SEARCH High-Tech Crime Trainers to Offer Solutions, Hands-on Instruction at Three National Conferences

  Back  See more recent articles


Tim Lott
SEARCH's High-Tech Crime Training Services team is gearing up to share its collective knowledge at three national law enforcement conferences in April 2013.

We caught up with Training Director Tim Lott recently and asked him to fill us in on what the team has been up to and what they expect from these upcoming engagements. (See the shaded box at the end of the Q&A for details on selected SEARCH presentations this month.)

Editor: This will be the first time your team has presented at the Dallas Conference on Crimes Against Women. Tell us about the specific challenges that the attendees are facing and the solutions you will provide.

Lott: Technology is now so widespread in everyday life, and nearly every "traditional" crime contains some technological component, whether it's an email sent from a computer, a text sent from a smartphone, or an incriminating picture taken with a digital camera.

SEARCH recognizes the need for law enforcement officers to be trained in how to process this digital evidence. From searching for a suspect or victim on social media, to seizing digital evidence at a crime scene, the techniques taught at this conference will enable the practitioner to properly seize this information and ultimately help keep their community safe.

The focus of this conference is to train professionals who are responders to or advocates for victims of crimes against women—but the techniques we teach here can be applied to a broad range of crimes.

Editor: Your team is also preparing to teach at the 2013 National Cyber Crime Conference in Massachusetts. Tell us about that conference and what SEARCH's involvement will be.

Lott: Again, as technology permeates the everyday lives of Americans—from kids to teens to adults—more criminal activities are facilitated or accomplished through technological means. Investigators and prosecutors from across the country are gathering in Massachusetts to learn the best practices for investigating and prosecuting cybercrimes. SEARCH was asked to design and facilitate the "prosecutor" track for this conference.

Through SEARCH training and direct assistance, attendees will learn about pre-charging decisions, search and seizure, presenting digital evidence in court, and demonstrating the techniques of conducting a direct and cross-examination of a computer forensic examiner, among other topics. SEARCH is providing subject matter experts from across the country to participate as faculty members for this course, along with regular SEARCH high-tech crime training staff.

Editor: The third upcoming conference is the Child Abuse and Family Violence Summit in Clackamas, Oregon. What information will SEARCH present there?

Lott: Our High-Tech Crime Training Services team is an annual presenter at the Clackamas summit. This year we will instruct attendees on how to search social networking sites—especially Facebook and MySpace—to find valuable information that can help solve a crime.

We will also introduce investigators to free resources that will help them with their investigations. We will cover on-scene digital triage, demonstrate how to recover volatile data, and provide an introduction to Internet relay chat investigations.

We'll also provide two full-day sessions for two of our most popular courses. They both address in-depth subject matter: Introduction to Internet Investigations and Introduction to Mobile Device Data Recovery.

Editor: Please speak to the differences in your presentations at conferences versus the day-to-day training your team provides.

Lott: There are many similarities between the trainings that we provide at conferences and our everyday training, but our traditional training sessions are limited to 20 students per course and typically last one day to up to four days.

Many of our conference blocks are segments from our training offerings, but we can provide them in 90- or 180-minute training blocks. Because of this format—combined with large conference attendance—we're able to take advantage of this opportunity to provide skills to more practitioners at one event. They may not get as in-depth training at the conferences, but at least they are introduced to the issues that must be addressed and shown the tools and resources that are available to help them.

Selected SEARCH Presentations

Dallas
SEARCH will make two hands-on presentations, and attendees are encouraged to bring laptops or tablets to actively participate in online aspects of the lectures:
  • Internet Searching Techniques: Using Google and Facebook to Find Information, which teaches how to use Google Boolean and advanced operators to more effectively search for information and how to use specific Facebook searching techniques to find all possible publicly available data.
  • Technology Awareness in Investigations: Using the Data You Can't See, which demonstrates how to find and use "hidden" geolocation information stored in pictures from cellphones and on social media to aid in online investigations.

Clackamas
SEARCH is providing labs, workshops, and presentations, including:
  • Introduction to Internet Investigation, a lab that covers basic website investigation—including finding legal contact information, registrar information, and mining the website for additional data and leads. It also covers IP addressing, photo searching and property data, basic Firefox Add-ons, and basic Google searching.
  • Introduction to Mobile Device Data Recovery, an introductory workshop on cellular devices and the effect that mobile devices have on investigations. It covers considerations for mobile-device seizure, and various tools for mobile-device data recovery.
  • Become a Google Jedi: Save Yourself from Information Overload, a lab that teaches the effective use of Google to filter search results to relevant and useable information.
  • Investigative USB Apps, a lab that teaches how to download, install, and use portable apps as an investigative tool.
  • Introduction to mIRC Investigations, a lab that teaches the basic of Internet Relay Chat (IRC), focusing on the software set up to install and capture potential evidence.
  • Field Triage and Data Acquisition, a lab and lecture that addresses collecting potential evidence from running devices at the scene of a search warrant or a probation/parole search using field triage tools.
  • Firefox Add-ons: Free Resources to Enhance Your Investigations, a lab that teaches the effective use of Mozilla Firefox add-ons as investigative tools, which can save time in routine tasks.
  • The Recovery of Volatile Data, a lab and lecture that addresses collecting "volatile data" in the form of a computer's Random Access Memory.
  • Introduction to Social Networking Site Investigations, a beginners' workshop to provide an overview of social networking websites and their investigative value. Students will also learn how to set up an investigative social networking account to search for information.
  • Using Social Networking Sites in 21st Century Investigations, an interactive lecture to detail the importance of using social media to develop evidence to corroborate child-exploitation and physical-abuse cases. The lecture will focus on the importance of acting quickly to secure this evidence, and participants will learn about authenticating evidence discovered in cyberspace for court purposes.
  • Direct Examination of Computer Forensic Examiner will focus on the nuts and bolts of presenting a forensic examiner at trial. It will highlight possible exhibits that can be used to assist in explaining technology devices and computer forensics during the foundation portion of the examination.