Monday, November 9, 2015

On the November 2015 LDS Guidance on Same-Sex Married Couples - Introduction: Defining Apostate

Background


This week the LDS church is under fire for a leaked set of instructions to Priesthood leaders.  News sources state that the new guidelines apparently provide guidance for how to handle children of married same-sex couples.  In short, married same-sex couples are called "apostates" and their children are to be denied infant blessings and baptism until they are 18 or move out of their parents' homes.

According to Deseret News, which is run by the Church:

The handbook now includes being in a same-sex marriage under the definition of apostasy and as a circumstance that requires the convening of a disciplinary council. The handbook also clarifies that the ordinance of naming and blessing a child may not be performed for children living with a parent in a same-gender relationship.
The new section of the handbook is listed under the heading "Children of a Parent Living in a Same-Gender Relationship." It states that "a natural or adopted child of a parent living in a same-gender relationship, whether the couple is married or cohabiting, may not receive a name and a blessing."
The Internet is up in arms about this, of course, which should surprise no one.  But the various reactions have left me personally surprised and confused.  The following series of posts are my attempt to reason through them all. 
 

Disclaimer


When writing these types of analyses, I often feel compelled to clarify my own purpose.  I am not an apologist for this or any other faith.  It is not my purpose to defend or rebuff the actions or policies of the church in any way.  I'm only seeking to make some sense of the arguments themselves.


Defining "Apostate"


A lot of outrage surrounds the declaration that same-sex married couples are now to be considered "apostates" subject to Church Discipline.  This can be dispensed with very quickly.  Regardless of specific internal church guidance on the specific subject, we can turn to any dictionary to define the term:


The LDS church has (to my knowledge) always condemned homosexuality as a sin.  It additionally (currently) defines marriage as a union between one man and one woman.  Legal same-sex marriage is a new thing, so in order to remain current, their guidelines needed to be updated.  No shock or horror there.

Couples living in a homosexual union, especially those who participate in a legal marriage ceremony contrary to the teachings of the church, are apostates.

Going further: Any person who joins an organization that clearly states it is run from the top down by a Prophet of God, who then works to change the organization democratically from the bottom up is an apostate.

Does this mean they're bad people?  Should they feel slighted or insulted by this label?  These are fascinating questions that I'll cover later.

Stay tuned for future installments.

Wednesday, October 7, 2015

Investigating Apocalyptic Claims as a Trained Forensic Analyst


Facts have always been important to me.  My work as a forensic investigator cemented and enhanced my insistence that any claim I entertained should be backed by evidence.  Simply put: the facts are what they are.  As I like to say about a suspect of an investigation, "either he did or he didn't," and it isn't my job to find prove either side.  My job is to present the facts as they are.

I'm not attempting to write a tautology with my statement about facts.  I mean to state that the law of non-contradiction is important to my work and to the way I approach my views of the world.  A thing cannot be true and untrue at the same time.  I understand that we humans are keenly able to live with cognitive dissonance, but I believe these biases have no place in an investigation, a professional conclusion, or a person's general epistemology.


How, then, should I react when one day my Facebook Timeline is plastered with a post declaring that the End Times were going to happen?  And not "any day now" like believers have claimed since time immemorial.  No - these things were going to happen within the next twelve months.

End-times claims are reasonably considered ridiculous prima facie, but my internal forensic investigator voice reminded me that because I cannot see the future, I can't dismiss the claims outright.  Based upon the reliability of previous claims throughout history, the chances of these being true are relatively low.  But I didn't want to fall into the fallacy of "argument from personal incredulity," so I followed standard forensic methodology.  First, I preserved the evidence.  Claims can always be changed later with "that's not what I said," etc., so I took screenshots and copied the original text to my computer.  Second, I performed my analysis using the best evidence, which is to say I waited for the year to play out before comparing the claims against actual events.  Those 12 months are over now.  We can't change the predictions and we can't change events of the previous year, making them perfect for analysis.  How did the predictions fare?  Read on!

