Jason: Forensic tools. 2 2
In this lesson, we are going to talk about forensic tools, 3 3
which is specialized applications 4 4
and hardware that we use to do data collection, 5 5
data analysis, and data acquisition. 6 6
Now, digital forensic kits are something 7 7
that we're going to put together 8 8
with a lot of different tools in it. 9 9
This is going to be a kit containing the software 10 10
and hardware tools required 11 11
for us to acquire and analyze evidence 12 12
from system memory dumps and mass storage file systems. 13 13
Now, this is important 14 14
because digital forensic software is specialized software 15 15
that's designed to assist in the collection and analysis 16 16
of this digital evidence 17 17
because you can't just copy it like you would a file 18 18
from your hard drive onto a USB drive. 19 19
You can't just drag and drop it. 20 20
There's special ways you have to do this 21 21
to make sure it's forensically sound. 22 22
Now, there are lots of different tools out there, 23 23
but the ones we are going to focus on 24 24
in this lesson is EnCase, 25 25
the Forensic Toolkit also known as FTK, 26 26
and The Sleuth Toolkit. 27 27
These are the three big ones that we're going to cover 28 28
inside the CySA+ curriculum. 29 29
Now, just an exam note here, 30 30
you don't need to know how to use these tools for the exam. 31 31
You should know what they are, and if you see their name, 32 32
you should know they're digital forensic tools. 33 33
First, we have EnCase. 34 34
And EnCase is a digital forensic case management product 35 35
that was created by guidance software. 36 36
It uses built-in pathways or workflow templates 37 37
that will show you the key steps 38 38
in many types of investigations. 39 39
Remember how I said it was really important 40 40
to follow a written process? 41 41
Well, these pathways and workflows help you do that. 42 42
They give you all the key steps that you need 43 43
as you're going through your process, 44 44
almost like a checklist. 45 45
Now, when you look at EnCase, 46 46
it is a graphical user environment, and it runs on Windows. 47 47
The great thing about it is you can use it 48 48
for both acquisition and analysis. 49 49
EnCase is a very powerful tool, 50 50
and it can read bit-by-bit copies of the hard drive 51 51
and do the analysis inside the slack space 52 52
and the deleted files and bring those back to life. 53 53
It can also help you with things 54 54
like timeline generation and lots more. 55 55
We're going to talk about more 56 56
of these features later on throughout this section. 57 57
Next, we have FTK, the Forensic Toolkit. 58 58
This is a digital forensic investigation suite 59 59
by AccessData, and it runs on Windows servers 60 60
or server clusters that allows for faster searching 61 61
and analysis due to the way it does data indexing 62 62
whenever you import evidence. 63 63
Now, most of the features you're going to find in EnCase 64 64
you're going to find in FTK as well. 65 65
They are really the two big competitors 66 66
in the digital forensic software market, 67 67
and they're both commercial solutions 68 68
that cost a lot of money. 69 69
Now, when you look at FTK, 70 70
it looks a lot like EnCase, right? 71 71
You see a lot of the same things. 72 72
It has the same kind of style inside the windows. 73 73
You can see, down at the bottom, 74 74
the binary data written in hexadecimal value 75 75
with the ask key off to the side. 76 76
You can see the files up and top in the file list 77 77
that it's found as it's gone through this hard drive. 78 78
And you can see it has basically the same type 79 79
of stuff that you found in EnCase. 80 80
Next, I want to talk about The Sleuth Toolkit. 81 81
Now, this is a good one for you 82 82
to start learning how to use digital forensics. 83 83
The reason for this is 84 84
it's an open source digital forensics collection 85 85
of a lot of different command-line tools 86 86
and programming libraries for disc imaging 87 87
and file analysis, 88 88
and it interfaces with a program called Autopsy 89 89
that is the graphical user front end interface for this kit. 90 90
Now, the great thing about The Sleuth Toolkit 91 91
it is a completely free and open source solution. 92 92
So you can go Google The Sleuth Toolkit 93 93
and download it and install it on your machine right now 94 94
and start playing with it. 95 95
Now, The Sleuth Toolkit looks a lot like the other ones 96 96
when you're using it on Windows, 97 97
again, graphical environment 98 98
and it's basically made to be a clone of FTK or EnCase 99 99
but in the open source, free for you to use market. 100 100
So you may be wondering, 101 101
"Jason, which one should I learn to use?" 102 102
Well, it really comes down 103 103
to which one your organization uses. 104 104
Now I like to start out with The Sleuth Toolkit, 105 105
'cause again, it's free and it's open source, 106 106
