Interview with Ghennadiy Konev, MSAB Technical Sales Engineer

FF: Tell us about your background and how you ended up in your current position.

Before joining MSAB, I worked in the IT sector as a systems engineer, as part of a small but very talented technical team. Among other things, we have carried out several IT-related projects for LEA clients. Some of those projects required additional specific solutions, such as digital forensics and mobile forensics software/hardware. They made me responsible for these “exotic” matters and it didn't take long for me to become fascinated by this new world. Among other tools and solutions requested by customers, there was a tool with a catchy name: XRY (although for some time I mistakenly called it X-ray), from a Swedish company, Micro Systemation AB. Communicating with them was always very easy: they were always approachable and knowledgeable.

I attended the MSAB partner event in 2016 to improve my product knowledge and it was the first time I visited the MSAB headquarters. It was probably the first time I started dreaming about working in a company like that.

Later, I continued my professional career as a freelancer and was invited to attend several MSAB events as a technical translator. I probably did a good job because soon after MSAB contacted me and asked if I would like to work for them in the new expanding Product Specialists (Technology Sales) department in 2017.

FF: What are your main responsibilities at MSAB?

I would say that two-way communication with our clients is my main responsibility. MSAB solutions help our customers at multiple levels, from the advanced acquisition capabilities of XRY Pro to management-level orchestration of the entire mobile forensics ecosystem with XEC Director. As a product specialist, I need to be able to explain how everything works, from general concepts to configuration-level details and more. That requires us to be constantly aware of our own technology and involves a lot of testing, preparing visual and demo material, and communicating with the development team.

The feedback part of this two-way communication is equally (sometimes even more) important. It could be a question that gives me a clue as to where I should improve my presentation and/or demo material, or it could be a great idea for a feature that we would evaluate internally among other product specialists and eventually forward to our product development team.

Sometimes I try to address this type of feedback through a route made possible by a notable feature of XRY and XAMN: the Python API. For the past two years, we have been helping clients solve certain specific tasks using Python scripts. For example, in 2019, inspired by a meeting with clients where I heard about their challenges with thousands of audio messages that needed to be listened to for analysis, I came up with the idea of ​​developing a Python script that would transcribe those audio messages to text and return ownership of the text to the XRY “report.” After finding a suitable offline AI engine, I quickly developed a simple Python script and shared it with the client. Later, an even better AI engine came on the radar, and my colleague updated the original idea with this better engine. Today, we receive many messages from clients telling us how they were able to analyze tens of thousands of audio messages within the framework of a larger case and find evidence using that script. All this without assuming extra costs on the part of the client.

Therefore, there is a lot of “homework” that is done before and after client meetings, and it is another key responsibility.

FF: What are the biggest mobile forensic challenges your clients will face in 2024?

I'd say it's the same usual suspects: data access and big data analysis.

Data access is the all-time champion. If less data is recovered, there is less material to analyze (it may seem like a relief, but it is not). This is a classic game of cat and mouse where the (smart) phone industry does everything it can to protect devices and mobile forensic solutions do everything they can to find a way in. The forces are unequal. Additionally, devices are becoming inherently more secure, because there are large teams continually improving device security at different levels, including platforms (the SoCs), vendors (smartphone brands), kernel developers, operating system developers, etc.

Efficiently navigating through large volumes of data in search of answers to research questions is arguably the second most challenging type of task our clients face. It depends on the country or type of organization and sometimes could be even more critical than the data acquisition itself. It is essential to have tools that allow flexible, efficient and easy-to-use navigation through large volumes (both in size and quantity) of data. Software efficiency is one of the pain points for many of our clients, as many must run the analysis on small computers. Lastly, it's great to have tools that allow multiple integrated functions to handle volumes of data. But no tool is perfect and can do everything, so it's even better to have a tool that allows you to expand those capabilities “on demand,” for any unforeseen challenges. This is usually done using some kind of API.

FF: How do MSAB solutions help overcome these challenges?

We do our best to address all of the challenges mentioned above (and many others).

