Parsing the Truth: One Byte at a Time

Parsing the Truth
  • 0.0 (0)
  • Technology
  • Updated weekly

Former FBI senior forensic examiners Becky Passmore and Stacy Eldridge dive into the world of digital forensics—one byte at a time. Now running their own firms and teaching the next wave of cyber sleuths, they share real-world case insights, expert tips, and a sharp sense of humor. From computer and iPhone forensics to ransomware attacks, this podcast unpacks how digital evidence solves modern crimes. Perfect for cybersecurity pros, students, and true crime techies. Join us as we Parse the Truth, One Byte at a Time. We focus on how digital evidence is used to find facts in today's crimes.

  1. 6 days ago

    TN vs Ahmad Gatlin: Part 5

    In this episode, we unpack a live Snapchat demo, a digital forensics expert, and one critical question: what does a file really prove once it leaves the app? Stacy Eldridge and Becky Passmore continue their deep-dive coverage of State of Tennessee vs. Ahmed Gatlin as defense expert Glenn Buckley takes the stand and shows how Snapchat data, metadata, and device timestamps can tell very different stories. Buckley walks through how Snapchat stores photos and videos, where those files physically live, and why the answer often depends on what the app saves locally versus what stays on the server. He explains how users choose whether a snap is saved, deleted, shared, or sent outside the app, and why that distinction matters when examiners are trying to recover evidence. Support the Podcast: https://www.patreon.com/c/ParsingtheTruth In this episode you’ll learn: ✔️How Snapchat handles camera roll files, saved snaps, and shared media ✔️Why in-app metadata and device timestamps can tell different stories—and may change when files are copied or exported ✔️Why matching the right device and app version matters when examining digital evidence This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

    TN vs Ahmad Gatlin: Part 5

  2. 8 Oct

    TN vs Ahmad Gatlin: Part 4

    In this episode of Parsing the Truth One Byte at a Time, Stacy Eldridge and Becky Passmore unpack digital evidence and courtroom testimony in the Tennessee v. Ahmed Gatlin trial. They examine how Snapchat files, phone settings, timestamps, Uber location data, Wi-Fi activity, and iPhone records can shape — or complicate — a forensic timeline. The discussion highlights why a file’s location and metadata matter, how device time settings can affect timestamps, and why different digital records may tell different parts of the story. For listeners interested in digital forensics, true crime, or how electronic evidence is challenged in court, this episode offers a plain-language look at the details behind high-stakes testimony. Three things you will learn from this Episode: ✔️Why Snapchat images or videos may appear in multiple places on a phone, and why that matters when examining a file. ✔️How time-zone and daylight-saving settings can affect the timestamps used to build a digital timeline. ✔️What Uber location updates, Wi-Fi records, and call logs can each indicate — and what they may not prove on their own. This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

    TN vs Ahmad Gatlin: Part 4

  3. 1 Oct

    TN vs Ahmad Gatlin: Part 3

    This episode explores the cross-examination of a digital forensics expert in the Ahmed Gatlin case, revealing how mobile phone evidence, cloud storage, app permissions, and location data can be interpreted in court. It also offers practical lessons for expert witnesses on preparing for testimony and answering technical questions accurately. What You'll learn: ✔️Why digital forensic experts should know the legal basis for accessing a device and bring notes or reports to court. ✔️Why gaps in phone activity data don’t, by themselves, prove whether a phone was off, idle, or simply not recording. ✔️How app-specific location permissions differ from phone-wide settings—and why mobile data may be stored on a device, in the cloud, or both. This podcast is for educational purposes only and is based on publicly available information and our knowledge, training, and experience at the time of recording.

