>> Some volatile data considerations though.
The decision to shut down a system
should be made on a case-by-case basis.
Obviously gotten destructive activity occurring on
a system and it is rapidly changing,
and the environment essentially
untenable and you're not going to
be able to shut down or stop that process,
shutting down the system may be your only option.
Therefore, the decision to
forego the collection of volatile data
depends on if it is reasonably
expected to support the investigation.
We talked about that earlier,
that if a long time has maybe progressed from
the time you became aware of the incident till now,
it may not be good practice to collect volatile data
because it's essentially useless or you've
lost control of that system.
Two or three or four users who have logged on.
Again, we also
hinted that some of the processes that we are
going to demonstrate do
require some changes to the system.
Collecting volatile data does
require more extensive changes to
the system and that can
overwrite other more valuable data.
All of those types of
considerations have to be thought of
before collecting the data and or
shutting off the system and
foregoing the collection of that data.
Another problem that you may encounter when
trying to preserve evidence is inactivity.
Inactivity functions can limit
access that you have to a particular computer system.
You may have different sources of inactivity,
such as the power scheme that will essentially activate
itself to reduce power consumption
to a device or an entire system.
You also have your screensaver which will essentially
lock the computer after a certain period of time,
if they have that screensaver that
locks when the computer essentially is left alone.
Some screensavers won't work but some might
require a password upon waking up.
Then Hibernation will simply
cause RAM to be written to the hard drive and
then content can be restored on
power up but it may require a password.
One of the first things to consider
when you come to a scene and you
find a computer with a blank screen is
to ensure the monitor is powered on.
If nothing appears on
the screen depress the left Shift key.
Now depressing that left shift key
is important because that is
the only key that can't really be
hotkey to create some other process.
If you have a very technically
savvy computer user and they've set
up something on their system when you
push any other key but that left shift key,
the CCleaner or BleachBit is going to
run starting to wiping everything on that system.
To wake that system up simply press
that left shift key and the system
>> should wake itself up.
>> The other thing that we can
do to prevent inactivity functions
is to insert a Mouse jiggler into the system.
What a Mouse jiggler
it looks almost like a very small thumb drive.
It mimics a human interface device,
such as a mouse and it makes
very slight mouse movements very occasionally,
very sporadically that keep the system from
being inactive and creating these inactivity functions,
but still allows the investigator
to perform his functions.
This is an example of the Wiebe Tech mouse jiggler.
They're relatively inexpensive, I
think they are about 17 to 20 bucks.
You can buy those and then
insert those into the operating system
and it will prevent the system from becoming inactive.
The next consideration that we have when
preserving data are the active connections.
Connectivity is a data connection between two systems.
They are most prevalent in modem or
networked connections to the Internet
so almost any system
that turned on to encounter more than
likely in 2016 is willing to have
some type of network or other type of
connection to it unless you're dealing with
some type of crude sneakernet system.
Active connections an investigator
does not have complete control of the system.
It's very important to
understand what the computer is connected to,
who may or may not have control over that system.
The network state may provide
vital information to the investigation,
such as remote storage.
If we were to immediately disconnect all
of the network connections
to the computer as soon as we got there,
we might lose some of that vital information.
That being said, data can be
sent or received over active connections and
may permit someone to begin
active destruction measures on the system.
Until we're certain that we have
complete control over that system,
we can't necessarily let our guard down and assume that
we are the only ones who may be working on that system.
Investigators need to conduct an assessment of
the situation and determine if
terminating the connection is warranted,
but volatile information should be collected
first unless it is
apparent the connection must be terminated immediately.
Again it's going to depend on the situation
but the investigator must be
cognizant of some of these considerations
and do that continual assessment
as they're going through out
>> your investigation process.
>> Terminating connections,
a wired connection can be terminated
as easily as removing
a data cable from the back of the computer.
That being said, some computers,
as soon as they're disconnected,
they may revert back to
a wireless connection or a Bluetooth connection.
Wireless connections, it could be as simple
as a disconnecting the cable to
the wireless access point.
That entails being able to locate
the wireless access point and
generally in a home or a business,
they're going to be near cable modems or near the TV.
Then any type of cabling can help
identify those access points
if they're not readily apparent.
Access points are probably generally close to
the computer due to the radio wave limitations.
However, keep in mind though that waves
can propagate to other levels within the home,
so if you're in a home setting you could have
a WiFi network that is
essentially hidden or obfuscated out of sight.
That being said, if you disconnect one WiFi setting it
is quite possible that someone has
another WiFi setting very close by,
that when you disconnect one
it will auto connect to another one.
You may also have to just completely disable
the WiFi connections on that system as well.