>> Hi, welcome back to the course.
In the last video, we went ahead and
set up our photos to use.
In this part of the lab,
we're going to actually analyze the two photos.
Now again, since we set them up,
we obviously know what we typed,
we know the differences between the two files.
However, again, this is a good lab to
do to show off to your family and friends.
Step number 1, if you're not already launched into
your Windows machine, make sure you log in.
Then we're going to open wherever you
saved the two files at.
More or basically you're going to do
is open both of the photos
and then we're going to open
our tools. Let's go ahead and do that now.
Mine I've got it saved in this folder here,
so go ahead and open both photographs.
Then we're basically just going
to compare them side-by-side.
You might have to do a little modification on
the sizing of each one.
You might have to close certain windows, etc.
Bear with me a second here while I get mine set up,
it might take a moment or so
especially if we're working inside of a virtual machine.
Then again, we're just going
to compare these side-by-side.
We're also going to use our two tools,
our hash calculator as well as our hex editor,
so the HxD Hex Editor.
Bear with me just another moment while I
modify our sizing here just so everybody can see it.
By the way, if you have a cat that can actually do this,
if you have a cat that can actually plunge
a toilet and clean toilets and stuff,
please feel free to send them over to my place
and I'll pay him to clean my bathroom.
That will be super cool
if we can actually train cats to do
stuff. The next step here.
If we go back to our lab document,
we're going to go ahead and actually open
our hash calculator application as
well as the hex editor,
so that HxD Hex Editor.
All we do is just double-click on each one.
Double-click on HashCalc just to open
that up and then same thing with HxD.
Just go ahead and double-click on that.
Again, we'll use those in just a moment here.
I just want to get those
opened and then we're going to actually
compare the files on our own here.
If you look at these two photos,
let's just look at them visually for a moment.
Let's just see, do we notice any differences at all?
Look at the photos that you have
if you're using different photos,
feel free to look at those and just look at differences.
Now obviously, we know they're
both the same photo and we
just used one and we've made
some changes to it in the Hex,
but just go ahead and look at them to
get to practice on it.
We see a cat here,
we see a cat here.
It looks like the cat is plunging the toilet.
I see that in both of them.
I see a bathroom floor.
I see that here. Something black here.
It could be a towel, could be like
a little rug that they put on the toilet.
I see that there. I see the wall back here.
I see the cats got two ears.
It's got an eye there, I see the eye.
Basically visually, these two files
look pretty much the same.
Let's go back to our lab documents.
Question number 1 here, are there
any visual differences in
those actual photos? The answer is no.
We knew that again from our setup of this lab,
but there are no visual differences that we can tell.
We're going to go ahead and close
our photos now and then we're
going to right-click on each one,
and then we're just going to check the file size.
Again, as I mentioned in the last video,
we want to make sure that we typed a shorter word or
a short or phrase in there so
we didn't alter the file size.
Because as you see here,
that's one of the areas that we do check.
I'm just going to go ahead and close these photos here.
I'm going to go back to my folder where I have them.
Just go ahead and right-click on each one
and see if you notice a difference in file size.
Just right-click on it,
go to Properties and
it might take a moment or so to pull up,
but it will eventually pull up and tell you the size,
which I see here is 85 kilobytes.
Once we see that, just go ahead and exit out of that one,
do the same thing here.
Just right-click on it, go to Properties,
and then 85 kilobytes we see right there.
So we know that, hey, they're both the same file size.
They look the same, they're both the same file size.
What else do we need to look at?
Well, let's go back to our lab document and find out.
Question number 2, are the files the same size?
Yes, they are. We noticed that
they were both the same size.
Next, we're going to check the hashes of the file.
We're going to do the hash and just like we did with
the downloadable file to see if it had been
altered at all when we took the hash,
we're doing the same thing here.
We're just going to check
the hash of the file and
see if there's a difference at all.
Let's go ahead and do that now.
Where are you going to go?
First for our hash calculator.
Let me just move this window out the way,
and then also this one as well and we have
our hash calculator that just
decided to close on me. There we go.
Let's go back to our lab document now.
The first thing we're going to do,
once we've got the hash calculator pulled up,
Step 7 here we're going to
click the three little dots that are
on the corner near the top right of the tool,
and then I'm going to select File.
Let's go ahead and do that now.
Click those three little dots.
