Sensitive Incident Investigations. Digital Risk Management. Forensics Testing.

Transcription

1

2 Sensitive Incident Investigations. Digital Risk Management. Forensics Testing.

3 2009 Innovation Award Winner Austin Chamber of Commerce

4 2010 Innovation Award Finalist Austin Chamber of Commerce

5 Only private laboratory in the world with same accreditation for digital forensics as FBI American Society of Crime Laboratory Directors 2010

6 Who We Are Since 2004, we ve provided sensitive incident response and investigation to clients around the world, including foreign governments, corporations, law firms, and state and federal agencies. Our digital forensics laboratory is ISO/IEC 17025:2005 compliant and accredited by the American Society of Crime Laboratory Directors under their International program (ASCLD/LAB International). Certificate ALI-113-T Field of Accreditation Forensic Science Testing Discipline 9.0 Digital and Multimedia Evidence

7 What We Do forensics. When corporations and foreign governments feel outstripped by technology, they call us. We provide 24-hour crisis support and computer incident response, including: Forensic Media Examination and Analysis crimes. disputes. corporate distress and investigations. Mobile Device Seizure and Investigation blackberrys. iphones. Evidence Preservation forensic collection. chains of custody. secure evidence storage. Data Recovery hardware failures. data reconstruction. advanced searching & processing. Expert Services Testimony. Affidavits. Reports.

8 What We Do Consulting. One of the things we do best is help clients cut us out of the process. FBD Global provides training and specialized advisory services to industry clients building their own internal forensics and data recovery labs, including: Strategic Consultation laboratory and clean room construction. staffing. toolkits. Regulatory Advisory Services risk assessment. audits. process and quality system development. Training forensic examination. data recovery. quality management. security. Our personnel have backgrounds in law, criminal investigation, intelligence, fraud examination, and information systems and security. We offer basic-to-advanced training on the techniques we use to provide digital forensics and data recovery support.

9 We Tell Stories. Computer Incident Autopsy Mobile Device Seizure and Analysis Lost or Fragmented Data Reconstruction User Profiling Internet History Analysis Event and Communication Analysis Deleted File Recovery Advanced Data Searching and Processing Google Search History Recovery and Analysis Social Networking Activity Forensic Evidence Collection Encryption Analysis We Keep Secrets.

10 These clients faced the same choice you do:

11 Case No CRIME A successful chain of retail businesses was acquired for a large sum of money. The day after the sale was announced the principal owner s 6-year old boy was kidnapped in a foreign country and held for ransom. The kidnappers negotiated an approximately $1M ransom. The money was dropped, and the kidnappers seized the ransom, murdered the boy, and vanished. Foreign law enforcement investigated and the case went cold after several months. We were engaged by the Attorney General for the country of incident. It was suspected that government employees may have masterminded the kidnapping. Within a week, forensic examination of agency computers developed evidence that identified the prime suspect in the case, a police officer. While in custody police discovered thesuspect was holding children from two other kidnappings. The case made national headlines and the rescued children were returned to their families. The suspect was killed in prison three weeks later.

12 Case No FRAUD Case No data breach Our client represented the wife in a complex divorce proceeding. Husband and wife had co-owned and sold an early stage company during their marriage for approximately $8M dollars. At the time divorce was filed, the marital estate was estimated to be approximately $2M dollars, and there was no accounting for the missing $6M dollars. Forensic examination of cell phones, personal computers, and financial activity uncovered data fragments which, upon analysis, were traceable to an undisclosed bank account that had been surreptitiously accessed by the husband. Following a subpoena to the bank, it was discovered that this undisclosed account contained about $6 million dollars. A settlement agreement was reached and greatly favored our client. We were retained by a government agency to respond to and investigate a breach incident that had resulted in data theft. The stolen data was sensitive and the client needed an emergency response. Our crisis support team responded in the middle of the night to assess the incident, analyze the technical landscape, and contain the breach. Progress was initially slow despite an all hands response. However, deep examination in our laboratory identified a small, almost insignificant string of malicious code intentionally obfuscated within other code. And further analysis traced the source to multiple internal employees. The breach was contained and criminal proceedings were instituted against the offenders, all software development engineers and programmers. Case No embezzlement We were engaged by a company to examine its technical infrastructure for suspected intrusion and/or monitoring. Investigation revealed an ongoing breach was in fact occurring, but the source was internal. We discovered multiple keyloggers and other monitoring software had been deployed to company computers. Further investigation determined the source was a trusted employee and that, in addition to monitoring, the employee had been embezzling money from the company for several years. It was later revealed her motive was to steal customer lists and spy on management in order to later separate from the company and form a competitor. Both civil and criminal proceedings were instituted against the suspect, who was ultimately convicted and imprisoned.