When it comes to data access, it's worth noting that MSAB is one of the few companies that has its own R&D department that continually researches new unique (and zero-day) exploits and allows you to overcome device security and data access obstacles. Considering the device security landscape, each new removal method opens doors that were previously closed and is greatly appreciated by our customers. We have heard many success stories where customers were able to solve impossible devices using MSAB Office and even more so with the new XRY Pro.

Data decoding has always been one of XRY's strengths. Speaking of the speech-to-text story mentioned above, it is now natively supported as one of XRY's additional decoders that can be activated if needed.

When researchers open an extract, they expect something like opening a PDF file: some loading time and it will be ready to read.

Navigating through large volumes of data efficiently has always been a strong point of our analysis package: XAMN Pro. It adds to the built-in efficiency of -indexed). Simply having these two features in one analytics tool greatly helps customers save time. The tool consumes few computing resources, so users do not need special hardware to perform the analysis, which often becomes an important factor.

The XAMN Pro (and XRY) Python API, which allows you to additionally process data via Python scripts, has proven invaluable when “zero-day functionality” is required. I previously described how we use this feature to help customers, but there are quite a few users who do this on their own. Sometimes it's a niche app that needs to be decoded; sometimes it is a massive custom analysis based on extracted data.

FF: Mobile technology is constantly evolving. What role does MSAB play in collaboration and information sharing within organizations to assist with mobile investigations?

Lab experts are the backbone of an organization's mobile technology knowledge. They have extensive knowledge and experience in specific fields and are well versed in the applicability of multiple tools to different scenarios.

In my opinion, it is important today for laboratory experts to broaden the scope of their expertise, for example to be able to capture evidence in an optimal state and benefit from the most modern acquisition technology available in their laboratory. Or, when a junior lab expert joins the team and once onboarding is complete, they may need an unsupervised but controlled environment to begin performing extractions with some guidance, based on best practices from senior colleagues.

MSAB has user account-based exam solutions that can implement an organization's procedures through customized step-by-step sequences. It could be, for example, a sequence that helps first responders capture different devices in optimal condition based on the organization's best practices and considering the current requirements of the laboratory experts (for example, if they have a tool that can offer surprising results when the device is in use). AFU mode). Or you could implement guided sequences for new lab members to help them follow established acquisition best practices in your lab/organization.

I believe this would allow organizations to ensure that the information and knowledge that is crucial for efficient mobile investigations is always there where it is needed and can be updated when the organization requires it.

Finally, everything mentioned above could be managed centrally by the management solution (XEC Director), ensuring that organizations have visibility and mechanisms to monitor their entire mobile forensic ecosystem and be able to act promptly when necessary.

FF: What type of education or experience is most helpful for someone aspiring to become a mobile forensic examiner?

I believe that curiosity-driven steps toward any topic across the computer science spectrum, such as the fundamentals of operating systems, databases, data structures, algorithms and programming, or even computer architecture, would enhance any further training and experience in specific fields. Learn to read the Source, Luke.

Studying a programming/scripting language is usually a good starting point. Inevitably, one would come across other topics, for example algorithms and data structures. Not to mention some immediate benefits of the applicability of some languages ​​like Python in the daily work of an examiner.

FF: Looking ahead, what new skills or areas of knowledge do you think will become increasingly important for professionals in the field of mobile forensics?

My feeling is that the more we advance in technology with layers and layers of abstraction (and sometimes obfuscation) everywhere, the more important it is to know and understand the underlying fundamentals. Therefore, I think it will be increasingly important to know and understand how these devices work and generate the data, where it comes from and what it means. In that sense, the important new skills will be the good old ones.

Another aspect that will become more important is efficiency through automation. The ability to automate routine tasks both through personal knowledge and skills (programming/scripting) and through tools and solutions that foster those skills will make a big difference.

FF: And finally, outside of digital forensics, what do you enjoy in your free time?

I like to spend time with my family, observe and develop the Natural Intelligence of the young person (my son). As a hobby, I try to follow my curiosity, which from now on dragged me back into computer architecture and the world of low-level programming. It's not that I'm particularly good at it, but taking small steps toward what I'm curious about and having those Aha moments makes me feel good.