>> The next part of this video will cover
the forensic acquisition of data from a PC,
and we will go from a powered on-state for the PC,
and then we will show you how to go about that process.
From here, we can go back
to our access data forensic integer.
We'll just close out of this
and we'll go back into it again.
From here, the nifty thing about the FTK Imager,
compared to the EnCase Forensic Imager,
is that the FTK Imager has the ability to
gather the virtual memory from a machine.
If you were to take this and put it
onto your forensic thumb drive,
you could actually run
FTK Imager from your forensic thumb drive and
then gather the volatile memory
>> from your victim machine.
>> From here, we'll go to the File menu,
and we can scroll down to
the icon that says Capture Memory.
Then we're going to browse to the destination path.
We're going to again put this on
our forensic thumb drive and click "Okay".
I'm running this program from my desktop.
However, you should be running this program from
your thumb drive to
ensure you're using forensically sound principles.
That we'll click Okay.
Then it's going to ask us to name the file.
We can name it,
my computer is EnolaGay.
We'll call it EnolaGay.mem.
It's going to ask you if you want to create an 81 file,
that's specifically for use for access data.
We don't need any of that,
so we can just click on the capture memory,
and it's going to start capturing the memory.
As you can see, I have 35 gigabytes
of volatile memory running in my RAM,
and it will go through that process of
collecting all of the volatile memory.
I will save you guys the wait time.
I'll click "Pause" and we'll come
back when this is finished.
We're back now, and we can see that
the memory capture process has finished.
It has sent the file to the E Drive,
EnolaGay.mem, and memory capture finished successfully.
If we go to the E Drive,
we can see that it also now contains
the EnolaGay.mem file,
and it provides the size of that file.
That took roughly an hour and a half or so.
Obviously, if time is of the essence and you have
a computer that does have a very large cache of RAM,
just be cognizant that it could
take quite a bit of time to get that.
If the case has been ongoing for
quite some time and the incident is relatively old,
it may not be in your best interests
>> to do a memory dump.
>> However, if you are
interested in some of the running processes and
things that can only be captured
>> in the volatile memory,
>> then that is something that you
should definitely consider doing.
Of course, there are other ways to
obtain the volatile memory from a system.
There are programs such as [inaudible] ,
that combined analysis and data capture into one tool.
I'll show you an example of
that here in a couple minutes.
Also, you could use a list of
trusted tools from either a CD
or a USB on the victim machine,
and run a series of
commands from the command line that get you
similar information as running the memory dump would.
I'll demonstrate that here in a second for you.
As I was saying, the other thing
that we could do is we could
load our own trusted tools into the system,
and we would be able to run similar commands from
that trusted tool lists
that we have on the victim machine.
What I've done is I've went ahead and I've
inserted my trusted tools into the computer system.
I have just to just scroll down and find it.
I did is listed as the H Drive.
As you can see, this is
a removable drive and it has quite a bit of programs on
it that I might want to
use in my forensic examination of a system.
As you can see, I've got my MD5 program on there,
I have a program that actually came with thumb drives,
the SanDisk for secure access.
I have my trusted toolkit,
the actual presentation that I'm working on now.
I also have DumpIt,
which will perform pretty much
the same process that the FTK Imager did.
By clicking on DumpIt,
you get a pop-up that asks if
>> we want to allow the device to make changes.
>> When you click on the DumpIt,
it will actually create a raw file of
the volatile memory onto our removable thumb drive.
That is another methodology that you could use.
Then as stated,
we have the EnCase Imager that
we can use on our victim machine.
Then we also have some RAM capture tools
that are also available for our use.
Thus, I've talked about trusted tools.
What the trusted tools are essentially,
the command-line programs
>> that you might be interested in
>> running on a victim machine.
You would never want to rely on
the machine to use the programs that it has
negatively installed because you don't
know where those programs came from.
You don't know if they've been altered
or even if they might be present on the system.
This list here has a lot of
the command-line programs that you would want to use,
including our MD5 files,
or some hash files,
the echo commands, disk maps,
we scroll down through here.
The Ps.exe, PsInfo, PSLess, PsLoggedOn.
All of these commands would be very
valuable and useful for you to use on a system.
Specialty did not want to wait around
to capture that volatile memory.