Inside Digital Forensics: Hunting for Truth in the Dark with Heather Barnhart | 22

In this episode, Ciaran and James speak with Heather Barnhart, Senior Director of Forensic Research at Cellebrite and Head of Faculty and DFIR Curriculum Lead at SANS, about the challenging world of digital forensics. Heather shares her experiences working on high-profile criminal cases, discusses the importance of thorough logging, and reflects on the real-world impact of cybersecurity on people’s lives.

Highlights

Background and Accomplishments

An introduction to Heather Barnhart and her various roles at Cellebrite and SANS.

• Cellebrite
• Heather Barnhart | SANS Institute
• FOR585: Smartphone Forensic Analysis In-Depth | SANS Institute

Inside Digital Forensics

The fundamentals of digital forensics, including the importance of logging.

• What is Digital Forensics and Incident Response (DFIR)? | IBM | Digital Forensics: Training Best Practices for Officers, Investigators
• RSA talk in the spring RSA conference: The Five Most Dangerous New Attack Techniques…and What to Do for Each | Log for Normal to Find Evil: Lessons from Real Crimes and Cyberattacks
• Logging and protective monitoring | OWASP A09 Security Logging and Monitoring Failures

• The APT 38 bybit attack: FBI Confirms North Korea’s Lazarus Group as Bybyit Hackers - Infosecurity Magazine

Forensics in the Field

How digital evidence has transformed criminal investigations, featuring high profile cases that Heather contributed to.

The Crystal Rogers case including the phone log as evidence:

• Prosecutors piece together Crystal Rogers’ presumed final hours in KY murder trial
• Jury deliberations expected in Crystal Rogers trial. Catch up on the case here
• Motions to acquit denied after prosecution rests against Houck, Lawson

Osama bin Laden

• One phone call led U.S. to bin Laden doorstep
• Bin Laden's tech trove may give up secrets

Bryan Kohberger and the Idaho murders

• A digital forensics expert who was set to testify at Bryan Kohberger’s trial says evidence shows ‘he prepared’ for Idaho murders
• Examining the Idaho Murderer’s Phone: How to Find Truth in Missing Data

The State of the Industry

Reflecting on the challenges shaping DFIR and the wider cybersecurity profession

The impact of burden

• The risk of a thousand paper cuts – the human-centred problem seen with stress and burnout in cyber security
• Why burnout is a growing problem in cyber-security
• Improving the Mental Health and Well-Being of Forensic Examiners

What makes for good DFIR?

• Digital Forensics and Incident Response Training
• DFIR Framework for Operational Technology (OT)
• The Art of DFIR: Why Our Work Makes the World a Safer Place

• Purple teaming: Mastering Purple Teaming: Collaborative cyber resilience and the benefits of Purple Teaming | Continuous Purple Teaming: A Practical Approach for Strengthening Your Offensive Capabilities
• Persistent threats and old techniques: Why the Old Ways Are Still the Best for Most Cybercriminals

Diversity of thought:

• Diversity matters even more: The case for holistic impact
• Decrypting diversity: Diversity and inclusion in cyber security report 2020
• Why diversity matters when recruiting cybersecurity staff

Additional Resources

• Ed Skoudis | SANS Institute
• Mick Douglas | SANS Institute
• Pierre Lidome | SANS Institute

Subscribe & Follow:

• Subscribe to the podcast on Apple Podcasts, Spotify, or your favorite podcast platform.
• Follow us on Twitter, Facebook, and LinkedIn for updates.

Contact:

• Have questions or comments? Email us at cyberleaderspodcast@sans.org