>> Hi. Welcome back to the course.
In the last video, we wrapped up
>> our Module 1 discussion.
>> We talked about the federal rules of evidence,
we talked about different laws and standards
that are pertinent to a forensic investigators,
as well as the Fourth Amendment.
In this video, we're going to start off our lab.
We're going to have three parts
>> to this lab in Module 1.
>> Basically, we are going to be analyzing photos,
so part 1 is going to just be
installing the tools that we need for the lab,
part 2 will be actually modifying
one of the photos that we retrieve,
and then part 3 is going to
be us actually looking at the photos.
Now, keep in mind that since
we're the ones setting up the lab,
we're obviously going to know the answers
when we go into part 3.
However, this is a good lab to
walk through once you get a setup,
to actually show a couple of
photos to your friends or family,
and have them try to figure
out what the differences are,
and impress them a little bit.
I want to give you a quick lab
that you can run pretty much from
anywhere on Microsoft Windows or
any operating system that you're using
to impress, again, your friends and family.
For this lab, I'm going to be using
a Windows 10 virtual machine.
I recommend you do use a virtual machine.
However, if you try to do this inside
of the Cyber Lab environment,
you might have some trouble because there are
limitations on opening photos.
You may want to open this in your own virtual lab,
or if you are running Microsoft Windows,
you can download these tools
and run them in there as well.
Again, virtual machine is a recommended route.
If you're running like Mac or Linux,
then just find a Hash calculator and then find also
a Hex editor tool that will
be relevant to your operating system.
That's all you actually need for this lab,
aside from just doing a quick Google search
on images and finding an image that you want to use.
Again, the tools for the lab,
we're running it inside a Microsoft Windows,
so we're going to use HashCalc and HxD editor.
But if you're using a different operating system,
just go ahead and find a relevant tool
that will work with your particular operating system.
We're not going to cover the other operating systems
in this particular lab.
Here in part 1 again,
we're just going to install the tool.
I've got my virtual machine launched here,
and then we're just going to open a web browser,
so whatever you choose to use,
just go ahead and open a web browser and
then search for HashCalc.
That's the first tool we want to get.
I'm going to go ahead and do that now,
I have Google pulled up here,
so I'm just going to type in HashCalc.
Just like that and press Enter.
You'll see here I already went to
the website, so it pulls up for me.
But it's going to be this slavasoft.com/HashCalc.
If we go back to our lab document,
you'll see that I have the link for you there.
You could also just click that link
and launch the website.
The next thing we want to do once we open
up the website is go to the downloads page,
it's going to be at the top.
Then we're going to look for the section that says
free software downloads here in Step 6.
Let's go ahead and do that now.
Just launch the website.
Might take a moment or so to pull up.
Once it does click downloads,
just near the top in the center,
and then here we're going to look for
the free software downloads,
so that second set of options down the page.
Once we find that,
we're going to select this Download button
that's to the right of the HashCalc.
Right now it's showing us the latest version is
2.02, if that updates,
then we of course would click
the most updated version.
>> Let's go ahead and do that now.
>> If we click on download,
it's going to download the zip file for us.
We'll go ahead,
it might take a moment or so.
Let's go back to our lab document.
Here in Step 7, we click the download link,
as I mentioned is going to download the zip file for
HashCalc in Step 8.
Then once it downloads it completely,
we're going to click the little arrow,
depending on your browser, I'm using Google Chrome.
I'm going to click the little arrow and then
select the show in folder option.
You'll see that mine has downloaded.
I'm going to click this little arrow
here and then just show it in folder.
Let's go back to our lab document.
Next step here, Step 10,
we're going to right-click on
that file and then extract the file.
Let's go ahead and do that now.
Just right-click wherever you downloaded it to.
It should be in, most cases,
your downloads folder,
unless you have a different configuration
on your machine,
and then just right-click on that file
and then just say extract files.
It may take a moment or so and it should pull up
and asked me where I want to go with it.
You see here by default, it
takes me to my Downloads folder.
I'm just going to say okay to that
because that's where I want it to go.
