>> One of the last things that we want to talk about
is getting the windows
>> or the BitLocker encryption keys.
>> That's going to be important
because if you're not able to get
a logical image of your hard drive system,
and you have to get a physical image,
if the system is encrypted with BitLocker,
you're not going to be able
to essentially do anything with
that hard-drive image unless
you have the keys to unlock it.
There's a couple of components to that statement.
First is a logical image
and the other is a physical image.
If we wanted to collect a logical image of the system,
we can go into
our portable FTK Imager program that we have.
You could also use in case imager if you wanted to.
I'm just pretty familiar with the FTK Imager.
We can essentially run FTK Imager from our thumb drive.
It will take it a minute for it to load.
Now that this is loaded and running,
what we'd want to do to capture
>> that logical image is we would go to File
>> and we would want to create a disk image.
>> It is going to be an image of our physical drive
>> that we have attached to the system,
>> our Physical Drive 0.
We would click finish
>> and we would go through the same process
>> that we initially went through with collecting
>> the data from the removable drive.
However, we would be collecting the data as it
sat on the system right now, unencrypted.
That would give us the ability to go in
>> and look at that data should we
>> not get the BitLocker encryption keys.
This long circuitous route,
if know that you can't get
the BitLocker encryption keys
>> or have a system up and running
>> and you're not sure of what type of encryption that
>> it has or it maybe connected to something else.
Maybe if you'd have true crypt running
>> or if you're connected to some type
>> of remote file-sharing service,
you may want to go ahead and get that logical image.
Otherwise, you can go ahead
>> and get the physical image of the system,
>> which would be with the system turned off.
Then you could go
>> and use a bootable Linux thumb drive
>> such as Kali Linux to go ahead
>> and image the drive of that system while it's at rest.
>> Or you could essentially remove
>> the hard drive from that system
>> and then image the hard-drive outside
>> of the system to get that physical image.
But either option that you choose,
it just needs to suit the purposes
that you're looking for, for your investigation.
If it's perfectly acceptable for you to use
a logical image or that's all you can get,
then by all means,
go ahead and use that type of image.
But if you're looking to do
the more forensics side of the house
>> and you have to maybe testify in court in reference
>> to some of the forensics processes that you do,
>> you would obviously want to use the best evidence
possible in it's most unalterable state,
which would be that image of the dead box.
Going on.
>> We've done a lot of things in this video
>> so let's just take a moment to consolidate
>> what it is that we have accomplished.
Thus far, we've talked about
>> essentially going through that preparation phase.
>> What we've done is we've taken our removable media
>> and we have wiped and sanitized
>> that media of any data that was on it.
We used the EnCase Imager to go in
>> and wipe that data
>> and then we essentially had to go back in
>> and reformat our drive.
>> Once we were able to format that device,
it was then ready to use on our victim system.
We could insert that device into the victim machine,
and then we could then go about
collecting that volatile memory,
then we could go about
collecting images from that system.
What we also talked about was we began to image
a thumb drive that was potentially
found at the scene of your incident.
We did a couple of types imaging.
We also took the hash files of the memory
>> that we were able to image,
>> and we consolidated all of those processes
>> that we did onto our forensic thumb drive.
>> Here we have the image of our SanDisk titanium drive,
and we have our volatile memory image.