Certificate Request
Each session sticker location must be filled with a sticker from the lecture or lab
the participant attended. Please turn in this page prior to departure. A location for
turn in will be designated before the end of the last session.
All below items must be completed to receive a certificate.
Name:
Agency Name:
Phone Number:
Email Address:
Session Sticker
Session Sticker
Session Sticker
Session Sticker
Session Sticker
Session Sticker
Session Sticker
Session Sticker
11
The 2014 ICAC Symposium is Hosted by
A special thank you to Fox Valley for the computer labs,
instructors, and symposium support personnel.
Additional Appreciation for Others who Also Provided Trainers
1
Florida Department of Law Enforcement
Missouri ICAC
7th Judicial Circuit
NCMEC
BlueBear LES, Inc.
NetClean
Brevard County SO
Nuix
Broward County SO
NW3C
Cobb County Police
Office of State Attorney
Connecticut State Police
Pinellas County SO
Embry Riddle
SEARCH
Facebook
Snapchat, Inc.
FL Dept. of Juvenile Justice
South Central Missouri SO
Gainesville PD
Tallahassee Fire Department
Henderson PD
Tallahassee Police Department
HSI
TLO
Magnet Forensics
University of Massachusetts
DO NOT WRITE
ON THIS PAGE
You will turn it in at the end of
the symposium
Manatee County SO
22
NOTES
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
Registration
___________________________________________________________________________________
Classes
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
Classes
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
17
2 33
NOTES
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
3
16
44
Color Key
Wednesday Afternoon — December 17, 2014
Regency 8
Palm 1
Room 8:00 — 9:45am
INTRODUCTION TO TECHNOLOGY FACILITATED CRIME PROSECUTION
Covered are the three common types of cases investigators and prosecutors will encounter and the role technology
plays in the exploitation. It also reviews the power of social media and its role in TFCSE cases and some of the
characteristics of offender behavior associated with TFCSE.
DEALING WITH ENCRYPTION
Recently, case law in the Federal courts and the Massachusetts highest State Court has provided a means by
which the 5th amendment protection may be overcome. This lecture will cover the uses of encryption, forensic attacks to that encryption, and the case law and practical tools for building a strong case are discussed.
Regency 3
INTERVIEWING OFFENDERS (repeated Wed 1500)
Students will be provided with interview strategies along with using themes in their interviews. This block will focus
on interviewing offenders who have traveled to engage in sex with a minor. Additionally students will learn how to
overcome common defense issues associated with the arrest of “travelers”.
Regency 4
SOCIAL MEDIA INVESTIGATIONS (repeated Wed 1000)
Because social media evolves daily, law enforcement and advocates must stay current with the latest developments
in order to properly utilize it from their investigations to their community services perspective.
SUPERVISORS’ ICAC OVERVIEW
An overview of ICAC investigations, equipment, training, and guidelines that supervisors should be aware of. This
course will also include a discussion highlighting how to get involved at a sustainable level proportional to agency
size.
Regency 5
Regency 2 Regency 1
KATANA FORENSICS
Vendor - Mobile Phone Forensics post SCOTUS, Apple and Google. How the landscape has changed and what
are the pitfalls and the future of cell phones and investigations.
ROUNDUP ARES REFRESHER
Designed for experienced P2P Investigators, this training will provide an update on using the RoundUp Ares tool.
OSTRIAGE (repeated Tues 1300) (runs until 1130)
OsTriage can extract operating system and registry details, USB device history, browser history of major browsers,
search engine search terms, cloud storage applications, encryption, P2P and other applications, and passwords. It
displays and categorizes images/videos based on a list of over 500,000 SHA's of interest and 300+ keywords.
INVESTIGATING ARES WITH CPS (repeated Wed 1000)
This lab will explain how Ares data is being incorporated into CPS and demonstrate adaptations to SharazaLE making it capable of collecting evidence from Ares users. This lab is designed for experienced peer-to-peer investigators. A CPS license is not required.
