The Product Updates
The team over at Magnet has been busy with development the past year rolling out major updates across the board and integrating more AI into their products. You can read more about their annoucements here. The two announcements that got me excited are more case streamlining through Magnet One and the upcoming release of Graykey/Verakey v2.
I knew about Magnet One only a little bit but having an all in one connected system across the landscape with dashboards can help with showing stakeholders where your cases are in the process. I look forward to testing it out further and hopefully integrating it into our workflow.
Graykey/Verakey are both finally getting a boost in the specs department with a brand new shell. I unfortunately didn't take any pictures of the display unit but it comes in two pieces, the top featuring the brains of the operation with a high speed SSD drive with 2-4 TB of capacity (hasn't been finalized yet) and branded heatsink "hat". The bottom piece has the two cable setup for plugging in your evidence phones. The cables are bit longer now for ease of operation. The two pieces are connected by a USB C to USB C in the back and you also get some updated USB 3.0 ports and I believe an upgraded ethernet port as well.
I was told you could see up to 5x speed increases on extractions which would be huge as we continue to see bigger and bigger capacity phones hit the market.
The Sessions
There were so many good sessions but I'll just highlight some that I was able to make it to.
Private sector PAC
The first was the special product advisory counsel meeting that I was graciously invited to. This included private sector experts from across the industry. It was nice to discuss with other similar corporate investigators to see what was working and what wasn't. I gained some new contacts so I hope to leverage them in the future as we continue to build out our own internal processes.
Pwning Windows in a TPM World
Matt Beers put on a lab where we got to utilize some Raspberry Pi Zeros to pull NTLM hashes off live running Windows computers to then attempt to break the passcodes. I could see certain scenarios where this could come in handy. It was nice to get some hands-on practice with some hardware and software that I wouldn't typically use.
Needle in an abyss: A cybertip's journey to the middle of the ocean
CJ Whiteside described a case he took on where one tip lead him on a journey of tracing guest wifi logs back to a single phone on an oil rig. DFIR will take you places you very much don't expect sometimes.
"Can't we all just get along?" - Understanding the green/blue bubble debate
My good friends Chris Vance and Preston McNair talked about all things chat messaging across both iOS and Android. With RCS now in the mix with both OS's it's becoming increasingly important to understand where the data may be located.
From breadcrumbs to breakthroughs: Digital forensics and Rachel Morin
Megan Waltimyer walked through a case she investigated of a tragic murder in Maryland. The phone was submerged in water and the board had to be transferred to a new shell to be able to extract the evidence. It was cool to see that she utilized iLEAPP during the case and used one of my parsers for Audio levels as part of here case timeline.
The Networking
Magnet always knows how to throw a party. From the welcome party, to the happy hours, to the appreciation event, it's nice to have some food and drinks with fellow forensicators and chat with friends both old and new.
This years appreciation event was at Whiskey River Saloon where some people had some fun riding the mechanical bull, rocked out to the band (with a special guest appearance by Jad), and enjoyed the rooftop views overlooking Broadway.
The Swag
The conference wouldn't be complete if I didn't bring back some goodies. This year I took first place in a little 1-hour CTF competition to take home a pair of Meta Ray-Ban glasses.
I also acquired the always coveted CTF challenge coin.
Some other nice little things I got were a custom heat pressed shirt (the design which I helped make actually), a waterproof backpack (from the PAC) that I'm sure will turn into a beer cooler for me, and some other small trinkets like a metal wallet tool and of course stickers. As Magnet introduced their new Autokey product, they had some Hot Wheels on hand to give out.
2027?
Next year's event is moving to Austin, Texas. I'm looking forward to it if I can swing it. I hope to see you there!