13 Case No ip theft Case No crime We were engaged by an online seller of nutritional supplements being sued in Federal Court for intellectual property theft. A motion was to be heard by the court regarding possible spoliation by our client. This motion was based upon a report generated by a national computer consulting and security firm hired by the plaintiffs. Our examination of the report revealed it contained multiple inaccurate statements and fundamental misunderstandings about computer forensics. We testified in court and advised our client during cross-examination of plaintiff s expert in a brutal challenge of his forensics expertise, which turned out to be rudimentary. Our client was a foreign government agency. We were engaged to investigate computer activity in connection with a suspected child exploitation ring. Forensic examination linked some computers to child pornography operations in Eastern Europe. The results of our investigation implicated multiple individuals, including a ranking member of the foreign ministry, as well as a local priest. The suspects were tried and imprisoned. The evidence we developed was instrumental in securing the conviction and sentence. Based on our work, the motions for sanctions and summary judgment were dismissed and a settlement between the parties was quickly reached. This was good news for our clients as they would have been personally bankrupted had they not prevailed on these motions. Case No e-forgery We were engaged to provide expert consulting and reports in connection with a complex lawsuit based on allegedly falsified contracts. A proud supporter of HTCIA high-tech crime investigation association An independent third party had been ordered by the court to handle document production and searching. Our forensic examination and analysis of the discovery provided by this third party indicated the contractsinquestionhadbeencreatedmore than two months after they were supposedly executed. Understandably, the judge in the case didn t have a sense of humor about the forgery, and our client prevailed on summary judgment.

14 Case No criminal defense Case No criminal defense Our client was charged with computer intrusion, aggravated identity theft and possession of contraband images. The case was investigated by the U.S. Secret Service in Dallas. Evidence comprised more than two million files spread across twelve computers and devices, many of them encrypted. Defendant filed a motion to suppress the evidence as seized outside the scope of the search warrant. Over the course of several months, both in our laboratory and at the U.S. Secret Service, we determined there were several misrepresentations in the government s responses to Defendant s motion. We further determined the government had no basis for searching encrypted files given the scope of its warrant. The District Judge granted the motion, calling the search an obvious case of deliberate overreaching by the government in an effort to seize data to which it lacked probable cause. Our client was charged with distribution of narcotics, counterfeiting, and possession of contraband images. The case was investigated by the U.S. Secret Service in Dallas. Defendant moved to suppress evidence claiming the computer was searched by police prior to obtaining a warrant. Our forensic examination determined (i) that local police had searched the computer for approximately two hours prior to seeking a warrant to search for evidence of counterfeiting, and (ii) the police exceeded the scope of that warrant for another three hours searching for contraband images. The court agreed that these and other actions were strong indicators of bad faith by the officers. The computer was suppressed and without it there was no evidence of counterfeiting or possession of contraband images. (And the narcotics alleged in the indictment which were found in a sugar bowl turned out to be sugar.) All charges against Defendant were dismissed with prejudice. Case No ip theft We were engaged by a multinational software firm being sued by its principal rival. Several employees had departed the rival firm and were employed by our client. The suit alleged sensitive confidential data had been taken without authorization. Examination of computers and cell phones determined that, while employees still possessed confidential data, no employee attempted to use or transfer the data, and there were no indications any data had been intentionally accessed. Member in good standing infragard association of certified fraud examiners The litigation had a potential loss for our client of $2 billion and was settled for a much more favorable sum.

15 Contact us today (U.S. and Canada) (all other countries)

16 Global Consulting Flashback Data FBD Management