Wifi signals in normal operation have a range. Wifi signals typically get out based on the channel, antenna type and configuration. However in unobstructed space Wifi signals can go 1000ft. So what would happen if you had a network that had a wifi access point every 1000ft that was listening to those MAC addresses passing by? Well if you had a deployment like that you could literally locate any user by MAC address no matter where they go.

Now imaging for a second if you had an anonymous database from advertisers that had all of the Wifi devices they have ever seen with location data. Well with this type of advertising data you can actually tell every place somebody has been historically and probably in real time as well.

Bluetooth only goes about 300ft so you would need open space and alot more access points when using bluetooth. Now what about the cellular networks? Can you look to see what handsets are active around the area connected to a nearby tower? Why yes you can because those frames are not encrypted, only the data is encrypted. Hmmmm......

So as you walk around with that phone realize that you have already bugged yourself, and anybody with a software defined radio and some knowledge can find you easily, at any time with nothing more than a computer and the SDR and a $20 antenna.

Geolocation is not only done by using mobile antennas triangulation. It is also done using the Wi-Fi and Bluetooth devices around you. Operating systems makers like Google (Android) and Apple (IOS) maintain a convenient database of most Wi-Fi access points, Bluetooth devices, and their location. This active and continuous probing can then be sent back to Google/Apple/Microsoft as part of their Telemetry. The issue is that this probing is unique and can be used to uniquely identify a user and track such user.

#TSCM #cellular #wifi #bluetooth

For more information on Electronic Countermeasures reach out to Skeleton Key Investigations at 919-441-7353

You may find yourself charges with any of the following:

• Criminal online activity

• Child Pornography

• Fraud

• Illegal intrusion to a controlled system

• Hacking and Malware related issues

If this happens getting the right team in place will be critical if not the most important aspect of your case. Most attorneys know the law but they can't speak the lingo, don't understand how digital evidence is stored, transmitted or the metadata associated with this type of evidence. To make matters worse, most law enforcement agencies know enough to be dangerous.

With any case you must prove or disprove an allegation that is within the scope of the investigation. For instance, if charged with hacking, the warrant must be specific on what has occurred and must fully describe the evidence to be collected. In this digitally connected age most agencies focus on the computer in which the activity may have occurred but there are other potential things that should be analyzed in these types of cases.

There have been many cases where a router at a site was infected and no evidence was present on the computer but because an individual accessed pornography in the past the charges stuck. It is the burden of proof for law enforcement to prove that the person in video or images are under the legal age in your state. There are hash sets that match content and that is one way that positive identification can occur but that's not the end of it. You have to check the network and ensure that routers, IOT devices, thermostats, refridgerators, etc. have not been compromised. There have been cases where a subjects refridgerator was connected to their wifi network and was service child pornography and the client was unaware. These things happen to innocent people. In some states mere possession of child pornography is all that is needed to catch a felony. The key of the forensics investigator is to determine HOW that information go to the device where it was detected. This is not always easy.

For a free consultation please use the contact us form on the website. All customers receive up to 90 min consultation to discuss your case and to give you some ideas on how you should proceed.

Here are some ideas for what you should probably consider in general should this occur to you:

1. Hire an attorney with experience in digital evidence. Not all attorneys understand how digital evidence is created.

2. Find and hire a reputable computer forensics examiner that is rendered as an expert witness.

3. Demand full discover of all electronic evidence

4. Review chain of custody and the proceedures used. They must be generally accepted and must have appeared in publications to be admissible. Not everybody processes the data like they should.

5. Review the warrant scope.

6. Review all electronic devices connected to the same network for evidence of intrusion or hacked systems.

7. Look for malware and virus activity that may account for the activity, this does happen from time to time.

These are the basics. There are more specific things that must be considered to be successful. Again reach out and we will give you a free 90 minute consultation.

