Realtime OSINT: Tracking the Escaped Georgia Fugitives

came across is uh oh it's on free math tools calm it's got a whole bunch of different dropdowns you can enter that information that we we try to pull out of the forensic site on the vehicle and once you drop it in there it'll populate a map giving you the options to include highways avoid highways avoid toll roads and kind of show the route so we can see in that time since the escape and when I call into the story the zone got pretty large already recap your tools there you got the Google Maps traffic layer the Birla vehicle lookup for vehicle specs and how far can I travel to map so this point I

think I'm caught up to where the story probably is you know we're obviously still looking for the the fugitives but we know where they were where they could be based on the map what they're driving and what they look like based on the bolo so you know cool now what I'm just realizing I don't think I have a single attractive person in my slide deck alright so next we're gonna go after information flow I mentioned this earlier but who's following the the story in the morning I went back and backtracked how how many different stories came out about it in a local news affiliate on there in Georgia was the first one that broke it about I

think 8:30 in the morning after that a regional affiliate out in Atlanta kicked something out around like 10 o'clock and then one of the national syndicates you know blew a big story out to CBS or something about 11:30 when I saw it so you're gonna want to kind of drill into that you know go to those local affiliates see if there's a particular reporter that that's reporting on this story and then kind of look and see sometimes locals in the area will jump on and just start chiming in to the comments and and saying you know little bits about where they are because they're real close to the scene the way I monitor that's with TweetDeck

on if you haven't used it before it's real easy to set up you have to log in through a signed in Twitter account so if you're not cool with that use a sock account once you get in there you make a new search field with the search icon there and then there's a couple different parameters you can start setting the one that I set for keep keywords was based off the different news articles and everything that we're coming up breaking escaped convict prisoners civic for the car manhunt those were all words I was seen in the initial stories so this was grabbing the the upcoming tweets that were coming out by the reporters and then you can also

make it regional you can drop a point so I've put exactly where the the bus breakout happened there give it a 200 kilometer radius and said go and then that became my my news feed during the the rest of the the event again this is still about it's Tuesday the 13th at about 12:30 p.m. at this point the other stuff you can get into for that on not so much live but Matt based you can drop the region in with tweet map and do hash tag searches and the other one is Echo SEC there then the last year at Echo SEC net launched their free service again on that one's useful enough that I would

recommend checking it out they're paid service is still like 150 bucks a month or something but the the free apps not bad so back to the toolbox we got TweetDeck map deep tweak map and echo sec now that we've got the system in place the next step is going to be to try to put eyes and ears on locations of interest on the stories that were popping up we started to see Morgan County Georgia as a place of interest there was a lot of police activity reported so they figured that that's where they had moved to the yellow spot there is where the bus situation happened and that would be Morgan County up in the highlighted area so how do we

go about putting eyes and ears on a new location once we we know that the information is coming out of that area where the best ways when law enforcement is involved I think is to jump on broadcast fi you can go by state and then by county and get a listen to police fire and EMS dispatch radios so if you know what county is kind of the hot spot a good way to jump on and just kind of listen up throw in your pot in and listen while you're doing your other stuff it's not uncommon to hear VIN numbers license plates vehicle descriptions and even addresses that the the officers are checking out places of

interest over those feeds unless you're doing something to record it you just got to be quick and and run Google searches and stuff in the background doing that we started to catch glimpses of different areas heard reports that they were looking into Booker Hill Road they got another another update from the athens-clarke police that said that the suspects had burglarized a house and had ditched their white prison clothes on there in Madison which is still Morgan County so what we had was locals in the area starting to pique their interest on what all the police activity was about so we go back to social media and see what we can find one of my favorite

recent has been the live live map on Facebook it seems like anything any time that the police are out in force somebody will pop their phone out and start going live on back when all the Hurricanes were coming through some of that footage was insane if you watched the people that were out there live live tweeting the storms coming in not the smartest but pretty impressive this one's been more recent for me the snapchats snap map you can jump in and see posts that people have done publicly in the last 24 hours while they're out there and it's really just a heat map if you have snapchat I like a dummy for not knowing it but you just squeeze the

screen and it takes you to the map light bulb moment for me never knew that as soon as you go into there please turn on your ghost mode that way we're not finding you being a creeper watching I looked this morning and found a whole bunch of bar shenanigans out in downtown Charleston last night so if you guys were here last night for the trainings and went out you're probably in there all right so you got people on the streets broadcasting live we started to see some of the police activity in the area when I dropped into these locations up in Morgan County that I was hearing on broadcast fi the one on the upper

