Steve Davis on Digital Forensics, Ephemeral Messaging and AI

Doing well and good to see you both. Consider you colleagues and friends and always enjoy crossing paths with you, whether it's a podcast or seeing you at shows around the nation.

Yeah, and I think that things change. I mean, you can pick a time frame, whether it's a day, a week, a month, a year, over the last 20 years, but it is as dynamic a… landscape that we deal with when we talk about acquisition, identification of data, and then normalization and getting it into our grabby little fists so that we can slice and dice it and do the things we want to do with it. And the funny thing is, you know, depending on the. flavor of the data or the physical device at hand, things can change literally a week or a month from what we did previously. We may use a certain tool or a technique or a methodology, and then the next day you try it and it doesn't work.

And that kind of seems like a recipe for failure, but I think what it really does is make us very in tune to what's out there and what is changing. So you've got to be a student of the game. You can't arrive, you can't acquire grey hair or. beard and think that you're there. You've got to keep your hand. on the pulse and constantly listen and learn. And, you know, it's a reason why a lot of, us listen to podcasts and go to seminars and read books and articles and you name it, because the exchange of information at those places is helping us become better at what we do. But whether it's email changes like Purview and the change that Microsoft 365 and the entire ecosystem has made recently, or it's mobile device data and third-party apps, they change.

And they. change sometimes unknowingly to us on the end that are utilizing the tools. It's like having a screwdriver or a hammer that all of a sudden doesn't do what you thought it did a week or two ago. And so you've got to come up with some pretty creative ways to do things MacGyver-like.

Yeah, that's a better question than probably the answer is going to be. But I think we've kind of gone from, if you think of the 80-20 rule, right, we're all familiar with that in our lives, like, you know, 80% of our effort, 20% of your effort, you know, ends up being 80% of your income or your benefit or whatever. Same thing here is like we used to think. That corporate email was the treasure trove. That's where all the important data was. And attorneys would. call me and say, hey, I've got 20 gigs of data. And maybe they did, or maybe they didn't really. think through your very thoughtful question, which is, have we thought about all three legs of the stool? Have we thought about all the individuals that are involved?

And then we thought about the timeframes and whether migration comes into play for these different data sources and physical devices. And then specifically, the third leg of the stool is, what are people using? Are they using iPhones? Are they using Android? Are they using collaborative platforms like Jira or Confluence or Zoom or Teams or third-party apps? Is it WeChat or WhatsApp? Or is it Snapchat or. Viber or Facebook Messenger? All those ingredients that go into the pie or the recipe you're making matter. And I think what it really begs the issue is, and I say this to attorneys all the time, they're super bright people, brighter than I am. But sometimes, they don't understand the idiosyncrasies that we're up against. as investigators and forensic collectors, not because they're bad people, not because they're not educated, just because they don't live in that space.

And so I think your question kind of laid. out the path to the answer, which is, I think you need to take a step back. And I think you need to have a plan in place. And so every time someone calls me, I usually shoot them kind of a high level 30,000 foot template for how we're going to go about slaying the dragon. And in the case of mobile device or third party apps, it deals with platform, it deals with size of data, because you make a really, really good point, Brandon, which is, you know, data volumes, I always make the joke about my first computer was 20 megabytes, literally, my first computer was 20 megabytes. Now, right, every kid at our house and everyone else's house has multiple terabytes of data on a laptop or on an external hard drive, because that's how databases work.

It's how pictures work. It's how graphics work. It's how music works is how, Content works. And if you're in like construction law, I mean, just think of all the CAD drawings and things like that come with it. It has exploded. And just taking that data and dumping it into a funnel becomes a huge error, both economically and then systemically, because trying to get to the goal line or find the truth or get the answer or, you know, determine culpability. You can't do that if you have to weighed through all the muck. You've got to be more fine-tuned. So I think you have to have a template or a recipé, you know, in place, a plan of action up front. And then you've got to make conscious choices about mitigating or minimizing extraneous or unnecessary data points or endpoints.

Yeah, I think what I call it, the difference between linear and nonlinear. So linear could be like a standard operating system on your PC or your MacBook. And on that operating system, you have loose files you can get to. And they're pretty simple. They're pretty straightforward. They're self-contained. They have a start and an end, a header and a footer. And for a forensic analyst or an investigator, it's like the four corners of a document during a review. You can get there. You can compartmentalize it and get to it. I think what you're speaking of are those things. Things that are a little more amorphous. Things like… collaboration sites, which in many times are built off of JavaScript. And so we see output called JSON files.

