DEF CON 32 - Curious Case of Alice&Bob: What You Can Do as Digital Investigators - Catherine Ullman

Digital forensics can only determine what happened on a system, not why someone did it—highlighting its limitation in establishing motive or intent. The investigation reveals that Charlie, not Alice, killed Bob due to drug-related activities, uncovered through timeline correlation, encrypted file analysis, and corroborating evidence from ring camera footage.

Key Takeaways:
• The investigative process begins with a scoping call to define objectives and gather initial information 11:15.
• Forensic data collection includes imaging devices, gathering logs, and using tools like FTK Imager and Axiom, with strict adherence to chain of custody 15:22.
• Data analysis reveals threatening SMS messages between Alice and Bob, but critical evidence—such as Bob’s encrypted file containing drug ledger details and Alice’s admission of logging in to Bob’s machine—points to Charlie as the suspect 28:00.
• Timeline analysis, using UTC timestamps and tools like Timeline Explorer, connects events showing Charlie entered Bob’s home before his death, supported by ring camera footage 32:00.
• Post-incident review emphasizes documentation, tool selection, and team collaboration to ensure transparency and accountability 45:37.

The case concludes that Charlie, not Alice, committed the murder due to drug-related activities, demonstrating how digital forensics, when properly applied, can resolve complex investigations.

Sources:

• 11:15 Scoping call objectives and initial case details.
• 15:22 Data collection methods and forensic tools used.
• [28:00](https://www.youtube.com/watch?