9:45 — 10:00am
15
Vendor
Regency 6
Regency 6
GIGATRIBE INVESTIGATIONS (continued)
Experience investigators will learn how to install, configure, and use the Gigatribe software to investigate the distribution of child pornography on the Gigatribe network. Evidence artifacts that are created during the use of the tools
will be identified and explained. Digital trace evidence will be identified and discussed.
Recommended
For Supervisors
Regency 7
Regency 5
SUSPECT VIEWER
Designed for users of the Roundup Suite of Investigative P2P tools. Students will learn how the add-on program,
Suspect Viewer, can integrate into their workflow and aid in the preparation of case documents.
Recommended
For Prosecutors
Regency 8
Regency 3
Regency 4
USING UC CALLS
Overview of the importance of undercover phone calls in online undercover operations to include best practices
when conducting undercover phone calls. A case study will be discussed that was successful largely due to the
undercover phone calls made throughout the investigations.
Regency 7
INTERVIEWING OFFENDERS
Students will be provided with interview strategies along with using themes in their interviews. This block will focus
on interviewing offenders who have traveled to engage in sex with a minor. Additionally students will learn how to
overcome common defense issues associated with the arrest of “travelers”.
Lab Class
Monday Morning — December 15, 2014
Palm 2
ETHICS AND SOCIAL MEDIA
The unique responsibilities of those in the medical, legal, law enforcement, victim services, and advocacy fields are
described to highlight common pitfalls of social media used by professionals. The attendees see examples pulled
from various media sites that could cause ethical issues. Privacy issues are also addressed.
Regency 2 Regency 1
Palm 2
Palm 1
Room 3:00 — 4:45am
Training Class
Break
4 55
Wednesday Afternoon — December 17, 2014
Monday Morning — December 15, 2014
Palm 1
ROUNDUP ARES FORENSIC ARTIFACTS
This lab will familiarize attendees with the Ares file-sharing client. Students will install and use the program, then
examine the digital trace evidence. The attendees will review a RoundUp Ares investigative session and the corresponding seized evidence.
Regency 5
EPHEX (continued)
Designed for beginner and Intermediate P2P investigators, this training will provide an overview of the Gnutella and
Gnutella2 networks. Students will learn how to use the ePhex program to target offenders trading child abuse material on those networks.
OSTRIAGE (continued from 0800) (repeated Wed 1300)
OsTriage can extract operating system and registry details, USB device history, browser history of major browsers,
search engine search terms, cloud storage applications, encryption, P2P and other applications, and passwords. It
displays and categorizes images/videos based on a list of over 500,000 SHA's of interest and 300+ keywords.
Regency 6
GIGATRIBE INVESTIGATIONS
Experience investigators will learn how to install, configure, and use the Gigatribe software to investigate the distribution of child pornography on the Gigatribe network. Evidence artifacts that are created during the use of the tools
will be identified and explained. Digital trace evidence will be identified and discussed.
CHILD PROTECTION SYSTEM (CPS) UPDATE (repeated Tues 1300)
Designed for currently licensed and experienced peer-to-peer investigators. Topics include new dashboard
“perspectives” to provide triage assistance, IP-GUID-Username subscription / real-time notification, media library
integration and more. This lab is for demonstration only. A current CPS license is not required.
Regency 7
Palm 2
Regency 4
ETHICS AND SOCIAL MEDIA (repeated Wed 1500)
The unique responsibilities of those in the medical, legal, law enforcement, victim services, and advocacy fields are
described to highlight common pitfalls of social media used by professionals. The attendees see examples pulled
from various media sites that could cause ethical issues. Privacy issues are also addressed.
NEW TO NORTH FLORIDA
For new investigators in the North Florida ICAC. This course is a mandatory familiarization course in the ICAC
Standards, North Florida ICAC web portal, training and equipment opportunities, multi-agency operations, and general communications.
LUNCH
Regency 8
“THE BOY WHO NEVER CRIED WOLF” – A SURVIVOR’S PERSPECTIVE (repeated Tues 0800)
From age four to fifteen Detective Jim Wischer survived more than ten years with a child predator. Detective
Wischer offers a unique look into the home and mind of the victim and the predator, as well as the investigator’s
perspective. Jim will be discussing his ordeal, his survival, and his experience as a CAC detective.
