>> Hey, everybody. Welcome back to the course.
In the last video, we used the ProDiscover tool
to look at our file that
>> we had downloaded and extracted.
>> Then to look for the search term FIF,
we had seen we were able to open that file,
look at the hex, and we're able to see
that search term that we were looking for.
In this video, we're going to go ahead and finish out
our lab of analyzing the file a little more.
Step 1 here, make sure we're clicked on the PLABWIN810.
Then we're going to open up the file
explorer from the taskbar.
Let's go ahead and do that now.
Just scroll down if you need to,
and click on this little folder icon here,
that'll be the File Explorer.
The next thing we want to do is navigate to C,
then the work folder,
then data files folder and then
Ch08. Let's go ahead and do that now.
Double-click on "C", double-click on "Work",
double-click on "Data files",
and then double-click on the "Ch08" folder.
The next thing we want to do,
we actually want to create a brand new folder in here.
Let's go back to our lab document.
We're going to click the New Folder icon
at the top left of that little window.
Then we're going to rename it.
We're going to name the new folder, chap08nProjects.
Let's go ahead and do that.
This little folder icon here, that's a new folder.
If you hover your mouse over top of it.
Go ahead and click on that. Then we're
going to rename this folder.
Again, we're going to rename it chap08nProjects.
Let's go ahead and do that now.
Chap08nProjects.
Once you've done that and renamed it,
you can just click off anywhere on
this blank area and it'll save that name for you.
Let's go back to our lab document here.
Now, what we're going to do is
we're going to locate here in step
5, the c08frag file.
Then we're going to right-click on it and select "Open".
That way we can go ahead and extract it.
We see it's right here, the c08frag.
Go ahead and right-click on that and select "Open".
It's going to open the WinRar self
extracting archive for us.
Let's go back to our lab document here.
We see in step 6 that that has opened,
that self extracting archive
of WinRar that is opened for us.
Now, we're going to go ahead
and click the "Browse" button.
We're going to click on the "PC",
"Local disk", "Work folder".
Basically, we're going to navigate to
that new folder that we
just created, that chap08nProjects folder.
We're going to go ahead and do steps 8 through
12 right now. Let's go ahead and do that.
We're going to click on "Browse".
We're going to select this PC right there in the middle.
We're going to scroll down just a little bit,
and we're going to select
the "My computer properties" there we go.
We're going to select the "Local Disk".
We're going to scroll down just a little more.
We're going to double-click on "Work".
We're going to click on "Data files".
We're going to click on "Ch08",
and then we're gonna click
on the, "chap08nProjects".
If you remember, that's that new folder we created.
Then just say okay to that.
Let's go back to our lab document.
We've selected "Okay" to that.
Now, in step 14,
we're going to go ahead and just extract to that folder.
Let's go ahead and do that. Just click
on the "Extract" button here.
It might take a moment or so, but it's
going to extract it in there for us.
Now, we can go ahead and close
the file explorer window and we're going to
go back into ProDiscover.
Here in step 16, we're just going to double-click on
the "ProDiscover" icon and launch the application.
Again, once it launches,
it gives us a pop-up box for the launch dialogue,
we're just going to click on the "Cancel" button.
Let's go ahead and do that now.
Just "X" out of this window here,
we're going to double-click on the ProDiscover icon.
Double-click on that, might take
a moment or so to launch for us.
Then you'll see here we have
a launch dialog pop-up boxes.
Go ahead and click "Cancel" to that.
Let's go back to our lab document.
Now, we're going to click back on the new project icons.
If you remember, it's a piece of paper looking icon.
Here in step 18, let's go ahead and do that.
Right here, new project.
Let's go ahead and click on that.
It's going to ask us for the project
name and file number.
Let's go back to our lab document
to see what that should be.
Here in step 19,
we see that for both of those,
for both the project number and the file name boxes,
we want to type in c08frag.dd.
Let's go ahead and do that, c08frag.dd.
Type c08frag.dd. Again,
we want to put that for both of
the boxes here and then we're going to
just select "Okay",
c08frag.dd, and then just choose the "Okay" button here.
Let's go back to our lab document.
In step 21, on the left side of our screen,
we're going to expand the "Add" option,
we're going to expand that by selecting
the plus sign just to the left of it.
Then we're going to also click on "Image File".
We'll see a pop-up box that
opens. Let's go ahead and do that now.
We're going to click on "Add".
We're going to click the plus sign to the left of it.
We see add right here near the top,
just click that plus sign to the left of it,
and then you'll see the image file option right here.
Just go ahead and click on that. You'll see
it opens a pop-up box for us.
In step 23, the pop-up box, it has opened.
Now, we're going to click "Ch08" at the top to
save ourselves from having to go through
and navigate to the C drive,
the work folder, data files, et cetera.
