>> Hey, welcome back to the course.
In the last video we talked about HFS,
HFS Plus, and then also the different raid levels.
In this video, we're going to go over file carving
>> as well as a different image files.
>> We're also going to talk about the Sleuth Kit
and some different commands we can use.
File carving.
>> As the name implies,
>> we're basically carving out information.
Essentially we're just reconstructing
information from different file fragments,
and we can use many, many different tools.
Now, some people like to use command line tools,
but generally most people use GUI interfaces.
Some different tools you can use
>> and again, not in all inclusive list here,
>> but OSForensics, DataLifter,
and Simple Carver Suite.
Again, many of the forensics tools
out there that you'll use like
>> in a day-to-day job are going to have
>> some component built-in
>> that allow you to do file carving.
>> We have different types of image files
>> and many of these or probably
>> all of these you've seen before;
>> JPEG, Bitmap, GIF, and then PNG.
For JPEG, just so you know for the exam,
make sure you understand
Joint Photographic Experts Group is what a stands for.
Also, the JPEG uses lossy compression,
and then it boast 90 percent
>> or up to 90 percent compression rates.
>> Another key thing to remember
for your examination is that
the hex value of a JPEG file starts with FF D8 FF.
Very important for the exam that you understand
image files and understand
the hex value that they start with.
Next up we have bitmap.
This one's for Windows,
and then a hex value here starts off with 42 4D.
Again, just another thing
you'll just want to keep in mind.
As I mentioned just a moment ago,
make sure you understand
the hex values of these image files
>> or what they start with.
>> We have GIF or Graphics Interchange Format.
This one has eight bits per pixel,
256 colors per frame.
It supports lossless data compression,
and then the hex value here is 47 49 46.
Again, starting off with that hex value,
make sure you memorize that.
PNG or Portable Network Graphic.
This one uses a lossless image format
>> and it was intended
>> or brought about to replace GIF and TIFF.
>> If you're not familiar with TIFF,
Tagged Image File Format.
Hex value here is 89 50 4E as an echo,
just keep that in mind as well.
We talked about here
like lossy compression, lossless compression.
What is that stuff?
>> Lossless compression
>> is mostly seen with GIF and PNG.
Basically that reduces the file size
>> without removing data.
>> If we uncompressed that file,
there's really nothing lost.
Whereas lossy, permanent discards bits of information.
We may not notice necessarily
>> like in a JPEG photo that,
>> as we unzipped it,
that bits of information are gone.
However, if we blow it up,
we'll see the different issues with pixelation.
That's where we see the main difference there.
Then different tools we can use
>> for a lossless are WinZip,
>> PKZip, StuffIt, and FreeZip.
Again, not an all inclusive list.
The Sleuth Kit, we talked about
this a little earlier in Module 2,
but here we're just going to talk about
>> the different commands.
>> You'll just want to memorize these for the examination,
fsstat, istat, fls and img_stat.
Again, fsstat displays
that general information about a file system.
The metadata details are istat,
directory names or file names or fls,
and then details of an image file which the name
on lends you to believe it is, is img_stat.
Just one quick post assessment question.
This TSK command displays general details
>> about the file system.
>> Which one of these is that?
If you guessed answer C, you are correct.
That's actually the only TSK command on this list,
the other ones are image files.
In this video we talked about image files,
file carving as well as the Sleuth Kit commands.
In the next video we're going to start off our lab.
In the lab we're going to be looking at a USB drive
>> and a couple of different files
>> on that particular drive.