>> Hey everyone, welcome back to the course.
In the last video, we talked
about some non-volatile data.
In this video we're going to go
>> over some browser paths.
>> Again, things like your Microsoft Edge,
Google Chrome and Firefox.
For the exam, you're just going to want to memorize.
You don't necessarily need to memorize
the entire path here,
but just be familiar with
where each browser stores certain information.
More specifically like the cached information.
Here, Microsoft Edge,
it's going to store it users and then the user_name,
AppData, Local, Packages, Microsoft.MicrosoftEdge.
Then basically you'll just want to
memorize, it's MicrosoftEdge/Cache.
Then also the last browsing session.
Again, similar to when we
were memorizing about the Windows registry stuff,
just the last portion of that
is really what we want to focus on.
It's unrealistic for you to try to
memorize the entire path of every single one of these
but a more realistic aspect
would be just memorizing the last few sections there.
For example, with the cached files here in Edge,
memorizing like the #!001\MicrosoftEdge\Cache.
Same thing with the act of browsing session,
Default\Recovery\Active.
Again, just memorize the last half of those.
Firefox, similar thing here.
You'll notice many of these look
somewhat similar in the structure.
They show you the username,
talks about the data,
then on the local machine,
then Mozilla, whatever the browser is, for example.
Then moving into some kind of default and then cache.
Now the one difference here you'll
notice between the cache of
Firefox and the history is you'll notice
the word roaming versus the word local.
Keep that in mind for your exam.
If you see them just
listing out a path for a browser and saying,
''Hey, what does it show in Firefox?''
Then those are some keywords you can look
at that will help you differentiate between the two.
Chrome cache here.
Again, a similar type of path.
We go here with the user information and then
we end up with Default/Cache.
Windows restore points.
This is something important
for your exam that you'll just want to know.
rp.log files, if you see a question about it.
Then also the thing to remember is
that these are like mini snapshots.
They take those little
"snapshots" at different points on the system.
Basically, it's giving us some data.
Now they're only generally retained for like 90 days.
If we don't catch it in time,
that data could be lost forever
but it is something that even if
the criminal is deleting stuff, they oftentimes can't.
It's stored in a place where they can't
get to, for the most part.
There are ways to delete it,
but most criminals aren't thinking to this capacity.
Keep that in mind that on a Windows machine,
this is one place where you may be able to
grab some good information
about the files that were in existence
on the machine at a certain particular date and time.
ELF_LOGFILE_HEADER, this is something
you'll just want to be familiar with as
far as the header and signature size.
More specifically, the header size,
I guess, for your exam.
This is used at the start of an event log.
Basically, it defines information about the event log.
Some of the information that's not going to
change or like the header size,
that's always going to be that 0x30,
and then the signature as well,
and also the major or minor version number.
Again, just keep
that in the back of your head for your exam,
just in case you see it asked.
I don't know that they're going to go too in depth on
this particular aspect because there's
more important topics in the material,
but just in case type of thing,
these are some key points
that you'll just want to know about ELF.
Linux shell commands.
Just be familiar with these,
what each one stands for.
dmesg is for display messages,
as you can determined from the name.
fsck, so that's not a typo there.
File system consistency check.
stat, that's going to display the file
>> or system status.
>> History, that's going to list out
the different Bash shell commands that were used.
Then mount, as the name implies,
it mounts a file system or device to the directory.
Some common Linux log files
that you just want to be familiar with.
If you're not a Linux person,
then just be familiar with where these are.
Var log auth.log for authentication.
The kernel's at var log kern.log.
Apache, var log httpd.
Just keep that one in mind for your exam.
Then also system boot, var log boot.log.
Mac log files, again,
you just want to be familiar with where
these operating systems are storing the log file.
Here you've got a couple aspects,
var log for the system log folder,
system application log is at library logs,
and then system log is at var log system.log.
Definitely keep that in mind for your exam.
Just a few quick post assessment questions here.
For Mac computers, a system log folder
is located at var/log.
Is that true or false?
We just went over that. That one is true.
Question number two here, Windows restore points are
like little snapshots on a suspect's computer.
Is that true or false? That one is also true as well.
If you remember, those are
only store generally for about 90 days.
You'll want to keep that in mind as
you're doing your investigation.
Then finally, question number three.
In Linux, the dmesg command is used to display
file or system status. That one is false.
We actually got a false one there.
If you remember the dmesg command is for
display messages and the one that's used to display
file or system status is going to be
the stat or S-T-A-T command.
In this video, we wrapped up
our discussion on operating system forensics.
In the next video, we're going to talk
about network forensics.