Digital Forensics Now
A podcast by digital forensics examiners for digital forensics examiners. Hear about the latest news in digital forensics and learn from researcher interviews with field memes sprinkled in.
Digital Forensics Now
Getting Our Tools Together
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
We come back from a busy conference stretch and go hands-on with new digital forensics tools that speed up real workflows across vehicle, iOS, and Android investigations. We also tour major updates to LEAPPs and LAVA, show how Batch LEAPP changes multi-extraction processing, and end with a hard question about validation that every examiner needs to take seriously.
Show Notes:
North Loop Consulting: Sedgwick and NCL Spectator https://northloopconsulting.com/
Crush Digital Forensic Analysis Workbench: https://github.com/kalink0/crush-forensics
LEAPPS: leapps.org
Welcome Back And Life Updates
SPEAKER_03Welcome to Eat of Forensic Now podcast. Today is Friday, July 10th, 2026. Eat of the episode 6. Here with my uh online classes. My name is Alexis Greg Twin Tony, and I'm accompanied away by the tablets, the amazing Nat Blue Pair, EtaPlensic expert, the controller of our tool, more orchestrator than bar, and away off the size than ChatGPT, the one, the only, the irreplaceable Heather Calvin Peter. The music is typed up by Jane Ibert and can be found at GilbermanTown.com. Heather. What's going on?
SPEAKER_08Hey, hey. Long time no see. Well, not really, but long time no see to everybody for the podcast.
SPEAKER_03That is true, because we've been uh I'm gonna say we've been really busy as opposed to slacking. How about that?
SPEAKER_08Yeah, or slacking. We we've been slacking a little. But busy too.
SPEAKER_03All right. So people are uh you know, people are coming into the chat. Let me know if my mic is too low, what's going on, because we were having this discussion before the show. Um so is this is this too low, let us know.
SPEAKER_07Yeah.
SPEAKER_03So uh Johan is there, Johan is the man. We got some uh some good stuff coming up uh in the show, but I'm not gonna say it yet. But before we go into that, so Heller, what's been going on in our absence to the show? What's been going on in your life, in my life? What's going on?
SPEAKER_08Uh so we did all the conferences and got that all out of the way, right? We did some live stuff from the conferences. So you all got to still see us with the live um uh interview with the truth podcast or the crime podcast and the live with MSAB, that was a little earlier in the year, and then live from techno. So we've been doing a lot of stuff, which has kind of led us to not be as regular with the episodes, but we're back and let's see if we can make it a little more regular going forward, right?
SPEAKER_03You're right, we we have to. Hopefully, after the big conference season. Heck, I was doing uh a podcast, well, not a podcast, a webinar about AI, and it was pretty good with Brian Carrier, Heather Barnhardt, um a few of other folks um uh about AI. And I was like, this what Wednesday? So if you go to Sleuth Lab Labs there, you can find that that uh we'll put the link later.
SPEAKER_08Oh yeah, remind me, I'll put it in the show notes at the end. I haven't gotten a chance to watch it yet. Um I gotta get to the recording.
SPEAKER_03No, it was it was really good. It was a good conversation. Pretty much the gist of it was that people put in examples of good use of AI, AI in the context of LMs, and then bad uses, and then we kind of spoke about them and kind of judge them and selected some winners for the best different categories. So that was that's a lot of fun. So people can check that out.
SPEAKER_08Very, very cool. Um, yeah. So I mean it's been it's been busy, and we we were both talking recently, and we're like, okay, we have to do an episode. So I said, All right, we're gonna be held to it for Friday. I'm gonna put it on the page, and then we can't turn back. So once we publish the date and time, we have to stick to it.
SPEAKER_03So no, we have we have to go. So so let me tell you a couple of things I've been doing on my time off. So yeah, the first is a nerd alert. This is an FC card, and I put a sticker of mine on it, and you press to your phone, and it takes you to my uh to my uh kind of my CV resume personal homepage, uh, github.io page.
SPEAKER_08You better be mailing me one of those.
SPEAKER_03Yeah, yeah. And then I and then me, me, me having because they're cheap, right? You got you buy them from Amazon, whatever. So I did a whole bunch that take you to all different places, like the the leaf and different leap releases and the podcasts and the website, and then some of mine, different colors. Oh my god, it is nerd alert. Say what?
SPEAKER_08It is nerd alert.
SPEAKER_03I mean, this is a nerd, this is a nerdy show. I mean, I mean, I apologize for the folks just listening and not watching. You should this is an episode that you should watch because we'll be showing visually stuff. So I I do apologize if you're just listening. We'll try to be as descriptive. See, yeah, you know, I I think your sister wants one.
SPEAKER_07Yeah, so you better mail me two then.
SPEAKER_03So uh, but no, it's it's pretty neat. I've been playing with NFC stuff. I mean, it's not new technology, it's all technology, but I just think it's fun. Anyhow, yeah, and other than that, then I did a lot of dancing. Uh Orlando salsa Congress last weekend, so I'm still recuperating for the event. It was so much fun.
SPEAKER_05Uh I saw all the videos.
SPEAKER_03Yeah, um, Instagram, forensics at Arignoni.
SPEAKER_08Yeah, if you're not following on Instagram, if you want your dose of forensics mixed with dancing, you have to follow Alexis on Instagram and you'll see instead of chips and salsa, it's forensics and salsa.
SPEAKER_03There you go. The most literal sense.
SPEAKER_08I said just dancing because I forgot if it was salsa, but you do bachata too, right?
SPEAKER_03I do, I do both, yeah. See, salsa and bachata, yeah. Yeah, yeah, yeah. I'm working on it.
SPEAKER_08That's awesome. Oh, you got little dancing icons in the chat.
SPEAKER_03Yeah. Right. All right. So uh, so yeah, so let's get uh beautiful, beautiful. That's me and the wife. All right. So uh so yeah, so enough about us. You know, yeah. I know truly interesting, but enough about us. What's going on? What do we have uh on top of the show?
SPEAKER_08Well, before we move on, computer chips and salsa.
SPEAKER_03Oh, so see, the thing is that now Kevin being a dad, he has to go, you know, dad jokes.
SPEAKER_07Oh, well, yeah.
SPEAKER_03So uh he can he's now allowed to make that joke. Actually, he's required to throw out dad jokes because he's a bad man. So thank you, Kevin, for upholding the traditions of dadhood.
SPEAKER_08Definitely. So this episode is gonna be uh heavy on like new tools and um new developments in a lot of the open source tools, a couple of tools that are um paid as well, but they're fairly inexpensive. So um, again, like Alexis said, if you're listening, this may be an episode you want to switch over to YouTube and watch because we're gonna actually show some of the tools and then we're gonna take a walk through the leaps page and talk about everything that's brand new with the leaps because there's so much going on. The uh development team of the leaps has been working like overtime and a lot of new cool stuff has happened. So that's the plan. So let's hop right into one
NLC Spectator For Vehicle QNX
SPEAKER_08of the tools. So the first one I'm gonna show is from Charlie Rubisoft. So he has a web page called North Loop Consulting, and he has a bunch of tools on the page. So I just want to take a minute to talk about them because a lot of them are free. So there's a lot of um free tools that he offers. He has Arsenic Mobile. So if you've never heard of that, that is an open source mobile device triage tool that you can get right on his site. And I'll have the link for his site in the show notes at the end. Um, he's got other tools. There's one that is a BitLocker key finder, there's another one that's used to process Cash App legal productions. He's got another one that parses extractions of vehicle key programmers. Um, he's got some unzipping programs that just help with those uh returns from different service providers. So check out his website because all of the free tools are there. And then the two tools we're going to show you today, uh, they just have a small yearly fee that go along with them.
SPEAKER_03No, that's a lot of a lot of like niche stuff, but that's really useful. It's really really useful. Um, the whole programming thing, I would never never thought. But that was me either use, yeah.
SPEAKER_08I know when I was typing up like the different tools that are on his site today, uh, yesterday, actually, um, I didn't even know he had that one. I'm looking at it, I'm like, oh, that came out of a case that he needed it. Um because nobody's nobody's doing that until they need it, right?
SPEAKER_06Yeah, yeah. So absolutely.
SPEAKER_08Yeah, so there's a bunch of really cool free tools there. Um, I haven't actually tried the arsenic uh mobile device triage tool either. I've seen people put posts about it on um on LinkedIn, but I haven't actually tried it. So I'm excited to try that one too. I just didn't have time before tonight.
SPEAKER_04So no, good stuff.
SPEAKER_08Um, so let me share my screen because the first one we're gonna talk about is called NLC Spectator. And what it is, is it's a forensic image viewer, but it's got some cool features. We haven't done a podcast in so long that I'm forgetting how to share the screen. There we go. I know. I know. All right, so NLC Spectator, you see here on the screen, it's um a tool to bring file system support for Windows. So the example that I'm gonna give for this tool, and the reason why I personally love it, um, is because you can bring in vehicle extractions. So let me let me back up. Vehicle extractions, a lot of time are the Q and X file system. Nothing recognizes the damn QNX file system.
SPEAKER_03Um except Linux, but you have you have to actually put commands in, which obviously everybody's allergic to the terminal. And for some reason, people see terminals like ah, they freak out.
SPEAKER_08So they are, they're allergic to the terminal, and you have to actually take the file system, you have to bring it to a Linux machine or a virtual machine with Linux, you have to do a bunch of things um to prepare it, and then you have access to the logical file system and you can pull those folders out. And actually, if you want to do it that way, uh Lexis has on his YouTube a walkthrough on how to do it. I've used it a whole bunch of times. But this NLC Spectator, all you have to do is bring the QNX vehicle file system or extraction, I'm sorry, in and it will automatically recognize. So if you look um up here where it says basic data partition, it'll automatically recognize that it's QX. For the purposes of this presentation, I didn't have I don't have a vehicle extraction handy that I can use. So I just pulled in a Windows E01.
SPEAKER_03And you can see and before you saw that, you should say a couple of things there. So so folks can visualize it. The program typical program screen, I love that it's dark. Is it like dark the whole time, or it's just like dark mode?