Once it finally extracts,
which might take a moment or so here,
in Step 11 we should see the folder there,
and then Step 12,
just double-click on the folder to open it up.
Again, that's the extracted folder.
Once we open it here in Step 13,
we will see a setup.exe file.
Let's go ahead and do that now.
We see the HashCalc folder here.
Then right there is a setup.exe file I mentioned,
I'm just going to go ahead and double-click on that.
Let's go back to our lab document.
Now we are probably going to get
a user account control pop-up
if you use a Microsoft Windows.
If you get that prompt,
just select yes to that and then
it's going to launch the wizard for us.
Let's go ahead and do that now.
You'll see here, it launches it.
It's given us this mostly
because it doesn't recognize who
the publisher is because there's
no security certificate,
so we're just going to say yes to that.
We assume that they're not hacking us.
You'll see here it launches a wizard for us.
In the wizard, you basically just going
to next all the way through.
You're also going to accept the license agreement,
then finally, you'll get to a button that says install
>> and you'll go ahead and install the tool.
>> Just could say next there,
then accept the license agreement,
and then whatever your defaults are,
just leave them alone and say next,
next all the way through.
We want it to create a desktop icon
and so it does it by default.
We're just going to leave that alone and say next.
Then you'll see here we have the installation option.
You'll see here if you
look on the left side of my screen,
I'm already had it installed,
but we can go ahead and install it again.
Now, I already have HxD as well,
the next tool that we're going to install.
You'll see when we go to install that one,
I'll get a little pop-up message.
But you'll be able to just go
through it and install it on your machine.
Let's go back to our lab document here with
the HashCalc wizard, and let's see where we are.
We just did Step 18,
we left all the default settings,
we accepted that license agreement,
and then we clicked install.
Our next step here in Step 19 is just
unchecking the read me file,
as well as launching the HashCalc checkboxes.
We're going to uncheck both these boxes,
and then just say finish,
>> mostly because we don't want
>> to launch the tool quite yet.
>> Let's go back to our lab document.
>> Now we're going to go to our
web browser and we're going to search
for HxD Hex Editor.
Let's go ahead and do that now.
Just go ahead and close out that downloads page,
just go back to Google search page or
whatever search engine you want to use.
Then just search for HxD Hex Editor
and then press "Enter" on your keyboard there.
You'll see here, it should be
like the first or second option.
You'll see it's going to be
>> this mh-nexus.de/en, etc.
>> Once we find that, just go ahead and
click on the page to open it,
might take a moment or so to pull up.
Let's go back to our lab document.
You could have also just went to
this URL if you wanted to,
that's the same one we're at right now.
But if you wanted to search for it like I did,
you can certainly do so.
Our next step here is Step 22.
Once we pull up the website,
we want to scroll down the page until we come to
the latest version released for Windows
or whatever your operating system is if
this tool works for that
or if you're using a different tool,
you'll have to follow the steps for
that tool and not these ones.
At the timing of this video,
and I think it's still the 2.1 version
>> but we'll see here in a second,
>> once we select that latest version,
we're just going to select the download page link.
That's going to take us to where we
>> can actually download the tool.
>> Let's go ahead and do that now.
>> We're just going to scroll down the page
until we see the latest version.
You'll see here it is the 2.1.
Click on this download page,
little blue link here.
It's going to take us to the download page.
Let's go back to our lab document.
Now we want to click on Step 24 and we
want to select the Download per HTTPS,
the link for English there,
unless you want to use a different language,
that's fine, but we're going to do the one for English.
You'll see it's this one right here.
We just select this blue link on the right side here
that says Download per HTTPS.
Now, you're also going to notice that they give us
the hash of this download file so
we can check that if we wanted
to and just make sure that hash is correct.
Let's just click on the Download per HTTPS link.
You'll see it's going to start downloading
the zip file for us.
Let's go back to our lab document.
You'll see here in Step 25,
the zip file is downloading for us.
Then in Step 26,
we're going to, on the desktop,
double-click the HashCalc to open up the applications.
Basically, we're going to hash
the zip file that we're downloading, the HxD one.
