Truth Crime Forensics

“The tool said” might be the fastest way to lose a jury. Recorded live at IACIS, we sit down with Stacy Eldridge and Becky Passmore of Parsing The Truth One Bite At A Time, two former FBI senior forensic examiners who build a true crime-ish podcast around one thing most shows ignore: the digital artifacts and the courtroom testimony that prove what happened.

https://parsingthetruth.com/

Transcript

SPEAKER_01 0:02

And we are live. Welcome to a Digital Friendship podcast and not only the DFN, but also we're accompanied by the amazing Stacey Eldrich, Becky Passmore, from Parsing the Truth One Bite at a Time. So uh just so glad. So first of all, we're in IASIS. We can see our IASIS shirt. So um we're teaching. Well, the student that could be uh our teacher, so all the all that knowledge there. So uh no, so thank you for being with us.

SPEAKER_04 0:31

So this is our first, I would say, official interview of we had one with Chris Bance prior, but this is our official interview interview that was talking about an artifact. An artifact, yeah.

SPEAKER_05 0:42

Oh, I was like, this is a crossover event, you know, like they used to do with Gray's Anatomy and private practice. That's how old I am.

SPEAKER_02 0:48

So we are shows you're talking about.

SPEAKER_01 0:53

Well, um, this is a treat because you're here also. We got some nice chairs here. We're at the ACES event, like I was saying, and this is the second week of the event, and uh it's been great. So uh we've been teaching, obviously, the for the folks that watch the mobile advanced mobile device forensics course.

SPEAKER_06 1:08

Becky is helping with a Cypher, Cyber Incident Forensic Response class.

SPEAKER_01 1:13

And that's one of the newer classes, I believe, right?

SPEAKER_06 1:14

Yeah, it's been going 10 years. This is your year 10 number 10.

SPEAKER_01 1:18

Oh, well, that's how much I know about intuition response. I'm the one that doesn't know anything, and you're taking a class.

SPEAKER_05 1:26

Yes, I am taking applied advanced applied database forensics. So now I'm really gonna be dangerous. Yes.

SPEAKER_01 1:32

Oh, Damien is great.

SPEAKER_05 1:33

Yeah, it's amazing. I think my ex head exploded about 14 times in the last two days. I'm just like, oh my gosh.

SPEAKER_01 1:41

Well, mine just exploded, just listening to you. All the databases. So, so yeah, so so today what one of the things we wanted to do, um, since we have you here and we kind of met here, and again, it's it gives us a little bit of background. Folks that listen to your podcast know I would assume we kind of have a lot of crossover between audiences, but for those that might listen to us and not know about what your podcast is about, can you give us a quick rundown of your background and what's the podcast about?

Why Their Podcast Exists

SPEAKER_05 2:07

Yeah. So Becky and I are both um former FBI senior forensic examiners. Used to be on the computer analysis response team. We've since moved on. We both teach at the university level. We have our own businesses. And what we do with our podcast, we say we're the true crime-ish podcast.

SPEAKER_01 2:25

Crime-ish.

SPEAKER_05 2:26

Yeah, because you know, we're not the typical true crime podcast. We're focusing on the facts and the artifacts that today's digital forensic examiners are finding or sometimes not finding. Yeah. And so we talk about all of that sort of stuff. And that's the only part of like the cases and the trials that we dive into. We don't go into anything else. We have a very narrow focus.

SPEAKER_01 2:48

Yeah, that's that's different from us. We're more like uh the whole kind of what's in the news.

SPEAKER_05 2:52

Yeah, yeah, digital forensic news.

SPEAKER_01 2:54

Yeah, our forte.

SPEAKER_05 2:56

So yeah, we go backwards in time, and you're current.

SPEAKER_01 2:59

Both needed. So so I want to say, look, I'm happy to have you because one of my first, uh not my first, but I Becky taught me a whole bunch of stuff when I was going up through the card program.

SPEAKER_06 3:09

That's how we met.

SPEAKER_01 3:10

Yeah.

SPEAKER_06 3:12

Briggs came to the a Dex course that I was teaching, and that's how we met.

SPEAKER_01 3:17

Yeah. So that was the pleasure of of of I think it was the first Dex class that we ever given in the bureau.

SPEAKER_02 3:24

Yes.

SPEAKER_01 3:24

So uh the searched for that cohort and the first class in that cohort.

SPEAKER_02 3:28

That's right. That's right.

SPEAKER_01 3:29

So and uh again, this this community, if if I mean, not only in the United States but worldwide, it's really a small group, right? I mean, of digital experts to do the type of work. And uh it's it's great to have those sort of relationships and uh kind of support each other as we grow in our careers. So awesome to have you here.

SPEAKER_04 3:46

So, question You're blending digital forensics with true crime, true crime discussions. Why did you feel that that perspective was missing from the true crime space?

Facts Over Opinions In True Crime

SPEAKER_05 3:57

From the true podcast or from the true crime podcast that I've listened to, so many of them are just people talking about whatever they think about this, that, and the other. It's not like relying on the facts or the evidence or like the case hasn't even started, there's no emotions, and it's not even in trial yet. And they have all of these opinions. And when I went through training, and what I stress to my students and when I stress in my own work is to focus on the facts and the evidence and present that without bias as much as possible. And I just didn't think there was a lot of that out there. And then I also think what a better way to learn than to see what's happening in the courtroom, because it's one thing if you understand the zeros and ones, but if you can't convey that information to the jury, if they don't understand that, then you know what have you even done? So I think the courtroom is like where the proof makes the pudding, right?