SPEAKER_08I did that for you, but this is my mode right there.
SPEAKER_00So bright, turn it off, turn it off.
SPEAKER_03Thank you. Oh my god, I'm I'm a vampire. I I can't I can't deal with light mode. All right, so yes, dark mode, thank goodness.
SPEAKER_08Yeah, I preset it for you.
SPEAKER_03Thank you for thinking of you know me really well, obviously. So, yeah, so and you know, kind of uh red accent, it's really nice. And then left you can see um kind of the main route of the file system and then different files. So go ahead.
SPEAKER_08Yeah, so I mean you can navigate through the file system like you would with a forensic tool here. We can navigate through um and take a look at the file system. The best part um for the vehicles, though, is it automatically identifies your Q and X as well. But then in your vehicles, you'd have all the partitions like you see here on the left-hand pane in this Windows. Um, and then you can export them. So you can choose which partitions you need or which um which areas of the extraction you need. And there's this little um save selection to disk, and you can save it out. Um there's other, let me see what other options I got.
SPEAKER_02The file, the file itself or the folder, or what's it say?
SPEAKER_08Uh you can do either way.
SPEAKER_02Oh, nice.
SPEAKER_08That's it. Yep. Um, you can do searches. So if you're looking for specific data, I don't know, in a vehicle, I would think like Bluetooth or something, you can do a search across it. Um, I'll just do this. Is probably gonna get a lot because I see it's a username. But so it just brought me to the users, um, the user's partition here when I searched Joe. Um, there's some advanced features that I haven't really played along around with a lot yet, but you can um you can set date modified, you can do uh regex searches across it, you can do content searches, you can do a scan for the through the full file system. Um, so it's a really neat little tool. Um, and if you do a lot of vehicle forensics, it's $199 a year, and you don't have to do that whole Linux, that whole Linux process, which I mean.
SPEAKER_02Instead of instead of taking terminal clarity, you're gonna take uh you know termin uh terminal analysis spectator so you don't have to deal with the terminal.
SPEAKER_08Yeah, right. So I feel like I I feel like I'd pay $199 to just not have to deal with the Linux. And actually, I did.
SPEAKER_03And I'm happy for it. No, I mean I I I'm okay on the side. If this if your workflow doesn't involve using uh Unix or Linux computers or whatever, and so when your lab is all Windows-based, then it's a good uh you know solution. Again, you know, we we we don't uh endorse or not endorse, we'll just show you what's here. But you know, as folks can see right now, as Heather is kind of adding and you know navigating uh through the uh the program, uh it enhances your workflow and you don't have to leave the workflow that you're used to. So there's there's uh a benefit to that.
SPEAKER_08Right. Yeah, so check it out. Um really neat little tool um that I think could be helpful in a lot of people's workflows.
SPEAKER_03So I want to say real quick hi how to how to uh Derek.
SPEAKER_08Hi Derek.
SPEAKER_03He's the mastermind behind the beautiful uh leap logo, so it's always so good to see him around. We I need to talk, Derek. I need a I need a logo for batch leap, which I'll talk about that later because the one that I have now is really crappy. So uh I'll I'll hit you up later.
SPEAKER_08Yeah.
Sedgwick Makes iOS Biomes Usable
SPEAKER_08Um the next tool, I'm gonna just stick right with Charlie. Uh so Charlie Rubisoff also has a tool called Sedgwick. Um, what this tool does is it handles Apple's biome artifacts and it interprets the binary P lists and the protobuffs that you find inside of biomes. Um, I'm gonna do another screen share and show that tool. Let's see here. Entire screen. So this one, I'm sorry, I'll show you the dark mode real quick, but I gotta leave it in the light mode and I'll show you why. Um, so if you do view toggle to dark mode, when I click on these different artifacts, it's really hard to see in the dark mode up on our screen for the podcast. So I'm gonna blind everybody and leave it on the light mode just to show the artifacts. So what I did here is I already processed this because it takes a little bit of time and I'm not gonna have everybody sit and watch it process, but I pointed the Sedgwick tool at uh one of my test extractions, iPhone test extractions, and it goes through and processes all of the biome files. So all of the app in focus, all of the screen time, all of those good biome files. And what you see here uh is the timeline view. So this is a timeline view of all of those different biome artifacts. So you can see here I've got the app in focus, and we've got the data here. Um, app usage, we've got the app usage information. This is the table view, and then there's also a tree view, which I actually like the tree view. So you can pull these up, and then you can just look at the ones you want to look at. If I want to take a look at app in focus, I can drop it down and just see the entry for the app in focus here.
SPEAKER_03Okay, let me let me just let me just cover real quick. Yeah. So folks that are just listening, the tree view is interesting because uh all the biomes, uh the the records within a biome will have a timestamp, right? So the way that uh Charlie organized the tree view is it has a timestamp as the main uh record holder there, right? And then as you click on it, uh you have the time in UTC, you have uh you know different different conversions of the time, and then different uh in fields within that record that show, which again is really convenient because now you have them all like stacked up and you can open and close whatever it is that you need. So that's kind of the how is it organized, which again it's it's pretty nice. You can collapse and uncollapse whatever you're trying to see or not see.
SPEAKER_08Yeah, so that's the that's the tree view for the timeline. And like I said before, this is all of those biomes um from the iPhone of my test data. But another, and actually, let me talk a little bit about the other fields that are here and available, and then I'll show you the other feature. So you can search across them. Um, you can pick which categories you want to see. So if you're only interested in seeing the app in focus or the app install, you can deselect everything and just choose app install um and then hit apply. And now we only have the app install artifacts. Um, if you're just looking to see that. There's um a date and time uh filter here. So you can set a filter for which date and time. So if you have, if you're working law enforcement and you have a time range specified in your warrant, you can actually set that time range here on the filters. There's some checkboxes where you can hide the deleted, you can hide the tombstones, you can show tagged only. So if I check mark a few of these and do tagged only, I'm now only seeing those entries that I have checkmarked. I checkmarked a few earlier. So um you can hexazki, and then there's a decode timestamps option here as well. Um, so let's see. I'm going to clear my filters. Oh, and also there's this time uh, I guess toolbar up at the top where you can use the plus and minus to zoom in and focus on specific time frames, or maybe where you see more activity.
SPEAKER_03Little bar columns. So the more activity on a day, the higher or lower that uh that column is. So it's like a little bar graph that extends through a timeline and you can zoom in and out pretty neat.
SPEAKER_08Yep. Um, there are options uh here to export too. You can export the whole timeline. If you're gonna do that, it's got a lot of records and there's a limit to export a hundred thousand. Um, I don't want to give a report that has a hundred thousand records, so you're probably gonna be choosing, you're probably gonna be choosing tagged um artifacts, which there's one here, export tagged entries. So if you just choose export track tagged entries, you can do it that way. I'll show you the report here after I already created a couple. Um and you can also change your time zone, which I love because UTC, blah.
SPEAKER_03Get out of here. And you know what? You just lost two uh points of your data forensics experts card.
SPEAKER_08I know. I think you and you and Kevin are rolling your eyes at me right now, aren't you?
SPEAKER_03I'm actually looking at my brain now. I can see my brain now, how how hard I rolled them into the back of my head.
SPEAKER_08Um so another cool feature of this tool, if you there's an investigative analysis tab. So if you click on that, we now have the segBs that Charlie supports in this tool parsed. So I'm gonna just click on contacts, and I think I'm already on it. Um let's just choose URLs so we can change it. Uh hold on, I'm on all. Ah, there we go. So I chose Wi-Fi and Bluetooth. When I double-clicked on the Wi-Fi and Bluetooth, I now have the 48 parsed Wi-Fi and Bluetooth entries. Um, let me just go to a few of them. Messages. There's some messages that were parsed here out of the biomes. Um, let's see if we can see where. I think you can do I click. Yeah, if I if you double click on the source down there, you can see the source path comes from the app intent local biome.
SPEAKER_04Oh, and the service, you know, service being my message. So that's a really convenient. Yep.
SPEAKER_08So yeah, you have it's an outgoing from contact Walter White, and the content is, I don't know, uh a Life 360 uh URL, and it's got the phone number there too. Um yeah, it's really cool. I really like the parsed feature. Um, the app installs, you can do the app installs, it shows here which apps were installed and when they were out installed from the biomes. Um, and then something I didn't know about, and let me know if you knew about it, Alexis, because I did not. So if you click on Investigative Analysis DB, I was like, what the heck is the investigative analysis db? Um let me see if I have one. So I just clicked on the let me see what I clicked on first. I clicked on the installed apps and then just chose an artifact and double-clicked it. And this is data coming from the directory for biome, and then it's in um a directory sets default app installed app database, and there's databases in these biome directories, and they're all called set.db. Have you ever heard of those?
SPEAKER_03No, no. I mean, I I I have not. I again I haven't so you know you had SegD version one, then they went to version two pretty shortly thereafter. So I wouldn't be surprised that they're adding some of those some additional things. Which by the way, um one thing that I hope the community does is look, get some phone extractions, latest iOS versions, whatever, do some test data and see.
SPEAKER_02For sure, there are plenty of biome entries that nobody parts because nobody knows they exist, because nobody has put them out there for public consumption. Right. So that's a really worthwhile effort to look for those.
SPEAKER_01And also look, uh, like like Charlie did, he just at least I haven't heard about set DVs. They might be something everybody knows, but I didn't. I didn't either.
SPEAKER_08And I asked Charlie about it, and um he's in the works, which maybe if he's listening or if he watches it back, uh here, come on, Charlie, we're waiting for it. But he said he's writing a blog about it. Um so hopefully that gets really soon.
SPEAKER_01Like the like the uh uh happy little more uh meme. Well, yeah, we're waiting.
SPEAKER_08Exactly. We're waiting. Yeah, yep. So he said he's gonna he's writing a blog about it. So I'm really interested to hear his research on that, especially because it's an artifact I hadn't heard of. Um so let me let me just pop up. I saved um a couple of the reports that come out of there, and I'm so excited about one of them. So you have to see it. Because when I'm excited about the forensic stuff, I need people to I need other people to be excited.
