Hello, and welcome to this module, Using PowerForensics to Perform Disk Analysis.
The goal of this module is to utilize PowerForensics,
and to do this, we're going to first understand what disk forensics actually is.
We'll then move on and review how to use PowerForensics and really what that is.
We'll look at installing and importing
PowerForensics into our PowerShell session.
We'll then look at performing hard disk forensics, and then we'll
look at how we can create a timeline of activities and events
using PowerForensics across the disk.
So first off, let's understand live response and forensics.
The first phase of this is an initial triage, and this is where we retrieve
system information that we've already talked about, for example,
going back and getting memory details or hard disk
information or services or processes.
The second step after this initial triage is the examination,
and this is where we can analyze the disk storage for further
supporting evidence that maps to some of the initial triage
information that we retrieved.
So let's say that we went through and grabbed a bunch of processes and
services that were executing and we found that there were also matching or
corresponding disk changes that matched the processes.
Now we're able to potentially understand what is going on.