Below is a summary of my technology experience. The extensive set of technologies listed below is broad due to years of consulting and working in-depth with technology to grow and protect businesses Learning has been a constant requirement for more than 20 years–across numerous technology domains and IT infrastructures.
| Platforms: | Managing computer investigations and conducting forensic analysis requires the ability to understand operating systems and file systems. For more than 6 years, I learned to walk through a diversity of host OS and file systems to profile users and systems use. Windows 7/8/8.1/10, Windows Server 2003/2005/2008/2012, Linux (Red Hat, Ubuntu; Fedora), Mac OS, Android, iOS, virtualized systems (Windows/ Linux) |
| Databases / Data Types: | I have worked in database design, modeling, and SQL for more than 15 years. This includes administrative duties such as backup/ restore/ access controls/ permissions. Database architecture is fascinating work that really permits deep understanding of business operations. Database forensics are often more straight-forward than working with unstructured data, and database design often provides a footprint for interpreting metadata. Microsoft SQL Server 2003 – 2012; SQLite; PostgreSQL; MySQL; DBF; FileMaker Pro; XML; JSON; Python Data Structures; Custom data file formats; Data warehousing (MS OLAP services / Business Objects / Cognos) |
| Analytics, Reporting, & Data Science: | SQL is like a Swiss-army knife for prototyping data design, use and analytics–such as prototyping dynamic website content design. SQL is also flexible for unstructured and structured search analytics such as filtering log files for social security numbers. Modern analytics tools such as Python and R are essentials tools for data analytics. Both offer a diversity of analytics capabilities, structured and unstructured data discovery, and the ability to connect analytics work directly to software applications. Data cleaning, descriptive statistics, and data modeling are also accessible without expensive software investment. SQL; MDX; Python (e.g., Pandas, Numpy, SciPy, NLTK, Matplotlib, Jupyter notebooks); R; SPSS; Excel with stats plug-in packages; Google Analytics; various log file analytics work (raw records analysis and pre-processed such as Google Analytics web logs) |
| Languages: | I have designed, prototyped and built websites and website service technologies since the Web 1.0 era. Basic knowledge of website technology serves as a platform for a diversity of projects including analytics presentations. Understanding also provides for more effective investigation skills and web-related security assessments. HTML/HTML 5, basic Python, basic JavaScript, basic PHP, CSS |
| Content Management Systems (CMS): | I have lead the development of websites associated with marketing, sales, and customer services. I have also conducted numerous investigations associated with website security incidents. I continue to design and develop websites using CMS technology. I enjoy the challenge and the creativity. WordPress; Drupal; DotNetNuke; Magento; custom CMS platforms; underlying support technologies such as Mailchimp, Google Analytics, email, backup software, web-application firewalls, access controls, authentication, server configuration, SSL, domain registry, and and DNS management. |
| Forensic Analysis: | I managed investigations, computer lab use, and engagements. Engagements ranged from a couple of devices to hundreds of devices, servers, virtual machines, mobile devices and cloud accounts. Tool use varied by legal protocols, device type, digital evidence, and analytics. Timespan could be weeks or years. Collections EnCase; FTK Imager; Paladin; Helix; MacQuisition; Cellebrite; Falcon; LogiCube Forensic Dossier; cloud collections; memory captures; website (curl/ wget); live and static acquistions. Analysis EnCase 7; Blacklight; Cellebrite; IEF; X1 Social Discovery; SANS SIFT workstation; Volatility; Open source tools (Nirsoft tools; Bulk Extractor; Mandiant Redline; SleuthKit; SANS SIFT compilation of open source tools; many more) Many times, specialized data such as Salesforce forensic log may require a combination of tools for analysis and reporting of results. |
| Log File Analytics Experience: | Log files serve as the backbone to analyzing applications computer systems and networking activities. The complexity of log data analysis depends on the the purpose of the logs and data tracked. for example, log files that track data lifecycle activities such as insurance claims status involve greater complexity than most access logs that track logon/ logout times. Logs may also interconnect such as patient medical imaging logs and EHR system logs. I have more than 15 years of experience with industry standard and custom log files and am still learning by the project. Systems and Networks IT system host and server event and application logs (Windows; Linux; MacOS); syslogs; devices (SIEM/ Firewalls/ Logs/ IDPS/ NIDS/ HIDS/ Routers/ Load Balancers/ NAT); virtualized environments (data centers / Amazon cloud); DevOps; directory services; VPN; access and authentication; antivirus and endpoint protection; DLP (e.g., IdentityFinder); backup services; DNS; centralized logging solutions Healthcare Electronic patient records systems; medical imaging; laboratory systems; dental care; specialty software (e.g., genomics software) Insurance P&C insurance claims; P&C quoting software; auto accident collision estimation software (CIECA); life and health insurance quoting systems; special investigations (SIU) and fraud alerting and logging Other eCommerce transactions; payment card transaction logs; survey and testing records and logging; banking; payroll and accounting systems; Google Analytics; web server logs; Salesforce; GetCake; SugarCRM; custom application logs; databases transactions Analysis Analysis may range from command line parsing of data in Linux to use of specialized tools such as Splunk. Analysis depended on the data and the scope of analysis. |
| Other: | Data analytics and information security require a constant learning process due to the breadth of custom systems and data formats that continue to evolve. Other tools and analytics I have used in investigations and computer data analysis include: Networking (Monitoring/ Packet Capture and Analysis/ Performance Tuning/ Security)
Scripting and Code Analysis Tools
Code Management
Web Application Vulnerability Testing
Threat Assessment |
| Electronic Discovery: | I managed discovery engagements and operations which included supporting the full lifecycle of early investigations; discovery; and litigation. This included producing files and consulting on data and evidence. Electronic evidence consulting; NUIX for search, review set (load file) creation, and document productions; Concordance and Relativity hosting management and reporting; managed discovery operations and staff. |