>> Hi, welcome back to the course.
In the last video, we wrapped up
our discussion on data acquisition.
In this video,
we're going to do Part 1 of our lab,
and then in the next video we'll do Part 2.
In this lab, we're going to go ahead
and acquire an image,
and then we're just going to perform a quick analysis.
Let's go ahead and get started.
Here in our lab document,
step Number 1, just log into
Cybrary if you're not already logged in.
Step Number 2, we're going to select
Catalog at the top of the page.
Then we're going to type in the word
forensic and search for that.
Just go ahead and click on "Catalog" at the top there.
You'll see a little search box on the left side here.
Then just type in forensic.
We're just wait a second or so and it's going
to pull up some different search results.
We're going to see here that we
have the computer forensics and
investigations practice lab environment.
Let's go back to our lab document.
We see that yes, that's the one that we want,
the computer forensics investigations.
Once we find that, we're just going to click
the "Start Now" button to go ahead and launch the lab.
It might take a moment
or so to launch the lab environment there.
Let's go back to our lab document.
Now we're here at Step 6.
Now we want to locate the understanding
the digital forensics profession and investigations.
That's the name of it.
>> That's the lab we're looking for.
>> We see here that that's a very top one right there.
Just go ahead and click on that.
Then next, we're going to click the "Start" button.
It's going to go ahead and launch the lab for us.
Once it does, we see our virtual machines here.
Let's go ahead and get those started up as well.
Just hover your mouse over top
here and just say power on.
Do the same thing for all these.
Just hover your mouse over top of
that machine and just select the Power On option.
While those are booting up, let's
go back to our lab document.
We see here in Step 6, we found our lab.
We selected the Start button.
Then Step 8, we went ahead and
just powered on all the virtual machines.
You'll see there in the background,
they're taking a moment or so,
but they'll boot up eventually.
In Step 9,
we're basically going to work now
to actually acquire the data.
In the real-world, not in this lab environment,
we will be using a write blocker so that
way we don't alter the data.
If you remember, we covered that information.
However, in the lab environment,
we're just going to go ahead and
continue on with our steps.
You'll see here in the background
everything's booting up for us.
Once your machines boot up,
you're going to be connecting to PLABWINA10.
By default, that generally is where it's
going to pop you in the lab anyways.
Once you connect to the PLABWINA10,
then in Step 11 here we're going
to double-click the shortcut icon on
the desktop that says Pro Discover basic 64.
This one with that little
Sherlock Holmes looking type of guy.
Once we do that, we're going to see a dialogue box.
We're just going to say Cancel to that.
Go ahead and double-click on that shortcut icon.
It's going to launch it for us.
It might take a moment or so to pop up.
You'll see here we have that launch
dialog box I mentioned.
Just go ahead and click the "Cancel"
button at the bottom right.
Let's go back to our lab document.
Now in Step 13, we want to select
>> Action at the very top.
>> Then we're going to select the Capture Image option.
Let's go ahead and do that now.
Click on Action at the very top here,
and then the Capture Image option,
that first one down.
Let's go back to our lab document here.
Now we do see that we do have a pop-up box open.
Step 15, under the source Drive area,
we're going to select the E drive that's labeled as
USP and then 4.997 gigabytes.
Let's go ahead and do that now.
Under the source Drive area,
go ahead and click in here.
We want to select the E drive
and it's the only E drive listed there,
obviously, the USP 4.997 gigabytes.
Go ahead and select that.
Let's go back to our lab document.
Now, we're going to click the button with
two arrows in the destination area.
Let's go ahead and do that now.
It's going to be
this little button on the right side here.
Just go ahead and click on that.
Then we're going to select, Choose Local Path.
Step 17, we've chosen the local path option there.
Next we're going to navigate ourselves to
the C work data files and then Chapter 1 folder.
Let's go ahead and do that now.
On the left side here, go ahead and scroll down.
We're going to click on "C." Double-click on "Work",
double-click on "Data Files",
and then double-click on the "Chapter 1" folder.
Let's go back to our lab document.
Now, in Step 19, we're going to
go ahead and name this file.
In the file name box area,
we're going to type in Chp- prac,
basically in chapter practice.
Let's go ahead and do that now.
We're going to type in capital I,
lowercase n, capital C,
lowercase hp, dash, prac.
We've taught that in there. Now we're going to click
the "Save" button just to save what we've done.
Go ahead and save that file now.
Step 21 here on the Capture Image pop-up box,
is the pop-up box we still have there.
We're going to just type your name
in the technician box, excuse me.
I'm just going to type a random name in there.
You can type your name if you want to.
You can just type a few characters if you want to.
It's up to you at that point.
Let's go ahead and do that now.
Right here in the technician name box,
just go ahead and type your name.
I'm just going to type, what is
called myself, Bob right now.
Once you've done that, go back to the lab document.
Our next step here in Step 22,
we're going to go ahead and type that InChp-prac,
but then we're going to add 01 to the end of it.
We're going to type that in the image number box.
Let's go ahead and do that now.
InChp, and then
we're going to type our rest here, dash prac.
Then again, instead of how we just said prac up here,
we're going to be typing 01 at the end of that,
so InChp-prac 01.
Let's go ahead and type that in there now.
We go back to our lab document.
Now we're just going to select the "Okay" button.
That's going to close the pop-up box for us.
Then what we're going to see here in
Step 24 at the bottom right of our screen,
we'll see a little green dashed thing there.
A bar that shows us the processing of it.
Then we're going to see that it might take
about 20-30 seconds total to complete.
It could take longer than that depending
on your particular connection.
I'll just go ahead and click "Okay" to that.
You'll see down here we have
our little process bar there going.
It's estimating the time remaining.
Again, it's going to be
variable there and it probably takes
around 20-30, sometimes 40 seconds,
I would say if you've got a really bad connection,
maybe like a minute or so,
but generally within about 20 seconds,
it's usually done processing.
You'll see here on the left side
>> it's jumping up there on
>> the file numbers that it's capturing there.
You'll see our end game there is the 10,479,615.
It's almost there, but not quite yet.
We probably have just a few more seconds.
Whenever it gets down here and it's almost done there,
we may see a pop-up box that says
>> image capture complete,
>> and actually we probably will see that.
Then please check the log file for any errors.
Once you see that, just go ahead and select
Okay there. Let's go ahead and do that now.
We see that we do have that pop-up box right there.
Let's go ahead and say okay to that.
Let's go back to our lab document here.
Now, we're going to just go ahead and close
the Pro Discover tool for this portion of the lab.
In the next video again,
we're going to actually analyze the capture.
Here in Step 26, just go ahead and
say file at the very top left,
and then just go ahead and exit.
You'll see you have take a moment or so,
but then Pro Discover will exit for us.
In this video, we just made a quick capture there.
Now in the next video
we're going to go ahead and just take
a look at some of the information that we've gathered.