Regency 3 Regency 2 Regency 1
Regency 4
LEGAL FOR SUPERVISORS
Will show supervisors how to make legally sound decisions when investigating ICAC cases and help to ensure that
their agency and investigators comply with the law.
Regency 5
Palm 1
Regency 2 Regency 1
Regency 3
TUCAN—CRIMINALIZATION OF WI-FI ON ENCRYPTED PUBLIC HOTEL ACCESS POINT (HOT SPOT)
A look at an intricate use of encrypted access points at a motel/hotel environment where the guest was able to
download and consume child pornography using GNUTELLA/E-Donkey as well as communicate with potential victims using Skype without observation.
Regency 6
WHITMORE CASE STUDY
The suspect used multiple profiles to contact and extort girls all over the country. Detectives from 8 different departments worked on the investigation to completion and prosecute. Suspect faced federal charges for possession/
distribution of child pornography and extortion.
PROSECUTING CASES WITH CPS DATA
This presentation will focus on the use of CPS in trial: how to present it; what is discoverable evidence; how to build
your suspect interview to corroborate the CPS data; and when all else fails, how to build a case solely on CPS data.
11:30am — 1:00pm
5
AUTHENTICATING DIGITAL EVIDENCE
The attendees are shown case law examples for authenticating emails, chats, and other technological evidence.
Also provided are examples of what type of witnesses are needed to lay the proper foundation for the admission of
digital evidence.
Regency 7
SEARCH AND SEIZURE: PART 1, PHYSICAL DEVICES
Explored are the different types of search and seizure used in technology facilitated child sexual exploitation
(TFCSE) cases. Attendees learn the differences between a consent search and a search warrant and discuss applicable cases for each. Common pitfalls with search procedures will also be discussed.
Room 1:00 — 2:45am
Regency 8
BLUE BEAR—USING LACE TO PROCESS CE CASES IN LESS TIME WITH LESS STRESS – lecture
During the presentation, we will fully process a sample CE case including: Carving Evidence, Importing Images and
Video Files, Analyzing Results, Categorizing Unknown Files, Searching for Known Victims, and Preparing Reports
for Court.
Palm 2
Room 10:00 — 11:30am
CASE LAW UPDATES
Designed for experienced investigators (either supervisory or non-supervisory), this course, we discuss recent and
important developments in case law that pertain to ICAC cases.
INTRODUCTION TO VICTIM ID
Provided will be an overview of victim identification methods and processes. Covered will be how to analyze child
exploitation images and videos to identify and rescue the child(ren), apprehend the offender(s), and identify/locate
the crime scene(s). Enhancing and manipulating material while maintaining the evidentiary integrity is discussed.
UC PHOTOS
This course will provide the latest changes to the ICAC directives pertaining to undercover photography. Topics
include photo manipulation techniques to age regress photos and the apps to do so, the pros and cons of using an
adult that looks underage or using a child photo of an adult, and some case studies.
2:45 — 3:00pm
Break
14
66
Monday Afternoon — December 15, 2014
Wednesday Morning — December 17, 2014
Palm 1
MEDIA SONAR – SOCIAL MEDIA MONITORING Vendor
Real world case studies will examine the impact and involvement of social media in active shooter scenarios
(schools), cyberbullying/self-harm, sexting, and youth-oriented riots. A facilitated discussion on human trafficking
will also be included to look at trends in this emerging topic.
Palm 2
SEARCH AND SEIZURE: PART 2, CLOUD AND CYBERSPACE
Attendees will learn what cloud computing is and how it works and will be shown the necessary steps to preserve,
seize and search evidence in the cloud. Investigators and prosecutors will gain information to understand when the
Electronic Communications Privacy Act and the Privacy Protection Act apply.
Regency 4
DARKNETS
Anonymous networks are popular for sharing child abuse material, and they present new challenges to law enforcement. This talk provides an overview of anonymous networks such as Tor and Freenet.
Regency 4
PROSECUTING TRAVELERS (repeated Tues 1000)
The presenter will explain best practices learned and discuss how the developing case law may affect investigations
and prosecutions in the future. There will be a focus on trial presentation and how to combat popular defenses including entrapment.
