Bunting Digital Forensics, LLC

07/14/2021

Basically, people find what they are told to expect.

In the first study designed to specifically explore reliability and biasability in digital forensics, renowned cognitive bias expert Itiel Dror and co-author Nina Sunde have illustrated that examiners’ observations are biased by contextual information, and consistency between the experts is low.

04/12/2021

There is no end to the news posts regarding this situation in Albania wherein the flight controllers staged an illegal strike under the guise of all controllers succumbing to stress within minutes of each other. https://apnews.com/article/albania-edi-rama-coronavirus-pandemic-strikes-tirana-28942d9e9d85ae674480f5d3d8d52e29 This strike shut down air traffic to and from the entire country for about 2 days. What you will be hard pressed to discover in the news, although common knowledge amongst Albanians, is the the government investigation led to the capture of all the the controller's "Whatsapp" messages! At one time, Whatsapp was regarded as the 'secure messaging' app, but recall that FB bought Whatsapp and with that purchase security of messages on Whatsapp went out the window. It seems that Signal is becoming the messaging app of choice for most Albanians, literally overnight. Imagine that... So those of you still trusting Whatspp to securely transmit and store your data should perhaps rethink that position. My advice; use Signal and forget Whatsapp.

04/07/2021

For those of you who use FTK Imager Lite from a USB Drive, please take heed that it is based on version 3.1.1 and the digital certificate for that version has been revoked. Therefore it will NOT run in Windows 10. This was discovered in February 2021. The fix is to download the latest version of FTK Imager, which is currently 4.5, and then build your own portable version. You'll need to include some dll's from Microsoft as well. The issue is fully described here: https://support.accessdata.com/hc/en-us/articles/360044641813-Permissions-error-when-trying-to-run-FTK-Imager-Lite . The links to the D/L and the BYOP (Build Your Own Portable) can be found on this page. The last place you want to discover this issue is out in the field! BTW, disabling UAC won't fix it. UAC is already disabled on this system giving this message.

09/08/2020

I enjoy this every time I watch it...

https://vimeo.com/134128443

06/22/2020

BlueLeaks posts data exfiltrated from over 200 law enforcement agencies. Apparently these agencies use the same web hosting company and that company's security was breached. Just what LE needs at this most crucial time.

04/03/2020

COVID-19 is 'normalizing surveillance'. Of course one can, perhaps, justify these actions now, but when it's over? The surveillance infrastructure is in place and normalized...

Gov't-mandated apps are bringing the fight against COVID-19 onto personal devices, prompting concerns about privacy.

02/07/2020

U.S. news outlets don't seem at all interested in this one. Too much else to report I guess. Nevertheless, location data use or misuse is a recurring theme. More location data now than ever before and it will only get worse. Harvesting and selling, even to the government is big business.

WSJ reports US agencies have arrested undocumented migrants based on phone data purchased from a commercial company.

02/06/2020

With WhatsApp being the most used messaging app, it is also a target for malware. That said, always take care to keep it up to date and to be wary of clicking on links from questionable sources.

A high-severity vulnerability could allow cybercriminals to push malware or remotely execute code, using seemingly innocuous messages.

11/16/2019

Old time crime meets high tech... The perfect heist! It's a great read, but do it when you have some time.

With its cheap geothermal energy and low crime rate, Iceland has become the world’s leading miner of digital currency. Then the crypto-crooks showed up.

10/28/2019

A major breakthrough for iPhone forensics for iPhones 4S up to iPhone 8 and X. The beauty is that Apple can't patch it because it is a bootrom vulnerability. Apple would have to recall all iPhones in this range and I can't see that happening. With this exploit, the iPhone can be jailbroken or rooted for forensic acquisition. If you reboot, it goes away, but that's quite ok! As this code is smoothed out, expect to see it in the mainstream forensic software very soon....

New jailbreak will work on iPhones 4S up to iPhone 8 and X.

10/28/2019

Just had a case where this happened. There was a question as to how certain "nasty photos" appeared on an iPhone that was in the possession of a child who was the object of a child custody battle. The parents were accusing each other of corrupting the minor by allowing him to have such pictures when, in fact, they were cyber flashed to him. The iPhone database that manages the photos on the phone has a field that stores the creator package or process that creates a photo on the phone. It is of course a deep forensic dive, but the proof was there. Air Drop was the culprit and the settings were for everyone. Air Drop's package name is com.apple.sharingd. There were a handful of images and the thumbnails were created at the same time, to the second.

People use Apple's AirDrop photos to send unwanted explicit photos to strangers. Here's how to change your settings to prevent people from being able to send you images without your consent.

08/30/2019

No such thing as 100% safe on the internet!

Google security researchers say that hackers spent at least two years targeting iPhones “en masse” and placing “monitoring implants” on Apple's smartphones.