>> Moving on from our trusted tools
after we have our toolkit gathered up,
we can use other programs
essentially to capture volatile memory.
The trusted toolkit will help us gather
information about that system,
that command prompt level.
But if we want to automate this process or capture
the entire volatile memory,
we can use FTK imager,
we can use a DumpIT, or we can use Mandiant Redline.
With any of those programs that will
essentially grab all of that volatile memory,
all of that ramp, and then put that out to
a file system where you can analyze that.
We'll go over that in-depth
in the handling portion as well.
Remember though the best practice in capturing
this volatile memory is to use removable media with
installed software to avoid adding
files to the system that can overwrite data.
Then the Disk Encryption process after you've
collected the volatile data,
if you believe that the system
>> may have BitLocker on it,
>> which if your system is
>> running Microsoft Windows Vista or later editions,
>> then it is highly likely that at least
has the ability to have BitLocker on it.
If you're not familiar with
what type of operating system that you've discovered,
you can open up a command prompt from
your trusted toolkit and type in Winver,
and that will give you the operating system.
If you believe that the system does have BitLocker,
you can type in the following command
of the manage-bde.exe -status.
That will show you BitLocker isn't able on the system.
If BitLocker is enabled,
you can type in the preceding command of the
manage-bde.exe -protectors -get.
That will provide you the recovery password.
Then once you get that recovery password,
you're going to want to save that to
some type of Notepad document onto
your forensically wiped thumb drive or hard drive.
That way you will have those encryption keys.
You can go ahead and get
that physical image of
the device and that you'll be able
to get into it and it will be useful.
The next step is going to be creating
the physical image of your system's hard drive.
There are both software and hardware
imaging tools and imaging allows investigator,
again, to work with that exact copy of
the evidence without altering the original.
Any type of media that you find seeing via
a thumb drive or a computer system,
you can and should get a forensic image of those.
Then in our hands-on portion,
we will demonstrate how to collect
the physical image of the USB thumb drive.
Then guided software produces
some very high-quality hardware imaging devices where
you do not need
an operating system or a computer to collect an image,
you can simply attach whatever device
you have and hit a button and it will
send a bit for bit copy of the data on that system to
your forensically wiped storage media.
FTK Imager is also
a great software imager and it can be downloaded
free from the access data website.
We're going to cover both the FTK Imager and
the Encase forensic imager in the hands-on portion.
Moving on from the imaging,
we can then go to look at some of
the analysis of the data.
There are several programs that can assist you and
the investigator in analyzing volatile memory.
Some of the most popular programs
for analyzing that data include
the program of volatility
>> and then the Mandiant Redline.
>> The cool thing about red line is that it is actually
an acquisition program and analysis program and one.
We'll cover the Redline program a little bit in
our hands-on portion and explore some of
the functionality of Redline.
However, after we captured
our data and we have it on our forensic device,
the next thing to do is analyze the data.
Once you have the data, what do you do with it?
Investigators need to examine the data for evidence or
indicators of activity that
they believe may have happened.
Depending on your case,
you're going to want to start
searching through various portions of
your data to help
determine or rule out that activity occurred.
However, before beginning to do this search,
you're going to want to have an idea
>> of what you're looking for
>> and where it may be stored within that data.
>> Again, if you're imaging a two-terabyte hard drive
or you have numerous hard drives,
searching through those images
could be time-consuming and cumbersome.
Having an idea of what to look for and
where to look for is very important.
Also, there are numerous forensic analysis programs
that can help you to examine some of that data.
FTK, Encase, OSForensics, Autopsy.
Those are some good programs that you can use.
There are others out there.
You could just Google them.
Again, don't get married to just
using one type of analysis program.
It's good to know several of these,
just because the user interfaces of them are different.
Some of them provide different outputs
and make the data easier to digest.
Keep at least two of these in your toolkit for use.
For what we're going to talk about
in the hands-on portion,
we're going to use Autopsy.
An Autopsy is a powerful free tool
>> for forensic investigators.
>> Then we'll go into a little bit of how to
use autopsy in that hands-on portion.
Then lastly, after we have
conducted the analysis portion week,
we're going to get into the reporting portion.
The reporting portion,
there is essentially going to be two types of reports.
It's going to be your technical report,
which details every [inaudible] that you
have in a very high level text
speak that other forensic investigators
and technically savvy people are
going to be able to understand.
The other type of report that you're going to have
is going to be your investigative report.
That's going to be something that
a non-technical person can understand.
A very cursory repetition of the who,
what, when, where, why, and how.
With each of those reports though,
you should begin with a brief executive summary.
Bottom line upfront.
This is what happened. This is what I found.
>> Everything in your report should be
>> listed in a series and/or a timeline
>> in some type of logical order.
>> If you're investigating, for instance,
malicious insider threat,
Mr. Smith budge in at the building at 7:05.
I was able to determine Mr. Smith
log into his system at this time.
Mr. Smith conducted this activity at this time.
He then did this at this time.
He budged out of the building at this time.
All of that timeline helps to, one,
make it easy for the reader to understand but it
also helps to tie your suspect or
your event to that particular computer
that you have been investigating.
That timeline, again, it's very important.
Then your technical reports should include
all the software and
the versions found on the victim machine.
It should also include all the
>> software and systems that
>> were used by the investigator
>> during your investigation.
>> If you use Microsoft Word to take notes
or if use Encase to
do your investigation and they
use FTK Imager to take an image of something,
all of those things should
be listed in that technical report.
Then lastly, in that report,
you want to stick with the facts.
A repetition of Joe Friday,
just the facts, ma'am.
No conjectures in your investigative report.
Your job as a forensic investigator is to
essentially stick with those facts
and just the facts and then the lawyers,
the attorneys, the administrators,
they can come up with whatever
>> conjecture that they want.
>> This will conclude the more or less
the lecture portion of
forensics and support of incident response.
We covered a lot of material.
In this lecture,
we covered the preparation phase of how to
get ready to respond to that incident.
We talked about how to sanitize and wipe our media.
We've talked about what items should be
listed and included in our toolkit.
We talked about note-taking.
Then we talked about the preservation phase
of the investigation,
how to identify essentially destructive activity,
how to stop disrupting activity.
Then from there, we talked about
>> essentially starting to
>> collect some data going through
>> and identifying on-screen data.
>> Finding, collecting that [inaudible] information,
gathering the BitLocker encryption keys,
and then gathering forensically
imaging some of the devices that we found,
thumb drives, taking an image of the hard drive system.
Then we talked about some of the analyses and
the ways and programs that we can
use to do our forensic analysis.
Then lastly, we talked about reporting.
Know that's a lot of information,
especially some of this is very technical
>> and you're going to want to see this hands-on.
>> As we discuss,
look at the next video and we'll go into some of
these forensic techniques and
show you how some of these are done.
Again, it'll be a very cursory, very short video,
>> it won't be completely in-depth of how to
>> do 100 percent forensic investigation,
but it will help explain some of
the topics that we discussed in today's lecture.
Thank you. I hope you enjoyed the video.
Come back to Cybrary again for more exciting classes.