What follows is the original text from the Facebook post (in red) followed by my opinion or analysis.  I read the following on Facebook exactly 12 months ago, on October 7, 2014. 

"The LORD will not leave the guilty unpunished"

So far, he apparently has.  The world is still full of sinners and hypocrites living their lives as they always have.

Judgement (sic) is coming to America!

It hasn’t yet.  America still stands as a nation, seemingly unpunished.

Nahum 1:3 The LORD is slow to anger but great in power; the LORD will not leave the guilty unpunished. His way is in the whirlwind and the storm, and clouds are the dust of his feet.

Context (KJV):

Nahum 1:2 God is jealous…  (Remember this.  We'll visit it again later)
Nahum 1:4 He rebuketh the sea, and maketh it dry, and drieth up all the rivers…
Nahum 1:5 The mountains quake at him, and the hills melt, and the earth is burned at his presence, yea, the world, and all that dwell therein.

Clearly this is not happening.  Instead, scientists continue to talk about the ice caps melting and fears of the sea levels rising.  Hills have not been melting, and everyone on earth hasn’t been burned to death.  Yet.  But California is on fire.  Again. 

God's judgement (sic) is coming to America. I believe in the next 12 months we are going to experience a collapse in the financial world, starting in American (sic). This will be much worse than what happened in 2008.

We did experience a stock market dip in that time period.  He was right!  Right? 

No he wasn’t.

There was a large correction (dip) during September 2015.  According to CNN Money, (source) it was the

“…worst point drop for stocks since October 2008. The Dow shed over 1,000 points in early trading. That's never happened before. America hasn't had a point drop near that since October 2008, when the financial crisis was in full effect and people were worried about more banks like Lehman Brothers collapsing.”

The worst drop since 2008 is hardly “much worse” than what happened in 2008.  Besides, the 2008 stock dip he used as the metric of “collapse” wasn’t as bad as, say, the infamous “Black Monday” in 1987.  In other words, the disaster he predicted wasn’t even that terrible.  If he wanted an example of financial ruin, he really should have predicted a collapse worse than 1929; however, as he demonstrates later, knowing the facts of history doesn’t seem to be important to him.

I believe we are going to get hit with a major earthquake on the West Coast possible (sic) in California and in Washington.

I believe there is going to be a (sic) earthquake along the Madrid Fault line which runs through the States on both sides of the Mississippi river.  Some believe this fault runs North and South, I believe the quake will cause major damage from the South through the Northeast.

The New Madrid fault line didn’t cause all those major earthquakes that struck the West Coast in California and in Washington in 2015 and destroyed everything any major earthquakes on the west coast.



His prediction states that, “some believe this fault line runs North and South.”  It doesn’t matter if some believe.  The fault line is where it is.  It just is. Seismology is not a belief system.  It is real, hard science.

The picture above shows reports of over 4,000 earthquakes since 1974 (source).  Notice how the most activity runs in a line from Southeast to Northwest, exactly the opposite direction he stated.  Most of the things he wrote were hyperbole, I understand.  But in this case, he could have spent 30 seconds on some due diligence when talking about an actual fault line with real life recorded seismic activity.

I also believe we could see a major failure of the electrical grid system sending America into the stone age over night. This could be from a solar flare, EMP or an act of terror.

Electricity wasn’t common in American households until the late 1800s.  Killing the lights would hardly throw us back into the stone age.  We had a bronze age, a Renaissance and the beginning of The Enlightenment all before the ubiquity of electricity.  Remember, before electricity was popular, we somehow managed to write the Declaration of Independence and form the alleged “Christian Nation” we now live in.

Also, in case it’s not clear:  What he predicted didn’t happen.  I’m writing this on a computer and posting it to the Internet.  Everything seems to be working just fine.  I know he used qualifying language like “I believe” and “could,” to weasel his way out, but I believe it's clear what he meant.  And he was wrong.

There are 55,000 hubs in America, it only takes 9 to fail and the whole system will go down. Google this, if true it is said that 80% to 90% of the American population will die in less than a year.