SPEAKER_06 4:51

Totally. And I look at it as I've been around for a long time, and I see the amazing work of examiners, like going back to first text, but also I remember you were the first person on site at the Pults Orlando, and you're like, I don't know what to do, but I have 50 phones here, and you know, just live working in that community and talking amongst each other. But examiners are humble people, and they're not, they don't get recognized in investigations like they should because they just sit back and do their work. And I just feel like this is a way through our podcast with true crime and investigations and court proceedings and testimony that we can bring their humble work to light. You know, we bring it out and we recognize what they have to do to get to where they're at.

SPEAKER_01 5:48

Yeah, I had a meme where it's a you know, boxing ring and the fighters all bloody, you know, and and and it's there. And next to it is the the girl that has the card numbers, right?

SPEAKER_02 5:59

For the rounds, right, right, right?

SPEAKER_01 6:00

And uh the the the the poor fighter that's the examiner and the it's tongue-in-cheek, people tongue-in-cheek. The girl with the cards is the the agent or the investigator. So they're there all pretty and over all bloody after the fight.

SPEAKER_05 6:13

You're getting all the attention, correct, and we don't, right?

SPEAKER_01 6:16

Now, but I mean I say tongue-in-cheek, right? Folks, if you follow my social media, you see my memes, is because again, to your point, examiners don't care for recognition. We care to bring justice to the victims and or or justice to those that have been wrongly accused, right? And and we have different roles to play. And there's a lot of work in it, but the reward is not recognition, the reward is not even the money, because most of us work in a government sector, is the is the actual change in society that we do. And I think I think most examiners we can uh agree that's that's that's that's the feeling that we have. I want to also comment real quick. I really appreciate that you deal with cases as examples. Something that we see a lot is folks asking us, well, where can we get a case study for something? Or an example of somebody testifying in in this high situation. I'm like, you know, I got a podcast for you that you gotta listen about how the trial went, all the details about it, interesting guests. So uh you're feeling a really niche important niche in, or like a gap in knowledge that most examiners have in regards to how these cases are presented uh at court.

SPEAKER_04 7:19

Yeah, and your podcast, I think just discussing the court cases that that are past or present or whatever, um, will lead people to go watch the trials that are televised too. So it really leads them into getting into the courtroom and getting that experience, watching the actual testimony. I don't think a lot of people, not a lot of people, but some people may not know how to find that on their own. And I feel like you guys are leading them there. It's very, very good.

unknown 7:44

Yeah.

Tool Dependency And Pump And Dump

SPEAKER_04 7:45

So you both have discussed the argument that tools don't solve cases, people do. We say that a lot as well. I think we have a common ground there. Um, and you say that the the dangers of over relying on commercial forensic tools. So, where do you see examiners going wrong most often when it comes to tool dependency?

SPEAKER_06 8:05

Yeah, I'm I'm I would say that I had this discussion recently with an um an AUSA that you know is wait still waiting for their evidence to be looked at, submitted, taken care of, and it's they just get a I'm gonna call it a pump and dump. Yep, they just get a pump and dump, right? They just have button pushing report and they don't understand.

SPEAKER_00 8:37

I I just call it dump. You do it.

SPEAKER_06 8:40

I call it the same as you do, and it's fine. But it is what it is because so many people, there's so much work, right? We look at anywhere from 18 to 36 months backlog for so many agencies that all they can do is push out reports, and all they can do is say, Well, the tool said, or the tool said, can't tell you how many times we've listened to testimony where they say the tool said, and it's it's that's that's that's such a huge pet peeve.

SPEAKER_05 9:13

They say celebrite said, axioms said, and if you are testifying, you need to put it in your own words about what you figured out and what you saw. You never once, like at the beginning, you can probably mention all your tools, but while you're talking about all the things and why it's important, you don't ever need to other utter another tool name again.

SPEAKER_06 9:34

That's right, that's right. And so just trying to, I mean, really teach those examiners that it's not what the tool says, it's what you interpret from the tool based on the artifacts, because the tool can be wrong.

SPEAKER_01 9:47

Oh my goodness, oh all the time. Absolutely. I'm a and I'm a tool maker because I've made the leaps, and I got folks that from the community that work on that. And uh I I've been actually actually I have one of the folks saying, hey, um, there's some dealocation points that you might need to that you're missing, right? So it's it's either it might be wrong or it doesn't show everything, right? So just saying, well, whatever the tool shows me is what it is. Well, maybe it's not, maybe there's some points that still need to hit, right?

SPEAKER_05 10:16

It's the tip of the iceberg.

SPEAKER_01 10:17

Yeah, yeah.

SPEAKER_05 10:18

And it's what the tool parts.

SPEAKER_04 10:20

It is. It is. I mean, maybe we can say the tool led me to, and then I dove into those databases or dove into those files and found this additional yeah, it's uh we're we're saying in class that you know you are the data forensics tool, right?

SPEAKER_02 10:35

Yeah, you are the tool.

SPEAKER_01 10:37

Yeah, my wife might think I'm a tool, but that's that's different, you know. Um sometimes. I'm actually the forensics tool. I bet she's watching, it's like, look at this tool. Anyways, I'm sure she is.

SPEAKER_04 10:51

Um, yeah, no, couldn't agree with you more on that. I think uh the more that we keep talking about it and keep pushing it and keep teaching it, hopefully people will realize that maybe the dump is enough on one case. It pleads out the dump was enough. I I got what I needed. Um, but you will have that case where you have to go further and hopefully continue making awareness on that.

SPEAKER_01 11:14

I need to put pause on this thing now.

SPEAKER_05 11:16

Yeah, that's uh somebody's like, hi, this podcast is great. Yeah, yeah, I love it. We're live.

