>> Hey everybody, welcome back to the course.
In the last video, we talked
about some of the investigative phases,
as well as we talked about warrants
and some of the actions
>> that a first responder might do.
>> In this video, we're going to talk about things like
best practices as well as exhibit numbering.
Some best practices for a forensic investigation.
Number 1, we want to have
authorization from a decision-maker.
That could be a judge, it could be
your manager, something like that,
basically saying, okay, it's cool to
go open up this investigation.
Now that of course, our first responses,
we mentioned our first responders.
Generally, those are not investigators,
they're generally going to be someone like,
your IT personnel like your system admin,
your network admin, could even be like an accountant,
for example, or like the janitor.
It could technically be anybody,
but generally it's going to be someone in
an IT capacity for a digital forensic investigation.
Also searching and seizing the evidence.
We want to make sure we have warrants
and where you don't have a warrant,
we want to make sure that we fall under
the applicability of warrantless seizures.
Also evidence collection.
We want to make sure we maintain
the standards, so for example,
standards set by a particular organization,
so our lab or standards
that we need to follow by a regulatory body.
For example, if we were working in
the federal government capacity,
we might have to meet certain standards that
the private sector maybe doesn't have to meet.
We want to secure that evidence.
We also want to make a copy,
so preferably a bit by bit copy of the evidence.
We also want to make sure we don't corrupt it at all,
so we want to change
the evidence or at least minimal changes.
Again, make sure you have some type
of write blocker in place
when you're collecting the evidence.
As we copy and then acquire the evidence,
we're going to analyze it,
so we're going to take a look at
it, look for information,
generate a report on that, and then ultimately,
if it's a criminal case, will end up
testifying more than likely in some capacity.
One key point for your examination for the CHFI exam,
if you decide to take it,
if the computer is powered off, leave it off.
You'll see possibly different
conflicting things in industry,
but for EC-Council purposes,
if you see any type of questions they are asking about,
hey, the computer is off,
what should Timmy do next?
Timmy should leave that thing off,
so that's a good thing to remember for your exam.
We also want to photograph
the current state of the computer.
If it's off, we just want to
photograph everything and everything around it
and make sure that we're not adjusting anything there.
Make sure that nothing's being disturbed.
All that comes into play when you're actually
in the courtroom and they're saying,
"Well, it looks like
this monitor should have been over here.
You say, "No.
Here's the original photograph from the scene."
Also, but the computer might be off,
we can move the mouse slightly and see what happens.
It may trigger the monitor to turn
on if the computer is actually
on it, and we just don't notice it.
But at that point, we don't do anything else,
so we move the mouse, and
if we don't see anything else happening,
we leave it alone, and then we continue on the process.
Key thing here that you'll see in
the official EC-Council material,
but that may or may not be applicable to the real-world
is unplugging the network cable from the router modem,
you may not be able to do that.
That's common sense of if I've got
two devices attached to
my network and they're compromised,
I'm not going to go unplug the router itself.
I'll just unplug those devices more than likely.
Just keep that in mind for the examination.
But the concept there is that you're
stopping the further attack on the machines.
If you feel that there's
imminent danger of a continued attack,
that might be something
>> you want to remember for the exam
>> is that the purpose
of unplugging the network cable is
to basically stop the attack.
You also want to collect all cords and
peripherals. That's common sense.
Grab everything that you can and then document
in the chain of custody through the entire process.
Speaking of chain of custody,
so that's a legal document
and you'll see different formatting of it.
But basically it should list all the
people that are touching
the evidence that are involved in the process,
and then walking through dates, times,
and etc., somebody signing off
that they've received the new evidence.
As I mentioned, it's that treasure map of
your evidence. Exhibit numbering.
This is the formatting from EC-Council
that you'll want to memorize for the exam,
however, you'll see different formatting out there.
The AAA is just to name your investigator initials,
the date of the seizure,
sequential number of exhibits,
so 001, 002, 003.
That's a sequential number.
For parts of the same exhibit is the two lowercase z's.
For example, this computer screen is
001A and then I put the CPU unit itself as 001B, etc.
Just FYI on that.
You'll just want to memorize
those for the actual examination.
Different data recovery tools that we can use.
This is not an all inclusive list.
These are some common ones that you might see
mentioned throughout the EC-Council official material.
These ones you'll probably want to
know for the examination.
Recuva, address disk recovery,
UndeletePlus, the Sleuth Kit.
Then on top of that Autopsy is actually what runs on
that toolkit and then EnCase, and then FTK.
EnCase, you may not actually see on the exam,
and that's the older version of the exam.
But just in case you do,
we're going to just touch on it just a little bit.
Really, we're just going to look at some screen shot.
Recuva, that's what it looks like there.
Again, a lot of these are just for
file recovery, recovering data.
Keep that in mind that there's
many tools tested on the CHFI exam,
and in the official material,
I think most of us stop counting after like two or
300 that are mentioned
throughout the EC-Council Fisher materials.
Just FYI on that, there's a ton of tools.
But if you understand each aspect
of what you're trying to do,
then you can generally figure out
from the name of the tool what it's doing.
For example, like Recuva,
we configure common sense wise,
that's for file recovery,
that we can recover things with that.
Whatever type of file,
something we can recover with it.
Advance disk recovery, similar type of thing here.
This is for Windows, and so
we can use that to recover information.
UndeletePlus. If we delete
a file and then they deleted from the recycle bin,
we can go in and grab it.
TSK and Autopsy.
Here's the autopsy interface here
and that's what you'll find in most forensic courses.
You'll find mentioning of autopsy,
so it's a common tool used out there.
EnCase is probably the most
popular commercial one out there, very expensive.
That's one of the rationales why we don't
actually use that in the labs in
the course because it's not pragmatic
for anyone to actually go out and spend
a few thousand dollars or so to get
a license to then just
do this for a course to pass one exam.
We don't use that, and
most smaller companies don't use EnCase.
These are your bigger labs that are
going to use EnCase and
especially like your federal government.
Then we also have FTK Imager as well.
This is another popular one from
AccessData that a lot of people are using.
Just a quick post assessment question.
This is a sequence number for
parts of the same exhibit, so for example,
001, and then 001 A, 001B, etc.
Which one of these is applicable to that?
If you said answer A, you are correct.
As I mentioned, just make sure you
memorize that for the actual examination itself.
Just remember the different parts of
the exhibits as according to EC-Council.
In this video, we wrapped up
>> our discussion for Module 2.
>> We talked about exhibit numbering
as well as some best practices.
In the next module we're going to talk about at
a high level of a lot of
different components of hard disk and file system.
For example, we'll talk about the master boot record.
We'll talk about HDD and SD.
We'll also talk about things like FAT,
NTFS as well as we'll go over the RAID levels,
which is something you definitely want to
know for your examination,
as well as some information about the hex.
Basically reading the first part
of the hex on image files.
We'll talk about those.
Again, all that is 10,000 foot level,
but it's valuable information that you
definitely need to know for the CHFI examination.
I'll see you guys in the next video.