Forensic 4:cast Nomination Picks from Magnet Forensics Examiners
Hi! This is Jessica Hyde, Director of Forensics, along with Tarah Melton, Solution Consultant, here at Magnet Forensics. We love the Forensic 4:Cast Awards because it is an opportunity for us to highlight many of the folks in the community who have been doing and creating incredible work.
One of the great things about nominations, is that you can nominate as many as you want in any category. Now, when it gets to voting, that is when it is hard because you need to decide. So, we wanted to share many of the nominations we are making this year and we hope that you will consider recognizing these folks with a nomination as well. This list is in no way exhaustive as there is so much incredible work being done in the community and is focused solely on work done in 2020.
DFIR Non-Commercial Tool of the Year
Jessica Hyde: xLEAPP (ALEAPP and iLEAPP) from Alexis Brignoni with Yogesh Khatri with a slew of contributions from the community! This suite of open-source tools for Android and iOS analysis provides rapid insights on mobile devices and is a win for users. The speed at which Alexis and other contributors add modules is incredible. Speaking of speed, it takes seconds to use. If it is not in your toolbox, give it a whirl.
MemProcFS by Ulf Frisk is an incredible tool that mounts memory as a file system that you can explore! Always excited when a new memory forensic tool hits the seen providing other analysis alternatives. Check out this presentation from Aaron Sparling and I at the 2020 DFIR Summit that shows how MemProcFS can be utilized alongside other memory forensics tools in your toolbox.
Unfurl by Ryan Benson is an amazing tool that delves into the parameters in URLs. There is the potential for incredible information including timestamps embedded in URLs that can be imperative to a case. Check it out next time you have a URL of interest recovered from evidence.
Epoch from Ian Whiffen has quickly become one of my favorite Time Stamp conversion tools. As someone who teaches mobile device forensics, I can say it is quickly the choice of my students as well when decoding even though they have a choice of tools for this purpose. This is another handy tool for your toolbox.
DFIR Show of the Year
13Cubed by Richard Davis delves into a variety of Digital Forensic topics with hands on how-to knowledge that is well suited for both beginners and advanced examiners. Richard’s knowledge and depth coupled with his fantastic teaching skills make for easy-to-understand explanations and practical demonstrations on a variety of forensic topics
DFIR Blog of the Year
Ciofeca Forensics: I am such a fan of this blog and what was produced in 2020, that I had already mentioned in last year’s post that I would be nominating this blog because of its incredible Apple Notes series. Well, that is not all, the blog went on to produce a slew of great content including thorough walkthroughs of a multitude of CTFs that really help the reader understand the way to solve these challenges enabling others to walk through the steps and learn more. Fantastic blog that should be in your RSS feed!
DFIR Book of the Year
iOS Research and Exploration Volume 1 by James Duffy. This was a year of self-published DFIR books, and I really enjoyed this book as it gives practical ways to start a journey into research pertaining to iOS.
DFIR Article of the Year
Tinkering with TikTok Timestamps was a fantastic blog post from Ryan Benson where he demonstrates how you can determine when a video was posted from the URL it shares. This is fantastic information that may not otherwise be immediately available when TikTok videos are shared. Not only is the information fantastic, but the content was peer reviewed by the community and is available both on Ryan’s blog and on DFIR Review.
DFIR Social Media Contributor of the Year
Ryan Benson shared DFIR content each and every day in 2020 with the hashtag #DailyDFIR. That is 366 tweets (it was a leap year!) that really drove conversation. Check out his most popular tweets in his blog post “A Year of #Daily DFIR” as well as my interview with Ryan.
DFIR Degree Program or Training Class of the Year
DFIR Python Study Group from Alexis Brignoni is a course to get Digital Forensics folks schooled on writing Python. Across 24 sessions, Alexis teaches the basics of Python and gets students comfortable writing their own parsers including everything from XML to protobuf data and more. Such an amazing free resource to the community.
Tarah Melton: I hope that you’ve have the opportunity to take any of the top notch training classes given by the exceptional Magnet Forensics Training Team (who definitely deserve a nod for this category too!). Additionally, I’d also like to give a shout out once again to the Digital Forensics Undergraduate Program at Bloomsburg University of Pennsylvania. The program (of which I am an alum, full disclosure) prepares the students with the technical foundations and use of popular forensic tools to ensure their success when entering the DFIR workforce. The Digital Forensics program at BU is also a National Center of Academic Excellence (CAE) in Cyber Defense Education with a focus in the area of digital forensics by the National Security Agency and the Department of Homeland Security, AND they host an annual digital forensics conference, BloomCON (virtual this year!), which offers valuable technical lectures and forensics challenges.
DFIR Newcomer of the Year
Jessica Hyde:
James Duffy has written tools, books, and blog posts around his iOS research this year. Check out my Cache Up interview with him to learn more about all the incredible work James has contributed during his first year in DFIR.
Elan Wright broke onto the scene with her website, DFIR Diva where she shares Free and Affordable DFIR content along with posts about how to set up your own lab! Check out our Cache Up chat to learn more about Elan.
Doug Bryan Jr. is a true motivator who broke out on the scene this year with a book and presentations. He also runs a non-profit to better his community when he isn’t working in Digital Forensics and Incident Response. You can learn more about what Doug is doing from our discussion on Cache Up.
Abhiram Kumar not only competes in CTFs, but he builds them too! He created MemLabs to help others learn memory forensics. Additionally, Abhiram is a contributor to About DFIR where he maintains the CTF page.
DFIR Mentor of the Year
I am fortunate to have had so many incredible mentors over the years. I would like to specifically call out some folks who helped me grow leaps and bounds in 2020 – Dr. Eoghan Casey, Mitch Kajzer, Jad Saliba, and Brett Shavers. All are incredibly smart and accomplished members of our field who share resources and help guide others. They each challenged me in different ways and mentored me through multiple projects in 2020. Just a huge thank you to you all. Take the opportunity in the 4:Cast awards to recognize all of your mentors, formal and informal. There are so many folks who are unaware of the mentorship they have provided as I have learned from them.
DFIR Resource of the Year
In addition to all the incredible community resources I have advocated in years’ prior; namely DFIR.training, Digital Forensics Discord Server, AboutDFIR, and This Week in 4n6 (which each deserve nomination), this year I would like to add to these amazing resources DFIR Diva. This website provides a regularly updated list of all the free or nearly free training resources available. It is a valuable site to both those getting started and those looking to level up their skills. There are so many free resources made available in 2020 and Elan did an amazing job sharing those resources in an organized way for the community.
DFIR Investigator of the Year
So many great folks all mentioned in the areas above. I would like to call out two of those folks who have dramatically improved our community and forensics body through their work for your consideration in nominations; namely Ryan Benson and Alexis Brignoni.
There are so many incredible folks in our industry and the Forensic 4:Cast awards are a fantastic time to recognize those whose work you appreciate. Remember, you can nominate as many folks as you want for each category. It doesn’t get hard until we have to actually vote.
Tarah Melton: So deserving of this nomination is none other than Alexis Brignoni. As always, throughout 2020, Alexis continued to be an amazing contributor to the DFIR community, sharing his tools, knowledge, and research. Alexis continues to update his iLEAPP and ALEAPP software to share with the community, and even hosted a multiweek long Python study group to help others enhance their investigations in DFIR. Thank you, Alexis, for your contributions and investigative insight in DFIR!
Get your nominations for the Forensic 4:Cast Awards in before May 14!