>> Hey everyone, welcome back to the course.
The last video we talked about
different types of data acquisition formats.
We also talk about live versus static acquisition.
In this video, we're going to talk about
some data collection.
Different forms of data collection we can do;
so disk to image probably the most popular one,
disk to disk, logical and sparse,
we'll talk about each one of those.
Disk to image, that's basically our bit to
bit replication or bit by bit replication.
Basically, we're getting all the information,
so every single bit we're replicating that.
Very time-consuming also takes a lot of memory.
Just keep that in mind
based on what you're trying to acquire,
this may not be the best format for you.
There's some different tools that can do it to; EnCase,
the Sleuth Kit and X-Way forensics, ProDiscover, etc.
Again, there's a ton of tools that may be
mentioned on the CHFA exam if you decide to take it,
so my best recommendation to you
is figure out the particular area, for example,
data acquisition, dynamic malware analysis,
static malware analysis,
network forensics, just
learn the most common tools that are in use,
and that should help you significantly with the exam.
Disk to disk, so for example,
if we're using all older software or hardware,
this is probably the best way to do it or at least one of
the most common ones I would
think based on the older software.
For example, if we're trying to do
like DOS or something like that,
we might not be able to get bit by bit copy
because of compatibility issues,
so just keep that in mind as well.
Sometimes criminals do use older software
in the hopes that nobody remembers it.
Not remembers it, but the hopes that nobody
has skill with it these days to
be able to get the data from them.
Keep that in mind that if you
decide to work as an investigator,
you might actually see that
different types of criminals may be
using very, very old software.
A couple of tools we could use
are EnCase again and X-Ways forensics.
Most of the proprietary tools can be used for
multiple aspects of an investigation,
so not just data acquisition,
but other things as well.
You'll see a lot of the names over and
over again throughout the course but
keep in mind that they may not be necessarily
the ones that you may see tested on the exam.
Again, my recommendation on that aspect is learn
each type of thing you're going
to do or learn the most common tools for it.
Again, I use example of malware,
learn the common tools for dynamic analysis
versus static analysis,
network forensics, database forensics,
etc, so just keep all that in mind for the exam.
Logical acquisitions, so you'll see
this more commonly in like E-discovery.
For example, the attorney comes to you and says,
"I want all the Microsoft Outlook e-mail files."
So you go in and you collect only the PST and OST files,
and then, "Here you go attorney, there you go."
Even though you might know as an investigator to like,
we really should check these other spots,
the attorney is like, "I don't care,
I just want these ones."
That also is another example,
there's RAID, so for example,
we just want very specific records
instead of copying the entire RAID drive,
we just want certain records off that.
Sparse acquisition, very similar to logical,
the only difference here being that
this one collects fragments of unallocated data,
whereas logical doesn't necessarily do that.
Dd, we have seen this in our pre-assessment question.
Dd again is a Linux command,
so it stands for data dump
if you wanted to impress your friends.
Then basically this one is designed for data management.
It's not the greatest forensic tool,
but it can be good to get some information.
It produces in a raw format
and it's not very user-friendly.
Then dcfldd came out.
This one adds some more features like the ability
to log errors, hashing ability,
the ability to split the data acquisition
into segmented volumes,
and then also the ability with the hashing
to verify the acquired data with the original disk.
Different tools that we could use.
Again, this is not an all-inclusive list.
This is some of the ones that
are the most common ones in the material.
I would definitely just make sure you know these,
DriveSpy, ProDiscover forensics,
AccessData FTk Imager,
F-Response, SafeBack, and DeepSpar.
Just a couple of post-assessment questions.
Question number 1, the dd command
allows you to log errors,
is that going to be true or false?
If you said false, you are correct.
The actual answer here is going to be
the dcfldd command is
the one that allows you to log errors.
If you remember that the dcfldd command,
add some more features and one of those
is the ability to log errors.
Then question number 2 here,
we would use a logical acquisition for a RAID server,
where the RAID server was too large to make a full copy.
Is that going to be true or false?
We know that what's going to be
true because we had talked
about that with logical acquisition,
that one of the aspects we could do on
a RAID server is we can just
take the information that we actually need.
In this video, we
wrapped up our discussion on data acquisition,
and we talked about data collection.
In the next video, we're going to go over our lab,
we're going to capture
an image and then also just analyze it.