My three favorite words here are “it is said.”  He provides no source.  Who says?  Are they credible? Here are four true examples of "it is said" statements:

  • It is said that a 14-year-old virgin got pregnant from a flu shot (source).  
  • It is said that a secret group of reptile people run the US government (source).
  • It is said that the earth is a flat disc, not a globe (source).
  • It is said that “lā ʾilāha ʾillā-llāh, muḥammadur rasūlu-llāh” (There is no god but [Allah].  Muhammad is the messenger of God).
Does he believe these things because “it is said?” Should anyone believe these things simply because “it is said?”  I say no.  I understand and empathize where this person is coming from.  According to the Christian, Jewish, and Islamic creation myth, God literally spoke the entire universe into existence.  The Pentateuch was written by unknown authors.  The New Testament Gospels and every first-hand account of the teachings of Jesus were written by people who were not eye witnesses.  Therefore, his entire belief system is rooted in things people said, rather than things that actually happened. 

I believe we are going to see acts of terror along the southern border. 100's will be killed and the number one act of terror will be the ISIS-style be-headings (sic) left as a witness to their evil.

The Southern border is a pretty dangerous place.  It was dangerous before he made his prediction, so anticipating violence there isn’t anything special.  In fact, predicting no violence would be the real miracle.  Nevertheless, we haven’t seen stories of 100’s of people being killed in ISIS-style beheadings.   This simply hasn’t happened.

We will look back and say "What happened had to happen so that what needs to happen can happen"

This is perhaps the most dangerous and disgusting part of the entire prediction.  A person who holds this mindset is a person who longs for the end times.  This is someone who actually hopes for the apocalypse to happen within his lifetime, who can't wait for the death and destruction of God's wrath to be visited upon people he disagrees with.  In this way, he is no different than members of ISIS and other organizations who are trying to establish a new caliphate or unite the world against Israel so that Jesus can return. 

I have to defer to the wise and poignant words of Christopher Hitchens, who said it better than I ever could:


What follows now where the writer goes into full-on Alex Jones mode.  One world government, antichrist, the number 7, tribulation, apocalypse, you name it.  If we read this while we were playing a drinking game called “Insane Christian Terminology Bingo,” we’d all be dead from alcohol poisoning.

satan's (sic) time is short and he is preparing the world for the one world bank, one world church and one world government lead (sic) by a man the will be filled by satan (sic) himself who we call the antichrist.

The biggest thing to watch for is the 7 year peace treaty that this administration is trying to force Israel into to create a false peace with people that only want one thing and that is death to the Jewish nation.

I'm still watching. This isn't the first end-times prophecy to fail. 

I believe in the next 12 months Israel will sign that 7 year peace treaty for the sake of sharing their capital, Zion the Holy City of Jerusalem.

Didn’t happen.

A large part of the land they will give away for this treaty is called Judea.

Nope.

They will do this so that they can build their temple and worship their God by making sacrifices of blood. Three and a half years into this 7 year peace treaty the new world government leader will step foot into the Holy Temple and tell the Jewish people to quit sacrificing to a false God but worship him as god.

The Jewish temple was already destroyed in 70 A.D.  They don’t need to build a new one to be destroyed in order to fulfill prophecy.  It already happened.  Again, knowing history (even the history of his own religion) isn’t important to this guy.

The Bible calls this the "Abomination of Desolation, (Matthew 24: 15, 16, 21). "So when you see standing in the holy place 'the abomination that causes desolation,' spoken of through the prophet Daniel, let the reader understand, then let those who are in Judea flee to the mountains. For then there will be great distress, unequaled from the beginning of the world until now--and never to be equaled again.
When you read the last line Matthew 24:21 this is just an example why I am now a believer in Mid-tribulation and not per-tribulation (sic) as I have heard all my life. After the rapture takes place the Holy Spirit and all Spirit filled believers which is the "salt" of the world will be gone. Salt was used to prevent food from rotting or going bad. The Holy Spirit and all true committed followers of Jesus Christ will be taken out of this world called the "rapture" and then now satan will not be restricted in his evil on this world.

