-: Digital forensic toolkits.
In this one, we're gonna talk about different components
that make up these digital forensic toolkits.
As we've mentioned before,
these consist of many specialized components
both hardware and software
that are needed to conduct collection and analysis
of data when you're in the field.
Tool kits are gonna vary widely in cost and capability.
There are some free open-source options
and then are toolkits that are commercial
that cost between five, 10 and 15 and $20,000
for each copy of the software.
These seem to be very expensive
but they have a lot of capability.
And so we'll talk about some of those as we go through.
The toolkit is gonna consist of many things
including a digital forensic workstation
which is your collection platform
as well as administrative tools.
So let's dig into each of these components
as we go through this lecture.
The first one we're gonna talk about
is a digital forensic workstation.
This is a really powerful computer.
It's gonna conduct the data capture and the analysis
of those imaged files.
You wanna make sure you have a workstation
that has a lot of power.
It has multicore CPUs or processors.
It's gonna have a lot of RAM,
16 32, 64 gigabytes of RAM in the system.
And they should have large, fast storage.
Often they'll use the operating system will be on SSD
or a solid-state drive
and then you'll have large radar rays
for all of the images that you're gonna be going through
because when you take an image of a machine
it can be several terabytes just for one computer.
Think about your computer you're using at home.
How big is its hard drive?
If it's a one terabye hard drive,
that means if I take a forensic image of it,
it's gonna be atleast one terabyte in size, right?
And so if I'm doing that for three or four or five
things in your network,
I'm gonna have to have a lot of disc space to capture that.
So that's why lots of fast and large storage is a necessity.
Now when you start looking at the software,
there is many different types of software
and the software is used to capture
and analyze those forensic images.
There's imaging software like the FTK toolkit imager
which is FTK imager.
There's the in-case imager
and then there's other ones like DDE
and other ones that we'll talk about later.
But then you have the analyzing part of it,
and there's several for those.
And you could see those here on the screen.
We have FTK, which is the forensic toolkit.
We have EnCase, we have SANS forensic toolkit
which is the SIFT.
We have the Sleuth toolkit, which TSK.
And the first two, FTK and EnCase
are both commercial products.
And they're very expensive.
You can pay between five and 10 or $15,000
for a copy of their software.
But they have a lot of good capability.
Now when you look at SIFT or TSK,
those are open source and free programs.
They still have a lot of capability,
but they're not nearly as easy to use
and they don't have as much capability as EnCase or FTK.
So if you're gonna be working
for a law enforcement organization,
they're probably gonna have FTK or EnCase.
If you're working for an organization
that doesn't do forensics on a daily basis
and you just have a specific need to do it this time,
you may be stuck using something that's open source and free
like SIFT or TSK.
Now they still have a lot of capability,
but they are much harder to use.
So you're gonna have to take time to play with them.
We'll actually use SIFT in a lab environment
in this course,
I'll show you an example of how SIFT works,
so you can get an idea of what it looks like.
Write blockers.
The next thing you need is a write blocker,
and this is when you go to take the disk image
which is a copy of the disk
of the machine that you're gonna be capturing.
So when you copy a hard disk
from somebody's laptop or desktop during investigation
you wanna make sure you're not changing
the data or contents on the drive.
So let's use the example of law enforcement.
If I was a police officer
and I came in and captured your laptop,
and I suspected there was kitty porn on it for instance
which is illegal, I would wanna make sure
that I copy the image to be able to use it in court.
Well if I didn't do a forensically sound image
then your attorney can say that I changed it
and I put the kitty porn on there.
So we need to make sure that we capture
in a forensically sound way, and we create a hash of it.
Now there's two different ways to do that,
and by using write blockers,
we verify that we have not written back to that victim's
hard drive.
Now there's a hardware variant
and there's a software variant.
A hardware variant is gonna be using a piece of hardware
as you can see here on the screen
that you connect hard drive through
before it connects to my forensic workstation.
And it will make sure that it's a one-way read.
I can read from your victim's drive
but I can't write back to it.