1. Smartphones - Everybody knows that without GPS phones become harder to use

2. GPS Devices - GPS navigators, GPS trackers and air tag data are some devices that will have location data

3. Smart Watches and Fitness Trackers - This is how they know how far you have run or walked during your exercise sessions

4. Vehicle Infotainment Systems and Smart Radios - Most vehicles these days are a treasure trove of GPS and other diagnostics data that are captured automatically

5. Dash Camera's and Body Camera's

6. Digital Cameras

7. Some laptops and computer motherboards

8. Game Consoles

9. Wifi Devices -Such as hotspots

10. Starlink Terminals

In short don't forget about these devices when doing digital forensics or corporate investigations. There is sometimes a treasure trove of data available.

Digital video recorders may even embed the GPS location information in video like is commonly done with images from iPhones and Android (if the feature is not disabled).

When looking into incidents don't forget that Digital Video Recorders and GPS devices probably contain location data that will be useful to your investigation.

In surveillance, sometimes audio is captured and stored but may not be clear or even understandable. So long as you maintain forensics methods and document the processing, this evidence may be critical in cracking your case.

Sometimes it's not even about what was recorded but building a timeline of events. Post processing can clear up video, ehnance recordings or assist in determining that timeline of events leading up to a crime.

Call 919-441-7353 if you want to discuss your particular case.

If you are not familiar with OCR let me explain briefly how it works. OCR (Optical Character Recognition) is a process that looks at files (images, video or audio) and then transcribes anything observed. For instance, if processing a video file and the person recording the video were to capture a billboard in their recording, the OCR reads the billboard text and then captures that text and associates it with the video. Say that billboard was for "Starbuck's" (the coffee chain). Searching case files for anything related to "Starbucks" would then link the video because the video is relevant to what you are looking for.

A good tool for doing this type of scraping is Alephdata (https://github.com/alephdata/aleph) which is an indexing and document storage platform that can index any type of data for you and then make all the OCR text and content searcheable. It can also build association charts showing you what files are connected to other files based on the keywords and OCR terms that were observed in the data.

Several forensics tools including Datapilot as well as EnCase have plugins or tools that can run OCR on photos and other evidence being processed.

This may make the difference between findings critical information for forensics cases and should be a toolbox in the investigators arsenal.

When doing forensics investigations it is critical to answer questions on how files arrived on the storage device being analyzed. During a recent case a child exploitation case was brought against an individual that was running peer to peer software. Because of how the software operated users had to explicitely select "share" to share the content.

The accused stated that while they had contraband, they did not distribute it. A review of the case showed that in fact, based on the configuration of the server itself it was not possible for this person to have shared the information located on the device. This resulted in a lesser sentence because the original charges were possession and distribution.

Everybody deserves to be treatly equally and fairly under the law. Even though this defendant did something bad (and served his time), his original sentence was nearly doubled becuase of the distribution charge. A case was brought against the FBI who originally handled the prosecution of the case and the evidence was reviewed. It was definitive that the defendant had child exploitation material but that they did not (and could not) distribute it. The jury during the original trial was told that the peer to peer software is used to share this material. In the case of this defendant, not only did he not share the content, but he explicitely disallowed sharing of files that were downloaded. The defendant was sentenced to 14 years originally, served 9 years before his appeal and was released after 10 years in prison.

While we don't like defending child exploitation cases, the sentence in this case was clearly wrong and mishandled. The original charges would have been 7 years if charged just with possession which the defendant admitted.

The attorneys did their job in that they got the appeal based on a review of the forensics information and the testimony of experts that proved that no sharing occurred in this case.

A note about the data. In forensics the data is what it is. Data can hurt or harm the defendants case or it can help the defendant prove their innocents. In the highlighted case the defendant was not innocent but was improperly convicted of a crime they did not commit in addition to the crime that they admitted.

The data in forensics speaks to what has occurred. In some cases it may not be possible to determine HOW a file was present on a computer or cell phone and in some cases the source is able to be determined with forensics data. Be sure to be honest with your attorney and the investigator or defense expert. Everybody deserves to be treated fairly and equally. If you committed the crime and we can prove it, we will support that finding. If we can show that you did not commit the crime, the data will show that.

Justice should be applied equally irregardless of net worth, status or title. All persons are entitled to a defense and guilty parties should be convicted. Fiding the right experts with the experience to answer complex questions is critical when mounting a defense.