Newsletter January 2024

It has been no surprise that last year has been an eventful year for Risk Diversion, long gone are the days when the henchman rode into town to rob the bank. While IoT has increased productivity for businesses, it has also introduced new risks and threats such as security and privacy issues. IoT devices contains sensitive and valuable information, and it has become one of the main sources of attacks and cybercrimes. The complexity of IoT in terms of the integration of different communication technologies, devices, protocols, and standards makes it difficult to ensure public or private security.

Based on the rapid growth in use of IoT and Mobile devices being used as a tool during or as part of a crime, Risk Diversion has seen the joining of forces of Father and Son to assist in the combatting of crime where digital devices are used.

Both members come with a vast amount of experience to tackle the cyber frontier.

Peter is the Director of Risk Diversion Digital and is responsible for driving the Forensic Technology Research division in South Africa. Peter has over 17 years’ experience in forensic investigations with specific reference to forensic IT related investigations. Peter is considered a subject matter expert on Cellphone and banking pay system forensics by his peers. During his career, Peter has managed several global assignments and has worked in the UAE, Saudi Arabia and countries across Africa and Europe.

Vernon has nearly 50 years of experience in the cybersecurity industry and has served at IBM, SAPS, Interpol Southern Africa, and has been SA’s national head of the Computer Crime Unit. Vernon also serviced as the Chief Technology Security Officer for a number of years. He is an expert in investigating computer fraud, testifying in intellectual property disputes, conducting forensic investigations, and numerous security audits for regulatory requirements. He was on the International Computer Crime Work Group and in 2008 was included in the Who’s Who in the World. He also consults to the continent’s most prominent defence, government, financial and telecommunication services providers, as well as businesses in several other sectors.

Another eventful launch was deploying the latest XRY 10.7 which brings significant extraction and decoding capabilities to more mobile devices, with the total number of supported devices exceeding 45.600 and over 4400 app versions. The recent release is the latest major release of Apple’s iOS operating system for the iPhone. Concurrently the Android 14 is the latest major release of the Android mobile operating system.

The arrival of iOS 17 and Android 14 has ramifications for the mobile forensics industry, as they usher in some novel changes and features. As phone users continually seek updates and the phone giants comply, so must we and our products.

The precise and accurate OCR recognition in Apple Photos applies OCR and content recognition on all pictures in the media partition. This means that machine and handwritten text in pictures, as well as the content in images, is recognized and decoded to be searchable in XAMN.

This new feature will significantly enhance the speed and comprehensiveness of digital investigations. It will be easier and more precise than ever to perform keyword searches, content searching, to analyse pictures that contain text, find place names and so much more.

Fryer says in addition we are delighted to announce that we now offer selective extraction possibilities when you’re using an FFS. We’ve expanded our capabilities to now support app selection, meaning you can select from which specific apps to extract data for Full File System extractions. The benefits of this new feature are multifaceted.

It’s very valuable in cases where only a fraction of the data on the device is relevant to your case, and you want to speed up the data extraction process. While previously you might have waited for 40 minutes or an hour to perform a full file system extraction on a device, by extracting only the data from a specific app, you can now accomplish this feat in as little as two minutes.

Beyond the extraction speed, this new feature holds legal significance. In certain scenarios, you may encounter legal regulations dictating that you can only extract data relevant to your case. The ability to selectively extract data from specific apps of interest helps ensure strict compliance with these legal requirements.

This new feature is a game-changer when time is of the essence and legal standpoints must be observed.

WhatsApp is, without a doubt, one of the most popular messaging platforms.

The new “Chat Lock” feature is intended to make it easier to keep conversations more private. The locked chats can only be opened via biometrics. It’s not hard to see why this feature might appeal to criminals and individuals with malicious intent. So, we moved quickly and introduced support for this new feature. In the most recent version of XRY, locked chats are decoded.

Additionally, WhatsApp messages that have been edited are shown with the timestamp of when they were edited.

Fryer added, just like mobile devices, vehicles also keep track of a lot of data. So, it comes as no shock that nowadays vehicle forensics plays a substantial role in many DFIR investigations.

Given the growing demand for vehicle forensics, you’ll be pleased to know that Risk Diversion now supports the import of Berla iVe files for vehicle forensics data. This import decodes locations, routes, and vehicle events such as gear shifts or doors opened. It also decodes information from the vehicle’s entertainment system, such as any mobile devices that have been connected to the system.

Being able to investigate a mobile device?and?a vehicle in the same case within XAMN is going to prove extremely useful for digital forensics professionals going forward.

That’s all for now, until next time!