SPEAKER_03This this investigated thing is pretty neat how it aggregates. Gates. We're looking to something, I mean, not like this, but just having our artifacts and the leaves have a like larger. So we have the artifact, the category for it. They have like a root category, right? So we can kind of organize them in a more uh targeted fashion. So this is this is really well done.
SPEAKER_08Yeah. So this is the timeline export. So everybody has heard me over the last almost three years, by the way. We would do the podcast. Um over the last almost three years, say nobody does a good timeline. Why can't anybody do a good timeline? I'm loving this format. It's I'm I'm set, I need Charlie now to make me a timeline viewer for all artifacts in this format. So this is the export from Sedgwick. Um, and it's the timeline and it's the tree where you have those expandable and collapse. In the report, he has an expand all and a collapse all. So I'm gonna collapse all. And now for my timeline export, I have those artifacts that I check marked in a timeline. And then if I choose, oh, so 618 at 1242 is something I related to my case, I can just drop that one down and take a look at it. I love this for a timeline report, it's just an HTML report. Do another one.
SPEAKER_03There's tools that you have to click on the thing and then on the next one, and on the next one, and on the next one. And me and Heather, we both made like 30 clicks into this little triangles in. Yeah, thing doesn't end, and there's no open all or nothing. It just drives me nuts.
SPEAKER_08Yep. There's another timeline export that I did. Let me see if it pops up. Here we go. And this one is that uh that table view, I believe. I didn't put, I don't think I put as many in here. Oh no, I did. Okay. Oh, it's just taking a minute to move over to I think I put too many artifacts in here. It is HTML, but this is that table view of those app and focus screen time usage. So this is another report option. I like the other one better. I just love it. Where you can drop them down. Yeah, but this is pretty cool.
SPEAKER_03Well, and obviously it's designed for when you mark things of interests and you do a time, a timeline of those. Because if you want to definitely, if you're lazy and do a timeline of everything, the ATM the HTML is gonna choke, right? It's not gonna be able to handle it. And we developing beliefs, which HTML used to be the main reporting method. We know all about it choking. Right. Um, but again, the ability to go tag it, then make a timeline of targeted timeline of those events. Oh, it's fantastic.
SPEAKER_08Yeah. Here's another one too of um tagged entries. So I did a tagged entries report, and this is uh just another another option for your reporting. And that was that little tag up on the on the top. If you wanted to just do your tagged entries, and then I think I created one more. Let me see if it's the same as the other one. It might be. Oh no, that's something different. Sorry, that didn't wasn't supposed to get into this folder. Um, and then let's see what this one is. Oh, so this is from the analysis tab. So I was showing you the the parsed entries from the biomes. You can also create a report, uh, which I love this one too, of those parsed entries. So we can click on whichever one you want.
SPEAKER_04So let me describe it.
SPEAKER_03So you have it's really similar to kind of the like a like a type of portable case looking thing or UFDR looking thing or even uh a leaps code. Oh no, wait.
SPEAKER_08Is this the one? Yeah, yeah. No, you're good. Yep. I'm sorry to stop you.
SPEAKER_03You you you you're killing me, Small.
SPEAKER_08I'm sorry, go ahead.
SPEAKER_03So so on the left, you see different cat uh different categories, like like keyboard, app installs, and they all have little icons that identify, which is pretty clean, very nice. And then as you click through them, the center part of the screen then actually shows you the the spreadsheet-like uh records and fields uh that we're all used to.
SPEAKER_02So that's that's how it looks. But it has a really UFDR portable, you know, lava leak type of look, which and again is you know, that's that's one of the best ways of consuming this type of data, and I I think it looks pretty pretty nice.
SPEAKER_08Yeah, yeah. Me too. So um that one is on his website as well. It is $5.99. So for a year $5.99. So if anybody wants to check it out, I think they're pretty cool tools.
SPEAKER_02Not not six dollars, just just to make it.
SPEAKER_08Oh, yeah, not five dollars and ninety-nine cents. $599.
SPEAKER_02I mean, we wish, but you know, yeah, you know, you gotta you gotta you know uh pay the man now for good doing a good job. So definitely.
SPEAKER_08But uh check those out. Um, let me pull up the next here.
Crush Workbench As File Viewer Hub
SPEAKER_08So the next tool we're gonna talk about is from Marco Newman, who I believe he's out of Germany. Um, he has the Crush Digital Forensic Analysis Workbench. And I had seen a whole bunch of posts on this, and I'm looking and I'm like, oh, I really need to check that out, really need to check that out. And now we have a podcast, so I took the time to check it out. It is a really cool tool.
SPEAKER_03And Mark Marco is really nice. He's done a lot of artifacts for the community throughout the leaps. So he's a longtime uh contributor and collaborator for the tooling. So it's always good when we see uh pull requests come from him. But this tool um it's it's pretty amazing.
SPEAKER_08Yeah, it is pretty cool. So let me just tell you what the supported viewers are and then we'll we'll take a look at it. So it has a SQLite database viewer, uh, hex viewer, text viewer, JSON viewer, XML viewer, p p list and bp list viewer, segb version one and version two viewer, abx, level db, image viewer, media viewer, multi-log studio, apple unified log, protobuf viewer, pdf test extraction, or text extraction, and realm database viewer.
SPEAKER_03So it has plus is licensed license and it's all that and a bag of chips, all in one, all in one tool.
SPEAKER_08Right. That's a lot of a lot of things that it does. So I had to check it out, of course. And I'll put his GitHub page where where you get the tool up at the end on the show notes. But let's share the screen and take a look at it quick together here. Just gonna show a couple files because that's a lot of files to show, and we'd be here on the podcast all day, uh, which I don't mind, but I think people would tune out eventually, right?
SPEAKER_03Well, I also have to go dancing also tonight. So I gotta I gotta fix, I gotta fix the time stop here.
SPEAKER_08So I launched us already. This is crush, and um let's just open up a file. So I opened up some files earlier, but you would just use the open file, navigate out to whatever files. I'm gonna open first um an ABX file. Let's see if I can get it.
SPEAKER_00Android binary files.
SPEAKER_08Ah, here we go. So you see on the left the Android, uh the binary data, and then on the right, you'll see the reconstructed XML. So that reconstructed readable good stuff in this uh ABX XML file. Can you see it? Yeah, yeah, yeah. Okay, good.
SPEAKER_00I got I got my glasses on, I got my readers. I'm at that age.
SPEAKER_08I got my I see you uh zooming in there with your head.
SPEAKER_03Look, I have my readers and I took the part of this full screen, like the controls from the where somebody's chatting. Sorry, I'm ignoring you because I'm uh full screen, so I can see this. This little small, tiny font for an old an old F-A-R-T like me.
SPEAKER_08Yeah, it's a little bit of a small font for to see here on this screen, but it actually looks really nice on my big I got new monitors here in my little office, so it looks really nice once you uh load the tool up.
SPEAKER_03No, we're within that age, we need large monitors. I know, I understand. I get you.
SPEAKER_08So the thing that I found really cool too is he has a little section here for forensic relevance and it talks about the Android configuration files and how they're stored as compact binary XML. Says that they were introduced in Android 12 and talks a little bit about the different file types. And it does that for any of those file types I talked about that you bring in here. And underneath that, he has a reference um of where he's getting those like descriptions from, right?
SPEAKER_00Let me let me ask you something like so this is this is from uh this file, it's uh from where?
SPEAKER_08From uh this is from an Android, it's duck duck go.
SPEAKER_03It's a is it from the shared files uh directory or what? Do you remember?
SPEAKER_08Oh, I don't remember. I just grabbed any ABX file I could find out of my abstraction.
SPEAKER_03I'm just asking because I've always been saying that at some point the share prefs folder is all XML, but at some point I'm predicting it should have been ABX, and maybe we're there, you just haven't looked like oh yeah you know, I did go I did go into there earlier, and I think none of them were ABX, and I grabbed this one from somewhere else.
SPEAKER_08Yeah.
SPEAKER_03Okay. Okay, I just just curious, but go ahead. Sorry for interruption.
SPEAKER_08No, no, you're fine. Um, so yeah, so that's an ABX. Let me let me close out the ABX and bring something else in. Um, let's do. I made a little folder, so let me find my folder of sample data here. How about we try a SQLite database?
SPEAKER_04So everybody's favorite.
SPEAKER_08Everybody's what?
SPEAKER_04Favorite.
SPEAKER_08Oh yeah, SQLite databases. So this is um this SQLite database is actually from Life 360. It's the pet profile database. So you'll see here I have it brought in, and then you have where you can drop down and look at the tables from the database. I'm gonna choose pet profile because I know that's where the pet profiles are. Um so here's my two pets that I have uh registered in my life 360, Jerry and Elaine, my cats. Um, but you can see the SQLite format in here. There's a box here kind of um in the middle where you can start typing your SQLite queries and run your SQLite queries. So I could cheat and grab the query from um A Leap that I just did, but I'm not gonna take the time to go do that. So you can look through the tables, you can do your queries, and then you can export a CSV from here. I don't know if there's any other format or not. I haven't had a ton of time to play around with the uh like exporting, but I do see right here there's an export CSV. And I actually tested that out earlier. So let me just pull up what that looks like.
SPEAKER_03And for most purposes, CSV from a SQLite table, that's kind of like, and then you can put it in Excel or something.
SPEAKER_04That's that's pretty standard. So yeah, it makes sense.
SPEAKER_08Sorry for the light, you're gonna be blinded for a minute.
SPEAKER_04Um yeah, by the light, like it's all but there we go.
SPEAKER_08So now I have that pet profile. Um, I put the query in and pulled out the data that I wanted, and I have that pet profile there in a CSV.
SPEAKER_04Nice.