EPHEX (continued—runs until1445)
Designed for beginner and Intermediate P2P investigators, this training will provide an overview of the Gnutella and
Gnutella2 networks. Students will learn how to use the ePhex program to target offenders trading child abuse material on those networks.
Regency 5
INTRODUCTION TO FREENET (part 1)
A hands-on introduction to Freenet and the messaging system Frost. Freenet is a peer-to-peer Internet network
regularly used to distribute and download child abuse material. The sessions will include the opportunity to install
Roundup Freenet and Frost and explore the material.
ROUTER INTERROGATION / PORTS (continued
This lab will provide instruction in the operation and configuration of four different wireless routers. Students will
have hands on experience in interrogating these wireless routers. Freeware wireless tools and commercially available tools will be utilized to locate wireless routers.
Regency 6
ROUNDUP BITTORRENT REFRESHER
Designed for experienced P2P Investigators, this training will provide an update on using the RoundUp BitTorrent
tool.
INVESTIGATING ARES WITH CPS
This lab will explain how Ares data is being incorporated into CPS and demonstrate adaptations to SharazaLE making it capable of collecting evidence from Ares users. This lab is designed for experienced peer-to-peer investigators. A CPS license is not required.
Regency 7
11:30am — 1:00pm
13
Regency 8
Regency 8
“THE BOY WHO NEVER CRIED WOLF” – A SURVIVOR’S PERSPECTIVE
From age four to fifteen Detective Jim Wischer survived more than ten years with a child predator. Detective
Wischer offers a unique look into the home and mind of the victim and the predator, as well as the investigator’s
perspective. Jim will be discussing his ordeal, his survival, and his experience as a CAC detective.
Regency 3 Regency 2 Regency 1
Regency 2 Regency 1
Regency 3
FUNDAMENTALS OF JTAG AND CHIP-OFF FOR THE MOBILE DEVICE FORENSIC EXAMINER
Vendor - Learn about JTAG and Chip-off techniques as well as related practices and how each can assist the examiner in acquiring data from mobile devices that are otherwise inaccessible. Covered will be the fundamentals and
advantages of both practices; where each is applied, and cost considerations for implementation.
Regency 5
INVESTIGATING HUMAN TRAFFICKING
This presentation is designed to raise awareness of the problem of Human Trafficking here in Florida. Recent cases and trends will be discussed as well as myths relating to Human Trafficking. All forms of Human Trafficking will
be discussed as well as recent statutory changes that affect investigating Human Trafficking.
SOCIAL MEDIA INVESTIGATIONS
Because social media evolves daily, law enforcement and advocates must stay current with the latest developments
in order to properly utilize it from their investigations to their community services perspective.
Regency 6
OVERCOMING UNTRUE DEFENSES
This presentation covers the most common defenses raised in technology-facilitated child sexual exploitation cases
and strategies for defeating them.
Room 1:00 — 2:45am
Regency 7
Palm 2
Palm 1
Room 10:00 — 11:30am
LUNCH
THE UTILITY OF POLYGRAPH IN ICAC INVESTIGATIONS (repeated Wed 0800)
The polygraph is an under-utilized investigative tool. Research and case studies show that the early use of polygraph in online child sexual exploitation investigations is an effective method of gathering information and uncovering previously undetected offenses of child sexual assault.
TASK FORCE CONSIDERATIONS FOR WARRANT SERVICES
A multi-agency task force…which agency’s policies govern you? Who comprises the chain of command? What are
the minimum training standards? Who is going to have the documents needed to insulate you from civil liability? If
you do not immediately know the answers to these questions then this session might benefit you.
MAC ONLINE TOOLS (runs until 1645)
Students will be provided with how to install and use Mac OS specific tools during your investigation. Some of the
tools are open source, some are native to the Mac OS and others are paid tools. During this class the Mac OS
along with utilizing short cuts within the OS will be shown and discussed.