SPEAKER_01 11:21

Let me let me interrupt you. All right, right. So so in in the cases that you discussed throughout throughout um your different episodes, have you seen that be an issue of an examiner that comes in and says, Well, you know, I I just did what the tool said, right? How would that play out kind of in general in some of those cases that you discuss in the podcast?

SPEAKER_06 11:40

I mean, we just watched testimony recently where you talked about the the celebrite tool said and the tool stated, and it's and we had that conversation about the fact that they're just reading what the tool says, they're not examining or are articulating the artifacts because the tool being celebrite has celebrate said yeah, because it has a X here and it produced this output. And I mean, that's what they're reading, they're reading it as what it is. Yeah.

SPEAKER_01 12:20

I I wish, I mean, they're gonna I mean for obvious reasons we can't do that, but I wish we have like a view of the jury to see how they react to different testimony and from from any sides, right? And I'm not thinking I like to your point, we're trying to be you know unbiased and and be factual. Um, but see what the reaction is because I I can assure you that in if you go with that weak sauce, uh that you're gonna be like looking at you like all sorts of ways.

SPEAKER_05 12:42

Well, I don't think you sound like an expert. You're it might come off as like defensive. Well, someone's upset. You know, like is that the tone that they're hearing? They can't defend it, they can't render an opinion, they can't make it sound important or significant because they're like, well, you know, Becky said, whatever you said, okay.

SPEAKER_06 13:02

And I say it's deflection, right? It's putting blame on something else. So if my testimony is wrong, it has to be because this is what the tools told me.

SPEAKER_01 13:10

Oh, yeah. And there's nothing, I believe, worse than not taking responsibility for whatever it is, either be it good or bad, right? Yeah, if if you made a mistake or you don't have a type on your report, then you know, well, the the computer the spell check. No, no, you you who are the one doing the report. So own it, own it. And actually helps a lot um with how you come come across as a person that's believable, that's trustworthy, right?

Casey Anthony Defense Expert Surprises

SPEAKER_04 13:34

Yep, yeah, definitely. So let's roll back to your podcast and specifically the interviews that you've done. So you interviewed the defense digital uh the defense is digital forensic expert for the Casey Anthony trial. Yes. Um he revealed untold stories about the role behind the scenes. What was the most eye-opening thing that you learned from the conversation?

SPEAKER_05 13:54

Well, one, that there was a defense expert.

SPEAKER_06 13:58

Yeah, that's true. They never got called to stand.

SPEAKER_01 14:00

Yeah, it just got a secret, right?

SPEAKER_05 14:02

Uh secret uh and he was in a safe house during the trial um because he was afraid people would find out. The whole team was. So he was in the safe house. He did it for free. Oh wow, because he felt like you know, she was not represented and she was gonna need somebody to, you know, um even the case out.

SPEAKER_06 14:23

I would say I also found out that how attorneys are strategic that the process the state prosecution called the same expert, I mean the defense, I'm sorry, the defense called the same experts that the prosecution did. So they were their witnesses. So they called them up there and got them to speak to reports that they never even created. And it was just mind-boggling because that was so many years ago that I couldn't believe that all that information came out through someone else. You know, we're we prepare to the best that we can with who we're um called by, either prosecution or defense, and then to be called by this uh opposing counsel to come up there and now get evidence in.

SPEAKER_05 15:14

Got evidence in, and it wasn't just like contradicting what they said earlier, they introduced evidence into the state's witnesses as well as as the defense.

SPEAKER_01 15:23

Well, but but that makes the point that I mean we we tend to uh folks on on the prosecution side usually well I'm a witness for the prosecution, right?

SPEAKER_03 15:32

Right.

SPEAKER_01 15:32

No, you're a witness of truth, right?

SPEAKER_03 15:34

Yeah, yeah, right.

SPEAKER_01 15:35

That's what you are and we need, I think, as uh us that we teach folks need to convey that to them too. Like you're not a defense, like you don't have a uh like a like a horse to run in a race, right? No, you you are you're here to answer any questions, and uh folks it happens, we try to break that bad habit. When you're talking to the prosecution, you're all attentive. And when it and when the defense asks you a question, you're like, what do you want, right? Or vice versa, right? But that mindset needs to go away, right? And I think to your point, we are there to speak the truth, no matter uh who has the questions. I would treat the prosecution and the defense just as likely. I think some other countries, the expert is not even a witness to any party, it's uh services the court. Yeah, and it services the the the court, and they're there to provide expert witness to the court, not as part of any other of any side, it's not adversarial like that. Yeah, so in different court systems, different ways of being, but the concept thing applies in that sense that we're there to speak the truth no matter who's asking the question, so what points are trying to be made. Truth is true no matter what.

SPEAKER_04 16:41

That's right. It's really easy to have that demeanor though when they're coming at you.

SPEAKER_06 16:46

Oh no, yes, that's why you try not to look at the attorney, you just look right, jury, and just be and trout yawning, yeah. Try to mix it up when the yawns become or try to get them to smile. Yeah, yes, yes.

SPEAKER_01 16:59

And and I will say, uh personal opinion, of course, is how important it is for folks that like this gentleman say, Well, I think this person deserves a defense, and I'm gonna just put some of my time to do that, and that's fine. I I believe that I believe that my understanding of the constitution is that people have a right for a defense. And yeah, that's some that stigma that sometimes some examiners have for folks that do work outside of prosecution, prosecution, prosecutorial work. Uh something that I don't really I don't agree. I think so just kind of like an old school way of thinking that you die.

SPEAKER_05 17:32

Right. Everybody deserves a defense. Checks and balances, it keeps us all accountable on both sides in both directions.

unknown 17:39

Yep.

