Webinars

Blackbag is excited to provide the following webinars free of charge! Increase your digital forensics knowledge, learn about our new product features, or ask our forensic analysts those difficult questions. Register today!

Webinars

Timesaving Forensic Techniques for your Next Case

With cases involving multiple mobile devices, and desktops storing terabytes of data, examiners need a pragmatic approach to finding the most relevant information quickly. From Smarter Searching to Actionable Intelligence and Image Analysis, use your tool to narrow in on what is essential. Join BlackBag’s Director of Product, Ashley Hernandez, as she shares how BlackLight’s latest features, combined with its already powerful filtering and tagging, give examiners the insight they need to thoroughly and efficiently handle their everyday caseload.


Recorded Webinar
Available Anytime
Finding Insider Threats: Digging Deeper

With Windows Operating Systems and Feature Updates coming out multiple times per year, each potentially providing new forensics artifacts as well as updates to old ones, keeping up can be a pain point for investigators. Modern forensics tools help by parsing evidence into easily digestible pieces. This, however, can have the unfortunate effect of lulling investigators into thinking that only a surface knowledge of each artifact is good enough. Certainly one investigator can’t know everything, but sometimes a deeper knowledge of the more useful areas of digital evidence is necessary to validate critical findings. Luckily, BlackLight supports the investigator’s need to dig deeper.


Recorded Webinar
Available Anytime
Physical Decrypted Images from Macs with the T2 Chip

BlackBag Technologies is proud to announce the first and only solution to produce a decrypted physical image of Apple’s latest Mac systems utilizing the T2 chip. Current logical imaging solutions, including functionality available in the previous version of BlackBag’s own MacQuisition tool, and competing solutions like Sumuri Recon and EnCase, miss critical file system information that only this new level of physical access will be able to provide. This vital imaging functionality will be available in the upcoming MacQuisition 2019 R1 release and the output will be seamlessly ingested for analysis by BlackLight 2019 R1.


Join BlackBag’s Director of Research, Dr. Joe Sylve to learn more about these new images including:


1. Why these new physical images are better than prior logical imaging techniques

2. How to image a system with the T2 chip

3. What changes they can expect when analyzing these new images

4. Details on the new image format needed to support T2 chip and APFS Fusion devices

Recorded Webinar
Available Anytime
Picture and Video Triage Using Advanced Image Categorization

There can be hundreds of thousands of images on digital devices – where does an examiner start? Techniques based on file size, date created, and hash sets are a good start, but are insufficient for the sheer volume of data examiners must sort through. What if investigators could view files with specific types of images first? Learning engines can be trained to identify pictures or videos that likely depict categories like weapons, pornography, drugs, and graphic violence. When combining image categorization with previous prioritization techniques, investigators can more quickly triage a device – allowing them to look at the best candidates that may be relevant to their case. Knowing how these models are trained, how to appropriately use them, and why it is essential to understand their power and limitations will reduce an investigator’s workload.

RECORDED WEBINAR
AVAILABLE ANYTIME
Naughty or Nice? Apple Changes in 2018

In 2018, forensic examiners had several gifts from Apple: a new file system, new hardware encryption, and new artifacts. Find out which of these gifts contained investigative gems and which were more like coal in our on demand webinar. Join us to hear our guest presenter, SANS Mac instructor, Sarah Edwards, and BlackBag’s Director of Research and Development, Dr. Joe Sylve, both Apple forensic experts, discuss the challenges and pitfalls these new features revealed this year. BlackBag's Director of Product Management, Ashley Hernandez, will moderate and ask all the burning questions investigators want to know! We’ll also cover what our experts predict lies ahead in 2019.

Recorded Webinar
Available Anytime
Ask the Expert: Apple iCloud Productions

iCloud production sets are solving cases; could they help solve yours? Apple iPhones are involved in so many cases but not all the data is stored or accessible on the iOS device. For investigators who need access to this data Apple has created a legal process to obtain iCloud production sets for evidence. BlackBag has assisted numerous organization since launching our iCloud production set processing service and we want to share what we’ve learned. Join BlackBag’s Ben Charnota, Chief Customer Officer, for our upcoming webinar where he will dive into Apple iCloud Production sets and how they can be used to reveal the truth.

Recorded Webinar
Available Anytime
What’s New in BlackLight: How to Streamline Investigations with the Latest Features

Do you want better control of the appearance and organization of your digital forensic examination reports? Are you in the hunt for historical data, or are you trying to prove the suspect attempted to destroy digital evidence? Join BlackBag’s Justin Matsuhara, Solutions Engineer, in this on demand webinar where he will review enhancements to BlackLight 2018 R3 and explain how they can help streamline your investigations.

Recorded Webinar
Available Anytime
Ask the Expert: How to Get a Better View with Spotlight

In this webinar, Dr. Vico Marziale, BlackBag's Senior Digital Forensics Researcher, will explore the treasure trove of forensic goodness that is the OS X/macOS Spotlight metadata store. He will cover topics including the file structure, forensically-useful content (including some that can't be found elsewhere), tool support, use cases and more. This will be a deep dive, covering the store in greater detail than ever before, enabling you to leverage this bountiful artifact in all of your Mac-related investigations.

Recorded Webinar
Available Anytime
Ask the Expert: The Importance of APFS Snapshots in Investigations

How do you go back in time to review what happened on an APFS volume? In Apple’s latest file system, snapshots are now used to store the history of changes to files. In addition, the file system may be creating this back up data in snapshots whether the user knows it or not.

Recorded Webinar
Available Anytime
Ask an Expert: How will APFS Impact my Investigations?

In this webinar, BlackBag’s Dr. Joe Sylve will cover what you need to know to identify and work with APFS volumes - including what copy-on-write and pooled storage mean for recovery.

Recorded Webinar
Available Anytime
Advanced Windows Artifacts

Webinar demonstrating the forensic examination of the Windows operating system. Learn how to analyze important Windows artifacts, such as Volume Shadow Copies, memory, and Jump Lists.

Recorded Webinar
Available Anytime
Implications of iOS 10 on Mobile Forensics

Learn how Apple has changed their latest mobile operating system, iOS 10, and what you can do to continue getting pertinent data off mobile devices.

Recorded Webinar
Available Anytime