SPEAKER_08So pretty cool, pretty cool. And then let's bring in, let's bring in another file. Let's see. The files are staying here under the file, under the name, too. So I looks like I can, yeah, I can just go back and forth to them if I needed to. That's cool. Um, let's try let's try a biome. We looked at the biomes in in Charlie's tool. Let's take a look in here. So here's our biomes. Um, let me just make sure I'm clicked on the right thing. So we have these are app installs. Um, I've just just brought in the app install one. You can bring in more than one though. Um, so you can see here that this one has the Google Maps app install with the modified date, times, birth time. I think you can, yeah, you can um right-click on anything and inspect a cell and take a look. So I just did it on the Google Maps. So you can inspect the cell anywhere else. Um, and then what I had over here. Let me I want to get back to uh yeah, I want to get back to just show the there we go. So I just brought it in again. If uh so the forensic relevance here, he's got the whole Apple segment binary format and talks about the seg B files here. So if you're unsure what a segb file even is, and you have one in your case and you're seeing installed Life 360 or installed, what else do I have here? Claude, and that's important to your case, and you're like, I don't even know what this is. There's some nice descriptions there of what the files are for you.
SPEAKER_04Nice.
SPEAKER_08Yeah, yeah. Um, so very, very cool tool. I haven't had a chance to try all of the different file formats like protobuf and all of the different um options that it has, but it has a ton.
SPEAKER_03So what if what if you have the biome and then there's like other data types inside of it?
SPEAKER_08I don't know. I I don't know yet.
SPEAKER_02I was just just curious if it does like a like a recursive search like other tools.
SPEAKER_08Yeah, I don't I don't know. We're gonna have to work through that together and find out.
SPEAKER_03Yeah, but we're not doing another here, but no, we're not. Yeah. But still, imagine having, you know, it's like a this is like a Swiss Army knife of of uh not preview, but uh V uh uh visualizer tools, right? Mm-hmm because you have in one tool all these file formats. So instead of having to hunt down uh different file formats, there's there's I mean there's various tools in the space that do that. Like Rabbit Hole does great. It has like that recursive searching inside of containers capability. Um but you know, for this is a uh a community, I say community tool, like um an open source tooling. I mean, I'm I mean I mean not say it's open source, maybe it's not. I haven't looked. But it is a tool that the cost is is free to use, right? And this is great. Like you have all the viewers in one place for the cost of nothing, then that's that's amazing. And and thank you to putting that out to the authors and all the collaborators on his project. But yeah, I I have to look, I haven't looked at it yet, see if it's open source or not.
SPEAKER_08I'm not sure, but Christian's saying you can interpret formats recursively.
SPEAKER_03Oh, really?
SPEAKER_08Yep. So I need to play with around with the tool a little bit more.
SPEAKER_03Oh, so that's that's a game changer right there.
SPEAKER_08I'm asking you all to also play around the tool and write a blog about it. Talk about how it works.
SPEAKER_03No, and and if you don't know what that means, it means that, like, for example, you go into a circular database and they inside that field there is a P list. Then the tool will go will recognize the P list and then break it out, and then you'll figure out that P-List has a base64 in it. So and so you go and decode the base 64, and then it realizes that the base64 is actually a JPEG file. And then you go decode the JPEG. So does that make sense? You can go kind of nest it in recursively through the data uh structure. Uh picking out the data formats and presenting them to you. Uh so that's just the fact that it's available to the community, it's it's really nice, really well done. I'm I'm I'm well not tonight, but I had to dance. But tomorrow, I'm gonna I'm gonna go and download it, install it, and start actually playing it and see how can I fit in some of our workflows because that's pretty, pretty nice.
SPEAKER_08One thing I like too um about Crush is uh so sometimes when you go get a tool off GitHub and you open up the readme and you're kind of new to forensics, you're like, oh God, I have no idea how to even open this tool and launch it. The readme is great, it's very detailed and it walks you right through what to do to make sure you have everything you need for the tool to run, and then also how to launch it. And I I just love that because I know when I first started in forensics, GitHub was scary for me because I mean, honestly, I would be like, All right, I don't know how to use this, and I just wouldn't. So I'm glad um I'm glad it has such a detailed readme.
SPEAKER_03No, read the uh freaking manuals, it's always a good, a good uh, a good advice. Yeah, and if the manual is well written, even better, right? So that's so important.
SPEAKER_08Yeah.
LEAPPs.org Releases And Lava Workflow
SPEAKER_08So for the rest of our time, we're gonna talk about all of the new stuff with the leaps because there you know and we there's a ton.
SPEAKER_03You know, I believe 10.
SPEAKER_08Um so I'm gonna share the leaps.org page as we walk through and talk about all of the new things. So if uh first, before we even go to the leaps.org page, if you haven't joined the mailing list on the leaps.org page, join the mailing list. Look, and it's something that Alexis is very proud of.
SPEAKER_03Yes, I I spent a lot of time uh working on that page. And it's funny because you said we're gonna talk about the leaps, all the things that are coming out, and literally, as you said that, I get a notification that Johan, and uh, you know, in folks don't know Johan, he's great news. He got uh the award from Celebrite this year. Was it mentor? No, no, no, it was the award category mentor of the year? No, no, it wasn't mentor, right? I forgot the category.
SPEAKER_07I don't remember which one.
SPEAKER_03He got an award for being freaking awesome because he is awesome. So are you saying that I got the notification that the latest release of iLeap came out like like like now? So start refreshing that uh that releases page because that is gonna be showing up in the next few minutes. Yeah, which is exciting. So yeah, so go to the page Leaps L L E A L E A P P S dot O R G. And now Heather's gonna show it. Look how beautiful that is.
SPEAKER_08It is pretty beautiful.
SPEAKER_03It is dark, dark, dark, like, like, like night, below the night dark.
SPEAKER_08Oh, wait, wait, wait. Ready?
SPEAKER_03Oh no, I did that for you, Heather.
SPEAKER_08It added this one actually looks a lot better in dark mode, too.
SPEAKER_03It does. It does. Hit it anyways, hit it.
SPEAKER_08Oh, yeah, hit it.
SPEAKER_03So you can see it. No, hit it. I can't even see it. Anyway, hit it now. Look at that. Look, I I don't even make it white, I make it like like yellow. So to motivate people to not use it. Anyway.
SPEAKER_08Oh my gosh. So lots of new things on the leaps.org page. Um, so what I love now is everything you need is there. Um, it's still take you out to the GitHub page that you're used to if you need it to, but everything you need is right here on the leaps.org page. Excellence in digital forensics. I knew it was because he was awesome. Excellence, awesome.
SPEAKER_03And and I can testify to that like literally every day. When first of all, what the work he does, and second of all, the community work he does for everybody, right? Oh, yeah, it's just it's just insane. So I I I will give him that award every single year. Actually, I would name it the Johan Excellency DeFocus Award from now on. Like he couldn't win it anymore because that's gonna be named after him. That's how I think it should go. But, anyways, yeah, pretty good stuff.
SPEAKER_08Yes. All right, so let's just start. Let's just take a look at the page. So um leap ahead of the evidence. We've got download the tools where you can go to download the tools, and you'll find iLeap, a leap, r leap, v leap, lava, and batch leap. And we're actually gonna talk about each of those.
SPEAKER_03Um I I gotta I gotta say something. So go ahead. It says that my marketing budget is hitting its limit. And I'm you know, I'm gonna say my budget, my my budget is goes in five hour increments. And if people if people do, well, I'll tell that's the joke, right? The joke is it's it's AI, it's AI involved because I'm not writing all the CSS code for this thing. So uh so yeah, out of my my marketing budget is in five hour increments.
SPEAKER_05Yeah.
SPEAKER_03So uh that's that's how that works. So plenty of you know, incisive joke from Kevin. I I like it.
SPEAKER_08Um, so you can go there and get all the releases, and the newest releases will be there. Um, so I'm just gonna click on the tool releases here. You can go check, you can get the newest releases for whatever uh platform you're running too, um Linux or Mac OS or Windows, whatever platform you're running. Um so everybody knows what A-Leap, iLeap, RLEAP, VLEAP are. Can you tell everybody what batch leap is?
SPEAKER_03Yeah, yeah, we'll give you all the details. Uh and one second before I start doing that. Notice stop in any of them. Notice that you will see in the uh in uh actually in the one before batch leap, before we get to batch leap. Uh scroll down a little bit, yeah. So you'll see there. Before to get to the uh executables, you will have to go and find where the GitHub repo was for VLEEP and then for the ILEP and the IT, and then look and click here, click there. Now we have uh uh one place when you can get all the distributions, the days of downloading the latest version and running them um through the uh through your pathway interpreter directly. I'm not gonna say they're gone, but they're ha you don't have to do that as often, right? You can go to the page, download it directly from the page. There's a hash values there, you can copy them and paste them on your report if you need them. So all that functionality uh is included. If you use Homebrew to install and Mac, there's some commands for there for you as well. So it's super convenient. So we've talked about the other the main leaps and lava in the past, the leaps doing the parsing and lava doing the visualization, which by the way, um the days, now I would say this 100%. The days I used in the HTML reporting are gone. The reason is because we've been able to take every single alter artifact in all the leaps and make them compatible with lava. And I cannot uh express how big of a watershed moment that is for the uh for the project. You know, it's it's insane. You don't have to use the HTML reports, you don't. And the amount of value, and this is a testament to James and the work he has done, and also Johan, and uh, and also John and Kevin. The work they have done with Lava and some of these tooling is amazing. You can uh we'll do another show later to show the latest things in Lava itself, but the searching, the filtering, the uh exporting of the data, it's all there. And you can look at big large data sets and it won't choke like the HTML used to be.
SPEAKER_08So, can I tell you how it came in handy for me today? I'm used to using the HTML. I like the HTML report, and it takes me a while to like adapt to something new. But today I needed just specific artifacts from the FCMs in an Android. And if you guys have ever run a leap on an Android, the FCMs are huge. There's a script that's dump and it dumps all of them. There's thousands of records. I only wanted the records from KIC. In the HTML, there's no way to do that. You're getting them all, you're getting everything that script um supports. In Lava, I open it up in Lava, I use the filtering to filter for only the KIC records and then just create a new HTML report out of Lava to put in my final product. So it came in handy for me today.