2:45 — 3:00pm
Break
6
77
Wednesday Morning — December 17, 2014
Monday Afternoon — December 15, 2014
KATANA FORENSICS
MAC ONLINE TOOLS (continued from 1300)
Students will be provided with how to install and use Mac OS specific tools during your investigation. Some of the
tools are open source, some are native to the Mac OS and others are paid tools. During this class the Mac OS
along with utilizing short cuts within the OS will be shown and discussed.
Vendor - Mobile Link Analysis, Hash Set Analysis and Call Detail Records.
Palm 1
Palm 2
Regency 3 Regency 2 Regency 1
Regency 6
ROUNDUP BITTORRENT FORENSIC ARTIFACTS
This lab will familiarize attendees with the BitTorrent file-sharing client. Students will install and use the program
then examine the digital trace evidence. The attendees will review a BitTorrent investigative session and the corresponding seized evidence.
THE UTILITY OF POLYGRAPH IN ICAC INVESTIGATIONS
The polygraph is an under-utilized investigative tool. Research and case studies show that the early use of polygraph in online child sexual exploitation investigations is an effective method of gathering information and uncovering previously undetected offenses of child sexual assault.
Regency 4
Regency 5
INTRODUCTION TO FREENET (part 2)
A hands-on introduction to Freenet and the messaging system Frost. Freenet is a peer-to-peer Internet network
regularly used to distribute and download child abuse material. The sessions will include the opportunity to install
Roundup Freenet and Frost and explore the material.
INTRODUCTION TO MOBILE DEVICE DATA RECOVERY
Students will be introduced to key terminology in relation to mobile device systems, proper collection and seizure
procedures, and important steps to preserve evidence on mobile devices such as cell phones, tablets, and portable
game units.
NETCLEAN VISUAL DATA EXAMINATION
This software is specifically designed to manage, investigate, and analyze images and video files. It streamlines the
workflow by minimizing the gap between computer forensics and image/video forensics hence reducing the examiner’s workload. A preview of the 2015 version will highlight new features that will raise eyebrows!
Regency 5
Regency 4
MAC IMAGING AND TRIAGE
Attendees gain basic skills to navigate and utilize both the graphical and command line interfaces of Mac OS X.
Focus will be the identification and collection of volatile data. Attendees will also be familiarized with the methods
for forensically imaging a Mac and become aware of the unique challenges this presents.
PROJECT VIC: THE MASS DATA PROBLEM, A GLOBAL INITIATIVE
Current tools and methods of deconfliction are largely inefficient at dealing with massive collections of image and
video data. You will learn about Project VIC which puts together an ecosystem of tool taking advantage of PhotoDNA, Visual Similarity Search, Robust Hash Technologies, Media Categorization, etc.
EPHEX (runs until1445)
Designed for beginner and Intermediate P2P investigators, this training will provide an overview of the Gnutella and
Gnutella2 networks. Students will learn how to use the ePhex program to target offenders trading child abuse material on those networks.
Regency 6
Regency 3
USING YOUR IFAK FOR EMERGENCY SELF AND BUDDY MEDICAL AID
Taken from the concepts taught to deploying soldiers and developed from Tactical Combat Casualty Care, it teaches the importance of self-aid, early treatment and knowing the equipment on hand. I teach the importance of hemorrhage control and staying in the fight until assistance can arrive.
CROSS EXAMINING DEFENSE EXPERTS
Provided are tips and examples of ways to cross examine defense experts in cases involving technology-facilitated
crimes against children. Attendees learn possible ways to defeat some of the more common defenses that are often raised by experts.
ROUTER INTERROGATION / PORTS (runs until 1130)
This lab will provide instruction in the operation and configuration of four different wireless routers. Students will
have hands on experience in interrogating these wireless routers. Freeware wireless tools and commercially available tools will be utilized to locate wireless routers.
Regency 7
Regency 2 Regency 1
FACEBOOK: WORKING WITH LAW ENFORCEMENT TO PROTECT CHILDREN
Discussed during this presentation will be Facebook “basics”, the latest safety and privacy controls available to prevent and reduce risks for users of the site, safety initiatives designed to combat crimes, and a detailed review of Facebook’s on-line records request system for law enforcement use.
Regency 7
LEGAL UPDATES
This lecture focuses on some of the main concerns and issues that may be encountered during the investigation
and prosecution phases of a technology-facilitated child sexual exploitation.