Ah, the revelation of Daniel.  The one that was supposed to come to pass in Daniel’s time, but didn’t.  Then was supposed to happen in Jesus’ time, but didn’t.  Then was supposed to happen on September 23, 2015 (in the future at the time of his predictions)…. but didn’t.  I’d say Daniel fails the test in Deuteronomy 18:22.  I think he and other believers should stop trying to make this prophecy work.  His own Bible says Daniel’s not to be trusted.  And by that same standard, the writer of this Facebook prophecy is also not to be trusted.

God has been warning us for years to repent as a people and as a Nation and now our own President declares we are no longer a Christian Nation.

He's obviously referring to President Obama here, which is odd considering "our own President” Thomas Jefferson said that we are “not, in any sense, founded on the Christian religion” in 1797.  It's only now - 218 years later, that God’s suddenly upset about the idea because Obama said it.  That doesn’t make sense.  Nor does it demonstrate (again) any inkling of knowledge about history. 

As Israel turned their backs to God around 782 BC Gods (sic) wrath came upon them. The Harbinger written by Jonathan Cahn and his new Book "The Mystery of the Shemitah" shows that God is involved in the daily workings in this great nation. He has warned us and we as a people have turned our backs against Him. Israel worship (sic) false gods and then began to sacrifice a few thousand babies in fires to their false gods.

Where in the Bible does it say that the Jews began sacrificing thousands of babies to false gods?  I can show you where Yahweh kills hundreds of thousands (or millions) of babies all by himself, and he’s the “real” God!  Why are we resorting to extra-biblical sources now? Does Jonathan Cahn “knoweth” (Matthew 24:36, Mark 13:32)?  When his prophecies don’t come true (spoiler: they won’t), will this guy reject him outright (Deuteronomy 18:22)?

We took prayer out of school

(Sigh) No we didn’t.  Prayer in school is perfectly legal, just like it’s always been.  Government school-led prayer is still just as unconstitutional as it’s always been.  History, again.  

and within 10 years legalized abortion in the safety of a mothers womb. We have sacrificed over 53,000,000 Fifty three million. To a false god of selfishness or self.

In 2 days we will have a blood moon which will start the final year of this 7 year cycle, this is the time that things will be brought down. This final year is called "The Shemitah" 

For the sake of argument, let's assume all his numbers are correct.  Roe v. Wade was in 1973.  That was 42 years ago. Fifty-three million dead, almost 50 years of the slaughter of unborn babies, and God still hasn’t stopped it?  What’s His threshold?  Seriously, how many is too many?  Tens of millions don’t seem to make Him mad enough to really do anything about it. 

After 2014, though.  After the Shemitah is done.  At that point, God will say “Whoa!”  Then he’ll put stop it.  Then he’s had enough.  Not now.  No… a million MORE babies have to die before he’ll do ANYTHING.  What kind of asshole is this God guy anyway?

This brings us to the context of his original bible quote.  Nahum 1:2 states that God is jealous.  Using the number stated in the Sam Harris speech popularly titled "Morality and the Christian God," from his debate with Christian apologist William Lane Craig (again, assuming all the numbers are correct), nine million children die every year before the age of 5.  These are children who are not aborted.  Over the course of the 42 years since Roe v. Wade, God has allegedly allowed 378,000,000 (Three Hundred Seventy Eight Million) children to die.  And this doesn't count the literally billions he's killed in the womb by way of miscarriages.  This is pure snark to be sure, but I'm wondering if he is mad about abortion, he's really just jealous that humans killed the 53 million, thereby robbing him of the chance to do it himself. After all, we're talking about the same person who personally killed people by the millions in the Old Testament.

