>> Hello and welcome to Cybrary.
My name is Max Alexander and I'll be
your subject matter expert for
incident response in advanced digital forensics.
Today, we're going to pick up where we left
off in the last set of videos and cover
the hands-on portion of
forensics and supportive incident response.
If you watch the last set of videos,
we talked a lot about
the preparation and process that are
involved in doing
the forensics portion of incident response.
If you remember from the last set of videos,
we talked about the preparation phase,
the preservation phase, the collection phase,
and then the reporting and analysis of that data.
The first thing that we're going to do,
we're going to start off with
the preparation of all the types of devices,
hardware, and media that we're going to
need for our forensic response.
In preparation for all this,
we're going to want to gather up all of the software,
all of the hardware,
and all of the necessary equipment that we're going
to use in our forensic investigation.
As far as software and hardware are concerned,
some of the things that I'm going to show
here on how to use and that
we're going to use in this demonstration are going to
be the AccessData Forensic Imager,
the EnCase Forensic Imager,
and the USB Write Blocker ALL Windows version 1.3.
Of course, there are other types of software out there.
There are also hardware types of write blocker.
You can use whichever is familiar with you.
But these are some of the programs that we're going to
use today to do this demonstration.
In order to get these programs,
you can just open up a window and you can
navigate to the AccessData web page.
From there, you can click on
the digital forensics link and then from
there it will take you to
the current releases of your digital forensic software.
As you can see, they've made quite a bit.
Some of the software is free and
some software requires a paid subscription to use.
We are going to use the FTK Imager,
so you can click on that.
It's going to give you three options.
You can click on any of these options,
they'll all work fine.
There are no issues with that.
I am using the FTK version 3.4.2
>> for this demonstration.
>> However, you can also
download the FTK Imager Lite version.
All these programs can be put on your forensic machine.
They can also be put onto a thumb drive
>> and used on a victim machine.
>> But to download this,
you'll just go to the download page.
It will give you a link to download this now
>> and you can install that onto your forensic machine.
>> The EnCase Imager is the same process.
You can just navigate to
the guidance software website,
guidancesoftware.com/EnCase-forensic-imager.
Then you can fill out
your contact information and click "Submit".
You will be able to download
the EnCase Forensic Imager onto your forensic machine.
You can also again download that to
a thumb drive or use on your victim machine.
Also, we're going to have the USB
Write Blocker ALL Windows version 1.3.
To get there, you can go to
the sourceforge website just by
typing in the USB
Write Blocker ALL Windows in the Google search.
That will take you to the sourceforge.net download page
>> and you can download that from here.
>> It will download and then you can
install that onto your desktop.
Those are the three pieces of
software that you're going to use.
But again, also the software portion
is just one part of the preparation phase.
You're going to want to prepare your camera.
You're going to want to prepare any type of
note-taking equipment that you're going to need,
pens, pencils, paper, evidence tags,
markers, a backup to your camera, and
preparation of any media that you might
use in that acquisition process.
By media, I'm talking about the SD card in
the camera and/or your portable hard drives or
thumb drives that you're going to use to start
imaging some of these victim machines
that you're going to come across.
That's what we're going to start with now,
is the wiping and sanitization of our forensic media.
The first part of the process
>> is you're going to actually
>> insert your thumb drive into your forensic machine.
>> Once you do that,
>> you should see the drive letter pop up,
mine popped up in this drive letter E,
yours might pop up as something different.
We can just close out of that window.
We're going to navigate to our EnCase Forensic Imager.
Double-click that.
You get these pop-up windows.
Just click "Yes", I just reinstalled windows
on my machine so I get these pop-ups.
I also have password set up so you may or may
not have password on your system.
If you do, just click "Yes" to navigate through that.
You'll eventually get to the EnCase Imager main page.
From here, we're going to click "Tools".
We're going to go to Wipe Drive and then select "Next".
Then from there, we're going to see
that our drive letter E popped up.
We have the logical portion
and then the physical disk itself.
We are going to wipe
the physical disk and we're going to select "1".
Then we will go and click on the "Next" key.
From here, it's going to ask you if you want
to verify wipe sectors,
leave that check as yes,
>> and then it's going to ask you what type of
>> characters you want to
overwrite all of the data on your [inaudible] .
I just leave that as the default zeros.
From here, we'll click "Finish".
It's going to ask you if you
want to destroy all information on
your device and that's going to force you,
>> you can type, yes. Type Yes.
>> Click "Okay". Then you will see a notification
down the very bottom right-hand corner
of the EnCase Imager that says it is wiping.
Eventually, that will change to a
>> countdown timer telling
>> you how long left
EnCase is going to be in wiping your device.
As you can see, I have one hour and
58 minutes left in wiping my device and this
is one of the reasons why you want to have all of
your forensic media prepared beforehand
because you don't have time to wait around
for an hour and 58 minutes when
you're trying to do your forensic investigation and
time is very much important to you.
I will save you all the trouble of waiting
here with me for an hour and 59 minutes,
two hours, for this thumb drive to be wiped.
We can click on the "Wipe",
>> it'll ask if we want to cancel.
>> For this demonstration, we're going to click "Yes".
However in the field, you would not want to do that.
You would want for it to be wiped completely.
After that is finished wiping,
it will just go back to a blank bar.
>> Down at the bottom.
>> It won't really give you a notification
that the wipe is complete.
The notification will be that there is no
more wiping being conducted.
Any of that, we're going to cancel the process.
To save some time, we'll click "Yes".
However, from here,
after you get this blank screen
when your device is done wiping,
if you want to actually see what it did,
you can go to the console view by clicking
the application button underneath
>> the EnCase Imager name.
>> Then go to View and then scroll down to Console.
Then from here, you can see that
the EnCase Imager was working.
We canceled the process.
This is our start date and time
and our stop date and time.
This is the elapsed time that ran.
It was working on one device
>> and then the total sectors.
>> This will tell you the read,
write, and verify errors.
If you let this run all the way through completion,
it will tell you exactly what
it did and if there were any errors.
You can also take this and copy it.
If you're doing electronic notes,
paste that right over into your notes.
That way you can see exactly when
you start it and stop this process.
Or hopefully, you've already had this pre-done and
you can verify that the device is wiped,
which we'll go over a little bit later.
But before we can verify the device,
we actually have to format it first.
That is the next part of the process.
We will go back to
our device and it's
going to tell us we need to
format it before we can use it.
We're going to click "Format Disk".
We see that it has a capacity of 5.8 gigabytes.
It will give us an option for
the file system, exFAT or NTFS,
select exFAT or FAT if possible,
that way you can use your device across
most operating systems and
not limit yourself to specific operating systems.
You can leave the default allocation size.
If you want to label your volume, you can label it.