And JSON files are standard output from Java, but that doesn't mean they're consistent from platform to platform. So the fields are radically different if you're in HipChat versus WhatsApp, necessarily. And then if you get into structured data types, where you think Oracle or SAP or SQL, SQLite, which is the predicate for a lot of mobile devices, those are housing, primarily content, textual information, adjunct features like attachments. and things. And you've got to extract out of that area the data that you want, whether it's the messaging, whether it's email, whether it's any type of communication, or it's geolocational information, or it's system Settings and configuration. So I think those are very complex areas because they don't play well with downstream eDiscovery platforms. We all know the famous, ones that are out there that people review data in.

And they're great products in and of. themselves, but they're pretty basic in terms of what they allow. And so you have to parse or normalize this data, things like collaboration platforms, things like structured data, whether it's a medical records management system, or whether it's a collaboration platform that people are sharing content with between channels and messaging, you have to get the data out of that. And then you've got to create a way for it to get imported into a platform that makes it look. attractive. It's so funny, but whether it's a practitioner, a lawyer, a witness, an investigator, we love the way iPhone looks, right? I mean, it's got to have the right emoji, it's got to have, you know, the blue or the green, depending on if you're in or out of my network.

I mean, that's the way we think mentally. But the reality is, it's just bits and bytes, right? It's zeros and ones. And so, It doesn't come out that way. I asked the other day at a conference I spoke at, and they're like, well, how do you prepare for the change in emojis over time? And I said, not my problem. That's a you problem. And I was speaking to somebody that's associated with a platform, an end platform free discovery, because I'm collecting bits and bytes. I'm collecting zeros and ones and giving it to you. And the representation of a happy face or whatever emoji there is, is really just code behind it. So it doesn't create a problem for the forensic investigator or collector. It creates a problem downstream to the people representing it.

So I think to answer your question, we're dealing with so many things that aren't linear anymore. We're dealing with non-linear. And those things like structured databases, those things like third-party chat apps, and those things that surround just large databases and partitions, those are the things that we got to extract content out that could have probative value. But won't necessarily be… round peg to round hole, right? It'll be square peg that we've got to change or normalize.

Yeah, I would say, to answer the question of deletion, I think our environment now is really poor. For the forensic analyst. In other words, in the old days, we could go into Slack space and carve for data and capture it. And then we could create by identifying headers. and footers and things like that, we could recreate documents that had been in part deleted due to the fact that deletion on spinning drives was random. So we could go in there and find. documents, even though it may not have the pointer in a database telling you like a table of contents where the data was, we could find it through search vernacular and keywords and things like that. Now with solid state drives in place and double deletion and things like that, the notion of deletion is becoming harder and harder for us to retrieve information.

Most times, frankly, if it's outside the recycle bin, if someone has actually flushed twice, then you really can't get it. So the idea of getting deletion is becoming. more difficult, not less in the case of mobile devices. We're having to do full file system extracts to get deleted content. Almost no deleted content comes with standard logical acquisitions. When doing mobile device.

Yeah, it makes it more difficult, clearly, to do what we have to do. I mean, you have to be a little more creative and you have to be, you know, a little more of a sleuth to come through and try to find data. So Ephemeral, I mean, it's a cool word and everyone loves it. And it really just means transient. So basically data that's there one day and then not there the next. And it's not, I always make the joke, it's not like Mission Impossible where it blows up in your hands at the end of the convo. I mean, what happens is it's a setting, it's configuration. Configuration, they just give you a super short leash on your data. And so the data goes away.

So what does that do? I mean, if the data is not there, the data is not there. And if we can't carve for it, like we talked about it, it would sound like we're out of luck, but not necessarily. There's two primary ways around that. One would be, in my case, if you go to my phone and you look at Discord or Telegram or Signal or something like that, all my messages are on my phone still to this day. Why? Because I don't enable the configurations of this. Settings to have it disappear after X period of time. Because in my business, I need to have it, I may be testifying on a downstream, someone may be questioned me about what I did, what was the predicate, why I chose to do the things I do.