SPEAKER_05 17:40

So I think the other interesting thing that Larry Daniel knew going into it is he knew the discrepancy and the parsing with the Mork database that led to the 84 times versus the one time for the chloroform because it hits he knew that, and so that was part of their strategy baked into it going into it. So it wasn't like um the lawyer Jose Baez, wasn't it? He was not surprised when any of that stuff came out in the testimony, and he was trying to get that to come out sooner rather than later.

SPEAKER_01 18:11

Yeah, well, yeah. I mean, I'm I'm not gonna speak to the details of the case, obviously, but it's interesting in general sense, either prosecution or defense have a strategy, they have steps to that strategy and and they execute it. And and that's their thing. And if you're thinking I'll be smarter than a lawyer, don't try it. Yeah, yeah. Just speak truth, all right? And that's it. No matter what your role is in a case, and and forget about the rest.

Ethics Of Talking After Trial

SPEAKER_04 18:35

So, speaking of the cases that you talked about, recently there's been some chatter around the fact of what whether or not it is acceptable to discuss ongoing, active, or close cases. Um, and it specifically addresses active and close cases. So you've been interviewing witnesses in these types of cases. How do you decide when it's the right time to conduct an interview? And honestly, I'll I'll add a little to that. Do you or are you open to actually discussing active cases?

SPEAKER_05 19:07

Yeah, we're we're not going to talk about any cases that are like active and going or like currently in trial or haven't gone to trial. But if something has had a verdict rendered but it's under appeal, we are open to discussing that. But obviously, we're going to keep it along to whatever's been said in the court of law, so whatever's part of the public record. And if we do get a witness to come on, you know, we would expect their interview to stay in line with that. We wouldn't try to like draw anything out and corner them and make them say something that hadn't been said said yet.

SPEAKER_06 19:44

Yeah. We've um we've invited people to come on the podcast, and they have respectfully declined. Yeah. Um because they are the cases are either under appeal or they just don't feel comfortable on being on the podcast. They just um but they but they either respectfully um decline or they have a conversation with us. And so we we just want to keep it like that. We don't want to involve any active cases that would um allow a juror to the a potential juror to hear on a podcast and then their bias, right? Yeah, all of a sudden we have mixed that um up. So we we just choose um cases that we can research that are open, the information is open on the internet or wherever.

SPEAKER_05 20:35

And yeah, and I mean obviously Karen Reen was a big one because there was a lot of heated debate on that digital evidence. So, you know, we look for it from like two things. What one was it just an interesting case for whatever reason, or is there a lot to be learned from this case?

SPEAKER_04 20:49

Right, yeah. I feel like there was like an ongoing public podcast from the Karen Reed trial right on Twitter the entire time. I mean, it was just on fire with comments and people discussing the evidence and people discussing the witnesses the entire time. I think I think it's really admirable that you don't do podcasts with people in active active cases for sure.

SPEAKER_06 21:12

Yeah, because otherwise, those podcasts, they're already, you know, rendering uh uh a verdict in their podcasts about what happened. Right. They're not they're you know, they're not listening to everything. So yeah, we don't we don't want to bring up anything active.

SPEAKER_04 21:31

That trial specifically, there were people recording about the evidence and tweeting about the evidence or whatever it's called now. I don't even know if it's called tweeting anymore. But yeah, but I feel like if the same thing you said, if any of the jurors were able to go on and read, and I know they're not supposed to, but you never know what they're gonna be exposed to. I feel like that's really uh gonna play into decisions in a trial. Yeah. Absolutely.

SPEAKER_01 21:59

And and I Like that, you keep yourself to your own wheelhouse, right? Yeah, you talk about forensics, which is the things that you know, right? And what you see, a lot of people, and that's something that we shouldn't make that mistake or trying to opine on things that we're not have expertise on, because that could let Leos Australia would, I would think.

Mobile Forensics Cloud And Extractions

SPEAKER_05 22:15

Somebody was like, Oh, you should do this recently to me. They were like, Oh, do this case because it's got some great geofencing in it. I'm like, I am not touching that one. No way.

SPEAKER_01 22:25

Let me talk about uh some cell towers. Uh yeah, I'm not an expert in cell towers. I'm not an expert on focus.

SPEAKER_04 22:30

That's definitely something we're never discussing. Yeah, cell tower. That is not my thing.

SPEAKER_06 22:35

My co-host over here passed the cast. The cast discussion to me on the on Karen Redround. I was like, uh not Karen Redrout, but um when we were preparing the murder on Merle, yeah, she passed the cast. I was like, I was like, yeah, yeah, we're just gonna just kind of bring it up. Like they were there. I know cast guys, they're fantastic.

SPEAKER_01 22:55

And for folks that don't know, Cast is uh a group that does work um with specific cell tower triangulation, figure out where a device might have been at a particular point based on the cell tower locations and the communication of the devices, which again, really interesting stuff, but that's not my idea of expertise, so I'm gonna stay away from that.

unknown 23:12

Yeah.

SPEAKER_04 23:13

So question which was your favorite? Which which trial was your favorite to discuss on the podcast and why? Wow, I'm throwing a oddball out too, because I didn't even tell you I was gonna ask you that question.

SPEAKER_02 23:25

So I'm sorry.

SPEAKER_00 23:26

So totally unfair.

SPEAKER_03 23:27

It's okay. It's okay.

SPEAKER_06 23:29

I mean, we had some great ones. Um, just interviewing. I I can go back and Dave Freiman and Mark Johnson and Wayne Mitchell and Randy Stone, who's the chair for the cypher class.