Then basically just compare that
to what the website is showing us,
just so we can take a quick
look and see what that looks like.
You'll see that the zip file is downloaded.
We're going to leave that alone for right now.
On your desktop, you should have
>> that HashCalc shortcut.
>> Go ahead and double-click on that.
It's going to open it up for us.
The next thing we're going to do is,
we're going to click the three
little dots here in Step 28,
at the top right of the HashCalc tool screen.
That way, we can search for the file,
which is going to be that zip file we just downloaded
for the HxD Hex Editor. Let's go ahead and do that now.
Just go ahead and click
these three little dots near the top right.
You'll see here it gives us some different options.
We're going to navigate to the Downloads folder.
At least that's where I have mine at.
I'll navigate to the Downloads folder
and then I can go ahead and actually find my file.
Just navigate to wherever you downloaded the HxD file.
We're just going to click on that
zip file and just say open.
Then just click the calculate button at the bottom.
You'll see it generates a hash for us.
If we just glance here at the hash,
the first part of it, you'll see here that
that matches with our hash right here.
It looks like this is a legitimate file.
Let's go back to our lab document here.
We see here that, yes,
the hashes do match.
We just compared them and, yes, they appear to match.
Then we can move on to our next step in the lab.
Now we're just going to close the HashCalc application.
Just go ahead and just X out of that.
Let's go back to our lab document.
Now, we just want to open
the Downloads folder where we have the HxD setup file.
What we're going to do is right-click
and extract the files.
I'm going to extract them to the desktop screen.
You can extract them anywhere you want to,
but I'm going to extract them to the desktop.
Let's go ahead and do that now. I just
want to navigate to the Downloads folder.
I'm just going to double-click on one of
my folders I have open here,
click on "Downloads",
and then I find my HxDSetup.zip.
I'm going to right-click,
I'm going to extract the files,
and then I'm going to navigate
to a different location here.
I actually want to throw these on the desktop.
I'm just going to click there on
my desktop and just say, "Okay".
Now, your process might be slightly different if you
don't have WinRAR installed,
if you're just using that right-click
and extract of Windows.
However, you can still extract it anywhere you want to.
You'll see that now I have
the HxD setup executable on my desktop there.
Let's go ahead and back to our lab document.
We've gone ahead and extracted the files.
The next thing we want to do, we want to
>> go ahead and double-click on
>> that executable to launch the installer.
>> If we get the user account control pop-up,
which we should, we're just going to say "Yes" to that.
We're going to choose English for the
language and then just say, "Okay".
Then basically at that point,
it's just a next, next all the way through,
to accept the license agreement as well,
and then just next, next, next all the way through.
Then the only other thing,
the only change we do is,
we select desktop shortcut to
add a desktop shortcut for it,
and then we'll just click the installation buttons.
A lot of steps there,
but basically just remember
>> in your head that next, next,
>> next, all the way through until
you get to the end and then install it.
We're going to double-click on that file now.
Double-click on the HxDSetup.exe.
Might take a moment or so to launch for us.
Again, what you're going to see here is
a user account control pop-up from Windows.
We're just going to say "Yes" to that and it's going
to launch the actual installer for us.
You'll see here it gives us a prompt
>> and that's where we say "Okay" to the English,
>> we want to keep that.
>> Then here, we just have our next options.
We just next all the way through,
we accept the license agreement.
Next, next, next, next,
and then here's where we want to
select the "Create a Desktop Shortcut".
We're going to say next one more time and then install.
Now, I should get an error message
since I've already got it installed,
but yours will actually go
ahead and install the tool at that time.
Apparently, I don't, it's going to let me
install it twice which is rare,
but I will take it if it works.
Let's go back to our lab document here.
Our very last step in this part of
the lab is just unchecking the two boxes there,
so to launch it and then also to
launch the readme.text file.
We're just going to go ahead and uncheck those boxes,
and then just say "Finish" here.
That wraps up part 1 of our lab.
Again, in part 2, we're going to go ahead
>> and get our photo setup to move on
>> to the then part 3 of the lab.