SPEAKER_03That's that's that's that's amazing. I mean, and even the HTML reporting, like the subset, it's really nice, really clean. I I like how it looks. So uh, and I that's awesome that I used it today. Like, yeah, heck yeah.
SPEAKER_08I was looking at the HTML, I'm like, oh my god, am I gonna have to edit the HTML to get all this stuff that I don't want in there out? And then I'm like, no, because there's lava. So
SPEAKER_03Yeah. And and and talking about the releases, right? Like for instance, with Matt is saying, um, you don't have to mess with Python versions. The executables are there. Um, Johan is the one that makes makes uh print puts them together for everybody. And they are the latest in they run internally, Python, I think 3.14. Kevin's in the chat, correct me if I'm wrong. Um and uh that's that's awesome, right? Then you have uh the latest uh Python uh installation running within the executable, so you get good results from that. So you don't have to compile any of that, we do it for you. So yeah, 3.14. So which uh 3.14.6 to be precise, baby, right? So let's let's not let's not be incorrect here. So the latest and greatest. So again, the the the work that the the the group has done this this last whatever a few months is it's been amazing. That the leaves are are are a different thing that uh yeah, I'm even stuttering that they were six months ago. It's just insane, right? So so before I I mean we could have a whole show talking about because we've done a lot of new things for the leaves, but before we maybe for another show, we're running out of time.
Batch LEAPP For Parallel Processing
SPEAKER_03I want to talk about batch leap. So this came from a conversation that I was having with James. And James's the one, I mean, uh the whole group, the whole develop core development team, we have these conversations, but James has been really pushing into um trying to figure out how we can do testing in a more easier, organized, streamlined fashion. And he's been putting some scripts out um in regards to how do we compare what the tools are supporting across versions, right? So Android 13, 14, 15, uh different apps versions within themselves. How can we get that visibility to figure out what we're supporting and what needs to be supported, which is something I made a post in my LinkedIn a few days ago that we don't see on the industry. The industry, most tools, no matter where they come from, they tell you this is all we that we do. But nobody comes and tells you this is what we don't do, or give you a process of how to figure out what is not doing. What are you missing, right? Right. So I I sat down and yeah, a little bit of my brain power, a little bit of uh AI uh assisted uh, you know, um coding, planning assistance. So and I'll be transparent. Look, and let me let me make this point here real quick, right? So I've been a really outspoken critic of AI in all sorts of forms. And not so much of AI, but of the hype surrounding AI, right? Which is a different thing, right? AI, and I said it in many podcasts and these shows in the past, will they have a use of neutral forensics? Yes, I'm actually in the middle of doing that in my own practice of using AI for different things, okay? Um, but I will say, I will say this. Um I have no issues using stochastic or indeterministic procedures to for it to get me to a really solid deterministic output and that I can verify and validate. And that's the key there, right? And I said it also in the past: if you're gonna use this type of tooling, uh, and when I say type of tooling, I mean LLM AIs, you gotta be an expert and you gotta know what you're doing. Because if you don't, you'll mess up. And I have stories from even developing batch leap as I'm providing the guidance and reviewing all the pull requests and the reviews where I'm catching things and fixing things, right? So uh just vive coding without knowing how to code is a dangerous endeavor. But as in principle, I do know and I test and I tested in my own experience that you can take these procedures that are that are uh more randomly based, but you can get a solid with enough following the procedure and your own knowledge and your expertise and your judgment. Get good solid um deterministic code that you can actually use, which is which is good news. And then I do that, right? So I do use it now. Though have I changed my my belief that that we should use LLM, for example, to ask the ask the LLM um I'm gonna say this investigative level type of questions, like, whoa, who did the crime and the why what time? I'm still opposed to that, but that's a different scenario. Does that make sense, Let it to you? More or less.
SPEAKER_08That makes a lot of sense. I I couldn't agree more. And when you say you're using the AI because you have a very deep understanding of what it's doing, that's why I'm not using it. I don't have that understanding of Python. And if it makes a mistake, I am not going to catch it because I don't know what it's doing. So I try not to. I'll use it for like little tiny things. Uh, but yeah, I can't do it because I don't have the proficiency that you have or the proficiency that the development team has. So I try not to, but I agree 100%.
SPEAKER_03No, and and and the tooling might show you, hey, do this this one way, but you you have this expertise of the framework you're working on. Say, well, actually, we're not gonna do that because that's gonna break something else, or it's not compatible with how we want to organize things. There's there's uh uh uh many reasons. And I agree with Brett. Again, so good to have Brett here. Uh I'm I'm a big uh Bread Stan, Brett fan. I I I would say I'm the uh the uh what's it called, the president of Brett Fans Fan Club. And and yeah, like the analytical type of stuff, computers like Brett says, we need the analytical and the uh investigative mindset. AI doesn't have that. AI doesn't have the experience or the breadth of expertise or or or the intuition to do certain those certain things. But there are situations that uh will that will lend itself to to use that. Well, I I'll I'll Venmo. Vem Vemo Venmo means dead, because I'm a modern guy, right?
SPEAKER_07Brad says Chuck is in the mail.
SPEAKER_03Yeah, just Venmo. That's good. I accept Venmo. All kidding aside, right? So went back to the tooling. But again, I want to say that because I'll be really transparent, right? Uh because if you look at Alex or Briggs, what an hypocrite, right? He's saying don't use AI, now he's using AI. No, again, I never said that you shouldn't use things. Technology is not gonna stop because I say so, right? Well, you know what? Briggs said that this technology is not good. Everybody stop the horses. That's not how it works, right? Uh there is a moment and a place for things, right? And I'm trying, I guess the whole community, we're trying to figure out where is the place for this technology. And vendors and industry and and and and people everywhere, influencers are telling us where it should be. Um, I'm trying to find out my opinion about it by you through using it, right? And have an informed opinion about it. So I that's I want to say that for full full clarity and transparency in regards to where I stand and how my positions evolve. Look, this last thing, it's like my soapbox moment. Always have one in the show. This is mine. Yeah. I I I don't care about being right. I I care about truth, right? And and uh if if if I'm if if the truth makes me be wrong, then I'm okay. I will change my mind and and be and tell be true, right? Um just because I believe something, I don't have to defend it. Um because I can be wrong at any time, right? So I I have no issue with evolving my positions. But that's where I stand right now. There are certain moments, certain positions, certain contexts where AI cannot and should not and and and will never be allowed, I think. But there's some other context that we can and and we could continue to define those boundaries where they are. All right. So um, yeah, like like Brett says, right? You have race cars for racing, RVs for traveling, right? Imagine trying to do an RV race. A pretty slow affair. Um, but so it's a price for everything, right? Including AI. So again, having uh Brett's backup um with double thoughts uh makes me feel that I'm in the right direction. Now let's go back to Batch Leap. So how do we automate that? So the idea was how do we do it? So it's pretty cool because the first functionality of Batch Leap doesn't even have you don't have to even use it for testing. You get you use it to make your life faster and easier. Imagine you have 10 extractions, zip files, and you want to run them by the leaps. Well, usually what you would do is one of two things. Either you run them one by one, all right, let's do the first one, and then the second one, and the third one, or you will go into the command line and make a little script that would ingest them sequentially, one after the other. You just well, you you would save the step of having to load it into the leap, right? Because the script will load it on its own using the command line prompts and stuff like that. Well, I thought, how about if we take uh advantage of parallel processing that motor computers have, being multi-core and multi-whatever, right? And that's what I did, right? And it's pretty neat. So now let's say you have 10 extractions, and assuming that your computer has the power to parallel process 10 extractions, assuming that, you can process them all at the same time, and uh pretty much it will tell you the time it would have taken your slowest extraction to parse. Make sense? So the slowest extraction is gonna determine how long all those test extract 10 extractions are gonna take, right? Which is amazing. So you're you're doing 10 extractions for this price of one of what the slowest one would have taken anyway and of its own. Pretty cool. And there you go. So it provides, I really I don't uh I don't think I don't have uh actually, do I have one? Maybe let's see if I have if I can show the folks, if I have one here on my desktop, because I was totally uh messing with that uh today. I mean not today, yesterday for other purposes that I hopefully have enough time to say. Um let me see here real quick if I have it. Oh, I do. This is great. So let me uh Heather, I'm gonna I'm gonna go and jump. I'm gonna take the screen now. Yep. Um let me take here the uh share screen. Um yes, I wanna allow this. And uh, how do I share the other window? I'll share the screen. Uh entire screen. Yes, yes, I want. Woo! Let me hide this. Okay. Can you see me? See my stuff there? Yep. All right, so what I'm interested in showing you, oops, it's the uh um I thought I was gonna go make this big. There we go. You see everybody sees there. Um so the the batch leap, I pointed towards a folder that has extractions, SIP, tar, or GCs. It will find it recursively inside that folder. And you're gonna point it also to the leap that you're gonna use. It could be an executable or a Python leap script, not the GUI, obviously, point it towards the command line one. And where you want your output to be. Okay? And you and how many processors are are you gonna use for the parallel processing. And you hit it, and you notice here that you have all your reports for every of those extractions that you parse. Does that make sense, Heather? What I'm trying to do is.
SPEAKER_08Yeah, very cool. Yes, it does.
SPEAKER_03So very very neat. And then you'll see here that it you end up with this file structure here.
SPEAKER_02If you go to the index.html, which I'm gonna, I should use a different, I don't want to mess this my left thing. Um, whatever.
SPEAKER_03I may just make this large here. Oh, actually, I'm gonna do this. Since this is like kind of off the cuff, that's why it doesn't look as nice as I wanna want it to look, but let me just change my browser here. All right, this is better.
SPEAKER_08Yeah, that looks good.
