>> Hey everyone, welcome back to the course.
The last module we talked
about hard disk and file systems.
Again, we're just took that 10,000 foot view of
hard disk file system
so you can understand the components of them.
In this video, we're going to start off
our discussion on data acquisition.
Just a quick pre-assessment question.
The dd command is used in
Microsoft Windows to acquire data.
Is that going to be true or false?
If you guessed false, you are correct.
The dd command is actually used in Linux,
but we'll talk about that a little later
on. Data acquisition.
Basically, as the name applies,
we're trying to extract the information
or obtain the information.
Then what we always want to create a copy of it.
We want to create a copy and we'll talk about
different types of copies a little later on as well.
We get all that information, we analyze it,
and then of course we want to be able
to present it in a court of law.
Now the data acquisition process
is very important in that aspect.
If we acquire the data
incorrectly or if we don't make copies,
if we don't maintain our chain of custody,
then generally speaking,
it's not going to be admissible in a court of law.
That's the end game. We want to get
there civilly or criminally.
We want to be able to have that evidence
to prove our case.
Or if we're working as an investigator,
prove the case of our prosecution.
Then different types of data acquisitions.
We have live and static acquisition,
we'll talk about each one of those in just a little bit.
Live acquisition. This is going to
be used to acquire the volatile data.
We talked about that a little bit in Module 1,
the difference between volatile and non-volatile.
I also gave some examples as well.
Things like your RAM, system, time processes,
command history, driver information,
etc, that type of
stuff is going to be your volatile data.
That's the information that we want to get because if we
turn off the device or if power is cut to the device,
then that data goes away,
so we can't acquire it.
Speaking of powered on,
the device might actually also be aside from just being
at the screen where you can just look at it,
might also be locked or it also might be in sleep mode.
Just keep that in mind as well.
Now, we would also use live acquisition in
a situation where someone's got an encrypted drive,
if we know the passphrase or
password or the person's already logged
into it where they've got the drive
decrypted at that particular point in time.
We obviously would not be doing
a live acquisition to get an encrypted drive.
We're not going to just get a bunch of
encrypted information
because that doesn't help us at all.
There's no point in that.
But if we know the passphrase,
if we know the password or
the suspect is already logged
into stuff and we can acquire it,
then we would do a live acquisition.
Along the lines of volatile data collection,
of course, we want to plan ahead.
We want to establish a trusted command shell
so we can get that information.
A transmission storage method.
We want to consider what we're going to
be grabbing that information with,
if we're doing it remotely or the storage method.
How are we storing the stuff? Are we securing it?
How are we securing it? We also
want to maintain integrity
so the hashing aspect to maintain
>> integrity and say yes,
>> this is the information we got.
Also recording the date, time,
and command history is part of a chain of custody.
Documentation, again,
the chain of custody and then
reporting the information that we've acquired.
Static acquisition. Honestly,
this is our data as we talked about in Module 1,
this is our data that if we turn the power off,
it's still around so our USB,
our Slack space, swap file, etc.
Now you'll generally see this like in police seizures,
but keep in mind that
police can also do live acquisition.
If the suspect has their device on,
the police sees it, then guess what?
Live acquisition. Media sanitation.
The main thing to remember here
is actually taken a look at
NIST SP800-88 that talks about media sanitation.
But keep in mind of clear, purge, destroy.
Basically, we're trying to wipe
all the information off a particular media,
like your hardware component,
whatever the case might be, we want
to wipe all the data off there.
Based on who you work for, for example,
let's say you work with classified information,
there's different protocols than if you're
just using the generalized workstation.
It's your private sector employer that doesn't have
any real proprietary information on it.
Your process is going to be different than if
it's like the NSA or CIA.
Just keep that in mind. NIST SP800-88
is definitely something you
want to take a look at for the exam.
Different types of data acquisition formats.
We've got raw, proprietary,
and then also AFF,
which we'll talk about what that is in just a moment.
Raw, basically here this is,
again as the name applies a raw data.
It creates simple sequential flat files.
You'll definitely want to memorize that for your exam.
Fast data transfers.
It's also considered the universal acquisition
format for most tools that are out there.
It's also the most common one that people do.
Now, couple of things to keep in mind
that as a downside,
it requires the same disk space or
more disk space in the original disk or data set.
Then also a different free tools might not
actually collect marginal sectors.
Keep that in mind as well.
If you're not using a proprietary tool,
you may be missing stuff with raw formatting.
Speaking of proprietary,
a proprietary as the name applies,
is somebody owns this stuff.
They create it,
they develop it, they sell it.
They may not develop it,
but anyways they buy it and they sell it.
Here, we have the option to compress
image files of suspect drive.
Also data integrity checks so hashing is built-in.
We could split the image up,
we can integrate metadata,
so things like our date and time.
A couple of downsides. Since it's proprietary,
the inability to share images between tools.
Now, some of them will work together,
but some of them don't so just keep that in mind.
Also file size limitations
based on the particular vendor.
AFF, advanced forensic format,
this one is actually open source.
It does incorporate metadata and
there's also no size limit on disk-to-image formatting.
Keep that in mind. These are just some examples
of what we could use.
In this video, we talked
about different types of data formats.
We also talked about some generalized information on
data acquisition as well
as live versus static acquisitions.
In the next video,
we are going to talk about data collection
and different types of data collection we can do.