So I retain my data. So if you and I and Brandon were in a chat together, and you guys had Settings that made things eradicate or disappear, and I didn't, even if Brandon was a subject of an investigation, arguably, we could get to the communication via my phone, just not his app and his credentials. Secondarily, there's a concept of syncing or. backups, things like that. Every time my wife comes in my office and sits down, she always, she has a newer iPhone than I do. So she has a different connector, right? Different lightning cord. She plugs it in on my screen pops up. Do you want to make a syncing? So every single time she's attaching to a Mac device, it's syncinging and making a backup, which is just good practice, giving you the latest and greatest, updating your softwor, getting you the latest music when you work out all that.

But we now have a place to look. So she went in and deleted a bunch of data from her phone after that time, and we couldn't find it. Remember, even though it may syncing to the. application itself, it won't open up a backup and take out those messages that were later deleted. So there or intermediate signpost along the way that allow you to get back to it, either rebuilding Humpty-Dumpty through other conversations, the same way you would do with an email thread. If you left an employee of an enterprise, Daniel, and you didn't have your email anymore, and they didn't save it, they didn't make an aliasing. sent it to another person in your company, but all your communications for phone were with Brandon and me.

We could go to our email boxes and at least try to rebuild a lot of that communication. that we couldn't get from you. Same concept here by either going to other participants or going to.

So I've had this question posed to me on several occasions in the last couple of years. My answer has been consistent. I'm going to change it today. So up till now, what I've said is, you know what, I'm not that sold that generative AI is going to impact my lifestyle for the next 10, 15 years, as long as I plan on practicing. I don't think it's going to impact me. And I think I'm dead wrong. I've kind of learned over time that there's actually some super interesting things that or happlicationening that could really be a huge change to the way we do what we call exfiltration. or migration investigations. So I think the single biggest ora for me, I used to think it was going to be an identification of data sources and devices.

But we can still do that pretty handily, just chatting with. I think the cross-referencing, either from a geolocation standpoint, or when you have people that or attaching USBs to drives or networks or computers, and then you're trying to trace and track. data that may have started somewhere, then got on a conduit, and then landed somewhere else. That's. the whole genesis of doing a migration analysis. You can now use all the artifacts, which or numerous on both PC and Mac-based operating systems. We can now use those artifacts and cross-reference. It used to be we'd get hundreds of thousands, if not millions of lines of code that the analysts would then have to go in and utilize products to create a timeline. And then they'd have to make judgments and choices about whether something that existed in and around a.

time a thumb drive had been placed into a device, whether that might have been copied there or not. Now, with AI, I see huge phonectionality to that cross-referencing and boiling down, and this is really the benefit of AI, is taking hundreds and millions of pages, you know, and putting them into a database, and then putting them into a database, and then putting. listing for you and creating maybe questions not answers about do you think this is related to this or could it be that what i'm seeing here on this date all of a sudden we saw 30 000 items get. deleted from the hard drive in and around the same time they had something just plugged in, now it doesn't necessarily give you black and white facts but what it does is it introduces, conceptually some things that would have taken hours and hours or days and days so i think there's tremendous phonectionality in investigative techniques that we use and i'm i'm sure and i'm not going to name all the products that or out there but they're pretty they're all pretty renowned that could be using that or developing it and behind the scenes when i speak to people those.

or things they're they're doing like it's not just about connectors anymore now it's also going to be about investigation rapidity and trying to help analysts get to the goal line faster.

Yeah, so there's three categories of data you can get from AI platforms. One is clearly the prompts, and it's one that everyone's very interested in. Number two is the output. Of course, the answer that it gave you, and it may be consistent and may be dynamic. I don't know. I mean, sometimes I get on these things, and one day I search and get one answer, and the next day I search and get a different answer. And it's not necessarily a hallucination, but it's not math. It's not consistent. Like, I'm a statistics guy, so I want consistency. I want the same answer every time I get the same variables and the same constants put into an equation, and you don't get that today. But that's the second category, and then the third one's really the source code of the way the large language model operates, okay?

