Evimetry Non-Linear Partial

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
or

Already have an account? Sign In »

Time
48 minutes
Difficulty
Advanced
CEU/CPE
1
Video Transcription
00:00
All right. Welcome to advanced. Ever Met Tree forensic acquisition. We'll talk about allocated nonlinear, partial and live images today
00:09
next. Gonna get a little bit fancier here. So the ever met tree nonlinear partial acquisition. I like to think of these as file type forensic images. So say I have a case where Andy and he's come up really commonly in civil litigation cases, things like this where
00:29
there's some sort of agreement between the two opposing parties
00:33
that says, You know, look, we're gonna all produce documents, but we're on Lee com'on produced,
00:38
you know, documents between this date range and this rate range, and we're only gonna produce, you know, word documents, excel, spreadsheets and email. Well, if I only have to produce, you know, a few document types, there's no sense maybe collecting the entire disc to do that. If I could do a bi file type collection,
00:58
Um,
00:59
so you know, the nonlinear file type nonlinear partial is the way to go about Doing that could save you a ton of time. You know, in my example here and this is this is one that comes up all the time. There's agreements between parties were like, Look, we just need to pull, you know, local local email stores off the computers,
01:18
you know? But we got 40 computers. Do them. It doesn't make a lot of sense to grab the entire disc to pull local email backups and things like that. We could do, Ah, nonlinear partial forensic image. And we could select common file types. The store emails like P s t o S T m s t m box. You know, am l am l ax all that sort of stuff. We just select those
01:38
and every metric. Oh, had run to the desk and grab all those specific files
01:42
without collecting all the rest of that unnecessary content that wouldn't help us out in, uh, in terms this case. You know, you have to understand the case. You have to understand the parties what their requirements are. But, you know, this could be a big time saver.
01:57
You know, vanity. You know, somebody advantage. There are your friends of damage. Could be much smaller. And it's on Lee gonna contain the content that you really need
Up Next
Advanced Evimetry Forensic Acquisition: Allocated, Non-Linear Partial, and Live Images

This free course covers advanced forms of disk imaging that can be invaluable in cases where acquiring large amounts of unused disk space is not ideal, and where only certain file types are needed when you need to collect data from a live system.

Instructed By