SPEAKER_03I was buying plane tickets here for work. All right, so all right, so you'll see here that you end up with this. You have all your extractions, the report folders, you can open each report, and you can open lava if you want to. It they it says skip because I did a second run for a different purpose. So if you already have a run like this one and you want to add additional file, additional extractions, you can do that and you don't have to uh re-process everything. But that's neither here nor there. The important thing is that you can always hit report or hit lava, and it will open those up from this uh kind of control dashboard, if if for lack of a better term, which is neat. Now you have all your 15 extractions, you went to lunch, or not even lunch, you went to do whatever, and you come back an hour later and you have your 15 extractions good to go, and you can open them. So uh James added this lava button here, which I love because now with the uh URL schema added to lava, I can just from the HTML, I can just press it and hit opening lava. And you want it? Yes, I want to allow it. And boom, I'm in.
SPEAKER_08Oh, that's pretty cool. Yeah.
SPEAKER_03And you see all look, oh, I I mentioned that we support all the artifacts now. Well, look at this.
SPEAKER_08All the artifacts.
SPEAKER_03All the artifacts are here, baby. Actually, we have the aura ring, which some was one that was added uh uh not too long ago. We have nice more icons now, um, using tabler icons as opposed to the feather icons. So now if you're making artifacts, there's more uh icons to select from. And obviously the searching, but again, this is not a lava presentation thing. The point is that you can uh access it all from here. Now, this is the cool thing, the extra thing that the batch leap does for you. Not only do you process everything at the same time, and and you can easily get to whatever port you want on this through the screen. Obviously, you have your shell values here, which are useful. We can talk about app coverage. If I hit this and open it in lava, which is cool. Yeah, it's neat. You will see here what are what is supported and what's not supported, right? What apps are not parsed? Out of two extractions, you know, the Gmail one wasn't parsing one of the extractions, how many files? Like there's a blog post that I have on this, and this is for researchers trying to figure out what apps are not parsed. And you can lag at which extraction, you can filter away. Extraction number four. How many apps are not parsed? And then you can go through the list and you can figure out what do I need to support now that I'm not supporting? What am I missing? Right? App coverage is uh is kind of one of the better ones, right? How many files are matched per app that's being parsed? And you have a good sense. I just check out uh the the blog post where I explain how to go to the explanation of how to um cover summaries pretty good on how to do this. So some of these numbers are kind of alarming, but not really, right? So look at this. Apps present, oh, we only parse 27. We gotta be careful, right? A lot of uh apps uh touch multiple directories, right? So for example, you have kick and iOS, you have kick, the data folder, but you have the group data, and you have other different folders, right? And they're like kind of sub-apps of it. So you've got to be careful with these numbers, right? But still, still the fact remains that there is a lot that we're missing. And using this format here, you can actually figure out what are you missing and how can you go about finding it. All right, does that make sense so far?
SPEAKER_08Yeah, then once you find the ones you're missing, if you need them, you can write parsers for them and become a contributor.
SPEAKER_03Absolutely, absolutely. And it's is easy peasy lemon squeezy. Let me just uh go back to the let me go back to the uh I know you love that phrase. Uh let me let me re-relinquish control. How do I relinquish control here?
SPEAKER_08Of the screen?
SPEAKER_03Yeah.
SPEAKER_08Remove.
SPEAKER_03There we go. Thank you.
SPEAKER_08I kicked you out. There you go.
SPEAKER_03That's fantastic. But so so that so batch leap does that. One last thing, and this is more for uh I added other functionality in Batch Leap that's more internal for for us. But the point I'm making by saying that is that Batch Leap is also open source. And if you find good ideas to use it, like that batch processing to make your life faster. The the way of being able to uh look and see what cup what or what apps are we missing. If you think of any other functionality that would benefit, uh please send a pull request. We'll be more than happy to entertain those.
SPEAKER_08Yeah.
SPEAKER_03Um, if it's something that that's useful.
SPEAKER_08Definitely.
SPEAKER_03Oh, and one last thing, one last thing. If you have test data, do test data and you can share with the community, please do so. Because now we have this framework where we can actually go in and compare it to app to app. So compare app to app too, but extraction to extraction. What are we supporting on this one? What are we not supporting on this one? What's the difference between extraction? You can do that now with patch leap. Then please put out uh test extraction and share with the community, and it will help us develop better parsers for everybody.
SPEAKER_08Absolutely. So we're gonna go over a little our hour tonight, but I don't care because there's a couple other cool things on the leaps.org page that I want to make sure we show.
Artifact Browser Stats Blog Scoreboard
SPEAKER_04So well, you're the boss, so I don't care.
SPEAKER_08Please stay with us. It looks like we gained a couple more people watching anyway, so they're tuning in for this part. Um, so anyway, the tools we talked about, the different releases we talked about. Um is this the artifacts where you can see the artifacts that are oh yes, my favorite.
SPEAKER_03I I put a lot of thought into this and I love it.
SPEAKER_08The artifact browser where you can browse and search every artifact that's supported across iLeap and A-Leap, RLEAP and VLEAP too. So this one I love, and the one of the reasons I love it is because how did you figure out what was supported before? You could open it up and then look at the modules, or if you knew, you could go into the scripts and then the artifacts folder and go through, but not all the time do they have a name that 100% lets you know what it supports. Now you have this, you have the artifact browser, which is awesome. So uh on the top, oh, it talks about how many total artifacts are supported, uh, what categories are how many categories and how many tools. And then you can narrow it down between the different tools. If you only want to see iLeap, you can click on iLeap, a leap, rleap, v leap. The recently added parsers are up here on the top, so you can get to those, access those fairly quickly. Um, or then you can just search for the artifact name. So I don't know, what do we want to do? I just added one. Let's search for that one.
SPEAKER_03Yeah, let me describe this for the folks that are listening. So the the in the website, the leaps.org website, the artifact uh browser, uh, like it says, has those descriptions of the browsers, right? I'm the browser of the artifacts. Yeah. And it's like in columns, right? You got the column that has the name of the artifact underneath, and maybe you can, you know, I'm gonna highlight one. It shows a little description of what it does, right? Yep. And I uh and I added that today. I added a description of what it does and who made that artifact, which I believe is really good to give credit to the folks that do all this great work. And if you could please click on path and press on it. Um, right underneath Kevin's name.
SPEAKER_08Oh, thank you.
SPEAKER_03Yeah, just press on path.
SPEAKER_08Oh, on path. Jeez, I'm an idiot. There we go.
SPEAKER_03I said path. Uh path. It's British. All right. So it tells you where's the source of that data.
SPEAKER_07Yeah, love that.
SPEAKER_03And back in the day, the old leap, we had uh I had the definition of the path in a file. Then we move it into the artifact at the bottom. Then we put it at the top, then we put it at the top version one. Now it's all uh normalized, unified. So now I can pull uh consistent, I put it, pull out every path, source path, you can get to it quickly, and it tells you um the output type. So it's it gave you an HTML report, is it giving you a timeline report, is it gives you a lava report, what it gives you. And I also added today when it was last updated. So you see something that's been there sitting for eight years, six years, maybe you can give it a shot and do an updated parser review, so please.
SPEAKER_08It probably needs one if it's been there that long. Yeah. Very, very cool though. I love this.
SPEAKER_03And I have folks pay, hey, does the leap support this thing? And I'm like, I don't know. There's like almost 2,000 of them. Go now. I can tell them. Go to uh leaps.org slash artifacts and uh you can you'll you can Google it. I think Google it, but you can search it.
SPEAKER_08Yeah. Um let's just check out the stats. So there's a stats page for the leaps where you can see the number of downloads, the stars, the contributors, releases, it's still a little bit because and then go to the download history underneath it and hit the 30 day mark.
SPEAKER_03So it's in the downloads, yeah. Just press it. So I just I just love that. So I again I do that just for my own entertainment to figure out how many downloads daily. I just want to put that big outlier. It's like like 1200 um downloads, and you can hover over over it and give you the number. I don't know what happened that day. A lot of people wanted the tooling that day.
SPEAKER_08Oh, yeah, I guess. You must have done some sort of announcement or something.
SPEAKER_03Yeah, 1300. Um, but no, it's it this is more like a fun page for me to see how the tools are progressing, how people are downloading. Usually we get like an average of 150 to 300 folks that are downloading the tooling uh straight from you know the executables, which again speaks to adoption, but also speaks to the a bribery community that's that's using the tooling. And uh we're trying to support you support you all. And please help us help us help you.
SPEAKER_08Yeah. So there's a change log too that talks about the release history um for all of the different tools. So lava, the leaps, and the bet, and then batch leap talks about all the change history. Uh, why do you want the change histories? What became supported? What what bugs were fixed? I mean, I find that huge to be transparent on the bugs that were fixed. Because if you fixed a bug in the new version, it means if I use the last version, it was there, I might need to go back and and change something or fix something, or maybe I missed something because there was a bug.
SPEAKER_03Well, read the first one right there. What does it say? What does it say there? Start with what?
SPEAKER_08Oh, where am I going?
SPEAKER_03Right there on the top. The first thing, July what?
SPEAKER_08July 10th, 2026, I leap. Oh, that's because it was just released. Wow. Like, where are you going with this? Yeah. So new release.
SPEAKER_03Trust me. Just read it. Just trust me, and you'll get there.
SPEAKER_07Look at the long list of stuff that was done with this release.
SPEAKER_03Oh, no. We could we could have a show. Look, this is a look. So go up again. So look at the version number. The version number, we changed it, right? We were doing version one, version two, version three. You go up a little bit. Yeah, we changed that. Version two, the 2026, right? For for the for the year. And then we have version one. Like this is a watershed moment. Again, I said it already, I said again, for the leaps. Where the the tooling is using the latest Python. We added a whole bunch of enhancements, a lot of a lot of functionality, support for all the tooling in Lava. Um, the interplay or the interconnection between the tooling is more seamless. Again, that's why this change log is so long. Now, this is important. Like Heather said, it tells you what it does, but it also helps you uh if you need to say, okay, this is the version that I'm using, you can take this and be make it make it part of your documentation if if you need. I think I don't think I added, I scrolled down a little bit. Um, I don't think let me see if I added a link for the copy thing. Let me see. Keep going down because I think I did.
