>> Hey, welcome back to the course.
In the last video, we talked
about the information we're
going to actually cover in the course.
We went over the course modules and
different aspects and those we're going to cover.
We also talked about my background as your instructor.
My name is Ken Underhill again, in case you forgot.
Then also we talked about the course structure.
We talked about some of the sections are going to
have pre and post-assessment questions
to test your knowledge.
We're also going to have
different labs throughout the course,
as well as a lot of free resources for you to download.
I'm sharing the notes I used to study for
the EC Council Computer
Hacking Forensic Investigator Examination,
as well as sharing step-by-step guides for the labs,
and also sharing the PowerPoint presentations.
In this video, we're going to cover module 1 stuff.
We're going to cover a brief history
of digital forensics,
some pertinent information in that at least.
We'll talk about
some different challenges for the investigators
as well as the investigative process itself.
As I mentioned, there are different pre-assessment,
post-assessment questions throughout the course.
Here's one right off the bat for you.
What does SWGDE stand for?
If you guessed answer A, you are correct.
It stands for Scientific Working Group
on Digital Evidence.
Don't worry about what that is right now.
We're going to cover that a
little later on in this module.
Computer forensics, and you also
hear it called digital forensics.
The main difference here being
computer forensics is going to
cover just computer components.
My hard drive, my CD ROM,
my CD itself, that stuff, my RAM.
Whereas digital evidence might include things like
your smartphone or your camera
if you have a digital camera, that stuff.
Just keep that in mind. Now for the examination itself,
you're not going to need to know
those different like that.
EC Council actually uses the
>> terminology interchangeably.
>> But in the real world,
just know the difference there between them.
Again, most people use them interchangeably.
What is computer forensics or digital forensics?
Basically, it's a set
of procedures and techniques that are going to help
us as an investigator identify
what evidence we actually want to
collect or that we can legally collect.
For example, what does our warranty cover?
Then from there, we're going to
actually gather the evidence.
We're going to collect it, and
then we're going to preserve it.
We're going to make a duplicate of it with a bit-by-bit
when we do the bit-by-bit copy
to prevent alteration of it.
All that stuff is intertwined.
Then from there, we're going to analyze it.
We're going to interpret the information we have,
see what it means to us,
and then we'll spit that out in
some report or other documentation.
From there, we would take it to
the prosecutor if it's a criminal case.
If it's a civil case, we might give
it to our attorney or something.
Or an administrative case,
we'll just hand it to HR or something like that.
[NOISE] A brief history here,
the couple of items that you
really need to know off this list
are going to be the Locard's exchange principle.
Basically, what that means is that,
I'm not sure what that is,
if I go into a crime scene,
I leave a part of me somehow,
I leave something there,
and then also I take something with me.
That's the Locard's exchange principle in a nutshell.
If I'm at a scene,
I leave something, and I take something.
The other notable thing here in 1986,
the Computer Fraud and Abuse Act was passed.
We'll talk about that a little later on in this module.
Different types of computer crimes
that you might see out there.
They're the most common ones,
phishing, malware, and ransomware go alongside that.
Identity theft, financial fraud, cyberterrorism.
If you're not familiar with that, basically,
let's pretend I'm a terrorist.
I'm going to use a computer or computer systems
to further my propaganda and try to intimidate you,
not necessarily you, but a group of people.
It could be religious-based or whatnot.
Cyberextortion, that's where you hear
about some criminal hacker hacks somebody's webcam.
Then took a bunch of nude photos of them
and then send them an email and said, hey,
I'm going to release to
your kids' school unless you do what I say.
That's basically the extortion aspect of it.
Cyberwarfare, that's self-explanatory.
Basically, nation-states trying to hack each
other and do nefarious things.
Cyberbullying, that's a more popular topic these days.
There's been several kids
that have committed suicide on it.
If you know someone getting bullied,
definitely reach out and help them out.
Get them the help they need.
But essentially, it's like back in
the schoolyard where the bully would come up to you,
push you down, and whatever.
Some of us would punch the bully in the face,
other people will just take the push down and
give the bully their lunch money.
Similar thing here. It's just somebody
using a computer and using social media.
It's the main avenue there for the cyberbullying.
Then, of course, narcotic trafficking.
Who could forget about that? That's a popular thing,
especially on the underground.
People are buying and selling narcotics all the time.
Many challenges for investigators.
The most prevalent one would be
encryption along with steganography.
Again, this is just hiding something
>> inside of something
>> else as well as anti-forensic.
That includes things like encryption and data
wiping and steganography inside
of that. Different legal challenges.
For example, we're here in the US,
and we track somebody down,
and they're actually in a country
with no extradition treaty or a country
that doesn't really have
a law enforcement infrastructure in place,
or they're corrupt or something.
We have to consider that like is it even worth
us trying to get an indictment or something?
Different types of media formats we might encounter.
For example, let's say some investigator,
and I'm not good with Mac, but the stuff is on a Mac.
That's a challenge.
I have to find somebody that's good with Mac.
The volume of data. For example,
if we're recovering from a raid or something,
[NOISE] the volume of data might be too much for us
to acquire in moving
into the next thing there, the time frame.
If we got the prosecutor
saying I need this stuff by next week,
we might not have enough time
>> to recover the information
>> as well as analyze it and get findings on it.
We might have to just choose some
of the most common areas that
people hide stuff when they do stuff.
That way, we can see if there's information in there.
The investigative process. Basically,
we're assessing what evidence do we need.
Then we're going to acquire that evidence, preserve it,
makes sure we make a copy of it,
and then analyze a copy of it.
Based of our findings,
we'll actually go ahead and generate some report.
In this video, we'll cover the history
of forensics in a nutshell there,
as well as different types of computer crimes.
In the next video, we're going to talk about
the difference between criminal,
civil, and administrative investigations.
>>