>> Hey everyone, welcome back to the course.
In the last module,
we wrapped up our discussion on data acquisition.
In this video, we're going to talk
about our goal with anti-forensics
as well as some information
about deleting files in Windows.
Just a quick pre-assessment question here.
A file in Windows 98 has been deleted and we
see Dc0.doc is produced.
In this example, what does the c represent?
If you guess the drive, you are correct.
Answer D is correct.
We'll go through that in just a little bit.
What are our goals with anti-forensic?
Number 1, an attacker wants or
a criminal wants the investigator
to have a large amount of data to try to sift through.
If we put so much volume out there,
then potentially the investigator can't either look in
all the areas or
time becomes a factor and money becomes a factor.
Especially for smaller law enforcement departments,
they may not have the budget
to sift through terabytes of data.
They just have to look at the main areas.
That's one goal with anti-forensics as
we throw so much data
and a lot of it corrupted
that the investigation has to cease.
This lines integrity of data.
We want to affect the integrity of the data so that
way the investigator or the prosecutor or whomever,
can't take that data and then use
it against us in a court of law.
An attacker's goal with
anti-forensics is to corrupt the data.
Difficulty. Again, going along with
both of these two, volume and integrity,
we want to make it more difficult for
the investigator to actually
perform their job and
actually acquire and analyze the data.
Thinking of the volume aspect again,
we throw so much data at
the investigator that they can't actually continue
the investigation either due to
cost or just due to the sheer amount of data.
Also integrity. We make it more
difficult for them to use it in a court of law.
Then of course, another aspect of
anti-forensics is the existence of data.
What I mean about that is just deleting data.
Deleting logs, deleting files,
whatever the case might be,
the attacker or criminal in that aspect could
be deleting the data so basically it no longer exists,
or at least it does not
exist in a capacity that we can retrieve it.
Now that we've talked about some
of the goals of anti-forensics,
let's talk about different file deletion in Windows.
This is very important for your examination with FAT,
file system that you need to
understand the operating system replaces the first letter
of a delete a filename with E5.
Remember that for your examination
just in case you see it on there.
Now with FAT,
file deletion, it's going to mark
the unused clusters as available.
But until those clusters are overridden,
the file information can be recovered.
Files can be recovered until the clusters are overridden.
Just keep that in mind as well for your exam.
What does file deletion in
the index file in NTFS in the master file travel?
It's going to be marked with a special code.
That's the difference between FAT and NTFS.
FAT again, remember that it's going
to label the first character
as E5 and NTFS,
it's going to use the index field and
then MFT or the master file table,
it's going to mark that with a special code.
Windows 98 and earlier.
I just remember the file path here for the recycle bin.
C:\Recycled. Just keep in
mind if you see that on the exam,
that's for Windows 98 and earlier.
It also is going to rename the deleted files, Dxy.ext,
or essentially the x is going to be
the drive.ext and then
also the y is the sequence number, so starting at zero.
In this example here,
Dc0.doc, D and then C is going to be the C drive.
Y is going to be sequence number,
which is zero in that example and
then dial name extension.
Windows 2000, XP.
Just remember the file path here,
it's going to be C:\Recycler.
Then also the file details are stored in the INFO2 file,
which we'll talk about in just a little bit.
Windows 7, 8, and 10.
Future iterations as well.
Likely it's going to be in C:\$Recycle.Bin.
Again, that's the file path.
Again, for your exam, you just want to
memorize those file paths is going to be very
important as you're looking through
the questions. Just in case it's tested.
Again, I can't tell you what's on the exam.
In this one, it's going to label it as $Ry.ext.
Again, the y is the sequence number and of course,
the ext is original extension.
Just an example there of $R0 for
the sequence number and then.doc for our extension.
INFO2, as I mentioned.
Basically, this is a hidden file that
stores data about the deleted file.
This one can be recovered with a tool.
Remember that for your exam,
if you happen to see a question
about that on there in some capacity
of how do we recover or retrieve INFO2 file.
Once you reboot the system,
you'll need to use a data recovery tool to get that file.
Again, a hidden file
contains things like the original filename,
date and time of the deletion,
original file size, and the drive number.
In this video, we talked about
the goal of anti-forensics.
We also talked about Windows file deletion,
at a high level there.
But we talked about some specific file pass for
the recycle bin that
you'll want to memorize for the exam.
We also touched on the INFO2 file a little bit.
In the next video, we're going to go over some
password cracking at just a high level.
We'll talk about different ways
we can do password cracking.