>> The next part of preserving evidence is
capturing the data that is on
the screen as you see it when you arrive on the scene.
One of the first things that you're going to
look for are open files.
The open files can be saved using the Save As function,
to a forensically wiped thumb drive
or external storage device.
Again, we've talked about we will
show you in the hands-on portion how to
forensically wipe a thumb drive and
prepare it for your evidence collection.
That being said, collecting those open files,
they should be completed after you'd have
collected that volatile data,
just to ensure that you're not
changing the state of the system.
Then also keep in mind,
that inserting a thumb drive will record information
about that device onto your victim machine.
The next piece of on-screen data that you
want to look for is wanted to be the taskbar.
It's going to show most of
the programs running on the computer.
That will be down the very
right-hand bottom corner of your screen.
The next process you're going to look for open windows.
Some programs they can run on the desktop,
they're not going to show up in the taskbar.
Just like open files,
being able to peruse through the window and
see what is there and what's not there,
and then taking a photograph of
any type of open window that you may have.
Particularly if they've go onto some various websites,
you may be able to save that
>> website to your thumb drive,
>> and also taking a picture of the website will not hurt.
Then the system tray programs can be
hidden in that location,
gadgets and sidebar on your fill-up
relatively recently, recent Windows systems,
you'll see some gadgets,
sometimes in sidebars on
the right-hand side of the computer.
Then lastly, recording the systems date and time,
which you'll see down in
the taskbar
below the bottom right-hand corner of your screen.
If you have a system that is
>> powered off and you need to
>> obtain the system date and time,
you can go through the BIOS in order to do that.
Essentially you would be photographing
the interior and exterior of that system,
and then you would power on
the system and enter the setup mode.
Then if you don't know how to do that,
you can follow the on-screen instructions that are
presented during that menu or you
can use Google on your forensic machine to
try and figure out which
>> key that you're going to press.
>> It could be the Escape key,
the F10 or F12,
the pretty common keys,
in order to help get you into that setup mode.
From that setup mode,
you can then find that system date and
time information and then power down the system.
That being said, if you're not able to stop
the system before it goes past that boot mode,
you'll want to immediately power down
that system by doing a hard power down,
you would not want the system to begin to
load the operating system so
that it's just a consideration.
The next you'll want to notate
the configuration of hard drives of the system,
document each setting for
the device out of tech use refined or non.
Then for use refined setting,
you're going to want to record
all settings to include cylinders heads,
pre-comp and logical block addressing.
All of that information should be
contained within that setup menu.
Moving on from there,
we have to essentially conduct a triage of the data,
once we become on seeing.
That being said, when we get there,
we have to know what
>> information that we're looking for.
>> When we're processing information,
if we have certain types of
incidents such as malware, suspicious ports,
remote users or suspicious processes,
collecting that volatile data
may be of very much importance.
However, if we have other types of cases,
where we suspect there may be
an authorized images, documents, videos,
determining user activity or registry information,
non-volatile data may be more important to collect.
Identifying what requirements you
have and what will answer them.
Figuring out what you need to get and how good
it should be important
when you're looking at doing that triage.
Are you looking for running processes,
listening ports, filers, registry keys,
network connections, essentially attend to find
your requirement and then going out and trying to find
the data that's going to answer that requirement.
Then lastly, after you've
identified what you need to get,
how are you going to get it?
What tools or techniques do you need
to use to get the information you need?
You can use FTK, Encase,
Volatility, Redline, DumpIT, COFEE,
Helix, Mac Marshall, Memoryze,
Raptor, Sysinternals Suite, Access Data Triage.
There are literally hundreds of tools out there to
use to acquire data and to analyze data.
Having a broad familiarity
with a lot of tools and knowing
how to use them will help
you in your forensic investigation.
After you have conducted that basic triage
of the system and you have
collected all of the on-screen data,
it is then time for the imaging process.
There are different types of images.
What we're going to use is we want
a forensic image so that is going to be
a file that includes a bit for
bit copy of specified data.
The types of files that you will see are E01 files,
Ex01 files, AD1 files,
and then the.001 raw files.
Then there are different types of
images so you will have a physical image,
which is a bit for bit copy of
a single physical storage device that
is more than likely going to be your best evidence.
However, you also have a logical image and that is one
can be a bit for bit copy of one or more partitions.
Regardless, if the partitions had
been formatted with a file system,
a logical image you're generally going to
collect from a system that is
powered on and you would collect that if you
feel that you cannot get a
>> physical image of the system,
>> or the physical image of the system you might
get would be useless for say,
if it had some type of
encryption on the system and you were not
able to obtain the unlock keys.
In the last type of image is a targeted image,
and that is going to be a bit for bit copy of
a specified target data,
usually a file or folder.
That will also be considered a logical image.