini-episodes to 5-10 minutes in size. They can be video or audio, just make sure that they are in a widely used format such as mp4 for video and mp3 for audio.
If you are interested please let me know either in the comments, or by any of the methods of communication set out in our ‘Contact Us’ page.
Forensic 4cast Awards 2011 – Your Thoughts
December 2, 2010 by Lee Whitfield
Filed under News
It is becoming more apparent to me that the Forensic 4cast Awards are becoming a huge deal. This thing seems to be snowballing into something huge. I ran a search for “forensic 4cast awards” today and was surprised to see many references from all over the world. Cellebrite even did a press release on winning two years running!
It is funny to me to see what has happened over the last two years. We started with Simon and I standing in front of a camera and, within a year, had moved to SANS presenting the awards before a live audience. The question is where do we go from here?
I’ve had a few people talking to me about different things such as doing an awards ceremony in the UK just for us Brits, and one in the USA for everyone, down to the format of the awards ceremony, and so forth.
I’ve always said that these are not my awards, they belong to the community, all I do is to provide a platform for them to take place. That being said I want to know your thoughts on next year’s event. Where, when, how, who, etc. I’m willing to listen to everything and anything that you might suggest. Be warned, however, if you have a good idea I might ask you to help implement it.
Where are my podcasts?!?!
September 24, 2010 by Lee Whitfield
Filed under News
A couple of weeks ago I was able to poke my head in at the SANS EU Forensic Summit in London. After giving a presentation (and before rushing off back home) I was able to talk to a few people in the field. During one such conversation I was asked why I’d stopped doing Forensic 4cast. Apparently they had heard that I’d given up on it and decided that it wasn’t worth my time. I don’t know where this came from but to paraphrase Mark Twain:
Rumours of my demise have been greatly exaggerated.
I love Forensic 4cast. I have invested to much time, energy, and money into this project and I will continue to produce content. The problem right now is that I have a lot going on in my personal and work life that means I don’t have a great deal of time available to concentrate on recording or writing.
From the time that we moved house things have been very complicated. We were told that our child would be born so premature that all we could do would be to watch her die, I’ve had to run around and do household chores because my wife has been on bed rest between working and running her to the hospital, etc.
Thankfully the baby was born safely at 32 weeks but had to be in hospital for around a month before coming home. Since then she has been re-admitted due to breathing complications. Thankfully she is home once more. But I’m sure you can see why I’ve been a little preoccupied lately…
Throw into the mix that I was experiencing suspected heart problems and that we’re working hard to get Shadow Analyser out and my life seems a little overloaded doesn’t it?
There is a lot more too but I don’t want to bore everyone with the details.
In short… I’m busy and I’m sorry that I’ve not been podcasting lately. We’ll be back soon. What I take from all of this is that it must be good if people are wanting more episodes
Thanks for your continued support. It is very much appreciated.
Forensic 4cast Live – Rerun
August 15, 2010 by Lee Whitfield
Filed under News
We did it! The first live broadcast of Forensic 4cast went out earlier today. In case you missed it (whether by accident or by design) you can watch it below. If you’ve already seen it once and want to watch it again I have the number of a really good therapist…