Room 8:00 — 9:45am
BLUESTACKS
Students will be shown how to install and use the Bluestacks android cell phone emulator program. This program
allows law enforcement to use applications like Kik, Instagram and others on their desktop or laptop computers utilizing the Google Play Store.
Regency 8
PEN-LINK XNET – ANALYSIS TOOL FOR IP INVESTIGATIONS - vendor
Xnet can save countless hours when analyzing thousands of emails/messages from providers like Yahoo, Gmail,
Hotmail, Facebook, WhatsApp, Apple iMessage, even Blackberry Messenger, and many more. There are a number
of ways to use Xnet, including a variety of functions to accommodate each investigations.
Regency 8
Palm 2
Palm 1
Room 3:00 — 4:45am
UC PHOTOS (repeated Wed 1300)
This course will provide the latest changes to the ICAC directives pertaining to undercover photography. Topics
include photo manipulation techniques to age regress photos and the apps to do so, the pros and cons of using an
adult that looks underage or using a child photo of an adult, and some case studies.
9:45 — 10:00am
7
Break
12
88
Tuesday Morning — December 16, 2014
Tuesday Afternoon — December 16, 2014
Palm 1
Palm 2
Regency 3
CASE STUDY ON SHUHEL ALI, “INTERNATIONAL CHILD PREDATOR” (repeated Tues 1500)
Ali travelled from Manchester England to Brevard County Florida for the purpose of impregnating a 13-year-old victim and starting his own incestuous family. Ali intended to father and sexually abuse this child from birth. During
the operation Ali traveled to numerous countries sexually abusing minor children. This case study is very graphic.
“THE BOY WHO NEVER CRIED WOLF” – A SURVIVOR’S PERSPECTIVE (repeated Wed 1000)
From age four to fifteen Detective Jim Wischer survived more than ten years with a child predator. Detective
Wischer offers a unique look into the home and mind of the victim and the predator, as well as the investigator’s
perspective. Jim will be discussing his ordeal, his survival, and his experience as a CAC detective.
Regency 4
Regency 2 Regency 1
TIPS FOR TESTIFYING
This interactive presentation provides concrete suggestions for enduring the witness stand. The attendee learns the
difference between direct and cross-examination, as well as common defense attorney tactics intended to destroy
witness credibility.
CYBERTIP SUPERVISION
Analysts of the Exploited Children Division (ECD) of NCMEC process reports received on child sexual exploitation
through the CyberTipline and disseminate the leads to Federal, state, local, and international law enforcement agencies for further investigation. They also provide technical assistance investigating child exploitation.
Regency 5
Regency 5
Regency 6
Regency 7
BLUE BEAR—USING LACE TO PROCESS CE CASES IN LESS TIME WITH LESS STRESS – lab
During the lab, we will fully process a sample CE case including: Carving Evidence, Importing Images and Video
Files, Analyzing Results, Categorizing Unknown Files, Searching for Known Victims, and Preparing Reports for
Court.
Regency 8
OSTRIAGE (continued from 1300)
OsTriage can extract operating system and registry details, USB device history, browser history of major browsers,
search engine search terms, cloud storage applications, encryption, P2P and other applications, and passwords. It
displays and categorizes images/videos based on a list of over 500,000 SHA's of interest and 300+ keywords.
PRE-TRIAL DECISIONS
This presentation discusses the various methods to charge TFCSE cases and provides information on forensic artifacts that will assist in proving intent and knowledge. Discussed will be different types of pre-trial motions to educate the court and provide for a more efficient trial.
PROACTIVE INVESTIGATIONS USING INTERNET EVIDENCE FINDER (IEF) (repeated Tues 1000)
Look at new features and artifact support. New user will be walked through an Internet Child Exploitation and Luring
case and we’ll demonstrate how IEF can help you find relevant evidence. There will also be open discussion on
features you would like to see us add.
Regency 6
INTRODUCTION TO MOBILE DEVICE DATA RECOVERY (repeated Wed 0800)
Students will be introduced to key terminology in relation to mobile device systems, proper collection and seizure
procedures, and important steps to preserve evidence on mobile devices such as cell phones, tablets, and portable
game units.
