Hello, and welcome back to the computer forensics path,
Course 7, Module 2.
In this module, we're going to look at
live versus dead box evidence collection.
This is collecting from a live running machine
versus collecting from a machine that is off.
Some of our considerations when
deciding whether to collect from
a live running machine or
go ahead and power down the machine and do
a traditional dead box collection would be volatile data,
specifically RAM, random access memory.
Encryption; if encryption is running,
we're going to want to collect that live.
Our inability to shut down the system;
some systems cannot be
shut down for one reason or another.
We talked about the example of
a business with servers that we cannot shut down.
The size of the data;
if we're dealing with big data,
we're going to be doing a large collection,
and we talked about that when we talked about
big data and the challenges of big data.
Cloud storage, social media;
we would have to access those accounts
through a live running computer
and capture that information from the live machine.
Remember to stay within the scope of your legal process.
Know what you have named in your search warrant,
and make sure you stay within those limitations.
This is the definition of volatile data.
Basically, it's data that goes away or
is eradicated when the device powers down.
If the device loses power,
that information is gone.
That random access memory is gone forever,
it's not going to come back when
you turn the machine back on.
Another way of defining it,
it could be the data that is not written to disk.
Because remember, if you're doing a dead box collection,
you're collecting only the data that
has been written to the disk.
Examples would be RAM,
random access memory, which I talked about before.
One thing to be aware of with RAM is there are
certain malware that will only run in RAM.
If we're doing an incident response case
and we're looking for that type of
malware and we don't
collect RAM and we power down our machine,
we're going to lose that information.
Certain registry keys only exist in RAM.
Our list of running processes,
the processes that are currently running on the machine,
and network connections,
the devices that are connected to the network.
RAM, always collect RAM, random access memory.
If a computer is on and you
have the ability to collect RAM,
you need to do so.
Modern computers contain anywhere from
eight gigabytes of RAM up to 96 gigabytes of RAM.
It is no longer acceptable to not collect it.
You're going to be questioned on why you didn't.
In an intrusion in
incident response cases, RAM is essential.
These cases rely heavily on
random access memory because we
need to see the network connections,
we need to see the running processes when
we're doing these types of investigations,
and we need to see any malware
that may only be running in memory.
We can see on this screenshot that
this particular machine had 64 gigabytes of RAM,
and it's just a desktop computer.
You wouldn't leave a 64-gigabyte thumb drive
sitting on the desk,
you shouldn't leave 64 gigabytes of RAM behind.
There are many RAM capture tools out there.
Here's a list of some of them.
Magnet has one, DumpIt,
Belkasoft, and FTK Imager is capable of capturing RAM.
This is a screenshot of DumpIt,
very easy to use, very efficient.
One thing to consider,
it has a very small footprint
since it is a command-line tool.
If you're using a GUI tool,
graphical user interface tool,
it's going to leave a bigger footprint on the system.
If you can use a command-line tool,
you're better off because it will
leave a smaller footprint.
At the end of this module,
we'll show you a live demonstration of DumpIt.
Encryption is another one of
the things we need to consider when we're
deciding whether or not we're going to do live imaging.
Encryption is defined as the process of
randomizing data to make it unreadable.
This is a way we secure our data
to prevent unauthorized access.
Encryption can be applied to files,
containers, volumes, or disks.
You can have an encrypted file, a container,
an entire volume or full disk encryption.
A lot of operating systems
including Windows 10 and the latest release of
Mac OSX have the capabilities
of encrypting any of these or all of these.
We're going to look for
encryption and we can see on the slide
the graphics show us examples of encryption.
We're going to check our taskbar and
our system tray and we're going to see what is running.
If you see an icon like you see on the very far right,
that is a BitLocker encrypted drive.
We can also see an example of cystine, PGP encryption,
and those other icons
are also showing you indications of encryption.
If you have no indication of encryption,
if you have a suspicion of encryption,
I would go ahead and check to see what's going on.
On a Windows system,
it's very easy,
if you look at the graphic on the right here.
You are interacting and making
changes to the system but document it.
Document use expected there was encryption running
because you know in Windows 10 BitLocker is enabled.
Here we go to the bottom
in the Windows 10 and type in "bit",
you'll see the BitLocker control panel.
You would go ahead and check the BitLocker control panel.
When you open it up, you're going to see
a graphics almost the one we have on the screen.
We can see here that BitLocker is turned off,
so you would know
that you had no BitLocker drives up here,
but wait a second,
if we look at this removable drive R,
BitLocker is turned on.
So we know volume
R is an encrypted volume that right now is unlocked.
If I saw that,
I would want to go ahead and live image,
logical volume R. Because
if I don't and I shut this machine down,
I power it off,
BitLocker will kick in and I may
not be able to get back into their drive.
This is going to be my only shot at that evidence.
I'm going to go ahead and create my live image,
I'm also going to go ahead and back up the recovery key,
as you can see here on the right-hand side.
We can save that recovery key to a file,
now you're going to go ahead and save that
out to your target media,
your destination drive,
where you're collecting your evidence,
the same place you would put
your logical image of the BitLocker R drive.
In our next module,
we're going to talk about
live imaging in forensic boot media,
now we're going to do a demo using DumpIt.
This is a live demonstration of DumpIt.
DumpIt is a very simple program,
it is a command line program
which you can go ahead and double-click on the Shortcut,
mine is right down here in my taskbar.
If I double-click on that,
DumpIt is going to run.
Now, it's going to ask me if I want to continue,
it's going to show me the size
of the memory that I'm collecting,
and it's going to show me where it is putting the files.
It's putting it at C Users Denise desktop OneDrive,
and it's naming the file the name of the computer,
a date and timestamp,
and it's called a.raw,
R-A-W will be the file extension.
I would simply hit the "Y" and it starts working.
When it's completed it is going to
save the file right here.
You can change that if you had
an external destination drive
that you are saving all your evidence to.
You would go ahead and save that file out there.
I'm not going to let this run through
because there's quite a bit of memory on this machine.
But I just wanted to give you a quick look at DumpIt,
we will be using this throughout the path.