SPEAKER_05 23:42

Like we did the BTK killer one um investigation, and um and then we got it wrong because the pub some of the there was like published books from special agents that were on the case that were wrong.

SPEAKER_06 23:58

Or about the digital evidence. There was information out there that was wrong, and so we did that podcast, and then Randy reached out to us and he was like, and this might not have been right, and this might not have been right, and we're like, Oh, let's do a you know, uh myth versus fact. Yeah, and so we rhyme. And he was able to clear up those myths versus facts, and so it just helped us to realize, yeah, we should do our research a little more, talk to people that work the investigation, and so that one was fantastic. Yeah, I think because he came back to us, we're like, you know what, we should try to interview people, see, let's see who will come on the podcast, yeah.

SPEAKER_05 24:39

Talk about their cases, yeah, and help everybody learn. Yeah.

SPEAKER_01 24:42

Well, I I love how that illustrates how volatile truth is. And in Data Friends, we're thinking volatile memory turn the computer off, goes away, right? But that's a that's a reflection of reality, right? Yeah, even though everybody saw that trial and everything, as time goes by and people start relating the thing, the actual facts kind of get diluted, right?

SPEAKER_02 25:02

They do.

SPEAKER_01 25:02

And and again, folks like you that now have now go back and say, okay, let's see what was the truth of the matter and how what can we learn from it today is super important.

SPEAKER_05 25:11

Right.

SPEAKER_01 25:11

So that's that's pretty awesome.

SPEAKER_05 25:12

Yeah. I I go ahead. I was saying, I still I think I kind of I mean, I've learned a ton from doing the Karen Reed case, but I think Casey Anthony is still my favorite because it was like you thought you knew how it all went down, but then once we dug into the testimony more, and then once we got John Bradley on and then worked out what happened and how it happened, I mean that was that was so interesting to finally learn how it all went down. Yeah. And what the attorneys did, their major role and how the digital evidence shook out in that case.

SPEAKER_06 25:44

Their strategies. I mean, learning from other examiners who have testified about the strategies of the attorneys and how they put them on the stand and use them for specific artifacts to be spoken about. And so just just know learning that through interviewing has been really interesting to us. Yeah, you are also the tool for the lawyer, the lawyer's tool.

SPEAKER_01 26:11

And they might make you look like a tool.

SPEAKER_05 26:14

Yeah, sometimes, and I think that's why like people want to come on the podcast, because there's so many things you never got to say on the stand. And so, especially if the verdict is rendered, there's no appeals, you can be like, this is everything that never got introduced, or I want to set the record straight. The media misinterpret stuff all the time. Yes, they do. If you've been in the courtroom and then you go and read the newspaper, you're like, were we sitting in the same courtroom? You know?

SPEAKER_01 26:42

So let me ask you this. Um I think we touch upon it, but I would like to ask you directly. Again, there's been some talk, folks say, well, maybe examiners that examiners or test witness have been in a case shouldn't be out there talking about the case after it goes, after it's finished, or whatever it is, either because there might be some confidentiality that's being broken ethically speaking, or not. What are your thoughts on that? Because that's some of some chatter that have been listening lately about it.

SPEAKER_05 27:10

Yeah. Well, it depends what you find first off. And then, like on my cases, I talk to the attorneys. I'm like, what can I say? Right. And they're like, Well, anything you said in court is is fine to say. And then, you know, keep in mind, you go outside of that, um, it's your butt on the line. Right.

AI Evidence And Court Admissibility

SPEAKER_01 27:27

Yeah, you're on your own.

SPEAKER_06 27:30

I think that I think we have to understand as digital forensic examiners, we're still ethically and professionally responsible for what we say and how much we say. And so I think um that's why we see so many humble forensic examiners not speaking on behalf of all their hard work. And so, but then you see other people maybe over speaking on maybe a part, uh a piece to the investigation, and then it gets taken out of context or it gets um reconstrued on how it was represented. And so I think being able to have one stay in our lane and be professionally and ethically responsible with our communication on a case is important.

SPEAKER_01 28:18

Yeah, yeah, and we we've seen many folks maybe going beyond what they should have said and then really getting in trouble about it. At the same time, I my thought I was discussing this with Heather during the day as we're preparing for the question, the interview, is that this balancing of well, there's things that happened, right? And that we might not be able to disclose, but at the same time, cases are in court, and court is public. Anybody can go and sit at a courtroom, any courtroom in any case. I mean, there's certain little exceptions, but for the most part, it's public.

SPEAKER_05 28:53

It's recorded, yeah. You can download transcripts sometimes and exhibits sometimes for free, or sometimes a small fee. So, I mean, you can get access to that data.

SPEAKER_04 29:03

And the the jurors are told you can now speak about this, you can go do interviews, you can you can tell your family that what happened with the um with the case throughout. So, I mean, I I I just feel like it it is public record when a verdict is rendered. Um, and obviously, if things weren't shared during during the court proceedings that that you may have access to, that's off limits. But anything in court.

SPEAKER_01 29:26

I mean freedom of speech doesn't go away because you were in a in a in a court in a courtroom, right? Yeah, yeah. But again, it's I guess exercising that judgment, proper judgment in regards to balancing my freedom of speech, the fact that the information is public record versus the points that you're just making in regards to maybe going beyond and and and then at that point.

SPEAKER_06 29:46

There's there's humble and there's humbleness, right? And then there's boasting and exaggerating, yeah. And um, you know, basically um inflict inflicting like more information than you really knew or had.