This ensures the integrity of the captured data.
Now software can be done through the registry.
It's not considered as forensically sound.
So if you're in law-enforcement,
you're gonna wanna use a hardware variant.
If you're doing this from an organizational response,
it's okay is a software one
but it's much better to use a hardware one
if you can get it.
The problem with the hardware ones is they're expensive.
The one on the screen for instance is one of the models,
they can cost several hundred dollars
or several thousand dollars
depending on the right blocker you get.
Now the next thing we have is what's called
a forensic disk duplicator or drive duplicator.
Now the benefit of this
is instead of having tie up my forensic workstation
to do the capturing, I can put the drives attached to this
and all it is is a single machine
that does nothing but duplication.
It will copy the hard drive as a bit by bit copy,
including the slack space and the empty space on the drive
and make sure that I have a forensically sound image.
All this thing does is copy things in
and puts them out onto another drive.
So I can capture your drive, hook it up
and then it'll go right to a blank drive
and copy the images for me.
This works very well and works fairly fast,
but again when you start having large disk images
like one terabyte or two terabyte hard drives,
it's gonna take eight, 10, 12, 16 hours to do it.
So by using this drive duplicator,
I can free up my forensic workstation
so that I can use that for analysis
and use this just for the imaging.
The next thing you need is a bunch of wiped drives
or removable medium.
Now what's a wiped drive?
These are clean hard drives
that are ready to receive disk images on.
So again, if I'm gonna take your laptop
that is a one terabyte drive, and I need to copy it,
I need a blank one terabyte drive to copy it to.
And so by having those in my toolkit ready to go,
I save myself a lot of time.
These drives are prepared in the lab
before we go out into the field
using a drive wipe utility,
where essentially it writes zeros across the entire drive
or some other known set of data.
And that allows us to know that it is a good wiped drive
and it is ready to be used.
Cables and drive adapters.
The next thing you need in your toolkit
is cables and drive adapters, why?
Because you never know what you're gonna face
when get out into the field, especially in law-enforcement.
So if I was working with law-enforcement, with the police
and they called me and said, "Hey,
"we need to collect on this suspect's drive."
How do I know what kind of drive it is?
Is it an old IDE cable?
Is it a PADA cable?
Is it a SATA cable?
Is it USB?
Is it micro USB?
I don't know.
So I wanna make sure I have all those type of cables
with me in my kit
so that I can connect to any media I find in the field.
The one on the screen here is an example of a SATA cable
which is the most common nowadays
but again it's not the only one you're gonna find out there.
The next thing in our toolkit is gonna be a digital camera.
And a digital camera is useful for documentation purposes.
We can use it to photograph the system layout,
system configurations, drive labels,
and how a machine is cabled.
If we look at the picture on the left for instance
this is a network switch
with a lot of different cables in it,
and they're not really labeled well.
So if I wanted to go and get that blue cable in the center
and unplug it,
so I can stop the attacker from hitting our network
I can snap a picture, unplug it
and later on be able to use that as documentation
that it was connected.
Now on the right, you can see here
that I have a hard disk drive connected by a PADA cable
or IDE cable.
Again, I can unplug that if I needed to, image the drive
and then I can put it back in.
This all serves as part of my documentation
in addition to writing things down,
taking pictures can be very helpful
'cause again, a picture's worth 1000 words.
The next thing we want is a label maker and labels
because as I start unhooking all of these things,
I'm gonna need to label them.
'Cause if I start unhooking that network switch of the left
because I need to take it with me to image it,
well there's about 15 cables in there.
Are you gonna remember which cable went into which port?
By labeling them with a label maker,
you can label them all one through 15,
make some notes and then you'll be good to put it back
later on during the recovery phase.
And documentation and checklist.
This is our last one.
We wanna make sure we have all the documentation we need
so that can be things like playbooks,
incident response forms, custody forms
and anything else that we might need.
Any of these checklist and documentation
will be in our toolkit,
so that we're ready to go whenever we arrive
on the scene for this forensic investigation.