SPEAKER_08Um, I think it gets all the way to the end, and then there's a show more or show less. Okay.
SPEAKER_03So it's oh yeah, yeah, yeah. So uh yeah, you can also go to Hit GitHub and the link to look at it there. And uh yeah, so uh it helps with your documentation. You can copy that and and and be part of what the tool does, right? Very useful to keep track. And if you're not sure what's the latest, you can go to Changelog and see what things are we adding to the tool.
SPEAKER_08Yeah. Then there's the community tab. So the community tab has contributors, they have a mail mailing list. The blog is the next tab over, which I consider part of like the community. Uh, if you're looking to contribute, there's a blog section, but there's also the scoreboard. So So I'm going to click the scoreboard because if you're a contributor, we now have like a little contest on here, which I think is really cool. It's fetching the fetching the data from GitHub right now, but it'll be up in a second. Here we go. So Alexis is leading the scoreboard with 1060 merged PRs. Somebody catch him and get past him. Somebody Johan's on your tail with 506, not really on your tail.
SPEAKER_03It's kind of unfair. I I got so many because I started the project and I did it by myself for a while. And and then uh uh um Yogesh, he's he's number five still, started also getting he did 3073 uh pull requests.
SPEAKER_06Yep.
SPEAKER_03But I don't I'm up to a thousand. That tells you how how long that project has been ongoing since I started it. And and you know, I mean it's good to be number one, although it's not really fair. Because of, again, I started the thing, so obviously I'm gonna be I I'll I'll be first for all for a while.
SPEAKER_05Yeah.
SPEAKER_03Um but this is more of a fun thing to kind of um you know have a feeling of you know, have visibility. Look, the work that you do matters, right? The the work that that you do when you share with the community is being recognized. We we we see you and we appreciate you. And the community, even if they use the artifacts and they know they don't know that you did it, they are appreciating you too. And this is one way of kind of making it a little bit fun so people can see what you can see there on the so the folks that are not uh listening, you have a listing in order, who has more, who has less, and then how many um uh leaps have you worked in? Some people only have one, so people have worked in a uh send uh day uh uh code or solutions for A-LEAP, I leap, V-Leap. Those are shown in little colored pills or rectangles. And we're trying to make the color consistent, red for I leap, green for A-leap, uh I think kind of purplish, not purple, but like uh yeah, purplish for uh V leap. Um I forgot. Oh um if you go to the top and see mine, I have all the colors there because obviously I work on all of them. Um and and they're being consistent. Um what am I missing? Oh, and a TL for R Leap.
SPEAKER_07Yeah, yep.
SPEAKER_03So if now we change that also in the reporting. So if you go to the HTML versions of the leaps, and if you're an iLeap, it will have red accents in the report. Uh A leap will have green accents. So actually we change visually how they come across to make it more pretty and more nice.
SPEAKER_08So you get a rank, you get a rank. So you start out as like a first responder and you can make it all the way up all the way up to forensic legend.
SPEAKER_03Yeah, you have forensic responder, digital analyst, forensic examiner, senior investigator, lead examiner, and forensic legend. Because you know, I gotta scratch my own back here. It's all in good fun, people. It's all in good fun. It's you know, um, it's it's a fun thing, it's not uh it's not a real measure of expertise, it's just fun.
SPEAKER_08And you know the best part about this too. I mean, the scoreboard's cool, it's fun, but if you scroll all the way to the bottom, there's 132 people on this list. I can't, that's just amazing to have 132 people in the community uh contributing, whether it's one contribution or a thousand contributions, all those people are contributing to a project that helps every one of us.
SPEAKER_03I would have looked and never in my wildest dreams would I imagine that this project would be such um such a make such an impact in in the field, in the people that commute that that you know collaborate, but also in the in the lives of folks uh making their lives better. Um it's funny because Johan says, of course you're first because you know you're the boss, you're the one that you're running this thing. And I'm like, nah, whatever. Again, Johan is really it's really the thing is that what people understand is that Johan is so productive, like he'll be up my my behind suit in this scoreboard like in no time. It's already halfway to catching me. So but again, all that joking aside and truth aside, uh, thank you everybody that collaborates and thank you to the users, and and uh, you know, that let's let's keep working together, doing it the right way and to get the right results.
SPEAKER_08Yeah. So the blog too. Uh so there's a blog here now. Uh is there any specific types of blogs that you're allowing to go on the blog, or just like anybody can put a blog up? Do they have to be related to the leaps? Like, what's the rules for the blog?
SPEAKER_03So um, so it depends, right? So obviously if it's leap related, that'll get you know top billing right away.
SPEAKER_06Yep.
SPEAKER_03If it's not, it has to have some forensic value, and and we're happy to share it through our our our channel or our blog, and that's fine. Now, the fact that you sent uh because this is I I did it through uh GitHub, so people can send a PR for their blog. So you can send make a PR and then we just post it, right? Just because you send me a PR for a blog post doesn't mean I'm gonna post it. Just make that clear.
SPEAKER_07Okay. That's yeah, I wanted to do that.
SPEAKER_03Yeah, the me and the developer, the core developer team will look at that blog post that's been submitted and we'll determine if it's relevant to the blog, relevant to the community, and we might post it or not, right? Um and I don't I don't want to discourage anybody from sending blog posts. What I'm trying to say is if it's relevant to the leaps, absolutely, or an artifact that's being made, absolutely. We're gonna put it there, it supports our the mission that we're engaged in. If it doesn't, that's fine, we'll look at it. If it's forensics related that has value to the community, we'll put it there. Um if you're gonna put some uh stuff to sell things, that's not happening. Right. You know what I mean? Like, yeah, yeah, look, look at this thing that I'm selling. That we're not, this is not advertisement that we're doing here. This is not an advertisement channel. The amount of money that the developers and me make out of this whole effort that we put so much blood, so, and tears, it's a big fat zero dollars and zero cents. All right. So uh so we're we're definitely not doing that. Um and uh and again, and the the let me let me say this real quick clearly. Does that include at some point being able to monetize some of the framework in some way to make the framework better and have some some funding sustaining for that? I don't I don't close the door to that. I don't know how that's gonna look. I have to retire first from my current job, so I'm allowed to get into other things, so that's not happening in a while. Um but the the heart of the this project is in supporting the community. The leads will always be open source, the leads will always be MIT and available for everybody, and that's just a hard rule that I have for that. The leads themselves are a community project yesterday, today, tomorrow, and forever. Right? And if you want to hear more or read more about, don't don't change the page, but read more about what's the philosophy behind the project, you can go to the about section and it'll tell you a little bit about the philosophy of the project. Actually, we'll go after this. And also tell you a little bit about who the core developers are. So we'll do that in a second. So the blog post, and you can click on one of those to show the folks how how it kind of looks. And you see there are a little uh blog that explains the batch sleep, how it works, how do you do the analysis for app coverage so you can actually get a feel for what are you missing, what needs to be supported, and what is supported, then you can check it out at that blog. And uh, there's an RSS feed, so you can follow it that way. And so you don't have to, you know, you get alerted or see it on your RSS feed reader, and you can go from there. Does that does that is that coming coming through, Heather?
SPEAKER_08Yeah, very cool. Yep. Um definitely submit to the blog if you've got a good artifact that you're gonna support in the leaps 100%. Because once you submit it to the leaps, it's nice to be able to, as a as an examiner, go read the blog and get the entire context of how you came to your conclusions about not only what the data means, but the locations where you found the data and really just like everything you did.
SPEAKER_03Well, look at the one underneath, right? Just press on that one underneath, right?
SPEAKER_08Um, mine.
SPEAKER_03See, exactly. So Heather did a whole bunch of artificial lights 360, and they're there. There's a little description and the thing, but here you get the real value because like deep value, because now she goes into where they are, what does it mean, how are they parsed, what are the fields. So you get a whole brief behind of what the work that she did. And and it will really inform your interpretation of that data. She has screenshots because then you can correlate those screenshots with the what's being shown on the report. So you actually do the proper interpretation, and uh and it's great. So I highly recommend folks if you develop an artifact for the leaps, have a little blog that goes with it, we'll post it and it'll be part of that documentation of your artifact, right? Which I think is pretty neat and makes it available also for the community in a central repository kind of way.
SPEAKER_08Definitely.
SPEAKER_03Good stuff.
SPEAKER_08So, where else do you want me to go?
SPEAKER_03Let's show the blog, the blog, uh, the about real quick because I said that we're gonna show it. So it how were um uh the about tells you how the project started. So, how I started the project, was the the the ethos behind it. Scroll down a little bit more, and then uh the principles that I kind of expose, right? Um and let's let me before you scroll down. No, no, no, no, yeah. Let me see. So again, like I said, always free. The leaves, the leaves themselves will always be free, right? That has to be open source, it's for the community first. And the idea is that you can get to the data fast. That's some those are the four things that I came across when I did the tooling that I needed, and those are the four principles that guide the project. And then if you go a little bit, uh you know, keep going down, teach a little bit about the projects, how they work, a little timeline of how they were developed. I just do it for fun, and then a little bit about me and who I am, but I know you're all sick and tired of me. Um but look at the uh this I like this part, the core contributors. Right? You got a new uh kind of background of who Johan is, where you can find him, James, and you see the little pills there, the the colors, it's the pro the lead parts that worked, which is pretty much all of them. Actually, I want to say a quick shout out to James. He's been uh leading a lot of effort in translation as well. He put translation capabilities into Lava, and uh and it supports, I think, Italian, German, uh, Spanish, obviously English. Um I'm missing languages, and I I actually you go to them and not do it, don't do it now. Folks can go later into the homepage of the leaps.org, you scroll down, we have a page where we recognize folks that give the translations. So again, if you're not a coder or or a developer or a researcher and you know a language that's not supported, send us uh some translations and we'll be happy to have you, right? You got Kevin there, some of the background and what he does. Joe Gesh, which is kind of the my main person in bringing this project from the ground. I oh I have a debt of gratitude to Joe Gesh all till the day I die for helping me when I need him the most. And also with John, the father of uh the biome uh artifacts, the one that pretty much discovered them and put them in the map for everybody. A good friend of ours, upstate New York. So again, I want I I want to take this extra minute to recognize them because this project will not exist without these folks. It could not be four without them. Uh I I love them all, they're great. Obviously, Heather, she's kind of like our sixth person, instead of six men in basketball, the sixth person.
