>> Moving on from photography,
we go to the keys of preservation.
Preserving evidence should be your primary goal.
The investigators should not attempt to
alter the system or alter it as little as
possible during the course of the investigation by
following sound incident responder principles.
Some of the techniques that we're going to show
you they're going to
be very minimal storage changing
>> the state of the system.
>> However, some of the techniques
that we're going to show you,
they're going to change
the state of the system slightly,
and that's going to be really the only way that you
can collect some evidence.
That being said, you'd have to take
certain considerations in mind as to why
you're doing certain procedures and what evidence
you may or may not be giving
up if you do these procedures.
Keep in mind though, as
you're going about attempting to preserve
evidence that computers may not
be your only piece of evidence.
There could be other witnesses devices such
as IDSs, routers, firewalls,
sniffers are other devices along
that path that could have
captured traffic during the incident.
So don't just think of the computer,
think of the other devices as well.
Then as we're collecting and preserving evidence,
we want to collect it and preserve
it in the order of volatility.
That essentially it's going to
prioritize your preservation and
collection to evidence that
can change once the power is shut off.
The goal being to collect the information that has
the greatest likelihood of being
changed once power is lost.
Then the volatile data which we've talked about,
it's running on the route system.
The amount of data essentially is going to provide
insight into the activities that
>> occurred on that system.
>> That could be the most important piece
of information together.
Again, the caveat that it is
>> going to be time sensitive.
>> Depending on how old the case might be
>> or when you were
>> notified of the incident if something that's
been ongoing or the computers
>> have been shut on and off,
>> that may limit the need to collect that volatile data.
One of the other things that you have to be cognizant
of when preserving evidence is destructive activity.
Particular, if a malicious actor
has had foreknowledge of investigation,
he or she may attempt to destroy
that evidence to hide their activities.
That destruction could come
anywhere from physical destruction,
that once you arrive on a scene,
you've got somebody standing
>> there with a hammer and he's
>> dashing in his computer system or hard drive,
they could be attempting to delete files,
which is not necessarily the worst thing.
Hopefully we can recover those.
He may attempting to format and/or wipe the system
using CCleaner or some other type
of program like BleachBit,
so you want to be paying
particular attention to
destructive activity, such as that.
That activity obviously has observable indicators for
the investigator if you get there and
someone's holding a hammer
and they're dashing on the computer.
That's a pretty good indicator.
If you get there and you see
certain files or programs up on
the computer system such as CCleaner
and running and cleaning all of the data on the system.
That should be an indicator.
Other indicators are generally more subtle.
It could be a flashing or
solid illuminated hard drive
to eliminate hard drive activity.
You could have a spinning hard drive
which resembles rattling or whirring.
However, don't confuse that cooling fans.
Then you can also attempt to detect
that through touch, that slight vibration.
Other destructive activities, though,
could be routine such as defragmentation.
There are certain processes that are set up to run.
You just happen to get there as
it's defragmenting the disk.
Obviously that will change the state of the system,
so you would want to disable that from occurring.
Again, we talked about automatic cleaners.
Every time you log on a system
may be CCleaner is going to run.
Or after it gets to a certain point,
CCleaner is going to run at 12 o'clock every day.
Those are things to consider.
Then even something as downloading
material over the Internet can also
overwrite any type of data
that is going to be in that volatile memory.
The big questions that you have to ask
yourself is what type of destruction occurring?
Then will that destruction cause
harm if it is allowed to continue?
Is there encrypted data that needs to be captured?
If you're going to shut off the system and
there are certain files,
folders that are unencrypted,
and by shutting the system off,
it will re-encrypt that data and you'll lose it.
Is it important to maybe capture that data first?
Then is the computer connected to cloud
storage devices that may be
pertinent to your investigations?
Again, disconnecting that computer, turning it off,
you might lose that connection
to cloud storage and that could
be the keys to unlocking your investigation.
Stopping the destructive activity, how you do it?
Stop the person from dashing
in the computer with the hammer.
Well, I'll leave that up to
you how you go about doing that,
but stopping a particular program and
our application could be
just as simple as clicking the red X.
You could also try a graceful shutdown of
a system or a hard shutdown of the system.
Lastly, pulling the power cord
from the back of the system including on your PC,
obviously a laptop,
pulling the cord is not going to
>> do a whole lot of good.
>> However, pulling that power cord,
there's going to be some caveats to that.
That's going to be the universal power supply.
If you have an UPS attached to your system,
when you pull the power cord,
nothing's going to happen.
Your computer system will continue to
run and it will not know
that power has been lost because the UPS has been
kicked on and continues to power the system.
UPS can either be internal or external to the system.
An internal UPS can look like a power supply.
It can look like a control panel
>> at the front of the box.
>> PCI card, or externally,
it can look like a power supply as well.
The safest option when dealing with some of
these UPSs is if
you don't know where they are or what they look like,
and pulling the power cord
out of the wall is not working.
The safest option then is to open the case
and handle the components while the power is still on,
and then disconnect
the input output cables from the drive.
I will remind you that it is
important to use the proper grounding techniques or to
discharge any static electricity before handling
these hard drives because you
could essentially damage them with
that static electricity and
any evidence on them would then become useless.
We hinted out the order of
volatility a little bit earlier in
this discussion about capturing
data that it's going to be lost once power is shut off.
Here we have the order of volatility.
From most volatile,
to least volatile,
we have registers and cache.
Then we move on to the routing tables, ARP cache,
process tables,
kernel statistics, connections, and memory.
Down from that we have temporary files.
Then we have hard disk and/or
other non-volatile storage media.
Then we have remote logging and monitoring devices.
Then we have network topology and
physical configuration and lastly
>> we have archive media.
>> Those are in order of how you
>> would generally want to go
>> about and collect data
during your forensic investigation.