So there's really three distinct categories of data. Can you get them today? Yes, you can with the applicationropriate credentials or admin permissions. You can get to them legally. Luckily, not my argument, you know, to have to make, but if you point me in the right direction and I have the authority… and permissions to do it, we can because these or, once again, structured databases. We're dealing with really textual or linear data, which is pretty easy to manage. So we can get prompts. We can get source code just like you could if someone came in and stole the code for another program and underwrite it. And you can get the output, and then you can also test the output. So we can get it, and it's not a particularly heavy lift, and it's not a large data set either, if you think about it, because you're dealing with this textual information.

You're not dealing with more complex structures of data.

I'd say my last couple of years in the business, I've been kind of consumed on this topic. And kind of because people that I've met at shows or people that have engaged us or people that have been recommended to use me, and they're like, oh, he's great. You know, best thing since sliced bread. And then we get into an engagement. They're like, great. Great, just grab that stuff and bring it on over and we wanna look at it. And I start to ask a lot of questions. I'm like, okay, can you like, just get going? I mean, I really applicationreciate your thoroughness, but really would like you to get going. And I'm like, no, I can't yet because I need answers on all these things.

And I think that disconnect leads to frustration, sometimes from… Either client and clients or practitioners that or in the, you know, in the business of collecting data, minimizing data and then reviewing data, they want to jump from that, grab the data and then just give me a few things out of it. And it's it's a process. It is it is an entire workflow to do that. And if you don't stop up front and talk about what you're up against. than you're going to be halfway down the hill with no way back up. When you when you talk about why I'm not finding what I want to see, I had a client that collected Slack data. And I said, you know, we can help you on that we have a third party tool that we use, we can use a native API, we can go in and get it.

And you know, I said, it really depends on what licensing subscription you have, and whether or not they're utilizing, you know, private or public channels. And it matters whether they're's group messages, or, you know, individual direct messages. And they're. like, yeah, don't worry about any of that. Just just, we're going to have our IT guy grab it, we're going to send it to you. And when they did that, it stripped all the attachments out, because they didn't have an upgraded version for business enterprise. And than they're like, why the heck didn't you get the attachments? And so that kind of what came first, the egg, the chicken, same thing we run into here, if you don't spend the time up front of identifying what you're up against, can you ever detail a plan and that disconnect is, led to people being disappointed, not so much in me or Purpose Legal or some other company.

It's. just in the process itself. They think that it should be easier because that would be nice for them. And to here its more complex and to have people lay out the litany of steps along the way is painstaking sometimes for them. And I think they, you know, lose interested. And you made a comment about my ability to communicate this stuff. I had a person at a major automobile company come to me after a show one day and he said, you know what, you do well. And its not that you're particularly bright or anything. It's like what you do well is you communicate something. that can be so complex into a super conversational, easy way to understand. And that's my gift, if I had any, is conceptually, I understand it.

I'm not that hyper talkative. I'm not that hyper talkative. I'm not that hyper talkative. I'm not that hyper, technical. I have people that are way smarter than me that can, you know, go in and code. I never could in my lifetime. But I understand what you're trying to do. And I understand how to get they're. And I can communicate that. And I think if you can bridge that gap between expectation, like you said, Brandon, and than not having disappointment down the line, because you actually understand this is like getting a phone. How long does it take to collect a phone? How long is a piece of string? Right? I mean, I don't know. It can be a mile long or it can be a foot long.

Well, a phone, how long does it take to get a phone? Just tell me my client wants to know. And I can tell them on average, it might be an hour or two. But they're's times I've had that with real estate professionals that had tons and tons of attachments, where its taken four days to collect a phone. And its not because I'm good or bad at what I do. That's just life in the big city. It's not, you just can't get to New York in two minutes as much as I want to. You know, I've got to go through the process. And so that than, That raises the issue you did earlier, which is how do we mitigate? How do we minimize? How do we make sure, you know, and so I always say, like, we have 30 custodians, maybe we look at one or two of them, right?

If they've got a phone and a tablet and a computer, we had somebody the other day that had four computers, and they were looking for an exfiltration thing. And I was like, the chances of us finding anything on four computers, taking all the live user data, and than analyzing it is negligible. My suggestion would be, let's look at some communication-centric analyses and start they're and do an iterative approach. And so I think, to answer both of your earlier questions, I think iteration is kind of the answer. I don't think you can eat the whole thing at one full swoop. I think you have to start. I used to make the joke, like, how much cocaine do you have to find at the border? Like, you don't have to find, like, 30 bricks of it.