SPEAKER_05 30:01

So well, yeah, or even like um phone numbers, like sometimes you're in the exhibits in the courtroom, and sometimes they're shown on the TV screen and sometimes they're not. So if you're gonna like show old exhibits, um redacting. Yeah, do you need to redact those phone numbers? Hopefully, all those people have probably changed their phone numbers by now, anyways.

SPEAKER_04 30:24

You're in the Karen Reed trial you did.

SPEAKER_05 30:26

Yeah, you know, stuff like that, but like also sensitivity to okay, in the courtroom you had to show these horrible pictures, but do you now need to go around showing that victim's picture on all of your presentations? Probably what value is it gonna add, especially as like a forensic examiner. We're here to learn about the facts and the artifacts. How can we find that evidence? I don't need to know what that picture looked like. Tell me how you found it. Let's talk about bits and bytes and offsets and the significance of it and why it mattered.

SPEAKER_01 30:57

Yeah, exactly.

SPEAKER_04 30:58

I think too, like, so if we took that off the table, we took speaking about cases when they're done in court off the table. How are we gonna learn from them? Yeah, we the case studies, when we go to these conferences and case studies are put on, or we're just teaching a subject, and I'm like, oh, I had a case and this is what happened, and this is how it relates to that data structure or that type of data that was found in the instruction. It's used as a learning tool in the industry too. And I really feel like we would be limiting ourselves if we didn't share court cases that happened. Yeah. I hope so.

SPEAKER_05 31:30

I was gonna say, I hope somebody, you know, is like listening to our podcast and they're, you know, and then they're working a case and they're like, you know what? I don't remember exactly what was said, but I remember like it was often misinterpreted or difficult to parse out or something like that. And then hopefully they will go and dig a little deeper instead of taking something at face value because they remembered hearing something. I remember, you know, that was a pain point.

SPEAKER_01 31:54

Well, and and you're reviewing some of those uh these are forensic points, also it models uh good behavior for examiners. Hey, look, this was effective, it was presented in this way, and this is the reason. And then folks like ourselves can go back and I haven't been in a trial at that exposure level, but if you learn from it, right, you should be able to function at cases that are not as um, how can I say, although that's such a microscope, right? Yeah, right.

SPEAKER_06 32:17

So right. And then going back to it's our responsibility as forensic examiners to educate the prosecution or the defense on the artifacts so that they don't misinterpret them when they're asking us questions on the stand. Um, because we're as I had um been told by an AUSA once when I went to testify, he says, don't be nervous. Yeah, okay.

SPEAKER_00 32:42

He said, Don't be nervous or don't, be nervous. Which one, which one is it?

SPEAKER_06 32:47

Don't be nervous.

SPEAKER_00 32:48

Or don't. No, be nervous.

SPEAKER_06 32:49

Yeah, and he said, because you know the most about this case, and I need you to go in there and tell a story to the people that don't know it.

unknown 32:58

Right.

SPEAKER_06 32:58

The judge, the jurors, these people don't know what you know, so be a storyteller, right? So, you know, a lot of people like the technical side of it, but it is truly an education side of it too.

SPEAKER_04 33:10

Yeah, definitely is, definitely. All right, so mobile device forensics is evolving rapidly with encryption and cloud data. What do you see as the biggest technical frontier or challenge facing examiners right now?

SPEAKER_05 33:24

Can we take that one? Me, my love of of iOS. Well, because I do civil work, I probably see something a little different than you guys, um, which is like e-discovery companies have come into the mobile forensic space, but they don't understand the differences between the extraction types, they don't understand what files come with what, and so they're getting the wrong extraction, they're not getting the evidence that is needed, and they are like ruining their own clients' cases. Oh, yeah. And um, it's just detrimental all all the way around. And I have one case where it was kind of not great for both sides, um, and they just don't know what what they're doing. So that's kind of a a different um thing than you guys might be seeing.

SPEAKER_01 34:12

Well, and that that that's that's why I love that question because my visibility into kind of the outside, how it's applied outside of strictly law enforcement, it's so limited. And I think a lot of the audience might come from from our your previous background and our current situation, and and that's something to also consider and learn from.

SPEAKER_02 34:28

Yeah.

SPEAKER_01 34:28

Right? How does that knowledge gets now transmitted across to other parts of the digital forensic practitioner space, right?

SPEAKER_06 34:34

Yeah, right. And then also the old-timer disk analysis versus a lot of it lives in the cloud now. Yeah, so if that's true, if you're only looking at the disk, if you're only looking at the you know, that um forensic image, you're you're missing the connection with the cloud. And so being able to uh explain that in uh communication to uh let's let's go ahead and preserve the cloud data and and get that pulled back as quickly as possible, too.

SPEAKER_01 35:07

And even outside of ourselves, I say ourselves the forensic examiner groups, the cohort of groups around the world, it's leaning the clients on your end, I would soon understand that. But even to this day, telling you know, investigators hey, you know, I know you spend a lot of time doing the search warrant and doing these things, you have to do one more thing. There's one more paper I have to put in to make sure you preserve it, and then you search warrant it or whatever it is. Yeah, and and uh we have to do that, even though it's not it shouldn't be my position to be reminding the investigator, but I do it all the time, and and we have to do it.

SPEAKER_06 35:40

And again, educating them, right? Yeah, because they don't know where the digital evidence lives, right? We know where and if we aren't doing our due diligence to remind them to go get that do that digital evidence, it could, you know, it's not due diligence.

SPEAKER_01 35:54

No, there they're being well again, no details on cases, but many cases where uh being able to have the probable cost on the device to reach out to the cloud actually was able to find that missing piece or smoking gun to actually be able to solve that case successfully. So important.

