>> Moving on from the preparation phase,
we go into the preservation phase.
The first part of the preservation phase
is that when encountering system,
investigators must perform a rapid assessment of
activity to ensure the preservation of any evidence.
What that means is being able to
look at a system and being able to
determine if something is
happening on that machine that is essentially
going to change its state and damage
any type of evidence that's going to hurt,
and not just on the system,
but maybe in the room where you find the system.
Having that situational awareness
of not just the machine,
but your entire surroundings is going to aid
you and being able to preserve all of that evidence.
One of the first things that
the investigator is going to want to do
>> as part of that preservation process is to take notes.
>> The note-taking essentially relates to
what happened during the investigation.
Notes are going to be very important,
especially if you have to be in court.
Oftentimes, a defense attorney
will not necessarily attack the evidence per say,
and they're going to attack the investigator,
which would be you.
Any little thing that they can find that you did
wrong during your investigation,
they're going to try and pick that
apart and destroy your case.
That's why it is of great importance that
you record in detail every action that
you take from the time that you
become aware of the incident to the time you
complete your central investigation on your notes.
Here are some key note-taking points.
The first thing that you're going to
want to do is write in ink.
Obviously, writing in pencil
would subject your notes to change,
writing in ink essentially makes them permanent.
Then you would want to put your name and
organization on the first line on the top of the page.
The location of where the incident
occurred to the smallest details.
Not just the address of 123 main street,
but if you have a suite number and office number,
a desk number, down to that very small granular detail.
You'll want to list any individuals
who were present at the time of you
acquiring that data or responding to the incident.
Law enforcement investigations,
they generally have a crime scene tape up,
and anyone who comes in and out of the crime scene,
their name must be written down on that log.
On from that, we have the initialing
each page and putting a number on each page.
Then we want to cross out any mistakes that
we make on our notes and all initial above them.
We must include any diagrams and photographs that we
make in our notes or reference
them and make them available.
At the end of the notes,
we would include the statement,
"nothing follows," and then we
detail any and all actions that we take.
Something as simple as arriving on
the scene and securing the scene,
that should appear in your notes.
Then, very granular details about
the operating system to include
any information that we return from the OS,
from any commands that we enter.
If we find any media laying around per say,
we find a thumb drive which we are going to get
into later in the hands-on portion,
we have to write the granular detail.
If I found a gray SanDisk cruzer or 2.0
gigabyte thumb drive
>> with serial number 1234 on the back.
>> Lastly, we're going to want to include
a known good local time
and annotate the source of where we obtained that.
That known good local time will help us to normalize
all the times that we find
throughout our investigation to that one time.
Often, systems may not be set to the appropriate time.
If you have a suspect who was particularly savvy,
they may cry and finagle the settings of
the clock in order to help
obfuscate some of their activities.
So including a known good local time and
annotating that on your notes is of key importance.
Here's an example of the notes.
As you can see,
at the top of the page,
I have the title of investigator notes.
We have our Case 1234.
If you are working,
particularly in an incident response office,
you may have an incident response number so that
the case number may replace
that incident response number.
The investigator's names,
I put my name there.
Your organization that you're
doing this forensic investigation for,
and then the section headings,
date and time, the
actions that were taken, and the results.
Essentially, if we respond
to the incident on 1st of August 2016,
we arrived at the scene of 123 main street,
Anytown, Maryland 12345 zip code.
Then from there, we obtain a known good local time.
You can use an Internet
restore such as time and date.com.
You can also use your cell phone,
just as long as you annotate where that time came from.
Then the next thing that we see in our notes is that we
secured the same and then
any individuals that were present,
we can attach a roster of who was there.
Hopefully, the third step,
you've already completed before you
got to the incident scene.
But in case you did not,
you can wipe the media and then
annotate that in your notes,
and we'll show you how to wipe media using the in case,
forensic imager and the hands-on section.
Then down at the bottom,
you can see the title of nothing follows,
followed by an investigator signature,
and page 1 of 1.
In conjunction with the notes,
photography will help build
credence to your investigation and
help keep track of what was
done during your investigation.
It is often the best way to
record information of the scene.
You can sit and write
a lot and essentially write the novel War and Peace,
or I can take a photograph of
it and write some cursory notes of what happened.
I'm not in favor of writing War and Peace,
I would just rather take a photograph of
the scene and record that in my notes section.
Considerations though when using photography is
that a flash can cause reflection onto the screen,
which can distort your image and make it not usable.
Also, screen refresh rates
>> can obscure your photography.
>> So you're going to want to use a slow shutter speed,
usually about 1/60 of a second,
and that's about the refresh rate of
most screens in the United States.
I think overseas they use a
1/50 of a second refresh rate.
However, the slower the shutter speed you can use,
the better it's going to be.
However, if you get a lot slower than 1/60
because the shutter speed is so slow,
it's going to require a lot of balance and steadiness
>> in your hands and you're probably not going to be
>> able to do that without the use of a tripod.
So 1/60 of a second is generally the recommended speed,
especially for hand photography.
That being said, it's very
important to know your equipment.
The time to figure out how your camera works
is before you respond to the incident, not during.
If you get one of these very expensive DSLR cameras,
figure out how it works before you get there.
Then, the old mantra of two is one and one is none.
Even if you have this very nice expensive DSLR camera,
if it's the only one you have,
it's going to break when you need it the most.
So having something as a backup,
even an iPhone is better than nothing.
Never alter the photographs
because any evidence that you take,
especially if you're going to go to court,
it needs to be miscible
and you have to qualify that evidence.
Altering the evidence after you take a picture
essentially makes those photographs
unusable in a court process.
Then after you take the photographs,
you're going to want to hash those photographs.
Then we go into some detail on
the hands-on portion of how to use MD5 hash.
We're going to hash a memory file that we
>> are going to create from vault memory from the system.
>> The same process of running MD5 hash on
a vault memory file is applicable to any type of file.
So you can hash one file,
you can hash in five.
But we'll show you how to do the MD5 hashes.