I’m doing an imaging job in the Dallas area. The client wants me to image four servers, three of which are business critical and can’t be out of use between 6am and 7pm.

So, these servers are so old that they make Ken Pryor look like a teenager…

At first I tried using FTK Imager (portable version) but that ended up crashing one of the servers (yikes). Thankfully the crash was over night and it was back up in time for the start of the working day.

Next I tried DCFLDD. This worked for two of the servers (bearing in mind that I had to do this over USB 1.1). This was painstakingly slow but it worked. However, the other two servers were simply unable to cope with being imaged. They would continually lock up or lose connectivity to the USB drives.

I tried netcat. No dice.

I exhausted all of my practical possibilities.

Finally we all decided to take the servers offline tonight and tomorrow night. We were going to image a 2TB server with SATA drives (yes, they had both IDE and SATA in their servers, as well as SCSI). If a boot disc wasn’t going to work I was going to have to image SATA drives (simple enough) and SCSI drives (shoot me in the head) with a Tableau write-blocker. My SATA write-blocker has eSATA so that would go pretty quick, but my SCSI write-blocker is USB. So, a bunch of SCSI drives to image, one at a time mind you. Then would come the painstaking effort of reassembling the RAID in some software tool.

I could see what was going to happen. I was going to spend every evening from now until next week sitting in a cold server room imaging SCSI drives. I was going to cry.

Thankfully the lab is armed with a copy of F-Response – Consultant Edition.

After a little tinkering I was able to plug a laptop into the network and mount the drives from the problematic servers. Within a couple of hours the worst of the two servers was completely imaged and the largest of the servers was in progress.

Tonight I am sat at home in the company of my gorgeous wife wrapping presents for the kids instead of  sitting in front of a laptop watching a status bar crawl, very slowly, across the screen.

Thanks F-Response.

A few weeks ago I recorded a segment with Jon Bentley (one of the hosts) on password cracking and it airs tonite.

For those of you who can’t see it I’ll do what I can to post something on here.

If nothing else it should provide some good photoshopping opportunities (I’m looking at you J).

Please take some time to watch and support the effort to recognise those people that work hard to improve and advance the field.

The link to watch is here: http://www.livestream.com/sansinstitute

The show kicks off at the following times:
BST – 10:20pm
EDT – 5:20pm
CDT – 4:20pm
MDT – 3:20pm
PDT – 2:20pm

Hope you can join us!

I find that I’m answering this question several times a week at the moment so I thought rather than writing the same reply to each email or forum post that I would just write a small post. Most of this comes from an email that I sent to one such inquirer last week. Hope someone finds this useful.

I work for Disklabs in the midlands but I’ve previously worked for CY4OR and Zentek. The December before I graduated I started calling as many forensic companies as I could find, asking them if they hired graduates. I managed to get an interview with CY4OR and they took me on just a few days after my final exam at University. I’m not saying that this is the right approach but it worked for me. My brother was on the exact same course at university. We both got comparable grades but he waited to look for a job until after graduation. If memory serves correctly it took more than a year, and a heck of a lot of miles, to find a forensics job.

Sadly, at the moment, the picture is looking grim. The tender for the Metropolitan Police is going to be announced soon and, as this is a very lucrative contract, most companies are not hiring in case they do not win the contract. Also many police forces have stopped outsourcing work due to budget cuts. This has seriously impacted the field. I know of several companies that have ceased trading in the last year or so because there is simply not enough work to keep them afloat. The outcome of this is that there is a surplus of experienced, qualified forensic investigators in the field who are all looking for work. One company that I know advertised for a single position and had something like 10 applications within an hour of posting the position. That is how desperate the situation is at the moment.

I know of a few people who graduated last year and are still looking for their first job in the field, and these are people who are quite well connected to others in the field through Twitter, Facebook, and the like. But I believe that if you excel and you know what you’re doing you should be able to get a start somewhere. The problem is making yourself more appealing to a potential employer. My best advice is to get some training. Finish your degree but don’t just stop there. Find a way to pay for an EnCase passport and attend their courses. If you do that it means that you know how to use the software and can go straight in to a job and start working right away without the company having to spend money training you. Anything you can do to help a potential employer save money will be in your favour and, if you can do the work you already have won half the battle. I would even suggest going to a local forensic company or police force and asking if you can volunteer your time there for free while you finish university. If you offer to work for free I don’t know many people that would turn you down and it would give you some much needed experience. Also, if you prove yourself to be good at the job they’ll be more likely to hire you once your degree is over.

Also, so something extraordinary. Write a paper about something new, get noticed. Write a blog. Connect with people on Twitter. Get involved in the community. By doing this you will gain respect and trust from your future peers. Don’t do a podcast though, I’ve got enough competition as it is

One thing you have to bear in mind is that you have to be prepared to move to work, potentially a large distance. Don’t limit yourself to a single geographical area because there aren’t that many forensic companies anyway. Maybe even look abroad.

I realise that might read this an become depressed. Sadly things really aren’t great at the moment in the field. They might improve in the future but there’s no harm in doing everything I’ve mentioned anyway.

Finally David Sullivan specialises in recruitment for forensics companies. He’s written a blog post on Forensic Focus about finding a job. Its here: http://www.forensicfocus.com/david-sullivan

We had out first live show this last weekend (audio podcast will be posted soon). It seems to have been very well received by all who watched. I would love nothing more than to conduct live 4cast shows every two weeks but we have some minor drawbacks.

1) Video quality sux. There is no getting around this. It was blocky and barely watchable. More bandwidth is necessary. I would also like to have guests on cam too.

