some volatile data considerations, though the decision to shut down the system should be made on a case by case basis obviously got destructive activity occurring on a system, and it is rapidly changing and the environment essentially untenable, and you're not going to be able to shut down
our stop that process.
Shutting down the system may be your only option.
Therefore, the decision to forego the collection of volatile data
depends on if it is reasonably expected to support the investigation.
So we talked about that earlier that a long time has maybe progressed from the time you became aware of the incident till
now. It may not be good
practice to collect that vault data because it essentially useless or you've lost control of that system. Two or three or four users have have logged on.
And then again, um, we also hinted that some of the processes that we are going to demonstrate do require some changes to the system. So collecting volatile data does require more extensive changes to the system and that can
override other, more valuable data.
So all of those types of considerations have to be thought of before collecting the data and or shutting off the system and forgoing the collection of that.
Another problem that you may encounter when trying to preserve evidence is in activity
an activity functions can limit
access that you have to a particular computer system.
you may have different sources of in activity, such as a power scheme
that will essentially activate itself to reduce power consumption to a device or an entire system.
You also have your screen saver, which will essentially lock computer after a certain period of time. If they have that screen saver that locks that when the computer
essentially is left alone some screen saver, it won't lock. But some might require a password on upon waking up. And then hibernation will simply cause Randi written to the hard drive and then content can be restored in power. It may require password.
one of the first things to consider when you come to a scene and you find a computer with a blank screen, it's too.
Ensure the monitors powered on
nothing appears on the screen, depressed the left ship, keep now depressing. That left shift key is
important because that is the only key that can't really be hot
to create some other process. So if you have a very technically savvy computer user and they've set up something on their system to when you push any other key. But that left ship P,
A C cleaner or bleach bit is going to run, start wiping everything on that system.
To wake that system up, simply press that left shift key, and the system should shouldn't wake itself up.
Uh, the other thing that we can do to prevent an activity functions
is to insert a mouse, jiggle er into the system and what a mouse jugular is. It's essentially a
looks almost like a very small thumb drive, and it mimics a human interface device such as a mouse. And it makes very slight mouse movements very occasionally, very sporadically, that keep the system from being
inactive and creating these in activity functions
that still allows the investigator to perform dysfunctions.
And this is an example of the weed B tech mouse jugular. They're relatively inexpensive. I think they're about 17 to 20 bucks, but you can buy those and then insert those into the operating system,
and it will prevent the system from becoming
the next consideration that we have when preserving data are the active connections and then connective ity is a data connection between two systems
and their most prevalent in modem or network connections to the Internet. So almost any system that you're going to encounter more than likely on 2016 is going to have some type of network.
Are are other type of connection to it, unless you're dealing with some type of true sneaker net system.
So with active connections, an investigator and does not have complete control system. So it's very important
to understand what the computer is connected to, who may or may not have control over that system.
So the network state may provide vital information to the investigation, such as remote storage. So if we were to immediately disconnect all of the network connections to the computer soon as we got there, we might lose some of that vital information.
That being said, data can be sent or received overactive connections and may permit someone to begin active destruction measures on the system.
So until we're certain that we had complete control over that system,
way can't necessarily let our guard down and assume that we are the only ones who may be working on that system.
So investigators need to conduct an assessment of the situation and determine terminating the connection. Is Morton.
Volatile? Information should be collected first unless it is apparent that connection must be terminated immediately.
So again it's going to depend on the situation. But the investigator must be cognisant of some of these considerations and do that continual assessment. A CZ. They're going throughout your investigation process.
terminated connections a wired connection can be terminated a CZ easily as removing a data cable from the back of the computer.
That being said, some computers, as soon as they're disconnected, they may revert back to a wireless connection or a Bluetooth connections. Wireless connections could be a simple is disconnecting the cable to the wireless access point
S. O. That entails being able to locate the wireless access point and generally in a home or business.
They're going to be near cable modems are near the TV,
and then any type of cabling can help identify
those access points if they're not readily apparent
and then access points are probably generally close to the computer due to the radio wave limitations, however. Keep in mind, though, that waits can propagate two other levels of home.
So if you're in a home setting, you could have
a WiFi network that, essentially hidden obvious, skated out of sight.
if you disconnect one wife by setting it, it's quite possible someone has another wife by setting very close by
that when you disconnect one, it will. I'll connect to another,
so you may also have to just completely disable the WiFi connections on that system as well.