Hiding in Plain Sight

With caseloads increasing and data storage sizes exploding, computer forensic examiners are feeling the pressure to clear data and close cases quicker. With the ease of access to pirated material and the lack of legal recourse for such media, many examiners quickly clear the material to ensure there is no illegal material and move on. This can lead to missed evidence. We have discovered a way to conceal a video file within a video as a secondary layer. This prevents many utilities from displaying the second or hidden stream to forensic examiners. With examiners relying on their tools to display all relevant media, in this case, examiners may be inaccurately categorizing the files as clear or non-relevant, potentially missing concealed illegal material. We address the solution to ensuring you are not missing this new potential hiding place and provide open source resources to ensure each video file you investigate is truly non-relevant. This webinar is geared towards computer forensic examiners of all levels, however, all criminal justice practitioners are welcome.

Presented by:
Olin Rankin, High Tech Crime Specialist, NW3C