SPEAKER_04 36:09

I think your your point in the civil um where you know the education on the types of extractions, that that's in in law enforcement. I've been trying to educate prosecutors when they get their final product, right? And this is everything on the phone. It's everything. The the investigator told me it's everything on the phone, and it's a logical extraction from an iPhone 15. So it's it's everywhere, it's everywhere. And uh a couple people in my office, we've been actually going around and talking to our prosecutors to try and try and um get that point across. I wish there was a way for us to like public service announce it to everybody involved in the digital forensics chain, right? Well, they just need the tool vendors need to change.

SPEAKER_05 36:54

The default should be full file system extraction, and you can only ever get an advanced logical if a full file system extraction isn't available. Right, right.

SPEAKER_04 37:02

Oh, so we're gonna just like block it out.

SPEAKER_05 37:04

It's not even enough. Just lock it. I'm sure they're um rolling over and just swearing at my name right now.

SPEAKER_01 37:09

It won't be unlocked until it fails first.

SPEAKER_05 37:12

Yeah, I love it. Well, because that impacts a lot of other things, because then they're trying to say, oh, we'll just collect um these 10 emails and these four text messages. And you know, and then you're like, but then I don't have any of the other data that I will undoubtedly need later to show the full picture. Exactly. And then on the civil side, you have problems with um the client, like everybody, nobody wants to give up their devices. Right, right. Well, if you want the best chance at your case, you're you know, you're you're gonna need to hand it over and it's gonna take some time, and I don't need to know how long. And then just like you have the problems with, you know, logical versus band's logical versus the whole file system, I struggle on the defense to get something besides a celebrite reader report. And we go that my I coach my attorneys with what to tell the prosecutor, and they're like, No, that's good enough. You have everything. And I was like, I assure you, I absolutely do not have everything.

SPEAKER_06 38:14

That's a conversation and you and I had just you know, about uh six months ago, and I was like, I I I need to get more data, and because all I have is a celebrity reader, and we had a big conversation about make them give you that image.

SPEAKER_01 38:30

Well, and and and and I did and I'm I feel really comfortable in saying that discovery obligations, I guess. I don't know, I don't I don't understand discovery obligations on their on the civil side. I don't understand them, so I'm not gonna go there.

SPEAKER_02 38:43

It's whatever the lawyers negotiate. That's discovery.

SPEAKER_01 38:46

Yeah, I'm not familiar with that. But I I I always as part of I've been trained, I keep all my work, all my traction, all my evidence, and that's that's that's provided. Like it it has to be that way. I am more than happy to receive examiners come into my office, and some evidence cannot be provided for them to take home.

SPEAKER_05 39:05

Right, right.

SPEAKER_01 39:05

But they can they're they provide them the space, the resources. Uh I want to make sure.

SPEAKER_05 39:09

I also have the horror stories all about that.

SPEAKER_01 39:15

And uh and it's it's to me, it's such a shock that that there will be some pushback on that on on either side, right? So again, that's that's something that hopefully as time goes by, and and this is my opinion, the examiner community skill level gets up, goes upwards in a general sense. I'm gonna say that I think there's a question about that that was coming up. Um the I I believe that uh the the the it's not formalized. You got folks that have no degrees in in the UTA for instance, like me, because I didn't exist. So we have a lot of training certifications. Oh, literally, that was not a thing. That did not exist. But now you require folks to come in with a degree. So there's a lot of variance on how much how trained are we, right? So maybe as we all kind of achieve this kind of uniform level of competency, then we can push forward for folks to be able to kind of do things uh in a more efficient, better, more transparent way. I would I would like to believe.

SPEAKER_04 40:14

You think we're going to achieve that level?

SPEAKER_01 40:20

I mean, I guess I guess if if we don't, they will force us. So you got yeah, you got you got feels that the the like you're a doctor, right? You gotta pass the bar, not the bar, so lawyers. But still, lawyers is the same, is it the same thing. They have the bar, the doctors have whatever doctors have. Maybe it's not a bar, maybe I don't know, maybe it's a kitchen. I don't know. Yeah, exactly. A medical board. Yeah, the medical board. Thank you for saving me there.

SPEAKER_06 40:41

I will watch a struggle.

SPEAKER_01 40:42

Yeah, thank you for letting me wonder about. And it's you know, it's like kind of mandated, right? Yeah, there's no uniform standard. I know Brett Shaver's uh talks a lot a lot about this, and you know who Brett Shaver is, you need to go Google him. Yeah, he talks a lot about it. So either us as a community and as an industry start putting those requirements out, or external entities will impose it upon us, and then who knows how's that gonna work?

SPEAKER_04 41:05

Yeah, I think eventually it will be imposed upon us, hopefully not in a bad way. That's right.

unknown 41:11

That's right.

SPEAKER_04 41:12

Um, okay, so where do you see the field of digital forensics in 10 years, especially given the rise of AI-generated content and encryption? And let me just say, we couldn't have a podcast without mentioning AI. I really apologize.

SPEAKER_01 41:26

But well, the good thing is that Becky's really diving deep in all those issues. So I'm so glad that she's gonna she's ready for this. Oh, yeah. Okay, I know she is.