    TN vs Ahmad Gatlin: Part 3

  4. 17 Sept

    TN vs Amad Gatlin: Part 2

    Ahmad Gatlin (16) and 2 other teenagers are on trial for a drive-by shooting. What will significant locations, Uber, and Snapchat data reveal? Listen to the second half of the state's digital forensics examiner's testimony. Everything in this case is leading up to a surprise ending... This is Part 2 of a multiple-part series. Support the podcast by becoming a Patreon Member at ⁠⁠https://patreon.com/parsingthetruth⁠⁠ Episode Summary Stacy Eldridge and Becky Passmore examine digital-forensics testimony from the Tennessee case State of Tennessee vs. Ahmed Gatlin. This episode discusses the second half of the state's digital forensic examiner's testimony. They discuss how investigators interpret phone extractions, photo and video metadata, Snapchat messages, and location data in an attempted-murder investigation. The episode also explores how timestamps can be misunderstood, why the original device matters, and how later handling of a phone may affect the interpretation of evidence. What You'll Learn: ✔️How Apple Maps and phone-location data can be misinterpreted in court ✔️Why timestamps, call logs, and digital artifacts require careful context ✔️How the presentation of forensic evidence can shape a jury’s understanding

    TN vs Amad Gatlin: Part 2

  5. 10 Sept

    TN vs Amad Gatlin: Part 1

    Ahmad Gatlin (16) and 2 other teenagers are on trial for a drive-by shooting. What will significant locations, Uber, and Snapchat data reveal? Tune in and find out in this case that brings a surprise ending. This is Part 1 of a multiple-part series. Support the podcast by becoming a Patreon Member at https://patreon.com/parsingthetruth Episode Summary Stacy Eldridge and Becky Passmore examine digital-forensics testimony from the Tennessee case State of Tennessee vs. Ahmed Gatlin. They discuss how investigators interpret phone extractions, photo and video metadata, Snapchat messages, and location data in an attempted-murder investigation. The episode also explores how timestamps can be misunderstood, why the original device matters, and how later handling of a phone may affect the interpretation of evidence. What You'll Learn: How EXIF data and file-system timestamps can differ and why neither should automatically be treated as definitive proof. Why Snapchat evidence can be difficult to analyze Learn why phone-location evidence should be supported by additional artifacts.

    TN vs Amad Gatlin: Part 1

  6. 27 Aug

    When nothing is all you got

    The digital evidence contained no leads until Steve Bunting searched for nothing in the 2021 Keith Gibson murder case. Special Guest: Steven Bunting Stacy Eldridge and Becky Passmore talk with digital forensics veteran Steve Bunting about the 2021 Keith Gibson murder case and the breakthrough that came from tracking phone inactivity instead of location data. Bunting explains how iPhone logs, unified logs, and FSEvents exposed a hidden “quiet time” window tied to the Delaware homicide, even when the original reader report showed nothing useful. He also breaks down why Apple location tiles only suggest a general area, why airplane mode is not the same as powering off a phone, and how a simple Python script can reveal patterns across millions of log entries. What You’ll learn: Why “nothing” can be the strongest digital clueHow power-off gaps show up in iPhone logsWhy location data can be misleading in courtHow to spot quiet time in noisy forensic dataWhy critical thinking matters more than button-pushing Download the tool and start finding nothing today https://buntingdigitalforensics.us/tools/fsevents-gap-finder/ Read More About the Case https://buntingdigitalforensics.us/insights/the-art-of-hunting-for-nothing/ Books written by Steve Bunting https://buntingdigitalforensics.us/publications/

    When nothing is all you got

  7. 13 Aug

    The Problem with Deepfakes

    Deepfakes are everywhere, and determining the Provenance of digital evidence is more important and challenging than ever before. Lars Daniel joins us to discuss the steps digital forensic examiners can take in their next case. Special Guest: Lars Daniel Connect with Lars: ⁠https://www.thelarsdaniel.com/⁠ ⁠https://www.linkedin.com/in/larsdaniel/⁠ Support the podcast ⁠⁠⁠https://patreon.com/parsingthetruth⁠⁠⁠ About this Episode Stacy Eldridge and Becky Passmore talk with Lars about the growing risk of AI generated evidence, why screenshots and consumer device media are increasingly unreliable on their own, and why provenance now has to be treated as a core evidentiary issue.The conversation focuses on how examiners, attorneys, judges, insurers, and law enforcement can respond before fake media becomes routine in litigation and investigations. Key topics In this episode, Lars explains how his work in trucking and accident investigations led him into the deeper problem of AI manipulated media and digital evidence triage.He breaks down the practical categories he uses with counsel and claims professionals:He describes the business case for a layered review process: automated screening, human review, then a digital forensics expert when litigation is possible.The discussion emphasizes that the best way to prove authenticity is still to return to the original device and source evidence whenever possible.Lars warns that consumer device evidence often arrives with weak or no provenance, unlike enterprise systems that may have stronger built in controls.The hosts and Lars discuss how deep fake claims may become a litigation tactic, forcing the other side to spend time and money disproving authenticity even when the evidence is real.He explains the liar’s dividend and why it can be used not just as a defense, but as a strategy to raise costs and create uncertainty.A recent civil case example shows how a manipulated video, including added water to suggest a slip and fall, was initially treated as real until deeper analysis raised questions.Lars stresses that examiners need to stay in their lane, know when to refer specialized work, and avoid claiming expertise across every digital forensics niche. Listeners will learn How deep fakes, shallow fakes, and enhancement differWhy screenshots are no longer enough to trust digital evidenceHow to build a layered authenticity review processWhy provenance matters in legal and investigative settingsWhen to return to the original device for verification

