Day 2 was just as good as day one, here are the highlights:
- Ethan Bayne presented on how to use GPUs to speed up carving and searching for files in a forensic image. Amazingly this has not been done yet, and the results he presented were spectacular as you can imagine! Essentially it’s just parallelising a search; and in a demo during the morning break he showed me he could search a 20GB image in 45 seconds – and this was just using his MacBook graphics card. It amazes me that Guidance or AccessData have not yet thought about this in their products.
- An interesting and lively discussion followed Jim Fraser‘s talk on the issues of modern police forensics. He (as a chemical/biological forensic expert) thought computer forensics was less rigorous and scientific than general forensics, as that was very much based on the scientific method. The debate followed that digital forensics is still a relatively new field in the history of forensics, and perhaps it’s yet to settle down into a more rigorous manner. However due to the ever changing nature of operating systems and applications, we’ll never have one method of doing anything. Blood and DNA doesn’t change; the data, software and hardware on a computer does.