PERPHOUND
Attendees will see a live demonstration of Perphound and how it can be used for analyzing and plotting detail records from various service providers.
ROUNDUP EMULE REFRESHER
Designed for experienced P2P Investigators, this training will provide an update on using the RoundUp eMule tool .
Regency 7
ANALYZING CHILD EXPLOITATION EVIDENCE WITH NUIX INVESTIGATOR
Vendor - This class is designed to show digital forensic examiners how to best leverage the power and capabilities
of Nuix Investigator during child sexual exploitation examinations. The Nuix methodology revolves around working
smarter, not harder.
ACTIONABLE HUMAN TRAFFICKING INTELLIGENCE - RESCUE OPS
Open source intelligence approaches are yielding tremendous amounts of useful information about behaviors of
human traffickers, location of victims, and patters of illicit trade. Our training teaches you how to target and identify
human traffickers and recover victims using open source intelligence through Rescue Ops.
Room 8:00 — 9:45am
PACKET SNIFFING (runs until 1130)
Provides an understanding into the operation of the Transmission Control Protocol/Internet Protocol (TCP/IP), reviewing basic terms and concepts, and introducing the operation of various TCP/IP communication and application
protocols. Hands-on exercises will be used to reinforce the lecture topics.
Regency 8
Palm 1
Regency 2 Regency 1
WHITMORE CASE STUDY (repeated Wed 1300)
The suspect used multiple profiles to contact and extort girls all over the country. Detectives from 8 different departments worked on the investigation to completion and prosecute. Suspect faced federal charges for possession/
distribution of child pornography and extortion.
Regency 3
DIRECT EXAMINATION OF A COMPUTER FORENSIC EXAMINER
The focus is on the fundamentals of presenting a forensic examiner at trial. Highlighted are possible exhibits that
prosecutors can use to help explain technology devices and computer forensics during the foundation portion of the
examination. Tips for effectively presenting computer forensic evidence at trial are provided.
Regency 4
CASE STUDY ON SHUHEL ALI, “INTERNATIONAL CHILD PREDATOR”
Ali travelled from Manchester England to Brevard County Florida for the purpose of impregnating a 13-year-old victim and starting his own incestuous family. Ali intended to father and sexually abuse this child from birth. During
the operation Ali traveled to numerous countries sexually abusing minor children. This case study is very graphic.
Palm 2
Room 3:00 — 4:45pm
9:45 — 10:00am
11
Break
8
99
Tuesday Afternoon — December 16, 2014
Tuesday Morning — December 16, 2014
MAC 101
Students will be exposed to Apple computers at an entry level. This class in intended to those individuals who are
new to the Mac OS or Apple hardware. Students will also be provided with Mac OS shot cuts and comparisons between the Mac OS and Windows OS.
11:30 — 1:00pm
9
Lunch
Palm 1
Palm 2
Regency 3 Regency 2 Regency 1
FACES - FACIAL RECOGNITION FOR LAW ENFORCEMENT
FACES provides the ability to search images through a facial database consisting of over 30 million records including mug shot and driver’s license photos for investigative purposes.
Regency 4
PACKET SNIFFING (continued from 0800)
Provides an understanding into the operation of the Transmission Control Protocol/Internet Protocol (TCP/IP), reviewing basic terms and concepts, and introducing the operation of various TCP/IP communication and application
protocols. Hands-on exercises will be used to reinforce the lecture topics.
SOCIAL NETWORK INVESTIGATIONS AND TECHNOLOGY TOOLS
Provided will be information on social networking websites useful to investigations and how to effectively search
those sites. Also covered is using Google Advanced Operators and techniques to capture profiles for evidentiary
purposes. Legal consideration as well as techniques to protect investigators will also be discussed.
TECH INV 101 - TRACING IP ADDRESSES
We’ll review terms and concepts, introduce the structure of the Internet and TCP/IP communication protocols, IP
addressing, and the use of anonymizers. We’ll also examine higher-layer protocol issues, and their related tools, to
include domain names and IP address blocks, tracing the route of packets, Web sites, e-mail, and social networks.
