>> After we finish wiping the device,
we're going to have to format it.
The next step of the process is to go
>> to our file viewer.
>> We're going to find our thumb drive.
It's going to tell us we need to
format it so we can format it.
From here, you will see that
it's 57.8 gigabyte capacity.
The file system it's going to give you
options between exFat and NTFS.
Leave it at exFAT, or FAT if given the option,
that way you can use your device across
multiple operating systems, and not just
limit yourself to one operating system.
You can leave the allocation unit
as the default setting,
the volume name, if you want to name your device,
[NOISE] you can name
it and then leave the quick format setting as it is.
Click "Start." [NOISE] It's going to
tell you that you're going to
erase all the data on the desk,
but we've already erased all of the data on
the desk. We can hit "Okay."
[NOISE] The format is complete.
We'll hit "Close."
We can see here now that we have
a forensic thumb drive, and
our drive letter E. From here,
if you want to verify exactly what is on your device,
you can go to the access data FTK Imager.
[NOISE] Just click through those prompts.
Go to File.
You're going to add an evidence item.
It's going to be a physical drive,
and we're going to scroll to the location of our drive.
It's going to the SanDisk Ultra USB 62 gigabyte.
We're going to click "Finish."
Then it's mounted our device.
From here, you can see that the first part of
this is giving you information
about the file system on the device,
and then as we scroll down a little bit more,
you can see that there's actually
a little bit of data left on there.
If we'd probably let it run more,
it would have gotten rid of that.
But then the rest of the device
I've actually formatted it
before is all zeros.
We can see that the device has been wiped.
From here, the next part of the process is to
actually ensure that we have all
of the write blocking technology setup, and
ready to go before we start inserting
any of the seized media
into our forensic machine, and we began imaging it.
That way we can ensure that we're not going
to write data to
the seized media, and contaminate
and taint the evidence that we've ceased,
which would essentially render all of it useless.
The whole part of forensics and digital forensics
is to preserve the evidence in its original state.
That way, we can look at
an exact copy, and duplicate of that evidence.
In order to ensure that
we're going to preserve that evidence,
we have to install some type of write
blocking technology on our forensic system.
That could be that hardware write blocker
>> that's in line
>> with that device that you've
seized, or it could be a software write blocker.
As we've discussed, we're going to
use the USB Write Blocker,
so we will click on that.
From here you're going to come to
a screen that says hit one to
enable the USB write blocker, and hit
two to disable the USB write blocker,
>> and three to exit.
>> We want to enable the write blocker,
so we're going to type one, and then hit "Enter."
[NOISE] Then you're going
to get these pop-ups if you haven't
turned in this thing off on Windows, just click "Yes."
Then it's going to tell you to type
>> any key to continue.
>> Now we've continued.
As you can see at the top of the status notification,
the USB Write Blocker is on.
Now, we haven't taken out
the drive that we just forensically wiped.
You will be able to write to that device.
However, any other
device that you insert into the system,
you will not be able to write to that device.
Just as an example,
don't do this in the field.
But as an example that you can write
data to your device,
I'm just going to drag the EnCase Imager over here,
and just click yes through that.
As you can see, I was able to copy
the EnCase Forensic Imager to our drive.
It is not write block enabled.
We can get rid of that EnCase program, delete it off.
Then once we have the write blocking
>> software turned on,
>> we are ready to insert our seized media.
In this case, we're going to be
using a seized thumb drive.
However, before we begin inserting the media into
our forensic machine for capturing the data,
we want to record any type
of specifics about this device.
When you're on the scene of your investigation,
before you start picking up
any media and before you start
doing your actual duplication of the media,
you're going to want to
denote in your notes what type of device that you have,
and you're also going to want to take
a picture of where the device was
found, and also record that in your notes.
That way we're whoever comes behind you,
if you have to go to court,
can see exactly what it is that you did.
If you found this thumb drive beside the laptop,
you would first want to take a picture
of where you found it, and then record it in
your notes that you photographed
a thumb drive, and
the exact location of where that drive was located.
Then you're going to want to record
the description of the device.
In our case, I have a gray cruiser,
titanium 2.0 gigabyte,
thumb drive created by SanDisk.
Then of course on the back you're
going to have a serial number,
and that's where your magnifying glass
and flashlight would come in handy.
This device serial number is Bravo Echo, 0160acbb.
You would want to put that in your notes that this is
the device that you
recovered from the scene
and the device that you're imaging.
After you have all of that recorded in your notes,
you can then begin the imaging process.
From here we're going to insert
the device into our forensic machine.
[NOISE] We're going to get some pop-ups.
It has popped up as drive letter G. As we can see,
we've got some files on our drive letter
G and that write blocking software should be enabled.
Now just as a test, and
demonstration purposes for this video,
I'm going to try and write a file to
drive letter G. Do not try this in the field again,
you want to preserve evidence, and not
taint or destroy the evidence in any way possible.
But to show you that the write blocker is working,
we're just going to try and move
a file or program over to it.
We'll just drag something over there,
and then it's going to tell you that
the desk is write protected.
Remove the write protection or use
another disk so we'll just hit cancel.
As you can see, the write protection is on,
>> and enabled.
>> If you have concerns about
your software or hardware before you actually
get out to the scene and start doing
your incident response and forensic examination,
you should test out your software, or
hardware to ensure that it works.
As you can see from this demonstration,
the write blocking software is on, and we
cannot alter the data that is on drive letter G.