left was like a car wash and across the street from it was a Family Dollar and we started to see a whole bunch of people jumping online live on Facebook I don't recall the audio so I think I've got this muted hopefully but how close do we think they actually get

pretty darn close

so from Google Maps Street View if you've ever dropped a little yellow dude in there you pretty much get the blue line along the street and you can see the area but these guys are literally like walking right up with the cops

the one that was across the street at the the carwash was earlier than this one and it was just car after car local sheriff's FBI vehicles you know they're all the agencies were working in at this point because these guys were murderers basically so this this goes on for a while they actually start to walk behind the building and there's a ton of police activity behind the family dollar in the woods area back behind there so it's pretty impressive if you want to catch a glimpse of what's going on the live map is definitely worth checking out so at this point I said the the taxes kind of changed when you're behind the story catching up or when you think that

you're caught up and you're kind of trying to get ahead of the events we started to see actual media coverage of the area about 5:00 p.m. all of that Facebook material coming out of the the live maps was around four o'clock so I think at that point we had zeroed in and started looking at things before you know media started you know getting cordoned off and investigation zones were getting set up so I think at that point we definitely were ahead of the story if you start following these active scenario events like this it's it's really kind of difficult to do so I was I was pretty pumped up that I had been into the area and seen a bunch of

stuff live before the authorities got in on another quick recap broadcast by the live map from Facebook snapchat snap map and then in Google Maps Street View to try to just zero in to official addresses when you're seeing stuff live sadly day one the trail pretty much went cold at that point on like said that was 5 p.m. I think the evening news ran a bunch of different recaps about the day's events on one of the one of the news company's channel 2 there was doing like I think they left like a two-hour like live stream of aerial footage there was like I said heavy police presence behind that Family Dollar we had police search in the railroad areas out and

around that general area in Morgan County so at that point the trail is pretty much cold with with live info coming up we go back to traditional Xhosa and try to fill in the gaps the hosting framework is one of those resources I lean on all the time not so much in the the live sense but when you're going back and looking for for what's been going on on their criminal records set there has a whole bunch of great resources you can use especially if you're your targets are convicts or if they've been arrested in the past and they're there currently you know free people the the information that gets booked and put on your public record

when you get arrested is pretty clear yeah I'm not showing anything based on the criminals because that would probably not be smart but here's just like a redacted SC courts archive this was actually just a business civil type case but you can see you're gonna have names business names address race sex your birth once you get into a criminal case you'll actually see like the names of arresting officers and attorneys and stuff so it's it's a lot of information that you can turn around and and put out into your next host cent searches again I didn't really go after these guys but what I found I won't put in here publicly but one of them was from Morgan

County and the other when I believe was from like Middle Tennessee area so if you think about the path of which direction they were headed it makes sense that these guys were going where it was familiar to be you know maybe they knew somebody that would help them hide out or or you know if they didn't find the first guys people they could keep going and possibly get to Tennessee so day two never really takes off there's a whole bunch of recap and and it filled in some of the gaps from the overnight stuff 2:30 p.m. on Tuesday was actually the last confirmed sighting of the the green Honda Civic and it was actually leaving the area

this is a nest webcam that was like hooked right next to the Family Dollar where all that activity was and it's hard to see but the green Civic is this was a video clip and it was pulling out and heading out of the area there so 2:30 p.m. was the last confirmed sighting for the green Civic and then a bolo came out again the next morning saying that the suspects reportedly stole a truck overnight it was a white work truck they dropped new plates into the details there the new stories were talking about the the work truck came from a rock quarry that was 10 miles east of the Family Dollar situation so there's the

the map of kind of where we know that they've been at that point starting from the prison bus up to the town Family Dollar and then off to where they picked up the work truck

sadly the the media coverage stayed pretty thin most of the day on the the truck they narrowed in that was stolen between 10:00 and 11:00 p.m. on Tuesday night it was reported that there was fuel on site at the quarry so running through the quick forensic tool sets again we see that the the f250 super truck had a 30 and a half gallon tank estimated 19 miles a gallon highway but they had all the gas they needed so I ran another analysis and now we can see that there potentially all the way out to the coast or up into Tennessee and then that tool again has the ability to do using highways and avoiding highways