Regency 5
Regency 5
ROUNDUP EMULE FORENSIC ARTIFACTS
This lab will familiarize attendees with the eMule file-sharing client. Students will install and use the program, then
examine the digital trace evidence. The attendees will review an eMule investigative session and the corresponding
seized evidence.
Regency 8
PROACTIVE INVESTIGATIONS USING INTERNET EVIDENCE FINDER (IEF)
Look at new features and artifact support. New user will be walked through an Internet Child Exploitation and Luring
case and we’ll demonstrate how IEF can help you find relevant evidence. There also will be open discussion on
features you would like to see us add.
Regency 6
DARKNETS (repeated Wed 1000)
Anonymous networks are popular for sharing child abuse material, and they present new challenges to law enforcement. This talk provides an overview of anonymous networks such as Tor and Freenet.
COMPUTER FORENSICS FOR PROSECUTORS - PART 2
Digital evidence is pervasive in today’s criminal trials making it imperative that prosecutors understand the intricacies of computer forensics. This presentation covers the fundamentals of computer forensics and discusses the
many forensic artifacts that are useful to prove up a variety of criminal charges.
NCMEC LESP
An online resource for law enforcement and prosecutors from NCMEC’s Exploited Children Division. The Hash
Search and the CVIP Reference Guide will be discussed and demonstrated...including user shortcuts.
Regency 6
SNAPCHAT
This session will provide practical information on Snapchat’s functionality as well as policies and procedures for submitting legal process and requesting user information.
APPLE IDEVICE FORENSICS
Attendees will become familiar with the acquisition and analysis of data from non-iOS devices (iPod Classic, Nano,
and Shuffle) and with the methods of acquiring data from iOS devices (iPod Touch, iPhone, and iPad). Also provided are techniques to analyze potential evidence from iOS devices.
OSTRIAGE (runs until 1645)
OsTriage can extract operating system and registry details, USB device history, browser history of major browsers,
search engine search terms, cloud storage applications, encryption, P2P and other applications, and passwords. It
displays and categorizes images/videos based on a list of over 500,000 SHA's of interest and 300+ keywords.
Regency 7
Regency 3
TAKING DOWN A HUMAN TRAFFICKING RING DEALING IN CHILDREN
A look into the joint investigation of ExecutiveModels.net and how law enforcement was able to build a case against
not just the Pimp/Agency Owner, but also the Agency’s Photographer and one of the Agency’s VIP Clients in an
effort to combat the commercial sexual exploitation of children.
Regency 7
Regency 4
CASE STUDY – MINOR FEMALE AND YOUTH PASTOR
The victim will provide information about the grooming, emotions, and law enforcement interactions with her about
the case were her church’s youth pastor groomed her for sex, was arrested with a no contact order, yet contacted
Room 1:00 — 2:45am
CHILD PROTECTION SYSTEM (CPS) UPDATE
Designed for currently licensed and experienced peer-to-peer investigators. Topics include new dashboard
“perspectives” to provide triage assistance, IP-GUID-Username subscription / real-time notification, media library
integration and more. This lab is for demonstration only. A current CPS license is not required.
Regency 8
Palm 1
COMPUTER FORENSICS FOR PROSECUTORS - PART 1
Digital evidence is pervasive in today’s criminal trials making it imperative that prosecutors understand the intricacies of computer forensics. This presentation covers the fundamentals of computer forensics and discusses the
many forensic artifacts that are useful to prove up a variety of criminal charges.
Regency 2 Regency 1
PROSECUTING TRAVELERS
The presenter will explain best practices learned and discuss how the developing case law may affect investigations
and prosecutions in the future. There will be a focus on trial presentation and how to combat popular defenses including entrapment.
Palm 2
Room 10:00 — 11:30am
BEYOND POWERPOINT: CREATING ENGAGING PRESENTATIONS
Provided is a response to the self-peer exploitation (sexting) issue. Attendees will be provided with links to download presentations and a mobile app targeting youth and presenting humor as a strategy to deal with the pressure to
send intimate images.
2:45 — 3:00pm
Break
10 10 10