>> Moving on from there,
we can now talk about the phases of the investigation.
We essentially have five phases
of forensic investigation,
and we have a follow-on,
hands-on video after this that will take us
through the phases of the investigation.
But the first phase,
it's preparation, getting ready
to do the incident response.
The next phase is the preservation of evidence.
The third phase is
the duplication of any evidence we find,
and then the analysis,
and then the reporting phase of the investigation.
Beginning with the preparation phase,
one of the first questions you have to ask is,
what authority do you have when getting
ready to do your forensic response?
Normally, if you work for a corporation
>> and you're going out
>> and you're responding to some type of incident
>> and they need additional forensic information,
>> that is generally all the authority you need.
If you're working in law enforcement or government,
do you have the appropriate search authority?
Do you have consent?
Do you have a search warrant?
All of those caveats need to be understood
>> before you go out and do your search.
>> The next question you want to identify is,
>> what type of operating system
>> are you going to be encountering?
>> If you work, again, in a corporate environment
>> or even in the government,
>> generally, you have an idea of what type of
operating system that you're going to come across.
More than likely, it's probably going to be
a Windows system.
>> That is predominantly what's used throughout the world.
>> However, some organizations do use a lot of Macs,
and then some organization use lot of
Linux machines or Unix machines.
Identifying what type of operating system is out there
>> will help you identify some of the
>> materials and software that you're going to need
>> in that preparation phase.
>> Another question you want to ask yourself is,
>> how old is the hardware that you're going
>> to be essentially interfacing?
A lot of times, especially within government sector,
you have some of these servers that have
been around and are as old as Methuselah,
and there is essentially no one left
that knows how these things work,
who established them,
what type of code is written on these,
and people just leave them alone and let them sit.
When it comes time to investigate these,
you would essentially find that they use
cables or processes that you've never heard of.
Identifying the hardware and
the information systems that
are going to be within your network that you
might one day have to investigate is a good step
>> in having the right equipment when necessary.
>> Another consideration to think of is
asking the question of who uses the computer?
Are there multiple suspects?
Does someone login and logout?
Does another person login after them?
That helps you narrow the focus of
your investigation and also helps you identify
what information might be useful
>> and what information may not be useful.
>> For instance, if someone were to
log in after a particular suspect,
the collection of volatile data may not be as
beneficial since they may have logged out and
cleared that cache from that previous user,
so that is something to consider.
After asking those basic questions,
you can then start preparing
that basic forensic toolkit
that you're going to use in your investigation.
One of the first things
that you're going to want is decrease
sterilized pre-wiped media which would include
your USB media and your external hard drives.
As you're going to see in the follow-on hands-on video,
wiping one of these devices,
although it's a fairly easy process,
is very time consuming.
We're going to wipe a 64 gigabyte thumb drive,
and you'll see that it can take
roughly two hours to wipe that device.
Having all of these devices
>> pre-wired and pre-staged is going to help you
>> out immensely when it comes time to
begin your forensic investigation.
After that, we have the use of surgical gloves.
>> That just helps keep everything sanitary,
>> helps keeping the equipment
inside the computer system
from being damaged by the grease and
dirt and oil on your hands.
The next thing that you're going to want to have is
your computer toolkit which includes
>> screwdrivers, Torx bits, and pliers,
>> and that's going to be to help you
remove hard drives from systems
or get into systems to
do your forensic investigation.
You're also going to want to have evidence tags,
>> markers, sticky notes, tape pens,
>> and so on and so forth.
>> This will make your investigation a lot easier if you
have multiple cables or multiple devices,
multiple thumb drives,
>> being able to tag and mark those
>> and identify them easily with these
>> sticky notes and tape is very beneficial.
>> If you have a lot of connections
in the back of your computer,
being able to label those
>> and take a picture of them will also help.
>> Speaking of taking pictures,
having the camera is very important.
Not just having one camera but sometimes having two
because when you need it the most,
you probably will find out that it's going to fail.
Then also having anti-static bags
and wrapping materials.
>> That way, when you do collect a lot of hard drives,
>> for instance, if you go to someone who is
>> pretty computer savvy
>> or they have a lot of illicit material on
>> these hard drives that they have it at their home,
you may end up coming across a stack of hard drives,
>> and you're going to want to package those in
>> these anti-static bags to keep them from being damaged.
Also along with the anti-static bags, Faraday bags,
>> they're particularly useful for cellular devices.
>> If you're going to image those,
the Faraday bag will essentially keep
electrical signals from getting into the bag
>> and changing the state of the device.
>> Magnifying glass to see small fine print
>> and serial numbers on certain devices.
>> Cable ties just to help keep things nice and easy.
Then we have additional suggested tools.
Again, we've talked about data cables,
8-bits, 16-bits SCSI,
IDE, SATA, USB,
CAT5, crossover, FireWire.
All these types of cables
>> you're going to want to include in your kit bag
>> just because you don't know necessarily what
>> type of devices you're going to come across.
>> Grounding straps just in case
>> you're taking a system apart,
>> and you want to prevent electrostatic shock from
damaging the hard drive in the system.
A grounding strap would be very useful.
Write Blockers for various media.
Those can be either software or hardware
>> which we'll talk about a little bit later.
>> Computer screws and jumpers.
Occasionally, you're just going to need those
>> because they get lost.
>> Software library boot medias,
assorted drivers, blank CD,
DVDs, and forensic software
we'll get into that pretty extensively.
You can create essentially
a Kali Linux boot disk
or whatever flavor of Linux you like,
boot disk in order to help do
your imaging of a computer system,
and then you can create
your forensic software that you're
going to use to put into
your victim machine to help
you get the data off of that machine that's necessary.
You may also want a network interface card
for crossover imaging,
disk drive, and duplicator.
Then lastly, write protected USB
>> or external storage drives
>> that just helps to ensure that
>> after you acquire the data,
>> that it is essentially not changed.