We open F-Interviews project with the interview with Charles Giglia, Vice President of Digital Intelligence, Inc. During the conversation he talks about 20-hour workdays, gives his opinion on feasibility of doing forensic examinations in Iraq, discusses that ‘clouds’ are simply computers, and chats about the challenges of forensic duplication.
Charles Giglia has been in the field of computer forensics since 2000 concentrating primarily on the research and development of computer forensic investigative techniques and training curriculum. Charles had been deployed nearly 18 months from 2007 to 2009 doing computer forensic investigations in support of Operation Iraqi Freedom while serving as a U.S. Army Contractor in Baghdad. Previously he spent six years as Computer Crime Specialist with the NW3C while leading the development of numerous training classes. His primary concentrations were courses related to Internet investigations and Internet forensics.
Charles has been a guest presenter at the FBI training academy, as well as several IACIS, FACT, RCFG/GMU, HTCIA international/regional conferences and an adjunct professor at Fairmont State College. He is a Certified Forensic Computer Examiner (CFCE) and a Red Hat Certified Engineer (RHCE). And he is just a nice person to speak to.
Yuri: Charles, please briefly describe your current occupation.
Charles: I am the Vice President of Digital Intelligence, Inc. My primary duties are running our training program and teaching classes. I also attend most of the Digital Forensics conferences our industry holds to promote our products and services. When I’m in the office I spend time talking to customers and potential customers about various solutions and ways that Digital Intelligence can help them.
Yuri: How did you become involved in computer forensic field?
Charles: I went to Graduate School for Forensic Sciences. I had intended to become a firearms examiner for a crime lab working for law enforcement. Digital Forensics was fairly new when I attended school and the University I attended was the first school to offer any type of certification in the field. I was the first student to receive such a certificate in Digital Forensics.
Yuri: Do you have any related education? What did you major in at university? What field do you have a degree in?
Charles: My undergraduate degree is in Mathematics from Canisius College in Buffalo, NY. I also have a master’s degree in Forensic Science, with a Professional Certificate in Computer Forensic Investigation from the University of New Haven in Connecticut.
Sometimes I can be at the office for 20 hours.
Yuri: Please describe your working day. When you get to, what do you do first? What do you do most of the time? Are there days when you work 14 hours or longer? If so, why?
Charles: My days vary based on the task I am doing. If I am attending a conference and working our booth and doing presentations I can work 10-12-14 hour days with no problem. If I’m back in the office developing training curriculum for classes those days can be even longer. Sometimes when I’m researching and building training material the day just slips away and I can be at the office for 20 hours. Some days I have to talk with customers and do various office related tasks that I spend 8-9 hours of the “regular” day doing that…then when everyone goes home…I work another 8-9 hours on my course development. That always goes much faster when the phone isn’t ringing or email isn’t coming in.
Yuri: What do you like about your job most?
Charles: The variety of tasks I’m able to do. My job is seldom boring. I get to teach, travel, interact with customers and even do forensic casework from time to time when I’m called upon.
In Iraq I was required to work 7 days a week and 12 hour days
Yuri: You’ve spent 1.5 years in Iraq, is that correct? Was it really tough? Dangerous? What were your responsibilities there? What kind of computer forensics was actual in the country, heavily hit by the war? Do they really have computers, Internet, computer-related crimes?
Charles: I did spend 1.5 years in Iraq. I took a leave of absence from Digital Intelligence to join a contracting company to work with the US Army and Air Force to do forensic examinations. I spent time on several different bases doing exams at the detention facilities on captured Iraqi insurgents and suspected terrorists. Although they do have access to computers and even the Internet, seldom Iraqi households have computers. Most of my examinations were cell phones and the multimedia cards from those phones. That was an interesting job. Every day was something different. The temperature extremes from 140 degrees during the day to 30 degrees at night was amazing. (Editor: 60 degrees Celsius and -1 degree Celsius correspondingly).
The brutal sand storms were tough on our bodies and our equipment…it became a daily task to clean all my electronic equipment. I was required to work 7 days a week and 12 hour days…though some days I had no evidence and had much shorter hours…some days we were slammed and would work for two days straight before getting a decent break. The work was definitely exciting and very fulfilling.
Yuri: Don’t you regret about this experience and would you have repeated it again, if you can return back to the past?
Charles: I definitely am glad and grateful I had the opportunity to go there. I don’t regret that decision at all…and if it weren’t for my wife…I’d be interested in going to Afghanistan and doing that job there again. I have a feeling if I said I wanted to go back over there…she’d end that discussion before it even started.
Yuri: How did you join Digital Intelligence? Why Digital Intelligence?
