So after we finish wiping the device, we're going to have to format it. So the next step of the process is to go
and we're going to find our thumb drive,
and it's one. Tell us we formatted so we could form at it.
From here, you will see that it's a 57.8 gigabyte capacity. The file system that's going to give you options between expat and NT F s Leavitt of X factor fat if given the option that way, you can use your device across multiple operating systems and not just limit yourself to one operating system.
You can leave the allocation unit as the default setting the volume name. If you want to name your device,
and then lead the quick format. Setting a zit is like start on its one to tell you that you're going to erase all the data on the desk that we've already erased all the data on the desk
and for Mattis complete clothes.
And we can see here now that we have a forensic,
some drive in our drive. Letter E.
If you want to verify exactly what is on your device,
you can go to the access data F K imager.
Just click through those props,
and you're going to add in evidence item.
It's going to be a physical Dr.
And we're going to swirl to the location of our drive. It's going to be that SanDisk ultra us be 62 gigabytes
and then it's mounted our device.
you can see that the first part of this is giving you information about the file system on the device.
And then as we scroll down
you can see that there's actually a little bit of data left on there. If we'd probably let it run
more, it would have gotten rid of that. But then the rest of the device of actually formatted it before is all zeros,
so we can see that the device has been
So from here, the next part of the process is to actually ensure that we have all of the right blocking technology set up and ready to go before we start inserting any of the seized media into our forensic machine and we begin imaging it.
That way we can ensure that we're not going to write data to the seized media and contaminating taint the evidence that we've ceased, which would essentially render all of it useless. The whole part of forensics and digital forensics is too
preserved the evidence in its original state.
That way we can look at an exact copy and duplicate of that evidence.
So in order to ensure that we're going to preserve that evidence, we have to install some type of right blocking technology on our forensic system. So that could be that hardware right blocker That's in line with that device that you've seized. Or it could be a software right block.
we're going to use the USB
right block. So we will click on that,
And from here, you're going to come to a screen
uh, hit one to enable the USB right blocker and hit two to disable the USB right blocker in three to exit.
We want to enable the right blockers were going to type one
and then hit into. And then you're gonna get these pop ups if you haven't turned this thing off
on windows, Just cook. Yes.
And then it's going to tell you to type any key to continue.
So now we've continued.
And as you can see at the top of the status notification, the USB right blocker is on.
Now. We haven't taken out the drive that we just forensically wife, so you will be able to write to that device. However,
any other device that you insert into the system, you will not be able to write to that device.
So just as an example, don't do this in the field.
But as an example that you can write data to your device. I'm just going to drag the in case imager over here
and just click yes through that.
So if you can see, I was able to copy the in case forensic imager to our thumb drive. So it is not right block and able
so we can get rid of that
Uh, and then once we have the right blocking software turned on, we are ready to insert our seized media. In this case, we're going to be using a seized thumb drive
However, before we begin
inserting the media into our forensic machine or
capturing the data, we want to record any type of specifics specifics about this device. So when you're on the scene of your investigation before you start picking up any media, and before you start doing your actual
duplication of the media, you're going to want to denote in your notes what type of device that you have. And you're also gonna want to take a picture of where the device was found,
uh, and also record that in your notes. That way, we're whoever comes behind you, if you have to go to court, can see exactly what it is that you did. So if you found this thumb drive beside a laptop, you would first want to take a picture of where you found it and then record in your notes
photographed a thumb drive and the exact location of where that drive was located,
and then you're gonna wanna record the description of the vice. So in our case, I have a Grey
Cruiser titanium 2.0 gigabyte thumb drive created by San desk
And then, of course, on the back, you're going to have a serial number.
And that's where your magnifying class
on flashlight would come in handy.
This device serial number is Bravo Echo 01
And you would want to put that in your notes that this is the device that you recovered from the scene and the vice that you're imaging.
After you have all of that recorded in your notes,
you can then begin the imaging process.
So from here, we're going to insert the device
into our forensic machine,
and we're going to get some pop ups.
And as we can see, we've got some files on our drive Letter G,
and they are right Blocking software should be unable. Now, just as a test and demonstration purposes for this video, I'm going to try and write a file to drive letter g. Do not try this in the field again. You want to preserve evidence and not taint or destroyed the evidence
in any way possible, but to show you that the right blocker is working,
we're just going to try and move a file our program over to it,
so just drag something over there,
and then it's gonna tell you that the desk is right protected.
Remove the right protection or use another desk so we'll just hit. Cancel. So as you can see, the right protection is on an able. If you have concerns about your software hardware before you actually get out to the scene and start doing your incident response and forensic examination,
you should test out your software or hardware to ensure that it works. So as you can see from this demonstration, the right blocking software is on, and we cannot alter the data that is on drive letter Jeep.