SPEAKER_08Yeah, we made the joke the other night, though. I can't be on the core contributor team because I'll just screw it all up. So I'm watching. I get to listen to the chats, but yeah, no touching the main framework.
SPEAKER_03Yeah, but the thing is that she's a core contributor, not in code, but in other things, right? In regards to no that the testing and the validation. Uh her so bash leap could not work without some of her test images. That's just how it is. No, thank you. You're a valued core contributor of the team, girl. So don't let me touch the code.
SPEAKER_06Don't let me touch the code.
SPEAKER_03I'm not gonna, I mean, I love you, but I don't love you that much.
unknownNo.
SPEAKER_08Um, so uh that I mean there's probably things on the page we've missed. The page has a lot of valuable resources. So I'm just everybody go check out the page and go get the new re release of iLeap. It's there. Uh it was released like literally a quarter of a second ago. So for real. Go pick up that iLeap.
SPEAKER_03Um, show the uh last thing. Uh I think go in, I think it's in community. Go to community because.
SPEAKER_06Oh, did I miss something?
SPEAKER_03No, no, no. I yeah, yeah, but no. Um is there is mailing there? Yeah, mailing list. Okay. Go to the community mailing list. All right, please go and sign up. Okay. If a new blog post comes out, I'll send you an email. If when the releases come out, I will send you an email. So that way you don't have to be checking, is that release out? Change the change log. I mean, you can check it, that's fine. But I'll send you an email so that way you'll know when to update the tooling um, you know, without having to sweat it. Because uh, you know, and all this is it's been a good uh learning experience for me in making the page, making the automations to make this, you know, if a new release comes out, you get an email automatically, right? So it's been a good uh learning experience for me and it works really well. So sign up for the mailing lists.
SPEAKER_08I get five emails because while Alexis was creating and generating the mailing list, he's like, register with a different email address, register with a different email address. So I've registered four personal emails and my work email. So I know when the releases are out.
SPEAKER_03Well, who's the testing and validation queen here? Huh? Isn't it you? So we needed you to make sure that this thing was working on the emails that we needed to work.
SPEAKER_08It works times five.
SPEAKER_03So no, so please send again. We're not we won't spam you, right? No, no spam. Yeah, no spam. It's releases when they come out, blog posts when they come out, and maybe some other thing that might come out that's important every now and then, and we'll send you that. But yeah, we again there's not it's not marketing. Uh first we must say he downloaded the new version already. Awesome. He says he hosts, he might be the first. Who knows? He he might.
SPEAKER_07That's cool.
SPEAKER_03But the new releases are fire, it has a whole bunch of new stuff, new artifacts, new support for Lava for all the artifacts. You can leave the HTMLs behind, say bye-bye, HTML. I don't you're there, but I don't need you. And really benefit from the analysis from Lava is so good. And we got and we're again, we're just starting with putting support on all these tools, so good stuff.
SPEAKER_08Yeah. Um, okay. So we've talked about all the tools today, and we went over by a little bit, but not too
AI Poster Fail And Why It Matters
SPEAKER_08much. So we always do the meme of the week, and this week it's like not really the meme of the week, the the AI disaster of the week. How's that?
SPEAKER_03Okay, I mean, somebody's disaster is somebody's game. So let's show it so I can explain what I mean by that.
SPEAKER_08Let me just tell you quickly first what my prompt was. And this isn't word for word because I didn't write it down, but my prompt was create me a poster for the Digital Forensics Now podcast, um, including the two hosts, Alexis Brignoni and Heather Charpentier. And my thought was that they would go out the the AI they I'm calling it a person now, that they would go out to the internet and actually find us, right? And and add information about us. Well, I mean, I mean giant veil.
SPEAKER_03I don't know. I I think I I look pretty accurate there. I mean, actually, I actually I look better.
SPEAKER_08They made you prettier than me. And why do I have purple hair?
SPEAKER_03I don't know. You you you give those uh I don't know, kind of like rebel vibes in some ways.
SPEAKER_08Oh my gosh.
SPEAKER_03Like like like Heather Charpentier. Sounds like like a rebel type of name.
SPEAKER_08Oh my gosh. So yeah, it's a very generic it says we do expert interviews, we do um it just it got it all wrong. And then when I asked it to make a little bit of a change, it turned us up both into guys. It got it a little bit better. Um, but yeah, never, it never got pictures of us.
SPEAKER_03Look, and and the thing we're we were doing this just to mess with it, just not to mess, just to see what we get. Yeah, because I was telling Heather, like, and from before, and she knows this, and she can't deny it. I said, We a couple of times we use like AI generated stuff for the holidays. Like, let's stop that. It looks so trite. Everybody will be doing this like in a few months, and it'll be like so obvious, is like AI stuff. Yeah, and now you're on LinkedIn, all you see is AI nonsense at all times.
SPEAKER_08I can't stand it, so I'm unfollowing as quickly as I see these posters of complete garbage.
SPEAKER_03Oh, I know, and and yeah, and so they did one that was really funny that about the deefer uh legends or really known folks. Yes, and I mean, people that we know that our friends, and none of them looked like them. Like random people, like it was crazy, like people, men were women, women were men.
SPEAKER_08Kind of like what's on the screen.
SPEAKER_03Yeah, I mean, you know, one of the experts uh you know is uh uh last name Lee. So I guess the AI thought it was Chinese because it's Lee's. I don't know necessarily borderline racist, even though the guy is not Asian. Yes, it's crazy, right? Um, and again, you know, obviously it's kind of a joke in that in that regard, because look, if you take the AI and you give it proper, like, hey, look, here are the pictures, this is what you want you to want you to say and create it, it might do something fairly good, right? Yeah, but just saying, hey, get me this, um, that's or the vision that the AI will just be a genie that you asked it for a wish and will you know grant it on command, that's not how it goes. And we need to that type of hype needs to go away. Look at this. We did this you we did it just to see what happens, and look, it turned me, it turned me into a beautiful woman, you know?
SPEAKER_08Yes, uh, yeah, pretty much.
SPEAKER_03I mean, I'm not complaining, I'm just saying that that's what happened. You know, I'm just saying that's what happened. That's all I'm saying.
SPEAKER_08You know, uh yeah, yeah. So that's how we uh we end the with instead of the meme of the week, the AI disaster of the week.
SPEAKER_03Yeah, that's right. Oh, and the mailing list works. So thanks, Matt, for confirming that it works. So I'm happy to have another data phone that tells that it works.
Tool Validation Question And Takeaways
SPEAKER_08So um, because we showed a whole bunch of tools, and because I think we get uh newer to digital forensics people listening to the podcast sometimes, my sister's here tonight, and I'm gonna call her out because she sent me a message privately instead of putting it in the chat. And she wanted to know about the tools. When you use these tools for police cases, do you have to do validation or verification studies before you can use them to ensure that they work as expected? And of course, I yelled back, why aren't you asking that in the chat? And she wrote, Because I'm not a forensic person and everyone else already knows the answer. But everyone else may not know the answer. So it's going.
SPEAKER_03No, it's nothing they don't know the answer. The answer is not known. And and and not only that, right? Yes, um, we're gonna now the show ex because of that this question, we're gonna extend it for another half hour.
SPEAKER_07Oh my god. Good job, Holly.
SPEAKER_03Yeah, because look, no, uh actually, look, I um I mean, we said it before on the show, but uh we're gonna take that question and I don't want to make it maybe a 30, 45-minute episode just going over that question. Because that's that's a really incisive question. That's a question of somebody as a scientist. And and I know how it's a scientist. And even if I didn't know that, by the question, I would have had inferred that and I would have been right. Yeah because that's that's that's the thing that gets lost, you know. See, now I got her fired up. That's the thing that gets lost in our field. This is not a mechanical field, you're not an operator. You don't go and I'm here to follow this checklist and I'm done. You're you're it's a scientific field. You're a scientist. There are some procedures that you need to follow as a scientist to be able to do this job properly. Yes. And we have this wrong impression that I'm here to just mechanically do something. In the same way I mechanically drive a car. I move a box from point A to point B, right? Uh mechanically I write a ticket and give it to a person because they were speeding. This this is not it. Uh we have to um see again, half an hour extra show. I'm gonna stop. I'm gonna stop. Incisive question. I'm gonna assume, really soon, put it on their to-do list. Yes. Short 30, 45 minute show or or on on that, just to reiterate the point, because it's so important that these conversations are ongoing for people who are coming new into the field, but also experts or people that have been a long time and we get complacent and we shouldn't, right?
SPEAKER_08Yes, agree. Holly, thanks for the topic.
SPEAKER_03Thank you. So yes, thank you. No, it's uh it's it's good stuff, great, great question.
SPEAKER_08All right.
Thanks For Watching And Goodbye
SPEAKER_08So I think that's I think that ends it. I think that is we can we came back and we came back for an extra half an hour almost.
SPEAKER_02So we're trying to make up for the abandonment that we're giving everybody.
SPEAKER_08So yeah, unless you have anything else, I think we're we're done for that.
SPEAKER_03Well, but let me so I do have to do something else, which is look for the look for the uh music. Again, we've been so so out of this for so long that I'm oh, here's the music. Okay, there we go. So again, I have to say this. Anything else for the show header? That's kind of my my exit phrase for you. No? All right, well, we see each other next time when we see each other.
SPEAKER_07We will. Maybe we'll make it a little a little uh sooner. How's that?
SPEAKER_03Thank you everybody for being around, folks in the chat. We love you, and we'll see you next time.
SPEAKER_07Bye.
SPEAKER_03Bye.
