Part 9 - Forensics in Support of Incident Response

Video Activity

This lab-based lesson covers forensics in support of incident response. Participants receive hands-on instructions about forensics in support of incident response. Participants receive step by step instructions and demonstrations on the preparation of devices for data collection.

Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
7 hours 56 minutes
Difficulty
Advanced
CEU/CPE
7
Video Description

This lab-based lesson covers forensics in support of incident response. Participants receive hands-on instructions about forensics in support of incident response. Participants receive step by step instructions and demonstrations on the preparation of devices for data collection.

Video Transcription
00:04
>> Hello and welcome to Cybrary.
00:04
My name is Max Alexander and I'll be
00:04
your subject matter expert for
00:04
incident response in advanced digital forensics.
00:04
Today, we're going to pick up where we left
00:04
off in the last set of videos and cover
00:04
the hands-on portion of
00:04
forensics and supportive incident response.
00:04
If you watch the last set of videos,
00:04
we talked a lot about
00:04
the preparation and process that are
00:04
involved in doing
00:04
the forensics portion of incident response.
00:04
If you remember from the last set of videos,
00:04
we talked about the preparation phase,
00:04
the preservation phase, the collection phase,
00:04
and then the reporting and analysis of that data.
00:04
The first thing that we're going to do,
00:04
we're going to start off with
00:04
the preparation of all the types of devices,
00:04
hardware, and media that we're going to
00:04
need for our forensic response.
00:04
In preparation for all this,
00:04
we're going to want to gather up all of the software,
00:04
all of the hardware,
00:04
and all of the necessary equipment that we're going
00:04
to use in our forensic investigation.
00:04
As far as software and hardware are concerned,
00:04
some of the things that I'm going to show
00:04
here on how to use and that
00:04
we're going to use in this demonstration are going to
00:04
be the AccessData Forensic Imager,
00:04
the EnCase Forensic Imager,
00:04
and the USB Write Blocker ALL Windows version 1.3.
00:04
Of course, there are other types of software out there.
00:04
There are also hardware types of write blocker.
00:04
You can use whichever is familiar with you.
00:04
But these are some of the programs that we're going to
00:04
use today to do this demonstration.
00:04
In order to get these programs,
00:04
you can just open up a window and you can
00:04
navigate to the AccessData web page.
00:04
From there, you can click on
00:04
the digital forensics link and then from
00:04
there it will take you to
00:04
the current releases of your digital forensic software.
00:04
As you can see, they've made quite a bit.
00:04
Some of the software is free and
00:04
some software requires a paid subscription to use.
00:04
We are going to use the FTK Imager,
00:04
so you can click on that.
00:04
It's going to give you three options.
00:04
You can click on any of these options,
00:04
they'll all work fine.
00:04
There are no issues with that.
00:04
I am using the FTK version 3.4.2
00:04
>> for this demonstration.
00:04
>> However, you can also
00:04
download the FTK Imager Lite version.
00:04
All these programs can be put on your forensic machine.
00:04
They can also be put onto a thumb drive
00:04
>> and used on a victim machine.
00:04
>> But to download this,
00:04
you'll just go to the download page.
00:04
It will give you a link to download this now
00:04
>> and you can install that onto your forensic machine.
00:04
>> The EnCase Imager is the same process.
00:04
You can just navigate to
00:04
the guidance software website,
00:04
guidancesoftware.com/EnCase-forensic-imager.
00:04
Then you can fill out
00:04
your contact information and click "Submit".
00:04
You will be able to download
00:04
the EnCase Forensic Imager onto your forensic machine.
00:04
You can also again download that to
00:04
a thumb drive or use on your victim machine.
00:04
Also, we're going to have the USB
00:04
Write Blocker ALL Windows version 1.3.
00:04
To get there, you can go to
00:04
the sourceforge website just by
00:04
typing in the USB
00:04
Write Blocker ALL Windows in the Google search.
00:04
That will take you to the sourceforge.net download page
00:04
>> and you can download that from here.
00:04
>> It will download and then you can
00:04
install that onto your desktop.
00:04
Those are the three pieces of
00:04
software that you're going to use.
00:04
But again, also the software portion
00:04
is just one part of the preparation phase.
00:04
You're going to want to prepare your camera.
00:04
You're going to want to prepare any type of
00:04
note-taking equipment that you're going to need,
00:04
pens, pencils, paper, evidence tags,
00:04
markers, a backup to your camera, and
00:04
preparation of any media that you might
00:04
use in that acquisition process.
00:04
By media, I'm talking about the SD card in
00:04
the camera and/or your portable hard drives or
00:04
thumb drives that you're going to use to start