In summary, here are the predictions for October 2014 – October 2015:

Collapse in the financial world, much worse than 2008
FAIL
Major earthquake on the west coast
FAIL
Major failure of the electrical grid and the consequent death of 80% to 90% of the American population in less than a year [after the failure]

FAIL
100s killed in ISIS-style beheadings along the southern US border
FAIL
7 year peace treaty where Israel starts building the new temple to do animal sacrifices

FAIL
Blood moons in October 2014 indicate the final year of the 7-year end-times cycle, after which “everything will be brought down”

FAIL

Some of my responses are snarky, I admit.  In my defense, I believe when refuting claims that appear to stand in such stark contradiction to both reality and sanity, it is entirely appropriate to lampoon and deride the statements.  In other words, when a person writes something that is batshit crazy, it's appropriate to respond as if the things they say are, well, batshit crazy.  After all, as I stated at the onset, the facts are what they are.  They can't be both crazy and non-crazy.  And insane ideas do not deserve, in my opinion, the same respect as reasonable ones.

To the original author:  It was a good try, but you failed.  Try again next year?

Friday, October 19, 2012

Teaching Ruby to a 9-Year-Old Part 3: Let's Program a Robot

This is part of a series of posts titled "Teaching Ruby to a 9-Year-Old."  See the Introduction for more information.



Computers Need to be Taught



Computers are giant calculators, and they can do billions of math problems every second.  They're also good at doing the same thing over and over.  But remember, they speak Computer Talk, not English.  And they have to be taught to do everything.  This can be a lot of work, but it's worth it in the end.

With Ruby, you can tell the computer to make decisions and do things.  We need to be careful how we tell it, though, because of the way computers think.  Let's look at a couple examples.

When Mom and Dad tell you, "Go put on your shoes for school," what are they really telling you to do?  In our house, it means:

  1. Put on your backpack
  2. Grab your water bottle
  3. Go out into the garage
  4. Put on your shoes
You know this because Mom and Dad taught you that.  (Sometimes Mom and Dad will remind you, and they'll even tell you all of those steps one by one!)  Remember, computers are dumb and have to be told everything.  Everything!  



Programming a Robot



So let's pretend we have a robot, which is really just a computer shaped like a human, and let's teach it how to do things.

Let's say that the robot already knows what things are.  It just doesn't know how to do stuff yet.  In Ruby, we'll put a list of actions together and define that list as something called a function.  (Define means to explain what something means.  For example, I just defined the word define.  Get it?)


Defining "Put on shoes for school" in Ruby

Now we've taught our robot something:  "If I say put_on_shoes_for_school, then grab_backpack, grab_water_bottle, go_into_garage, place_shoes_on_feet, that's it."

Notice that there are no spaces in the actions.  Also notice that you say "that's it" by writing "end".

If you programmed this into your robot, and then you gave your robot a command:  "put_on_shoes_for_school", what do you think the robot would do?  Let's try it using Ruby!

Step 1 - Defining function put_shoes_on_for_school


Okay, this part worked great.  Ruby gave us a fist-bump.  Let's tell it to put_on_shoes_for_school now.


Uh oh!  Why did Ruby barf?

Oh no!  It looks like Ruby didn't like what you said.  What do you think happened?

Remember how we learned that computers have to be told how to do everything?  Let's look closer at what we told it to do.  When we said put_on_shoes_for_school, Ruby said, "Okay, I'll start by grab_backpack.  Oh no!  I don't know how to grab_backpack!  I'm going to barf now!"

See?  We gave Ruby a list of things to do, but we didn't tell it how to do all of those things.  Make sense?  Here's what a more complete program might look like:


So now, if you told the robot to grab_backpack, grab_water_bottle, or go_into_garage, it knows what to do!

Oh my gosh, do you see what just happened?  Somehow you've ended up learning about a whole page of computer code!  If you showed this code to most grownups, they'd tell you it's too hard to figure out.  Just tell them all you're doing is defining some functions, duh!  We haven't even done the hard stuff yet!

Friday, October 12, 2012

Teaching Ruby to a 9-Year-Old, Part 2: The Smart - Dumb Computer

This is part of a series of posts titled "Teaching Ruby to a 9-Year-Old."  See the Introduction for more information.


Computers are Really Smart...

