HTCIA Asia Pacific Chapter
2nd Evening Talk of 2010
On March 2nd the Chapter was very pleased to welcome back another friend and previous speaker, Mr Ryan Connolly. With his extensive background in network security, Ryan is former Team Cymru and served as their Asia representative, where he focused on spreading security awareness and providing security training. He has recently set up his own consultancy based out of Kuala Lumpur, and we were fortunate he agreed to volunteer an evening of his time in Hong Kong.
The topic of the evening was the challenges the Fast Flux phenomenon presents to internet investigations. We had another good turnout, filling the by now familiar Microsoft 23rd floor conference room. Ryan's very thorough presentation covered the usual way in which internet sites operate, and then went on to explain how Fast Flux enables criminals and unethical internet-based vendors to conceal the servers hosting their services through a mask of shifting compromised computers. Ryan finished off by explaining how the functionality which enables use of Fast Flux also enables the investigator to spot that a Fast Flux system is being operated. There followed a lively Q&A session from the membership. Ryan has kindly agreed to make the presentation available to the membership, which will be uploaded shortly.
1st Evening Talk of 2010
The HTCIA Asia Pacific Chapter had the opportunity to welcome back Live Forensics/Memory Analysis expert Jon Evans back as he was passing through town on his travels. Jon very kindly agreed to run an evening presentation on recovery of artifacts such as Facebook Chat and MSN messages from a live memory capture. Jon has recently been heavily involved in the development of the new live forensics boot CD "Phoenix" (the brainchild of Helix creator Drew Fahey) and much of his research is focused in this area. Below, Jon shows his command line skills in the fantastic surroundings of the Microsoft Offices with the HK skyline in the background!
Given the short notice, a good turnout of over 20 members were able to enjoy a deeply technical explanation of parsing memory files for evidence. The presentation material will be available soon to Chapter members via the document repositary in the members area of this site. After the talk, Jon was warmly thanked by the new Chapter President Mr. Richard Kershaw
This was following by the traditional "networking session" across the road in Wanchai!
Conference 2009 Day-One Highlights
The third annual HTCIA Asia Pacific Training Conference was held successfully in Hong Kong from 2-4 December 2009. Here are some of the highlights from the main conference day on 2nd December at the Microsoft Conference Centre.
Paul Jackson, Chapter President gets proceedings underway:
Ms. Joelle Woo, Director at Microsoft Asia & key sponsor of the event provides a welcoming address:
The event was also suported by the Hong Kong Police and Ag. Chief Superintendent Alan Man (Current Chairman of the Interpol Asia South Pacific Working Group on IT Crime) delivered an opening speech:
Group photo with the VIP guests and Keynote speakers:
Mr. Bernhard Otupal, theAssistant Director of Financial and High Tech Crime at Interpol HQ in Lyon France gets the main proceedings underway with a speech on the current work of Interpol against High-Tech Crime and their coordination of harmonised global training projects:
The first Keynote speaker was Mr. Warren Kruse - Co-author of "Computer Forensics: Incident Response Essentials" - an entertaining and enlightening look at the top ten mistakes made in computer forensics work:
The second Keynote was an innovative and extremely popular presentation by Mr. Craig Ball, a lawyer from Texas USA, who provided a timely and educational look at visualising technical concepts using presentation tools in order to explain evidence in legal proceedings:
Finishing off the morning session was the third keynote speaker Mr. Erik Laykin from Duff and Phelps. He provided a corporate perspective on e-Discovery issues and inspired a lively Q&A session before the lunch-break:
The afternoon was started in style by an excellent presentation from Mr. Nigel Carson; a hugely experienced forensics professional with both a law enforcement and corporate perspective. Currently working with Ferrier Hodgson, his presentation on the pitfalls faced by practitioners proved extremely relevant & informative:
This was followed by an in depth explanation of the importance of thorough forensic analysis of e-mail artifacts in modern investigations. Leading expert and author of the software Intella; Mr. Peter Mercer from Australia delivered the presentation:
Ms. Clara Ho was next up and as the Head of Information Security Risk for HSBC Asia Pacific, she provided an insightful perspective on in-house investigations and forensics work and introduced all to the Chicken Detective!
Providing an unusual perspective of the rapidly evolving work of mobile device forensics, Mr. Kevin Mansell of Control-F Ltd in the UK (former lead trainer to the UK Police) demystified this complex discipline and helped shed light on the challenges being faced by those currently working in this field:
One of the most thought provoking presentations of the day was provided by BJ Gleason from the University of Maryland (South Korea) who delivered a study of the contentious subject of professional qualifications: in light of the need to improve the current state of certifications, this topic opened a debate that ccontinued long into the evening:
The final speaker of the day needed no introduction. Mr. Andrew Rosen, the original author of the software now known as Encase, author of SMART forensics and lead forensic investigator in the Enron case (and notoriously camera-shy) delivered the final presentation on complexities of large scale investigations.
The day was wrapped up in style by Mr. Thomas Parenty and his panel of experts (Drew Fahey, Warren Kruse, Craig Ball and Andrew Rosen) in a lively open forum. Below, the excellent MC (and incoming President of HTCIA Asia Pacific Chapter for 2010) Mr. Richard Kershaw presents the final speaker gift to Mr. Parenty.
With the formal proceedings completed, it was time to head off to the refined surroundings of the 1/5 Nuevo Bistro for a networking function to round off an excellent event in relaxing style:
