We're back to the slides now, leaving the VM.
And again, I will go back into the VM
to show you some of this.
Under Tools, the features are always changing.
I am going to show you my favorite ones
that I want you to run.
And if you're taking notes at this point,
write this down because these are the things
that everyone forgets.
Enrichment engines-- this is where you can carve for media
files, you can carve for additional location
information.
There's a lot of things you can get from this.
On Section 4, we're going to talk about Malware scanner.
So for now, we're not really going to hone in on that.
That will be relevant coming into play.
Do not download offline maps into your VM,
or you will have a terrible experience
if it even boots again.
I think it's currently 90 gigs in size.
Not recommended for a virtual machine but may be helpful
if you work in an air-gapped lab where you cannot connect
to the network to then map locations,
that could be really helpful to you.
This Run fuzzy model plugin--
if you are taking notes, write that down.
That is something I want you to do
in every single investigation you work.
This is your only option to do this.
You go to Tools.
After it's parsed, you run fuzzy model.
It is going to uncover additional application
information that is relevant to you
in your investigations-- very, very important.
The AppGenie I'm going to cover here in a moment.
Also, run Cryptocurrency analyzer.
You can do that when you're loading evidence or on-demand
or on the fly after the fact.
So it's totally up to you.
Many of these things will be covered in this course.
I am not going to cover all of them
right now because you may get confused,
but I want to show you what some of these will look like.
So we go in to Tools, under Enrichment engines,
you see Media classification.
If it is grayed out, it's because it's not supported
for your level of extraction.
That is completely normal.
It is not an issue of SANS.
It's not an issue of your VM.
It is the data extraction you're looking at,
and you're going to see that in some of your labs.
We will talk about media classification coming up.
If we look at Run fuzzy model--
I'm actually going to click on it
and run it against this Lab 1.1.
You'll see it just looks like the blue spinning thing,
but if you look closely at the bottom,
you'll see that it's running the plugins down here
at the bottom right-hand side.
When it's done, you are going to have a new table that's
introduced in Analyzed data.
It's going to be called this Manual Data collected--
Manual Data Collection, sorry.
You can see we have 4,659 Fuzzy events and 3,094 Fuzzy objects.
And what this is, this is going through and saying,
hey, these are databases that may contain
application data of value.
So this first one is something for Chrome
called offline pages.
It gives you access to a snippet of what it found.
Here it looks like something prompting you to join Facebook.
Here we're looking at the best deep dish pizza in Chicago.
But it gives you access to the databases at the bottom.
Now, this is really important.
If you skip to the lab, you may struggle with this part.
Do you see here how it says creation time?
If you just keep clicking on it, this Unix epoch date/time stamp
is not going to make much sense.
But if you click on that down arrow--
let me zoom out just a little bit--
it's telling you the suggested way to decode it.
And then when you click on it, it
changes those into normalized date/time stamps.
So again, if you missed that, if I clear this,
you look at this date/time stamp,
this may not make sense to you.
If you click on the arrow and go with the suggested value
it then makes that readable, which is so much easier.
So let's do another one in this table.
If we go to last_access, we right-click,
it tells us microsecond.
We change it, now we have readable date/time stamps.
That's very helpful.
You will be writing queries later
in the section to do exactly what I
did with the press of a button.
If you have a lot of tabs open--
so let me open a few more--
and they leave the screen, and you swear you have them open,
if you look over here, there's this arrow.
It's going to show you everything that you have open.
So you could click on it, and it will take you to that view.
And again, if you want to close them all,
I usually go back to Extraction Summary, click the Control
and close all of this.