We're just going to click "Ch08" at the top.
Then we're going to open up our
new folder that we created.
That way we can then select
that new file we have in there.
Let's go ahead and do that.
We're just going to click here at
the top where it says "Ch08".
That basically just backs us out one level.
We're going to double-click
on the "chap08nProjects" folder.
Then into here we're just going to select the
"c08frag.dd", and select "Open".
Step 27, we select "Open".
Let's go down to step 28.
Now, we're going to go ahead and just click
the "Search" button at the top.
Then we're going to make sure that we're under
the content search tab when the pop-up box opens for us.
Let's go ahead and do that now.
We're going to click on the "Search" button,
which is this one right here,
it's like a piece of paper with a magnifying glass on it.
If you hover your mouse over top,
you'll see it says search on
it. Go ahead and click on that.
We want to make sure we're under the content search.
We are by default,
where you generally should be.
Then in the search for patterns box,
we're going to type the JFIF.
All capital there J,
F, I, F. Let's go ahead and do that now.
This top box here just type in JFIF,
again, all capital letters.
Let's go back to our lab document here.
In step 31, under the select
the disk images you want to search in box.
We're going to select this C work data,
et cetera, c08frag.dd path.
You'll see it's the only one we have in that box there.
Now, we just want to click on "Okay".
We'll click the "Okay" button at the bottom there.
It's going to pull up the search results for us here.
Let's go back to our lab document here.
Now, we're going to click on the "Shellback2" file,
and we're just going to review the file contents.
We just want to look to see if we notice that
JFIF is labeled in there anywhere.
Basically, question number 1 here is,
do you see JFIF in the file contents?
Again, we're going to click on the "Shellback2" file
and just look at the file contents.
See we have a couple of them in here.
We're just going to choose this top one here.
You'll see all jumbly stuff here in this bottom box,
but we basically just want to come over and scroll
down and just see if we see JFIF anywhere.
We're going to scroll down here
and see if we see it located anywhere in there.
You'll see I have it here. There we go.
You'll see JFIF right there.
Depending on which one you click on,
it might be in a different location.
Let's go back to our lab documents.
Question number 1, do we see JFIF in the file contents?
The answer there is yes,
at least I do on my end.
If you do as well, just post that in
the chat if you're watching this live.
Next, we're going to click the check box
to the left of the file,
and then we're going to add a comment.
We're going to click on the "Add
Comment" pop-up box. Let's go ahead and do that.
Just to the left of the file here in the top window,
click the checkbox here.
You'll see it pops up the add comment box for us.
We're just gonna go back to our lab document here.
In step 36 in the comments section,
we want to type Recovered hidden.jpg file.
Go ahead and type all that in.
Recovered hidden.jpg file.
In this pop-up box here, Recovered hidden.jpg file.
We're also going to check this box that
says apply to all items,
and then we're going to say, "Okay".
Let's go back to our lab document.
We've checked that box it says,
apply to all items,
and then we selected "Okay".
Now, what we're going to do is we're
going to mark the check boxes to the left of
all the remaining files that don't
show that they're a jpg right off the bat.
Basically, if they don't show jpg
under the file extension column,
we're going to select those.
Let's go ahead and do that now.
You'll see here the file extension columns.
For example, we're not going to
select this top one because it's showing
jpg under shell back
forward showing jpg as a file extension.
We're not going to select that one.
For example, we will select
shellback2 here because it's
not showing jpg under the column.
Go ahead and select it for all those that
do not show jpg under the file extension column.
Once we've done that, let's
go back to our lab document here.
Step 39 here we're going to
click on "Report" on the left side,
and it's going to generate a report for us.
Let's go ahead and do that. Just scroll
over to the left side here,
select on "Report". Here at the top.
Just take a moment, you'll see on the right side here,
it generates a report for us.
Let's go back to our lab document.
We'll see in question number 2,
do you see anything on the report
under the section that's labeled as,
total evidence items of
interests? Let's take a look here.
Do we see anything under that?
We see here, here's that area,
total evidence items of interests.
The question is, do we see anything under that area?
Do we see anything under that area? Yes, we do.
We see three items of interests and it
list out what those items are.
Here in step 41, we're just going
to select "File" and then "Exit".
Then it's going to prompt us again,
do you want to save this case?
We're going to say no to that.
Let's go back to the top here.
We're going to select "File" and then "Exit".
It's going to basically ask us,
do you want to save this case?
We're just going to say no to that.
In this video, we wrapped up our lab
where we analyzed the files little more in depth.
We kept looking for jpg file types.
I'm going to see if we noticed those at all,
we also learned how to generate a report.
In the next section we're
going to go over data acquisition.