>> Hey. Welcome back to the course.
In the last video, we went ahead and installed
our two tools that we're going to use for the lab.
We installed the HxD hex editor,
as well as the hash calculator.
In this video, we're going to go ahead and actually
>> pick some photos and then get those setup for the lab.
>> Then in part three, we're going to go
ahead and actually just analyze the photos.
This part is going to be a little
shorter just because I already
have a couple of photos that I'm going to use,
but I'll show you what we're going to do in the lab.
Step number one here,
just make sure you're logged into
whatever Windows machine you're using,
or if you use a Mac or Linux with
some type of hex editor and a hash calculator,
then just follow along from that standpoint.
We just want to open a web browser.
Then from there, you're just going to
search for any photo that you want to use.
You could even just use a photo
on your desktop of family or friends,
or your pet or something like that.
You can also just Google search for any photos.
I'm actually going to skip step three.
I'm going to just move
on because I already have a couple of photos.
So I'm just gonna pull up the photos that I
have in the folder here.
I picked this cat photo here and then I've
already actually made a modification to this one here.
But I'll go ahead and make another modification to
the first one to walk everybody through the lab.
Let's go back to our lab document here.
Our next step here in step four,
once we find whatever photo that you want to use,
again, you don't have to pick the one that I'm using.
Step number four, we already going to
double click on our hex editor.
So that HxD editor. Let's go ahead and do that.
For me I've installed it, essentially twice,
so I have two shortcuts but
>> they all go to the same spot.
>> If we double click, it's going to open it up to
basically a gray box for us.
Once it opens for us here in step five,
we're going to select here on step six,
we're going to select File and then Open.
Then what that's going to do is give
us basically a box that
we can navigate to wherever the photo it lives at.
Whatever photo we chose,
wherever that one is stashed at.
Click "File" and then Open.
You'll see it's going to open that pop-up box for us.
For me it defaults me into
where actually I have the photo saved.
In most cases, if you just downloaded the photo,
it should take you to the downloads
folder where that photo lives.
For me, I'm just going to click on the photo
that I have not altered yet.
I'll click on the original one is what this one is.
Then I'll just say open there.
Just follow along with that step.
You'll see it's going to
>> open the hex of the actual file.
>> Let's go back to our lab document here.
Step number eight, guess we do the file in the editor.
For example, if we use a JPEG file, which this one is,
what we're going to see is that the hex here in step 9,
the hex starts off with FFD8FF,
which indicates a JPEG file.
So we click over there, you'll see
FFD8FF here at the very top.
That indicates to us that that's a JPEG file.
Very important if you decide to take
the Computer Hacking Forensic
Investigator exam through EC-Council
that you know your image files and basically
know the hex that each one starts with.
That's going to help you a lot on the examination.
Let's go back to our lab document here.
Now we're going to scroll to the very bottom of
the hex editor page,
and we're just going to click on the text area.
Once we do that, we're just going to type
some type of short word in there.
Nothing extravagant at all because
if you type a long thing in there,
it's going to actually change the size of the file.
Very important step for us when we want to
analyze these files in part three of the lab,
we want them to actually be the same size.
If we type some, 30-character long-phrase,
that's going to modify the file size and
we're not going to be able
>> to actually complete part three.
>> But if you just type something like
the word password or like
your first name or something like that,
feel free to type whatever you want,
but just try to make it some type
of short word or phrase.
Let's go ahead and do that now.
Here we're just going to scroll to the very bottom.
On the right side, we want to see
the ending of all these random characters here.
You'll see we have it right there at the very end.
Just go ahead and click after
this very last character here.
Just go ahead and click your mouse here
and then just start typing in there.
I'm just going to start typing the word password.
Just type that in. Now you may get a prompt,
asking you, I forget exactly
what it asks you but there
is an option to make that go away.
Basically, each time you type a character
in, it gives you a prompt.
I believe it says something along the lines of,
"Hey, just so you know, you're modifying data.
Or this might change the hex values
or it might change the file size."
There's some type of error message prompt
that gives you, again,
I forget what it is because I have
it blocked on my particular virtual machine.
But there should also be a checkbox there that says,
"Hey, I don't want to see this message
again," in some capacity.
Then just check that box and you should be good to
go for typing everything else in there.
Let's go back to our lab document.
Yes, we typed a short word.
You saw I just typed the word password in there.
I actually didn't follow my instructions.
I didn't type the word test.
I did the word password
because I wanted to change it up a little bit.
Here's step 12. We're just
going to basically File and Save
As file and then just name it.
I'm going to name mine as you'll see,
I'll just name it like cat3.jpeg to keep consistency.
Once you've typed in whatever you want to
just go to File and Save As.
Then again, in my situation,
I'm just going to change that one to a three just so
I know which one I'm choosing.
You can name the file whatever you want to.
You don't have to name it the
same thing as the original one.
Just go ahead and click on "Save" now.
It's going to save that particular modification.
If we go back to our lab document here,
you'll see that, yes, we did save the file.
Now we're going to move on to part three
where we actually go ahead and analyze the file.
Again, here in part two of the lab,
we basically just opened
the file inside of our hex editor,
took a look at it, and then
we look at it and notice that,
at least in my example, it was a JPEG file.
I noticed that it was FFD8FF to start off the hex.
Then we also scroll to the bottom right
of the hex editor and added
some information whether that was our first name
or like the word password or it's a few characters,
whatever the case might be,
but our main goal there was we didn't want to
modify the actual file size.
In part three again of the lab,
we're going to go ahead in the next video
and actually analyze our files.