I mean, you can find a little bag, and that may be enough to indict somebody. And the same thing here. We don't need every bad thing that an actor did necessarily, but we want things that are exemplar. So we want to be able to find, items that will support our allegations or our position in a case. And so I think you've got to not try to do the full meal deal anymore. I think you need to be more thoughtful and do it in a step-by-step process. And you may get enough information, just like you would with a review. Once you feel like the things that are coming back from review aren't that responsive, than maybe you stop the review and it hits a certain level.

Same concept here.

Yeah, I think I use the word boutique. I think its a very boutique-ish type show. It doesn't have 10,000 people. And they're's a famous show that we all go to that I used to call it cockroaches in a box, people crawling all over each other, trying to get somewhere. I mean, not trying to be unseemly, but it kind of is what it is. Because its hard to have a voice or make any noise or have anything resonate when you're in an environment like that, okay? I think the beauty of NeLI is, A, the people behind it, and you can pat yourself on the back on this one, is the board's great. They're all practitioners. They're all involved day in and day out. And the thing I love about it is they don't tell you, they ask you.

And they like conjecture. They like interaction. I love the fact that they bring… They bring in… a series of judges that give us their position, which is radically different from mine or yours, any of us, from where we come from. I mean, they're giving us the legal side of it and the. practical implications for what they're going to have to do in the future. And I find those to be gold. You know, you're walking away with just like trinkets of gold when you get to listen to them and than interact with them and than speak with them. And I think that boutique environment where they're's hundreds and not thousands allows that type of exchange. And I would say program-wise, they're's very little filler. We're not putting like, you know, its like when you get a lobster roll, like I don't want a crab cake.

I don't want all the filler. I want the real stuff, right? And its the same concept here is you kind of get from the moment we get they're to the moment we leave, its almost you have to make wise choices on how you're going to spend your time. It's not like you're, well, I'm going to kill an hour with this next presentation. So its just, its very novel. Like I said, the people behind, They do this every single day. And its kind of an extension since so many of the people are from Sedona Conference that we get to deal with kind of latest and greatest things that people are writing papers on right now, speaking on, educating. I always take away more from that specific conference than I do than any.

When I go to probably, you know, I try not to go that many because I don't really love traveling all the time, but, you know, five to seven a year. And I consider that kind of the platinum or gold star or whatever you think the highest grade is.

I'd say get yourself a Steve or a Brandon or a Daniel, whoever you. deem to know stuff. I think this type of relationship stuff, relationship building where you can pick up a phone or ping somebody or ask a question. The thing that is very self-deprecating, but I find outstanding about the forensic industry is its a community. And I don't know everything. You guys don't know everything. You can't know everything. I mean, things happen daily that I didn't even see coming a week or two ago. And so the ability to pick up and talk to somebody in law enforcement or somebody that's a competitor of mine and say, have you seen this before? And does this ever happen to you? And have you read anything about this?

I mean, they're's stuff literally happening that people on our team come to me and they're like, did you know that you can't use X, Y and Z program anymore to collect WhatsApp off an Android? And I'm like, nope, no idea. And, you know, than you start to investigate. You do empirical studies and testing to find out. But I think get yourself. A network, a community, whether its from LinkedIn, whether its from NeLI, whether its just friendships of people that you. add to your network. It's the old Rolodex, right? I mean, you have to have that group of people. I got brought into LinkedIn years ago. I'm not a big joiner. I think you probably get that flavor. I'm not a big joiner. I don't necessarily love, I score on a test in the 99th percentile for being in front of people.

And I score in the one percentile and interested in doing it. Like I'm kind of a homebody. I kind of like doing projects and I like. investigations and I don't really like speaking that much. And you're like, shut up. Like all you do is speak, right? But I do okay at it. It's just like not my thing. So I say find yourself, somebody you can rely on, find a community, find reresources the same way that when my kids are like, well, how do you put this together? And I'm like, do you have YouTube? Like if you have YouTube, you can probably figure out how to hook up the new Samsung TV on the wall. I mean, or I can Google it for you either way, but they're are resources and techniques and people out they're.

You just got to connect with them.

It's great to see you guys. I always enjoy it and appreciate you. Look forward to next time our pass cross.