Author Archive for: ig-dave

Entries by Dave Proulx

Impact of Fake Messaging Applications on eDiscovery

By: Dave Proulx, Director Digital Forensics & Training, Traversed LLC

Technology today has made it unbelievably easy to create what appear to be real text messages between two parties through the use of fake text messaging applications and spoofing services.  And if you are relying on printed screenshots to “authenticate” those text conversations, you are doing a disservice to your client and your case because those screenshots can be faked just as easily.  You don’t have to be a computer whiz to find these applications, they are available to anyone capable of conducting a basic internet search or cruising smart phone marketplaces.

In my experience I’ve seen three common ways a person can produce fake text messages and conversations ranging from the most basic approaches and progressing to more advanced methods. The first and easiest to detect is when the actual text message conversation is photoshopped from a screen capture.  This is a rudimentary way to fake messages and is not difficult to detect. 

With advances in technology and the plethora of applications available to consumers, in recent years I’ve seen cases where a fake text screenshot application is used.  While these applications were initially created and marketed for novelty purposes, there are dozens of applications out there today that allow a user to create fake screen captures of fake messages.  They even take it one step further and come equipped with advanced formatting options to ensure the messages match the formatting of popular applications such as Facebook Messenger, Instagram,  and What’s App. The applications I’ve come across allow customization of the provider tags for ATT, Verizon, T-Mobile, battery and signal strength bars, and contact names to match real messages as they display on the phone.  

The last and most advanced method uses text message spoofing services.  These have been gaining in popularity and through the course of my work I’ve encountered spoofing applications which are highly complex and may even fool an unseasoned forensic examiner. One of the more sophisticated applications I’ve come across and use as an example during classes I teach, actually ingests fake messages in line with real messages. These messages are ingested into the phone’s message database by temporarily using a spoofing service.  The user enters the recipient phone number and the message they wish to send, and it will appear to have come from whatever number or contact they choose. 

During my time as a digital forensic investigator I’ve seen all three methods used to fake text messages and while authenticating the text message communication is the ultimate goal, there are additional steps a forensic examiner will take first to ensure the data is preserved in a forensically sound manner and will help to further validate any findings.  A digital image or copy of the phone will be made and all forensics will be conducted on the image; preserving the information and ensuring none of the data on the phone is disturbed or changed.  A forensic examiner will be able to verify text messages sent and/or received and substantiate these findings through multiple datasets found within the phone. If and when one of these fake messages are discovered, it may provide the forensic examiner the additional evidence needed to support a case of spoliation.

Many cases can move slowly or involve years’ worth of communication where evidence production could prove problematic due to sheer volume and/or accidental or deliberate loss of data.   In these situations, a forensic examiner’s expertise and tools will not only authenticate the data but facilitate the production of evidence that may not have been possible before.

 

With today’s technology, in order to truly authenticate a text message was sent from one phone to another you may need the actual device, a backup of the device, phone records but certainly an experienced digital forensic examiner.  Don’t put your case at risk, consult with a digital forensic expert at Traversed today. 

Apple Digital Forensic Experience Paves Way for Partnership

Here at Traversed, we are excited about our new partnership with BlackBag Technologies.  This new collaboration will enable both companies to address the growing challenges faced by digital forensic examiners in our ever-changing, technology-focused world.  We are confident that BlackBag Technologies’s innovative forensic acquisition and analysis tools, for Windows and Mac based computers, as well as iOS and Android mobile devices, will complement the work we do here at Traversed with digital forensics in the preservation, analysis and production of electronic data.

 

For over a decade, Traversed’s digital forensic experts have been utilizing BlackBag’s suite of tools and performing Apple Macintosh-based forensics.  While Apple forensics poses a number of unique challenges, Traversed is well equipped and able to provide the same level of expertise BlackBag has historically provided commercial customers.  Our experts have worked directly with BlackBag on cases involving encrypted devices, iCloud backups, as well as investigations that go beyond Apple forensics, working on both Windows and Android devices, to collect critical evidence in a forensically sound manner. Our eDiscovery and forensic investigations have aided in cases such as: intellectual property theft, corporate investigations, business disputes, family law matters, and spoliation of ESI. Our work has played a key role in not only uncovering digital truths, but directly impacting settlement agreements, loss valuations and monetary judgements.

 

Fostering this long relationship with BlackBag Technologies enables us to address hurdles in today’s technology including APFS, FileVault2 and the T2 chip encryption technologies.  Our years of experience and expertise in digital forensics coupled with BlackBag’s suite of tools will allow us to provide clients the best possible solutions to often complex matters.

 

Contact Traversed today to learn more or speak with one of our forensic and eDiscovery experts!

Traversed Announces Partnership with BlackBag Technologies

Traversed LLC has announced a new services partnership with BlackBag Technologies effective immediately. The partnership will enable both BlackBag and Traversed to address growing challenges faced by examiners in the digital forensics field.

 

Under this new partnership, BlackBag and Traversed will work together to provide examiners and investigators access to forensic services that can assist with unique cases and circumstances that require additional expertise. 

 

“I was originally introduced to BlackBag Technologies during my time as a law enforcement officer,” explained Dave Proulx, Director of Digital Forensic Services at Traversed.  “Our lab performed countless digital forensic examinations utilizing BlackBag’s suite of software tools that were instrumental during the course of an investigation.  After making the decision to leave law enforcement, I knew I would maintain the partnership I cultivated with BlackBag and take it with me to wherever I landed next, and I couldn’t have found a better home with Traversed.”

 

“Specializing in cyber training, digital forensics, private investigations, and the preservation, analysis, and production of electronic data, Traversed is looking forward to this new level of collaboration with BlackBag Technologies and what we can bring to the private sector together,” said Proulx.

 

BlackBag will work with customers to identify when cases can benefit from Traversed’s team of experts. Specialists who are formally trained and certified in computer, cell phone, and mobile forensics and advanced specialties such as vehicle infotainment and telematics, cloud system and Drone UAV (unmanned aerial vehicle) forensics will be brought in to help investigate.

 

“We’re excited to have a partner with the technical investigative capabilities Dave Proulx and the Traversed, LLC team possess,” BlackBag’s Chief Customer Officer, Ben Charnota explained.

 

“Having worked with Dave previously, I know firsthand how he’s embraced BlackBag’s mission with his extensive Law Enforcement career and has brought that knowledge and experience to Traversed”, Charnota said. “The digital investigation abilities of Dave and his team will enable a level of expertise not often found in a private service offering.  We’re looking forward to our partnership’s growth and revealing the truth in data to create a safer world.”

 

About BlackBag Technologies:

 

BlackBag® Technologies offers innovative forensic acquisition and analysis tools for both Windows and Mac OS X based computers, as well as iOS and Android mobile devices. Its forensic software is used by hundreds of federal, state, and local law enforcement agencies around the world, as well as by leading corporations and consultants, to investigate all types of digital evidence associated with both criminal, civil and internal investigations. BlackBag® Technologies also develops and delivers expert forensics training and certification programs, designed for both novice and experienced forensics professionals. To learn more, visit www.blackbagtech.com.

 

About Traversed, LLC:

 

Traversed specializes in digital forensics, incident response, and the preservation, analysis, and production of electronic data in matters involving civil litigation, regulatory matters, and corporate investigations. Traversed provides objective and comprehensive answers based upon expert analysis of electronic data while addressing challenges with simple solutions using the latest acquisition, search and forensic technologies. Learn more at www.Traversed.com .

 

To request services from BlackBag and Traversed, visit http://offers.blackbagtech.com/traversed.