but if you can get access to EnCase or FTK, 107 107
it's great to try learning those as well. 108 108
And both of those do have free demos 109 109
that you can download and use. 110 110
Now as an analyst, 111 111
which one are you going to become proficient in and use? 112 112
Well, most likely you're going to be using EnCase or FTK. 113 113
Why? 114 114
Because if you're doing forensic analysis, 115 115
you're probably working for a corporation 116 116
or you're working for law enforcement, 117 117
and most police stations 118 118
and law enforcement use either FTK or EnCase, 119 119
and which one you're going to use is going to be based 120 120
on the place that hires you. 121 121
If they're already using EnCase, 122 122
that's what you're going to use. 123 123
If they use FTK, that's what you're going to use, 124 124
and that's the idea here. 125 125
As a student, I would go ahead 126 126
and download The Sleuth Toolkit 127 127
and start learning how that works, 128 128
and I'll actually show you how I use The Sleuth Toolkit 129 129
a little bit later on in this section 130 130
as I do a demonstration for you. 131 131
Now, in addition to having the software, 132 132
you also need hardware. 133 133
And when you start dealing with a forensic workstation, 134 134
these things have to be powerful. 135 135
Now, these are standalone forensic tools. 136 136
They're going to have lots of power behind them. 137 137
You're going to have multiple processors in this system. 138 138
You're going to have multiple cores inside the system. 139 139
You're going to have 32 or 64 or 128 gigabytes of main memory 140 140
in these systems. 141 141
You're going to have fast SSDs 142 142
to be able to run all this stuff, 143 143
and you're going to have a wide variety 144 144
of drive host bus adapters. 145 145
Things like EIDE, SATA, SCSI, 146 146
SaaS, USB, FireWire, Thunderbolt, 147 147
and pretty much any other connection mechanism you may need 148 148
because you might need to connect 149 149
an external drive of some kind 150 150
to your system to import that evidence. 151 151
So you want to make sure you have access to all of that. 152 152
In addition to that, you're going to have optical drives. 153 153
You're going to have CD, DVD, Blu-Ray, 154 154
and even memory card readers, all of this in one machine. 155 155
Now, in addition to all this, 156 156
your forensic workstation has to have access 157 157
to a high-capacity disc array subsystem 158 158
like a RAID or a storage area network. 159 159
And the reason for this is simple, evidence files are huge. 160 160
If you took an evidence collection 161 161
on my personal computer right now, 162 162
you would have two terabytes worth of data, 163 163
and that's just on one of my machines. 164 164
I have four or five machines 165 165
sitting around my office right now. 166 166
And if you came in here and collected on each one of those, 167 167
you would have 5, 10, 15 terabytes of information 168 168
that you're going to have to store. 169 169
If you came in to look at my server, 170 170
that's 40 terabytes of information. 171 171
And so you need to have access 172 172
to someplace to put these huge evidence files 173 173
as you're collecting them. 174 174
Now, another thing I mentioned before 175 175
was that we always want to do our analysis 176 176
on the copies of your acquired images. 177 177
You never do it on the actual drives themself. 178 178
So the way this works is 179 179
you're going to have the original evidence, 180 180
say a hard drive or an SSD. 181 181
You're going to make a bit-by-bit copy of that 182 182
and acquire that using your digital forensic tools. 183 183
Now that you have that acquired image, 184 184
we're not going to do the analysis on that image either. 185 185
We're going to make a copy of that image, 186 186
and that's what we're going to do our analysis on. 187 187
This way, we can always go back to the source image, 188 188
make another copy, 189 189
and do more analysis without affecting the original. 190 190
One last big warning here in this lesson, 191 191
as an analyst, you should always make sure 192 192
your forensic workstation is prohibited 193 193
from accessing the internet. 194 194
You don't want it to connect to the internet. 195 195
Why? 196 196
Because if you can connect to the internet, 197 197
that means the internet can connect to you. 198 198
And if the internet connect to you, 199 199
there's a possibility your forensic workstation 200 200
could be compromised with malware, 201 201
it can get a remote access Trojan, 202 202
and then a bad guy could get in 203 203
and start manipulating your evidence 204 204
and making it not say what it's supposed to say. 205 205
So you always want to make sure 206 206
that your forensic workstation is cut off from the internet. 207 207
This way, your evidence stays pure, 208 208
and so does your machine.