>> As the encase, forensic and the access data
FTK analysis programs, they're quite expensive.
What we're going to talk about today is
essentially a program that is low cost,
no cost, and that is going to be the Autopsy program.
We'll go ahead and we'll get this loaded.
As you can see, we've got it loaded here.
If you wanted to download Autopsy,
you can go to the sleuthkit.org/autopsy.
[NOISE] You can click on
the download it now link and then
download either the 64 bit or 32 bit project.
They also have the Sleuth Kit,
which is essentially command-line tools
to help you investigate disk images.
A lot of times the Sleuth Kit,
you'll see that on some of
your Linux distros for forensics work.
But either one of those two programs,
they're both free and they work fairly
well at investigating some of these disk images.
Today, we're going to work with the Autopsy program.
We'll go back to Autopsy.
We're essentially going to want to create a new case,
so we can look at the images that we have obtained.
We're going to open a New Case.
Then the Case Name, we'll just call it
[NOISE] Cybrary since that's where we're at right now.
Then it's going to ask you to essentially
find a directory where you want to save this information.
You would be doing this on your forensic machine.
If you have a forensic machine you'd like to use,
you could save it somewhere on that forensic machine.
If you want to do all of your work saved to
an external hard drive
that you use for your forensic purposes,
you could do that as well.
For the purpose of this demonstration,
we're just going to save it to
our forensics folder that I already
have created on the desktop.
As you can see there,
it will be under the C\users\admin\desktop\forensics
and then Cybrary for our case name.
Then the case number.
Again, if you're working at particular incident,
you would want to probably number with that incident.
For [NOISE] our purposes, we'll just call it
case or incident number 1, 2, 3,
4, [NOISE] and then our examiners name.
Then we'll click "Finish".
Then it will start creating our case for us.
Once it creates that case,
it's going to pop up with a window where it's
asking you to select an image.
We will look for a image or VM,
a local disk which would allow
you to image where you're at,
or hit Logical Files.
Since we collected a physical image,
we're going to select image.
Then we're going to browse for where we had that image.
Then we had that on our forensic thumb drive.
Then there is our SanDisk Titanium image.
We will click that.
Select an input time zone.
This is important, more
specifically for computer systems.
If we looked at that volatile memory section
under the Mandiant Redline,
it did actually say what time zone the computer was on.
If you can select that correct time zone,
it will essentially normalize all of
those times for you and
make your collection process a lot easier.
Go ahead and select the appropriate time zone.
Then it gives you the option to ignore
orphan files in that file system.
We can just go ahead and leave that unchecked.
You will select "Next".
Then it gives you some configuration module.
Hash Lookup, File Type
Identification, Embedded File Extractor.
You can go ahead and leave all of
those selected as it is.
[NOISE] Then it will go
ahead and process all of that data for you.
Then we will click "Finish".
Then down here at the very bottom,
you can see that it is analyzing the files that
we have on our two gigabyte thumb drive.
This is the home screen here,
we can see the physical image itself.
We can click through that.
It shows any orphan files that we have,
gives us information about the system volume.
We can click through that.
Then we see essentially some files on here.
We have a digital investigation statement
of purpose that is going to
the George Washington University.
Then we have a PDF of the same file.
We have essentially the encase forensic imager exe file
that looks like we deleted earlier has that red X file.
There are essentially a couple
of these files that we can see on here.
We also have a letterhead information
that is the picture.
Then we can go through and look
at the various type of files that we have.
We have one image, zero videos,
zero audio, documents,
executables, deleted files, file systems,
where we deleted that encase forensic imager.
Again, autopsy is a very powerful and free tool.
If we had a hard drive, for instance,
and we had essentially emails
that were essentially searched through emails.
We do have email addresses that it will go
ahead and search through on this system.
Again, it just helps you
analyze all of the data that you have
collected for only having just
>> a few files on the drive.
>> Autopsy is going through and trying to parse
out this data and make it easy
for you to investigate
these files that are on what you had found.
Again, this is a pretty rudimentary and cursory look
at the autopsy program and the analysis.
Just one keyword with analysis.
When you get into a lot of these larger file systems,
this file system is
only two gigabytes and it
only had three files on the system.
When you get into essentially an entire hard drive,
you're going to have
a ton of information on this hard drive.
If you don't know what you're looking for,
you could essentially spend days or weeks
combing through all of this data
trying to find something.
Knowing what you're looking for
or having an idea where to look
for will essentially aid you in that investigation.
We won't go through the process today of going through
all of the analysis because that would
essentially take an entire week's worth, of course.
But the whole purpose of this today was just to expose
you to this autopsy program and what it can do.
Again, this is just one type of investigative platform.
There are many others. Again,
encase has its own version as well as FTK.
We covered a lot of material in
today's lesson and it
may be a lot of information for you to take in,
especially if you're not familiar
>> with digital forensics.
>> But again, we'll just
capstone what we talked about today.
We went over essentially the preparation phase of
sanitizing and cleaning all
of the equipment that we're going to
use in our investigation process.
We inserted our forensic thumb drive into the system,
we wiped it using FTK.
We got it prepared,
we've reformatted it,
we can name it whatever configuration
>> we want to name it.
>> In this case, we named it forensic td for thumb drive.
We then went to
a scene and we started processing that scene.
We only recovered a SanDisk Cruzer Titanium drive.
Then before we started imaging that drive,
we essentially took notes about
the device and its configuration.
Then we installed our USB write
blocker before we inserted that device into our system.
That way we were ensuring that we're not
writing or corrupting the data on what we discovered.
Once we had that device in our system,
we were then able to forensically image
that device using the FTK access data imager.
Then we put that image to our forensic thumb drive.
Then from there, we talked about
getting the volatile memory of the system.
There were several ways to do that.
We also used the FTK imager
to obtain the volatile memory,
which we named EnolaGay.mem.
However, there are also other ways to get
that volatile memory and we discussed
using the Redline program to do that.
We provided an overview of what Redline look like.
Then lastly, as
far as the [inaudible] for memory
>> process was concerned.
>> We've looked at getting the BitLocker
encryption keys on the system.
It is not encrypted by BitLocker,
but we went through that process of getting all of
that BitLocker data just in
case you had to do that in one of your investigations.
Then after we got all of the data,
we ensured that we had the correct hashes of this.
We have the hash of our mem file.
We also have the information pertaining to
our SanDisk physical memory file.
From there we can take that forensic thumb drive,
we can remove it,
and then we can put that back into our forensic machine.
From there, we can go into our analysis program,
autopsy that we talked about today.
It breaks it down into different types of file systems,
filters, interesting files, email messages.
Again, the file system
that we were looking at was very simple.
It only had three files on it,
so there wasn't a lot to look at.
But that steers you through
>> that process of preparation,
>> and then the preservation,
collection, and then analysis.
Then finally, the reporting of the information.
Anytime that you collect this information,
you're going to want to consolidate
it into some type of report.
Generally with an executive summary at the top,
followed by the step actions that you
took and any type of
operating systems and programs that
you've found on the system,
that one was your victim machine and your system as well.
Again, that's a lot of information to take in.
If you have questions,
please feel free to write in,
please feel free to ask questions.
We'll get back to you with anything
>> that you might have.
>> If there's something else that
you think that you want to see,
please let us know and we can create some type of
video to go into those processes a little bit deeper.
But this concludes the hands-on portion of
the digital forensics in
as far as incident response is concerned.