Cybersecurity Today TV - Ep 78 - The Future of Digital Forensics and Data-Driven Investigations

In this episode of Cybersecurity Today, host Jim Wiggins interviews Dr. Nima Zahadat, a professor at Virginia Tech and expert in digital forensics and data science. The discussion begins with an introduction to digital forensics, emphasizing its importance in investigating breaches. Dr. Zahadat contrasts digital forensics with traditional forensics, highlighting challenges such as volatile memory evidence and encryption. He traces the evolution of encryption, citing the FBI-Apple case and TrueCrypt’s shutdown, which made encryption more prevalent. The conversation then addresses the impact of big data, noting that while it complicates investigations due to distribution and jurisdictional issues, AI and machine learning can help sift through data and find patterns, though explainability remains a concern. Dr. Zahadat discusses the value of different data types, such as logs and metadata, and offers best practices for managing data, including using proper tools and maintaining chain of custody. He explains how data science complements forensics by aiding in data mining and visualization. Practical approaches include using Python and AI to analyze intrusion detection data. Common obstacles in evidence collection include encryption and data distribution across cloud providers. Remote work exacerbates challenges by blurring personal and corporate data. Best practices for maintaining evidence integrity include strict chain of custody and professionalism. Automation and AI are used to write code and sift through data, but hallucinations and false positives are risks. Legal issues include wrongful convictions due to bad forensics, and ethical responsibilities require objectivity and avoiding pirated software. Core skills for modern forensic professionals include hands-on experience and training.