SPEAKER_06 41:35

So um for those that don't know, I am a PhD student too. So soon to be Dr. Becky. Oh, very long. Well, I don't know. One of the we have to finish first. But um, so I I I I I live in the community, right? So I pay attention to what's being said and what's being done. And so I have um started my dissertation um thesis and done it, um, started my research, and um I have chosen to focus on the area of the the admissibility of evidence that is AI. How is that affecting that admissibility of evidence through our Dobert and our 702 evidence, especially since that amendment in 2023? And so I have started a my research paper to you know define that those boundaries of what should be accepted and what should not be accepted, and the mere fact that AI can't testify. So it still takes a human to sit on that stand and tell what AI told you. It's no different from well, the tool told me what AI told me, right? And so I have started that and I will be looking for participants to help me with the research, right? Because I will have um data sets that will be designed to use human only, so uh our judgment, and then AI assisted, what different models produce the results, and then AI only. How can AI only be the judgment of this data? That's really so so um that's my that's my research, and uh it'll be for the next year and a half.

SPEAKER_04 43:29

So I want to read it now.

SPEAKER_00 43:32

What are the answers? Tell me.

SPEAKER_04 43:35

Just put it into the chat.

SPEAKER_00 43:39

There'll be answers.

SPEAKER_06 43:42

Yeah, it's it's a very interesting. I have um there's a big gap. Like people have done study on triage. You know, I know, you know, there's back in twenty fourteen there was a study on the fact that the data was overwhelming and backlog and all that stuff. And that's no different today. Right, right. But we also have to be mindful of the fact that you are you're dealing with evidence and you're going to that's gonna have to make it into the court of law. And if you're only using AI and you're letting AI interpret it only, then there's gonna be a an issue. So um yeah, I'm I'm excited about um sharing that with you guys. Yeah, that's it.

SPEAKER_01 44:20

It's it's it's frontier uh investigation or research because there is n uh I haven't heard of any work really being done at uh um academic level on any of this that is extremely necessary. There's a lot of things have been going on, but I'm really again super looking forward to it.

SPEAKER_04 44:37

You may not be able to answer this because you're doing the research now, but are you will you be implementing any of like the digital forensic tools in or just testing the models behind the digital forensic tool?

SPEAKER_06 44:48

So testing the models, yep, but also testing some tools that are incorporating those models and also um putting together the questions to say, how did you study it? Because if you use a model, you use a model, and you use a model, do they all interpret the same thing? Right, right, and so so just trying to develop those uh qualitative, quantitative questions, and then do the testing to human AI and AI assistant. That's so cool. Oh, I can't wait.

SPEAKER_02 45:20

I cannot go, go, go, go, let's get it. Somebody's waiting for it.

SPEAKER_01 45:27

Yeah, I mean, see, because I mean and folks that that listen to me talk, I go a lot about my experience and intuitions, and that's great to opine, but that's all it is, right? Uh uh hard research, that's where it's actually at. And uh, and look, uh I talk a lot, but I'm more than happy to say I'm wrong. And the research shows something else, then that's what the research shows.

SPEAKER_06 45:47

And and we all know that um we do triage, we do triage data. Oh, yeah, definitely um cases where you need some you need something right now to move a case forward, like we get it. You can do the triage data, but is AI the answer for triaging that data, or do we have sufficient tools to triage the data to get the results, or do we have a combination? Like, what is the end result there?

SPEAKER_01 46:18

Yeah, I'm super interested in the whole your Daubert analysis. Yeah, me too. So uh I'm super interested in that.

SPEAKER_06 46:24

And especially since there's um Dobert and there's Mona Tires, um, where it also is it part of research where being used very similar to like Daubert and then the 702 evidence that had an amendment in 2023.

SPEAKER_01 46:40

Oh, how that impacts all those things.

SPEAKER_06 46:42

Yeah.

SPEAKER_04 46:48

I'm super excited. You need to get working. A year and a half is too long.

SPEAKER_06 46:55

A year and a half is when I finish, so it'll be until next.

SPEAKER_03 46:58

Yeah, yeah. Yeah, a year and a half is when I finish, so it'll be in the next uh eight months.

SPEAKER_04 47:05

Very cool, very cool. Yeah, I'm really excited.

SPEAKER_01 47:09

Well, again, we cannot thank you enough for uh for being here and talking to us.

SPEAKER_06 47:15

No, we appreciate you having us great to sit down.

SPEAKER_04 47:18

I'm glad we're all in the same place at the same time to make it happen. Yes, definitely.

SPEAKER_01 47:22

So please, if again, if you're not familiar with the the podcast, go follow them, listen to them, go comment on the social media um after we do some of the editing. I'm gonna put uh that on the notes.

SPEAKER_02 47:35

Yes, and by me, I mean Heather the link will be in the notes, yeah.

SPEAKER_01 47:39

Because she helps me because I I'm I'm I'm an idiot in some things. So we have those links for you. So call the podcast.

SPEAKER_06 47:45

Yeah, and uh if you're at IASUS, come see us. We have stickers.

SPEAKER_01 47:50

Oh, yeah, yeah, let's just do it. No, she gave me some already. Any parting words?

SPEAKER_06 48:00

Becky, thank you so much. You guys' podcast is amazing, and we like to listen to it and learn. I'd love to hear all about that. The tools are not the answer. Definitely examiner is the new tools, can do what new thing that we need to like give a world. Yeah, so we appreciate you guys bringing that um to to the to the podcast and to the community. And thanks for having us.

SPEAKER_04 48:23

Thank you so much. Same right back to you. Love the podcast, it's awesome.

SPEAKER_01 48:27

Well, without this love here, now sharing it to you. Thank you for the folks. I apologize that I couldn't read some of the message as we usually do because the computer's all the way out there, and we're all the way over here. So uh so now you'll see me in the show, like uh get into it. But um, we will read those comments. Uh again, yeah, uh you know, our audience knows you can reach us at our LinkedIn and our social media pages. And as always, thank you for watching. Take care and have a good night.

SPEAKER_03 48:56

Thank you. Bye. Any any second now. I'm still here. No, I'm not.