Computers are basically giant calculators.  Type in a big multiplication problem, and watch how long it takes to figure out the answer.  Note:  On computers, we say "times" with a *.


This took less than 1 second.  My computer is super smart!


Computers are Also Really Stupid and Stuck Up.

Computers speak their own special language.  If you say something to the computer, and you don't say it exactly the right way, it says it doesn't understand.  Then it barfs on you. Look at these examples when I try to tell it to clear the screen:




Don't Make the Computer Barf

When we write a computer program, we need to be sure we don't make the computer sick.  This means we have to be very careful about how we write things.  Even something as simple as forgetting to put the period at the end of a sentence can make the entire program not work.

 

Nil


A long time ago, I put Ruby on my tablet.  I thought it was broken because it kept saying nil all the time.  Later on, I learned that nil is good!

The word "nil" means "nothing."  When Ruby tells you "nil," it means "Nothing is wrong.  I'm not going to barf on you."  So whenever you see that word on your screen, get excited because the computer just gave you a high-five (or fist bump)!




Tuesday, September 25, 2012

Teaching Ruby to a 9-Year-Old, Part 1 - Introduction

I Learned This When I Was a Child


I learned how to write computer programs when I was a boy.  This was due to interest as much as necessity.  Our Commodore 64 and Texas Instruments TI-994-A didn't have a mouse, Windows, or any of the other features we currently take for granted.  I wasn't a child prodigy; programming was simply part of the experience of using a computer.  The language was called BASIC, and that word best describes my abilities at the time.


Fast forward more years than I like to acknowledge, and my grasp of computer programming is still nascent, or perhaps adolescent, at best.

Although not required for my daily work, knowing how to program (or "script" as we say now) could be very helpful and lucrative.  So I've set upon the journey of learning, and what an adventure that has been.  Like many computer geeks, my knowledge is fragmented.  I have great understanding of certain advanced subjects and little understanding of others.  Like most people who don't understand programming, when looking at lines of code, such as this simple snippet, I feel like it might as well be written in hieroglyphics. 

A snippet of code I wrote for submission to the metasploit project.

This fragmentation of knowledge is a strange combination.  On certain subjects, I could teach a college-level course.  On others, I need to sit in a class and have an instructor mete out knowledge as if I'm a child.  After many false starts - reading books that quickly traveled beyond my comprehension - I had  the realization that (with respect to computer programming) I need to be taught like a child.  This ultimately led to some measurable advances in my education and understanding.

If this is you - if the words in the picture above seem like complete gibberish - I encourage you to keep reading.

Teaching Ruby to a 9-Year-Old

My son is 9 years old and is interested in math and science.  But for the son of a Digital Forensic Analyst, he's woefully uneducated regarding computers.  I've often heard the expression, "The best way to learn is by teaching," so I've dedicated myself to learning Ruby by teaching him.  Convincing him was easy:   He was hooked the minute he discovered that, with a few lines of code, he could make the computer display the word "butt" on the screen 100,000 times.  I hope he never gets too old to enjoy that experience.

In this series of posts, I will chronicle my method of explanation.   If you're already knowledgeable about computer programming, these posts will drive you crazy with their slow pace and simplistic language.  But if you're like me, wanting to learn this one bite at a time, you may find them helpful.

So, fellow Grownups - set your ego aside and put on your thinking caps.  The bell has rung; class has begun.

Note:  If you want to follow along, you will need to install Ruby and use a programming-friendly text editor like Notepad++.

Saturday, January 7, 2012

A Shout-Out to a Great Piece of Software


I want to take an opportunity to write about a piece of software I use in every single investigation.  Please note that I do not work for the software company, nor do I receive any compensation from them.

SAW (SMART Acquisition Workshop) is a staple in my forensics lab.  The software is made by Andrew Rosen of ASR Data.  I'll take a moment to mention here that his software (an entire Forensics suite, including SAW) is cheaper than the stuff from Big G or Big A, and he doesn't charge annual "maintenance" fees.

