-: Let's dig a little bit deeper into forensic software
and the different types of software that you're gonna find
inside your kits,
whether they're your standard kit
or your mobile forensic kit.
Now, when we start talking about software,
there is two basics types as I mentioned before.
There's commercial and there's open-source.
Commercial software, you have to pay for.
Open-source generally tends to be free,
or there's some sort of a support fee
that might be associated with it,
and there's different ones for different things.
You might have one for imaging, analysis,
hashing and validation, process and memory dumps,
password cracking and log viewing.
We're gonna talk about each of these
and some of the software tools associated with them
in this lesson.
So we talk about imaging media and drives.
This is the collection of information
from a suspect's drive.
This would be a bit by bit copy of the drive,
including the slack space and the unallocated space.
This way it is a mirror image of that drive,
not just the data on the drive,
but any hidden files or hidden residual information.
Now you can use many different tools to do this,
but the three big ones out there
are two commercial tools and one open-source tool.
The commercial tools are FTK Imager and EnCase Imager.
Now, both of those products are free to use.
They will give that to you free
because they want you to use those,
because that creates a proprietary format
of that disk image that can only be read
inside their own analysis tools,
known as FTK and EnCase.
Now the third one is DD,
and dd is an open-source tool.
In fact, dd, you're gonna find on every Linux,
Unix, and Mac system by default.
So it's great and widely available.
It does a great job of it.
It's a command line tool, and it's completely free.
Now, analysis software.
This is gonna create a timeline
of the system changes that occur.
This can validate a file against a known good file,
so you can find out if malware has been in it,
or somebody has modified something,
and it can do file system analysis changes for hidden files,
changes, access, and metadata.
So it can actually search through and find anything
that might be hidden using stenography
or other such techniques.
There's ability to do Window Registry analysis
using some of these tools,
and log parsing and analysis.
Some good examples of these again is FTK and EnCase.
Those are kind of your all=in-one forensic tool suites.
And then from an open-source perspective,
you have SIFT, which is made by SANS,
CANE, and Autopsy,
and Autopsy is part of that Sleuth toolkit,
which is another great open-source tool.
Now, when you start looking at hashing and validation,
what is that?
Well, hashing is when you create a unique
file integrity check of a disk image
after you create the file.
So when I copy the disk image off your hard drive,
I'll do a hash which creates
a unique fingerprint of that drive,
so everybody knows that is what the drive look like
when I collected it.
If any changes to my image occur,
that hash is gonna be different,
and then it can get thrown out in court.
This is used as part of your chain of custody.
EnCase has a built in hash as part of its file format.
So if you're using the EnCase Imager,
it will create the files in a .EO1 format,
and that is gonna have a has built in.
If you're gonna be using FTK or using dd,
it will do what's called an MD5, a SHA1 or a SHA256 hash.
Now, dd doesn't do it by default.
You'll have to run that image across an MD5
or a SHA hash after you're done creating it.
But again, it's not that hard
and there are open-source tools to do that.
The next thing is processor and memory dumps.
So, if we have the state of the operating system
and all the processes that are currently running,
all that data that's being in memory
at the time of collection can be collected.
This can be done by using what's called a memory dump.
This can be difficult to collect
without changing the actual contents of the memory though,
because memory is changing constantly all the time.
And running that dump requires you
loading a program into memory,
which therefore creates some of the memory that gets lost.
This is useful to capture things
like decryption keys for full disk hard drive encryption,
because if I turn off the computer
and that drive has BitLocker
and I don't know the password,
I am not gonna be able to analyze that drive well.
So it's better to collect it from memory,
try to get that decryption key,
and then I can use that to unencrypt the drive.
Hibernation files and crash dumps can also be useful
because when you hibernate,
which is when you put your laptop to sleep,
it takes everything in memory
and copies it to a file in the hard drive.
Same thing when you have a crash,
it's gonna dump the memory into a file in your hard drive,
and that can be looked at and analyzed using special tools.
Now, what are those tools that you can use?
Well, if you wanna do a memory dump,
there's two really good ones in Linux.
One is called fmem and the other one is LIME.
Fmem is by far more popular.
Now in Windows, we use programs like Dumpit.
If you're using Windows, Linux, or OS X,
there is a commercial tool suite that we can use
called the Volatility Framework
that will do processor and memory dumps for you.
And again, EnCase and FTK
both have the ability to do memory dumps
and analyzing those crash files.
The memory dumps are usually stored
on a Windows machine in the system root directory,
under the memory.dmp file.
And these dumps can also be analyzed using
Microsoft's free tool, which WinDbg or Windows Debug.
Again, that's another free tool that you can use,
so you're not reliant on those commercial open-source ones,
like EnCase and FTK,
even those are a little bit easier to use.
Now, password cracking and recovering.
Let's say that you got a file that you collected,
and it was encrypted using a password,
or is protected with a password.
How are you gonna get into it?
Well, you're either gonna have to guess the password,
get the suspect to tell you the password,
or you're gonna have to crack the password.
Now, every password out there can be cracked.
It's just a matter of time and effort.
But if it's a long and strong password,
it can take millions of years
to crack a password using brute force.
There are lots of tools out there
to do password cracking though.
There's John The Ripper, Cain and Able,
and other hacking tools that can be used.
And then there's ones that are specific
to us using inside the forensic world.
Now, if you have doc file, a spreadsheet file,
like an xls or Excel file, a PowerPoint file, or a zip file,
these too have the ability
to password protect the files individually as a user.
Well, their passwords are not that strong,
and so there are cracking tools for it.
Thinks like Advanced Office Password Breaker.
ElcomSoft has the Distributed Password Recovery software
that will actually allow you to use multiple computers
to split the brute force load
and try to attack that password quicker.
And you have Zip Files 2 John
if you're trying to crack a zip,
and numerous, numerous others.
If you're in the forensic world
and you're doing a lot of password cracking and recovering,
you're gonna work with other people in the industry
to find out what is commonplace
and which are the best tools to use
for your particular situation.
Now log viewers.
Log viewers are there so you can look at these text logs
in a very clean and easy to look at format.
They can also have some ability
creating timelines and visualizing the data
across the timeline,
so you can know when things happened,
when changes occurred, when accesses were made,
and the logs are gonna give you all of that information
in a nice clean viewable way of doing it
if you're using a log viewing software.