So imaging concepts, forensic
imaging is conducted to preserve the
integrity of the original evidence
by creating an exact duplicate
and pretty cool thing about
digital forensics that
separates it from a lot of the other
forensics fields is
that when we conduct our
investigations, we essentially
preserve evidence
and we preserve it a lot better than
some of the other forensic sciences.
For instance, if you have
someone who is conducting an
autopsy of a cadaver
and they remove certain portions
of that cadaver and they're doing
their scientific tests, they
are in fact destroying
that evidence that they have
where it is in the digital forensics
realm. We are making an exact copy
and then all of the investigation
that we're doing is with that copy
and we believe the original
evidence intact.
So therefore,
when making these copies, it is
important to consider the size
of the media, the image, the number
of devices and the access
to the media. So obviously,
if we're going to image
a five hundred gigabyte
hard drive, we need to
have at least a five hundred
gigabyte hard drive to image
our data to.
Also, keep in mind that we're going
to want to use some type of forensic
right blocker to protect
the evidence against alteration
during the imaging process,
and those right blockers can either
be software or hardware
based right blockers.
And then lastly, the integrity
of the images should be validated
through action and then matching
the hash values from the original
evidence to the forensic
image that we've created,
verified that those images are
identical.
And then when we image this
thumb drive that I have
during our hands
on portion, you'll see
that the image that is created
on our forensic media
is going to be an exact duplicate
of the information that was
contained on that thumb drive.
And the way we were able to
ascertain that is that the
modified hashes
do, in fact, match.
The first thing, however, that we
want to do when
we
start to collect the
data is to ensure that
we have forensically wiped media.
Now, this should be conducted
during our preservation phase,
but we'll go ahead and cover it
again here.
So wiping
the media ensures every
bit of data on that device
that we have is
is wiped with a predetermined
are a known value.
I generally use
zeroes and the
the in case imager will
let you change whatever hexadecimal
value you would like to write
that device
and then you can check it using some
type of hex adequate to see
that that data is and has in fact
been wiped.
And then Weiping will allow the
investigator to sanitize
the media to ensure that no data
is left on the device.
Keep in mind, though, it is not
deleting to them.
Deleting the data essentially
still leaves.
The data on the device just says
that that space is open to be
written to wipe in
the media. It eliminates any
possibility of cross contamination
because it overrides every bit
of that device with
your predetermined.
But also keep in mind
the formatting. Your device does not
delete the data, but there
are no links to these files
logically.
So conducting that forensic
wipe is going to be of great
importance, especially if you're
going to go to court, because
an attorney could ask,
well, how do you know my client
didn't have this bad image
on his computer
because it could have been
on your media
when you collected the data from
my client's computer system.
And of course, your retort to that
would be no, there's no way
that it was going to be on my
forensically white media because I
use this process where
I take my media and I
wipe it with zeros
using the incase
forensic imager, and that ensures
that there are no data left on
my forensic media.
So, again, if you're going to
go to court and this process is
going to be very important, however,
even if you're not going to court
having a clean piece of media
and then inserting that into
your forensic, you
or your forensic analysts program
just helps to ensure
the integrity of that data
and that you're not cross
contaminating it.
So we'll talk about a logical first
and say physical and psychological,
what completely eliminates
files or logical volumes
and may
be able to override all the sectors
that are considered unallocated
space. However, it does not want
partition space, such as partition
tables are volume records,
a physical wipe
of the system, which is
what we generally try to do
every single time, overwrites
the entire physical disk.
All right.
All petition's, all Valliant files
and space bottom
line. Everything's gone.
Once Weiping is complete, verify
the white by using a disk.
Ed, Ed and
I will show you again during the
handling portion how to
do that and how to
look through that device and ensure
that it hasn't been wiped with
zeros.
After you have that forensically
clean media, that type the media,
the next process is to
actually conduct the acquisition
of that.
So acquisition
of media will include any type of
store electronic storage device
capable of retaining debt,
so that can include hard drives,
takes optical media, thumb drives,
external hard drives, servers, etc..
If they can hold data,
then you should be able to
figure out how to
acquire the data from
that media.
However, before removing or
interacting with any part,
media investigators should
photograph and document the location
that the media's discovered in
and indicate the type of media
that you have discovered in your
nose. So like we talked about,
the very pedantic, the very specific
way of recording, I have found
a two gigabyte Gray
SanDisk cruiser, titanium
thumb drive with serial number
ABC one, two, three.
And then I have taken a picture of
it and it is included in the minus.
And then keep in mind that the media
should not be altered in any way
and ensure that the media
is not altered by using that right
blocking device when
you go to acquire
the data from it.
So speaking of right blockers,
a blocker is
a piece of software or hardware
that prevents data from being
written to your
discovered storage media.
So many forensic software providers
also make your right blocker
to copy their product.
So I know
there's one the tablet right
blockers.
They are a good
hardware blocker that sits in
line with any type
of discovered media and you're
frantically clicking media.
There are about four or five hundred
dollars on on up, depending on
which model you select for
the purposes of this
this course.
And for our discussion, we're going
to be using a free software
blocker that you can get from
SourceForge, which is going to be
the USB right blocker for
all windows, and you can go
to the source link
to download the
right blocker.
Also, keep in mind that
you want to have a set of trusted
tools as you're going
about doing your
forensic investigation
and some of the tools
that we've talked about are going to
talk about are going to be
your imaging programs such
as the BTK imager
or the in case in the drawer.
We'll also discuss a little
bit of Mandeans red line.
However, it's also important to
have essentially some command
line tools that you can run
on a system.
When you do find a system,
you may or may not know
what has happened to
that system,
depending on
who touched the system and
what type of investigation that
you're doing.
That being said, you'll want to have
certain command functions
on your trust into a list such as
your command prompt and
some of the commands such as
lisps logged on IP
config, your net stats
info, you'll want to have all of
those potential commands
load on to your trusted
tool kit payload
mine onto a removable
portable USB device.
And that way, when you find
your victim's system, you can run
all of your
commands from your device
and not have to rely on
the commands
from the machine.
So those are just a small list
of some of the trusted tools
that you're going to want to create
and have available when we
get into the Hands-On portion, I
will show you a larger
list of trusted tools that I
have on my
my thumb drive.
And you can download some
tools that you think that you're
going to need or want
in more forensic investigations.