Charles: Digital Intelligence was founded by two colleagues of mine from a previous job working for the Department of Justice. They started DI out of their basements and built it slowly and surely to what it is today. I respected those men a great deal…and really liked what DI offered service wise…and lobbied them for a job. I was pleased that after a couple years of growth they were able to find me a place with them.
Yuri: What is special about your company/solutions?
Charles: Digital Intelligence is the largest, and I think most respected, provider of Forensic Hardware in the world. Additionally we offer a wide range of training classes and full forensic and eDiscovery investigation support. We are the only company in the world that offers all three of these things making us pretty well rounded and able to provide customers with every level of support.
If I can’t speak positively about a tool or piece of hardware…then I don’t want to sell it.
Yuri: Your company is a well-known reseller. How do you choose vendors to resell their products?
Charles: We basically decide if the tool or hardware device is something we would use. We can’t sell a device or utility if we can’t provide support on it…that’s another key thing about DI is our pride in customer service. We often have to turn people down as we don’t want to just be the Walmart of Forensics, so to speak. If I can’t speak positively about a tool or piece of hardware…then I don’t want to sell it.
Yuri: If I remember correctly, we’ve first met at DoD CyberCrime conference. Do you often visit conferences? What is the main purpose of visiting conferences? I suspect, you already know each other there, including both other exhibitors and attendees.
Charles: We pretty much attend all the major conferences. Our primary goal is to advertise our hardware and other products/services. We also like to be out there and available for our customers to talk to us in person about any problems or issues they may be experiencing as well as giving us a chance to thank people in person for being our customers. Of course, it also gives us a chance to meet other vendors and develop new partnerships.
All the “cloud” is… is a computer
Yuri: Cloud computing is becoming very popular now. Do you feel that forensic market for vendors, like you, is decreasing due to that? The more data is in a cloud, the less data is on a suspect’s computer. If all data goes to a cloud, will your company disappear? Do you have any support for clouds in your products? Do you think that forensic investigation itself is going to be much more difficult due to the cloud idea implementation?
Charles: While the cloud has definitely changed Digital Forensics…everyone has to remember…all the “cloud” is…is a computer. It might be a very large computer, or one with a lot of storage, but in the end it’s just a computer we must get access to and recover and preserve the data. So while I think it adds challenges to our field, it does not eliminate our need or the need for our products and services. On the contrary…I think it actually makes our wide range of solutions that much more necessary.
Yuri: The same question about social networks, which displace usual evidence such as mailboxes, chats, etc.: does this decrease your niche and make investigations more difficult?
Charles: Most of the time the use of those online resources leaves trace evidence behind. So a trained investigator with the right tools should still be able to find data on a local machine. When that fails, of course, a court order or warrant to the right organization can get you data that’s stored on a server.
Yuri: What do you like most about computer forensics?
Charles: The challenge…it’s constantly changing and forces us to adapt. Whether it’s new hardware, updated operating systems, new software or encryption challenges…a forensic investigator’s day will never be boring.
I think there will be a pretty good debate about forensic duplication.
Yuri: Please give some predictions of what may happen in the nearest 5 years with computer forensics.
Charles: I would have to say that cloud computing and cell phones will almost assuredly be the primary focus for investigations. Cell phones and ipod/ipad type devices allow people to leave their computers behind and access all their data anywhere. That’s going to have to be a major training and hardware focus for investigators.
I also think there will be a pretty good debate about forensic duplication. The volume of data and the size of hard drives has been causing issues for years regarding storage of evidence and image files. It may very well be that in the near future full forensic images may have to be rethought. The time it takes to image…and the volume of storage space required to keep them…is overwhelming. Working on live evidence connected to a write blocker may be a popular solution soon enough.
Yuri: How old are you?
Yuri: How many kids do you have?
Yuri: How do you spend your free time?
Charles: Traveling as much as I can…abroad if possible. That’s my true passion…so much in the world to see.
Yuri: How many hours of sleep do you usually have?
Charles: It varies depending on my current workload…but, 6, maybe?
Yuri: What is your favorite vacation spot? What is the most unusual place you have ever been to?
Charles: I love Europe…Germany, first and foremost. I grew up there as a kid with my dad in the Army. Vegas and New York City are my favorites here in the US.
Yuri: When did you have your last vacation? A real vacation, without any Internet and calls from your colleagues or customers?
Charles: We took a 2 week Southeast Asian Cruise earlier this year to China and Japan. And there’s no such thing as a vacation where I don’t check mail or do work…it’s impossible…haha. I don’t mind however…I know it’s my job and especially my customers that allow me the travel I get to take.
Yuri: Thank you for your interview, Charles. I enjoyed it very much!