It's going to open up for us the search box here,
and then we're just going to find our initial file there.
If we look at our lab document,
it's going to be that very first photo
that we saved from the Internet,
or if you're using a family photo, something like that.
I'm going to go ahead and pull mine up and
it doesn't look like it's pulling up
that folder for some reason.
Oh, well, that's why.
I'm looking in the downloads when
it's on the desktop. There we are.
Once we find out where it's at and we pull it up,
we're just going to open that very first one that
we did not type anything in,
that we did not alter and then just say Open there.
Let's go back to our lab document.
Now we're going to unselect
all the different hash options except for the MD5.
Again, we could do a lot of different hashes
inside of the hash calculator.
We're just going to choose the MD5 one.
Let's go ahead and select that and select only that one,
and then click Calculate
and then just basically make a notation of the hash.
We're just going to uncheck
these other couple of ones here.
Then make sure we just leave
the MD5 and then just say Calculate.
We see our long hash here.
Let's go back to our lab document.
Now what we're going to do, we're going to
select those three little dots
again and now we're going to select
the file that we actually did alter.
We want to check and see for Question 3,
here are the file hashes the same?
Let's go ahead and check that now.
Click those three little dots again,
now choose a file that you altered in this case mine is
cat3.jpeg. Just say Open there.
Same thing here, just go ahead and calculate the hash.
You're going to notice that the hash
is different here than it was in the other one.
The photos looked visually the same.
Then we check the file size, that was the same.
But we do a hash on it and they're different.
Well, I think we need to take a closer look
at those couple of photos.
Let's go ahead and do that now. We see that no,
the file hashes were not the same for those photos.
Again, we altered one of those.
We knew what the issue was.
Now we're going to switch over to the hex editor.
We're going to select File and Open
and then still we're going to look
at both photos and see if we notice anything wrong.
Let's go ahead and do that now.
We're going to switch back to our hex editor or HxD.
We're just going to select File and then Open.
Let's go back to our lab document here.
Once we select File and Open,
we're going to go back to our, again,
our original photo that we had saved and select
Open and we're going to
see if we notice any information in there.
Let me navigate to that spot,
will grab the photo.
Again, that original one,
we're just going to say Open to
that, might take a moment or so.
If you get this box on the right side of where it says
special editors, daily inspector.
Then just click that little extra
that'll close up box for you.
Let's scroll to the very bottom here and just take
a look at the last little bit of character strings there.
Do we notice anything readable?
And if yes, what is it?
The answer is no. This is basically our original file.
We didn't alter this in any way,
so it shouldn't be anything at the very end there.
Let's go ahead and
next thing we're going to do is actually open the
other file inside of this hex editor. Let's do that now.
Do we notice any secret information in the first file?
The answer is no, we didn't notice anything in there.
Next we're going to select File,
Open and then we navigate to that,
quote-unquote, "Corrupt file".
Then we're going to open it up.
We're just going to look for
any secret information that might be typed in there.
Let's go ahead and do that now.
Go to File and then Open.
Now we're going to check the Cat 3,
at least in my example, the cat3.jpeg.
I'm going to say Open there,
could take a moment or so.
But that's going to open the hex editor for us.
So you might have to scroll down a bit.
Let's go back to our lab document now.
Question 5, is there
any already secret information hidden in there?
You might find different information possibly,
but is there any secret information inside of the Hex?
Let's go ahead and take a look. Oh, yeah.
Looks like the word password.
Technically, this is probably something simple.
Generally, this is not something that
a malicious actor might
hide long amount of information in,
especially if they're trying to
keep the file size the same.
However, keeping that in mind,
there are ways around that,
but for our purposes,
we typed something very short in here.
You'll see that was pretty easy to find.
We were able to see the password at
the very end there or whatever word
you had chosen to use.
But that's what we're looking for in this particular lab.
If we image your suspect machine,
and we noticed a couple of photos that
are the same thing there,
then we generally are going to want to open them in
a hex editor to see what content is actually in there.
Because it might be something where this
might be the password to get in their actual laptop.
Then we can use that to get in the laptop and
actually get stronger conviction on the bad person.
In this video, we just
wrapped up our analysis of the photos.
In the next video,
we're going to start off Module 2 for
the computer forensics investigation process and
we'll talk about things like the
>> pre-investigation phase,
>> investigation phase,
as well as the post-investigation phase.