00:04
imaging some of these victim machines
00:04
that you're going to come across.
00:04
That's what we're going to start with now,
00:04
is the wiping and sanitization of our forensic media.
00:04
The first part of the process
00:04
>> is you're going to actually
00:04
>> insert your thumb drive into your forensic machine.
00:04
>> Once you do that,
00:04
>> you should see the drive letter pop up,
00:04
mine popped up in this drive letter E,
00:04
yours might pop up as something different.
00:04
We can just close out of that window.
00:04
We're going to navigate to our EnCase Forensic Imager.
00:04
Double-click that.
00:04
You get these pop-up windows.
00:04
Just click "Yes", I just reinstalled windows
00:04
on my machine so I get these pop-ups.
00:04
I also have password set up so you may or may
00:04
not have password on your system.
00:04
If you do, just click "Yes" to navigate through that.
00:04
You'll eventually get to the EnCase Imager main page.
00:04
From here, we're going to click "Tools".
00:04
We're going to go to Wipe Drive and then select "Next".
00:04
Then from there, we're going to see
00:04
that our drive letter E popped up.
00:04
We have the logical portion
00:04
and then the physical disk itself.
00:04
We are going to wipe
00:04
the physical disk and we're going to select "1".
00:04
Then we will go and click on the "Next" key.
00:04
From here, it's going to ask you if you want
00:04
to verify wipe sectors,
00:04
leave that check as yes,
00:04
>> and then it's going to ask you what type of
00:04
>> characters you want to
00:04
overwrite all of the data on your [inaudible] .
00:04
I just leave that as the default zeros.
00:04
From here, we'll click "Finish".
00:04
It's going to ask you if you
00:04
want to destroy all information on
00:04
your device and that's going to force you,
00:04
>> you can type, yes. Type Yes.
00:04
>> Click "Okay". Then you will see a notification
00:04
down the very bottom right-hand corner
00:04
of the EnCase Imager that says it is wiping.
00:04
Eventually, that will change to a
00:04
>> countdown timer telling
00:04
>> you how long left
00:04
EnCase is going to be in wiping your device.
00:04
As you can see, I have one hour and
00:04
58 minutes left in wiping my device and this
00:04
is one of the reasons why you want to have all of
00:04
your forensic media prepared beforehand
00:04
because you don't have time to wait around
00:04
for an hour and 58 minutes when
00:04
you're trying to do your forensic investigation and
00:04
time is very much important to you.
00:04
I will save you all the trouble of waiting
00:04
here with me for an hour and 59 minutes,
00:04
two hours, for this thumb drive to be wiped.
00:04
We can click on the "Wipe",
00:04
>> it'll ask if we want to cancel.
00:04
>> For this demonstration, we're going to click "Yes".
00:04
However in the field, you would not want to do that.
00:04
You would want for it to be wiped completely.
00:04
After that is finished wiping,
00:04
it will just go back to a blank bar.
00:04
>> Down at the bottom.
00:04
>> It won't really give you a notification
00:04
that the wipe is complete.
00:04
The notification will be that there is no
00:04
more wiping being conducted.
00:04
Any of that, we're going to cancel the process.
00:04
To save some time, we'll click "Yes".
00:04
However, from here,
00:04
after you get this blank screen
00:04
when your device is done wiping,
00:04
if you want to actually see what it did,
00:04
you can go to the console view by clicking
00:04
the application button underneath
00:04
>> the EnCase Imager name.
00:04
>> Then go to View and then scroll down to Console.
00:04
Then from here, you can see that
00:04
the EnCase Imager was working.
00:04
We canceled the process.
00:04
This is our start date and time
00:04
and our stop date and time.
00:04
This is the elapsed time that ran.
00:04
It was working on one device
00:04
>> and then the total sectors.
00:04
>> This will tell you the read,
00:04
write, and verify errors.
00:04
If you let this run all the way through completion,
00:04
it will tell you exactly what
00:04
it did and if there were any errors.
00:04
You can also take this and copy it.
00:04
If you're doing electronic notes,
00:04
paste that right over into your notes.
00:04
That way you can see exactly when
00:04
you start it and stop this process.
00:04
Or hopefully, you've already had this pre-done and
00:04
you can verify that the device is wiped,
00:04
which we'll go over a little bit later.
00:04
But before we can verify the device,
00:04
we actually have to format it first.
00:04
That is the next part of the process.
00:04
We will go back to
00:04
our device and it's
00:04
going to tell us we need to
00:04
format it before we can use it.
00:04
We're going to click "Format Disk".
00:04
We see that it has a capacity of 5.8 gigabytes.
00:04
It will give us an option for
00:04
the file system, exFAT or NTFS,
00:04
select exFAT or FAT if possible,
00:04
that way you can use your device across
00:04
most operating systems and
00:04
not limit yourself to specific operating systems.
00:04
You can leave the default allocation size.
00:04
If you want to label your volume, you can label it.
Up Next