This is how SAW works, as I understand it.  When imaging a device, instead of writing out a cluster of zeroes, it simply makes a note of it.  The resulting file is often significantly smaller than a dd image would be because it is a sparse file.

SAW imaging a 160GB 2.5" SATA HDD.

In the example shown in the picture (sorry for the bad quality), the Source device is mostly empty.  Because SAW creates a sparse file, the acquisition process isn't slowed by having to write zeroes to the Target drive.  Note the current acquisition speed of 82.28 MB / second on a standard USB3 connection and the amount of data "optimized."

The resulting evidence file in this particular case (a 160 GB drive) was just over 6 GB - a whopping 96% reduction in file size.

The use of a sparse file is a clever idea in several ways:

First, the original data is not altered or compressed.  What is missing from the end file is what wasn't there in the first place (e.g. thousands of 4k chunks of \x00).  Andrew likes to say, "What's missing from the file is Nothing.  Nothing is missing."

(That play on words reminds me of a co-worker who called IT and stated his keyboard wasn't working. When the tech arrived, my co-worker stated, "Seems like somebody spilled coffee on it." The tech picked up the keyboard and out poured what seemed like a full mug's worth of coffee.  The tech said: "Be honest, you did this, didn't you?" to which my co-worker replied, "Well, I'm somebody!")

Second, the resulting sparse file can be read (e.g. keyword searched, carved, etc.) by any other program without that program supporting a specific decompression algorithm.  Additionally, the processor isn't bogged down with any decompression.  For the drive shown in the picture, it would mean no waiting for the hard drive to read out 154 gigabytes of zeroes on every job.  I've run tools like IEF against such files with great success.

Third, if you want to mount an actual image, with zeroes and all, you simply instantiate one using a companion piece of software called Smart Mount.  Smart Mount presents the filesystem with a dd image (called 'image.dd') while simultaneously creating a mount point that can be browsed manually.  That's neat and all, but what is significant is how the zeroes are re-inserted.

When the OS reads the instantiated image.dd, or you browse through the mounted filesystem, the "missing" zeroes are read not from the hard drive (remember, they were never included in the forensic image), but instead from /dev/zero.  So the processor, not the hard drive, is slinging those zeroes about.

I wrote this as some food for thought that might help some of you - especially those of you who find your storage arrays filling up with mostly-empty forensic images.  Again, I use this piece of software on every forensics or data recovery job I perform. 

Friday, November 11, 2011

Beware the LaCie iamakey!

A customer called regarding his USB device that was no longer working properly. The device is a LaCie iamakey USB drive that has the form factor of a large house key:


The LaCie iamakey USB device



The customer stated that his girlfriend kept the device on her keychain and allowed it to dangle from the front of the computer when she used it. When the device began having problems, she wrapped it in tape and continued. Eventually the drive was no longer functioning and, according to the customer, it would get very hot when plugged in.


Our company doesn't care much for the pretty packaging your drive comes in. External drive enclosures can be replaced - your precious data can't. We operate under the K.I.S.S. principle, so we work directly with the drives themselves. Plus we like taking stuff apart.

Here is the device disassembled:

The unit disassembled into its component parts.


As you can see, most of the weight or "strength" of the device is in the large square portion of the key. The portion containing the flash memory is not reinforced.

Also, when inserted into a USB port and left hanging with a weight attached, the weak point - the fulcrum of the lever, if you will - is just above the 4 contacts.


In the next photograph, we can see a hairline crack that runs diagonally through the medium:


One side of card - notice the cracked casing.



Here is the reverse side of the card. The bend in the card causes it to reflect the camera's flash unevenly:


Opposite side of card with bend highlighted.


Further examination of this card indicates that the crack runs all the way through the circuit board, severing multiple connections that were improperly mated when the card was "fixed," causing a short-circuit and overheating.

Lesson learned: When purchasing a USB device, consider all consequences if its form factor. Sure, a USB device that fits onto your key ring may seem practical. However, if we know anything about human nature, we can formulate a number of great ways to finish this sentence:

"I would normally remove it from the keychain to plug it in, but...."