>> Hey everyone, welcome back to the course.
In the last module, we wrapped up
our discussion on anti-forensics.
Again, we talked about some of the goals of
anti-forensics for an attacker.
In this video, we're going to start
Module 6 with operating system forensics.
Just a quick pre-assessment question.
As a digital forensic investigator,
you should never collect volatile data first,
is that true or false?
We obviously know that's false.
That was an easy one.
But we always want to collect the volatile data first.
If you remember from earlier modules,
the volatile data is the data that's
lost once we unplug or turn off the machine.
Speaking of volatile data, how do we collect it?
We want to collect different things and
this is not an all-inclusive list,
but some of the most common things to
collect are system time, the RAM,
the logged-on users, open files,
and then also the print spool files.
System time. The ways we can collect this,
there's several different commands we can use.
If it's a proprietary software,
we would want to go to the website and just see, hey,
how do we look for the system time,
or even just do a quick Google search
of how do we find the system time on
this particular piece of software or
this particular operating system,
>> this particular device.
>> Also 64-bit file type,
which is one of the more common ones in
Windows for an investigator to get.
That basically is designed as
100 nanosecond interval since
January 1st, 1601 at midnight.
Basically, it's going to be a whole bunch
of numbers and then you have to calculate out,
and there's many tools that'll do that for you.
But you'll calculate out what the actual date,
time, and hours are that we would be able to interpret.
That's one of the more common ones as well.
The 32-bit Unix,
again, that's on Windows.
That's the number of seconds since January 1st,
1970 at midnight.
Then string format which we
see when we log into our computer,
for example, we see the date and the time.
Different commands we can use,
and this is not an all-inclusive list,
there's a ton of them you can use.
These are some of the most common ones
that you'll find investigators using.
GetSystemTime, GetSystemTimeAdjustment,
GetTimeFormat, etc.
Basically, you'll notice
>> all of these have time in them,
>> as we see there.
If you're on your exam, if you see
any of these by chance,
just look for something with time in it,
and that should help you narrow down the answers.
RAM. A couple of tools we can use to grab RAM.
DumpIT is probably one of
the more popular ones and then
after we do the DumpIT or after we dump it,
we would use the volatility
framework to take a look at it.
Just a quick screenshot here of the DumpIT tools,
what it looks like a command-line tool.
Then same with volatility framework,
just looking at to see, look at
all the stuff we can dump out and analyze.
Logged-on users. A couple of tools
you'll want to just memorize or a couple
of ways we can
grab that information that you'll
just want to memorize for the exam,
PsLoggedOn, net sessions, and LogonSessions.
Just a quick screenshot of each one of those.
Net sessions and then LogonSessions.
Again, you just want to memorize those three for
your examination.
>> Open file.
>> Again, another thing here where you want to
just memorize these and just understand them,
net file, PsFile Utility, and Openfile.
Net file, basically open shared files
and also the file locks.
PsFile Utility,
that's regarding files that are opened remotely.
Just remember that keyword right there, remotely.
Then Openfiles, as the name implies,
it allows you to see open files. Print spool file.
Remember with this one, just remember
that for principals spool files,
it's going to produce a graphics file as well,
and that's going to be a.emf.
Just remember that for your exam,
and also you're going to need to do
file carving to grab these.
In this video,
we talked about getting volatile data.
In the next video, we're going to actually
go over non-volatile data.