2) I tried, and failed, to get something set up whereby we could have live callers. My current equipment is somewhat limited (i.e. I have none) and investment is this area is looking more necessary with each passing week.

My current setup is amateur, at best (some may even say “What? You call that a setup?”). I want to make 4cast a lot more professional looking but, in order to do this I would need to upgrade my internet connection (recurring cost) and try to find some more adequate equipment (one-off cost). In order to facilitate this I am going to sell my soul and find some sponsorship. You may say “You’re already sponsored by Digital Forensic Magazine”, well, in short that is an agreement that we have in place but no money trades hands.

What I plan on offering is “on-screen” advertisements, and a spoken advert during the show. We can also offer limited advertising on the website.

If you know of anyone who would be looking to reach over 1000 digital forensic investigators each month with their message please let me know.

Also don’t forget that we are still taking donations. If you have some spare cash and would like to contribute please feel free to live a little and send us some money. Ideally this would have been the way to do things but the donations don’t cover all the costs and allow us to grow how we want.

Please get in touch if you can help!

Issue 4, released online on August 1st, takes a look at how effective traditional digital forensic techniques are at obtaining forensically sound data in scenarios where computer misuse has been used in attempts to frame the innocent. The DFM team also investigates and details the state of digital forensics in law enforcement around the world identifying which countries are doing well and which have much to do, highlighting the disparity in skills and qualifications between each. In a world that is getting ever more interconnected and one in which international online crime is on the increase, the industry should look to establish and apply minimum standards .

Other features include:

• Preservation of Evidence – How an organization should establish its policy regarding the investigation of a computer crime scenarios
• Psychosocial Forensics – A novel approach to operational forensics
• iPhone Forensics – An exploration of the challenges that the iPhone has introduced for the digital forensic investigator
• In “Meet the DF Professionals”, DF Mag interviews viaForensics’ Andrew Hoog
• Live Data Collection – Ron Tasker asks why we should or shouldn’t capture live data at a crime scene
• Real Time Stenography – A use case for Real Time Network Forensics
• SANS’ Rob Lee asks, “Do you have what it takes to be a digital forensics pro?”

As well as the usual book reviews, legal section and product reviews, readers are given the chance to win a free ticket to the SANS Digital Forensics and Incident Response summit either in the UK in September 2010, or in the US next July 2011.

Digital Forensics Magazine issue 4 is published online on August the 1st and digital subscriptions start at under GBP30. Users can upgrade their subscription to the print and digital version for only GBP10 at any time.

To subscribe to Digital Forensics Magazine please visit www.digitalforensicsmagazine.com.

Digital Forensics Magazine is the flagship publication of TR Media Limited, a UK-based company which specializes in publishing academic quality consumer magazines and books for the information security sector. Digital Forensics Magazine combines the depth and research of the best academic journals with the more traditional consumer feel of a trade magazine. For more information, please visit www.digitalforensicsmagazine.com

With Football (soccer) season just around the corner I have been bombarded with requests to join many different fantasy football leagues. While I was deleting one such email a thought entered my mind. Why not start a Fantasy Forensicator League?

The idea is quite simple, as with other fantasy leagues you’d get a certain amount of virtual cash with which to build your elite team of forensicators. You could choose, lets say, five people to be on your crack squad. Points would be awarded for various accomplishments. I thought something like the following would be awesome:

Giving a presentation – 10 points

Writing a whitepaper/blog post – 5 points

Being on a podcast – 10 points

Releasing a new piece of software – 20 points

Appearing on local radio – 15 points

Appearing on national radio – 20 points

Appearing on local TV – 20 points

Appearing on national TV – 30 points

I’m sure there are loads more. What can you think of?

JUMPING OUT OF A FREAKING AEROPLANE!!!

I’m trying to get hold of the video and will post it as soon as I have it. But it raises several questions; Have any of you tried to do anything to liven up your day-to-day forensics work? Will this spur on more radical behaviour? What other extreme forensics can you think of?

I have a day job doing forensic investigations. This is a full time job and quite demanding at times, but I’m paid well enough by Disklabs to see past the less enjoyable parts of the job and focus on the upside.

When I come home in the evenings I can often be found preparing for the next episode of the podcast, doing some research, or writing an article. Am I paid for doing any of this? No. I receive donations from time to time but these are used to sustain the podcast. I also receive items from time to time, t-shirts, software, and so on. These are sent to me by kind people that are associated with Forensic 4cast in some way.

I have poured hundreds of hours into Forensic 4cast over the last two years, none more so than with the Forensic 4cast Awards. This event is held at my own expense. It is entirely voluntary. I receive no payment of any kind for organising and hosting the event. Yes, this year SANS have been kind enough to provide a venue for this, for which I’m very grateful, and someone else has kindly offered to provide the physical awards for distribution. Let me reiterate…

I do not receive ANYTHING for this event. I do not take sponsorship, I do not take payment, I do this  for the sole purpose of giving a few hard working people, those that are the pillars of the forensic community, some much needed recognition. I completely resent any implication that I’m doing this for some ulterior motive.

Next year things will change. I’m going to get a bit more organised and get in some volunteers to assist. I’m also going to remove ‘Forensic 4cast’ from the title of the awards and call it the ‘Digital Forensic Awards’. That way people can’t complain that I’m even doing it for publicity purposes. I do this because I love doing it.

Sorry, I just wanted to make sure that everyone knew exactly what benefit there is for me in organising the awards and maintaining the podcast. As for the naysayers (and no its not Luby or Kovar) why don’t you try doing something more productive than tearing others down. Why not focus all of that energy into doing something productive and bettering the field instead of trying to pull people down? </rant>