    The Problem with Deepfakes

  8. 30 Jul

    The Daubert Standard Part 2 - What you Need to Know

    Part 2: We continue the conversation with Jessica Hyde regarding the Daubert Standard, AI, and Peer Reviews. Special Guest: Jessica Hyde, Hexordia Support the podcast ⁠https://patreon.com/parsingthetruth⁠ Detailed Summary of Part 2: In this episode, we explore the critical intersection of digital forensics, legal standards, and artificial intelligence. Jessica Hyde shares her expert insights on the importance of proper testing, validation, peer review, and the evolving standards that govern forensic evidence in court. Key topics in Part 2: The fundamentals of the Daubert standard for admissible scientific evidenceHow digital forensics tools and methodologies meet (or don’t meet) Daubert criteriaChallenges introduced by AI and machine learning models in forensic analysisThe critical role of peer review, including internal lab processes and community validationThe importance of independent testing and error rate assessment for evidence reliabilityUpcoming legislative and regulatory efforts around AI in forensic evidencePractical steps for examiners to prepare for Daubert challenges and improve credibility This episode emphasizes that sound scientific methodology, rigorous peer review, and validation are the backbone of credible digital forensic testimony. Links: The Daubert Standard ⁠https://www.law.cornell.edu/wex/daubert_standard⁠Rule 702 ⁠https://www.law.cornell.edu/rules/fre/rule_702⁠NIST Foundations document ⁠https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8354.pdf⁠NIST OSAC Guidelines for Dataset Development ⁠https://www.nist.gov/system/files/documents/2026/01/16/OSAC-DE-Guidelines%20for%20Dataset%20Development.pdf⁠DFIR Review ⁠https://dfir.pubpub.org/⁠Upcoming work from SWGDE in this area including the draft Quality Management System ⁠https://www.swgde.org/25-q-001-draft/⁠ Hexordia Creating Mobile Text Data FREE Online Class ⁠https://learn.hexordia.com/courses/Creating-Mobile-Test-Data-66eae235a2b4ef2d6b79cef3⁠Hexordia FREE Mobile Peer Review Checklist ⁠https://www.hexordia.com/blog/gc0vnvj80ogwx724ovu7avzwvjl742?rq=peer%20review⁠Rule 707 Regarding AI ⁠https://www.purduegloballawschool.edu/blog/news/ai-generated-materials-federal-rules-evidence ⁠Connect with Jessica Hyde on LinkedIn ⁠https://www.linkedin.com/in/hydejessica/⁠Connect with Hexordia on Twitter ⁠https://x.com/hexordia⁠

    The Daubert Standard Part 2 - What you Need to Know
See All (69)

Trailer

About

Former FBI senior forensic examiners Becky Passmore and Stacy Eldridge dive into the world of digital forensics—one byte at a time. Now running their own firms and teaching the next wave of cyber sleuths, they share real-world case insights, expert tips, and a sharp sense of humor. From computer and iPhone forensics to ransomware attacks, this podcast unpacks how digital evidence solves modern crimes. Perfect for cybersecurity pros, students, and true crime techies. Join us as we Parse the Truth, One Byte at a Time. We focus on how digital evidence is used to find facts in today's crimes.

Information

You Might Also Like