and then showing the actual main routes that they could possibly be on so that one's pretty awesome I would recommend playing around with that it's pretty neat so like I said the the coverage is pretty thin that day but we start to get random pop up stories about sightings on listening in with broadcast if I again was a good way to try to listen to two little hotspots that we might be able to to zero in on one of them was a rest area near Switzerland South Carolina I ran it and kind of overlaid it and I said you know hey that makes sense maybe they ran out of gas and you know got antsy that would make sense for a

sighting but it did get bumped later in the day there was also a couple sightings out in Georgia that we debunked I didn't show those ones on here but day two essentially there there was no no major breaks in the story another Ford Taurus that was a potential new vehicle of interest had some people that look similar to the suspects and you know they got reported the story caught some traction but it ended up getting debunked by the authorities and you can actually hear that on broadcast two-five if you catch the right frequencies you'll hear the officers going out and checking an area of interest and then reporting back in and you can you can do your own debunk and

say hey the the officer shot this one down so that would have been all the way through Wednesday these guys stayed off the radar pretty good on day three was more of the same there was a lot of press conferences with all the different agencies that were out tracking these guys you can tell that the the presence was out there but they were laying low obviously during the day and I think traveling at night so all all day three was pretty much the same we watched traffic we watched broadcast fi and then about 8:00 p.m. I caught a blip that said they were spotted in Shelbyville Tennessee and within 20 minutes it was game over

Bureau of Investigation said that they had been captured at 8:23 p.m. this is mostly recap from news stories because I was not able to track during the the endgame here but what went down was 2:30 Du Bois and Rove broke into a home in Shelbyville Tennessee that had made their way all the way up through Georgia at that point they held a couple hostage for several hours ate some of their food I believe they had one vehicle that they tried to take off in and it wouldn't start so they went back in there was some arguing and stuff and then they ended up taking a Jeep Cherokee at the time they left the couple was able to

free themselves from the restraints and dial nine-one-one immediately the authorities jumped on it there was a 10 mile highway pursuit there in Shelbyville where the Jeep crashed the fugitives jumped out took off on foot through the countryside tried to run to a nearby house going through the stories Google Maps and you could pretty much see where they went just jumped a fence over a rural spot and this is America so they got held at gunpoint until the cops showed up yeah the the last last couple sequences were just Bam Bam Bam cuz these guys were off the radar I'm assuming that that was probably by design I don't think the authorities were given much out to the to the media

so they they were probably trying to keep the investigation under wraps like we said with an active case that's that's pretty uh pretty common but yeah these guys they picked the wrong house and they got popped they did not put much of a fight up I believe the the gentleman that held them up at gunpoint and the couple that was held hostage but managed to call the authorities were some of the people that got some of the reward money that was out for these guys it's kind of a thing it's like I'm running fast I apologize do you guys have any questions about any of the tools or anything that that I used during the the tracking

the the OSA framework basically has a bunch of at least trial level stuff you may have to sign up for for some of the sites on I know the guy that runs it if you happen to know of a bad link they it probably used to be good and they change something or went to a software-based you know payment thing on Jane or Dean as this handle on Twitter you shoot him a message and he'll he'll pop him off of there he does updates probably on every month or so and tries to to fry the the bad sites and add the new ones up there so he's pretty consistent a troll and updates about it about once a month so

but yeah I'll let him know if you see a dead dead link he'll go fry it any other questions anybody honestly it's it's just practice on I love doing ocean stuff on digital forensics is is my my bread and butter but doing the investigative stuff around it is something I love doing so when situations like these on I've tried to do this with a lot of the I think it was the Ohio State campus incident on the guy out in Ohio that did the shootings and was putting them on Facebook like I've tracked most of those over the years but and it's just again not something I really want to put on my blog and you know be up here talking

about it's just this is one of those that I even though there was officers that died you know and in the story if I can give people tools to help track these guys and you know maybe send some tips in it kind of becomes worth it so that's that's that was my motivation loving OSINT and trying to get bad guys

basically just practice on if you if you do Osen investigations on routine basis you kind of get into different patterns now I'm not saying that's that's a bad thing methodology is good especially from a forensic standpoint you know I have to follow certain methods to get my end results and have them be valid on but when you get into the same routine because you know a person's email and address sometimes you follow the same path and you get kind of the same stuff all the time these investigations because they're like live fire I tend to do random stuff and in the process of doing the the random things I usually pick up new tools that I'm not usually

you know grabbing you know stuff that I may discover just because on Google search and how I could figure out something totally random about something I saw on a video clip so that that's the that's the the reason that I do these kind of things also other questions all right thank you very much for listening [Applause]