In this lesson, I'm going to simply
walk you through removing a map from
the Windows operating system,
I'm pretty sure that all of you know
how to remove a program from
windows. But I thought I'd throw in
a couple built in Windows command
line tool that helps a pen tester
cover tracks.
The obvious benefit of such a tool
is that you don't have to install a
third party tool like Eraser or
C cleaner on a compromise machine
during a penetration test.
Let's get started.
Here are the learning objectives for
this lesson.
This lesson will almost entirely
focus on the lab.
First, I'm going to show you how to
uninstall and map and Zend map
from a 64 bit Windows 10
installation.
Then I'm going to show you how to
use a couple of built-In Windows
commands to make the work you did
and map completely irrecoverable
in the lab. I'll walk you through
removing and cap and
maps, packet capture library.
Then we'll remove and map
Zend map and all of its dependencies
and features.
Finally, I'll show you how to run
the cipher command to make it so
that all the work you did and map
will be irrecoverable
when you delete files or folders.
The data is not actually removed
from the hard disk right away.
Instead, the space on the disk
that was occupied by that deleted
data is considered delegated.
That basically means that it has
stuff on it that can't be seen by
browsing the operating system and
that the space it used to occupy
can be overwritten
until that space is overwritten.
A low level disk ed or
piece of data recovery software
like those used by digital forensic
analysts can still actually
fairly easily recover it.
However, the cipher utility is
designed to prevent unauthorized
recovery of such data.
So using cipher
will make it so that all deleted
files like the ones removed
by uninstalling and map
will be impossible to get back.
Welcome to the lab on removing
and map in windows.
All right, first of all, we're going
to open a command prompt.
Click on the start button,
then just start typing ACMD.
Once you see command prompted the
top just right, click and
run as administrator.
All right, I'm going to show you
where in the file system
and map stores all its files,
so do a CD space
backslash enter.
On a 64 bit operating system.
It is do a CD
space program,
files space.
X eighty six.
Hit enter.
We'll do a dear
and map star
Dot that'll show us all
directories that start with and
map.
So we see a directory right here
called And Map.
That's where and map stores all its
files.
For now, we'll just minimize the
screen, we'll come back to this
later.
All right, now we'll go through the
actual removal process.
I have control panel on my desktop,
but.
The best way to navigate to it is
just simply click the start button.
And start typing control panel.
And you can see that up there at the
top. Just click on it.
Now we want to scroll down and find
programs and features.
Click on that.
I'll maximize the screen and make it
bigger.
Now, simply just scroll down until
you see and pick up.
Click on it.
And click uninstall.
The wizard will just walk us through
the process.
Once completed, just click close.
Then I'll open back up my control
panel.
And we'll look for and
map.
And click on.
And just walk through the wizard.
Click next.
Click uninstall.
Yes.
Click close.
And now I want to open back up my
command prompt and.
Click the up arrow just to run
the same command that I
did last time, and that is Dark
Space and map star DOT
in the program files directory.
Hit enter.
The folder is still there,
so.
So I'm going to go into that folder
and see what's there.
CD Space and Matt.
Enter the dear.
So there's still some files there.
So if we want to clear our tracks
really well.
Then we want to remove all
of that stuff, not just from
the filesystem, but remove it
permanently.
So the CD.
Dot, dot.
I'll do a R.M.
Dyax space.
And map.
Says the directory is not empty.
So in order to remove the
directory with files
in it, we have to do a R.M.
R.
S.
So do a R.M.
Diyab space
s space.
And map.
Are you sure why?
Now to a dire
space.
And Matt Stadt again.
Found, not found.
OK, so now we removed it from the
file system, but unfortunately,
as many of you know, just
deleting stuff from the file system
doesn't permanently remove it.
So.
The command to permanently remove it
is.
Not very well known, but it's very
effective.
That is safer, so
the command we want to execute is
safer.
Space
w colon
and map.
Hit enter.
OK, so it's done
so if you have been following along
with me and are extremely patient,
then you can be
reasonably certain that the
map folder has been
completely deleted and
is irrecoverable.
A lot of you probably know that any
reasonably good digital forensic
person will be
able to look
into your operating system and know
that and map was
installed at some point.
But what you can
be certain of after doing this
is that.
Any of the map scans or
files created by any map
or vulnerability tests
or penetration tests that you've
run?
Will be completely removed from the
system and therefore
undetectable in
this lesson, I showed you how to
remove and map from windows.
Thank you so much for walking
through that with me.
And I'll see you in the next lesson.