Enviar pesquisa
Carregar
File000132
•
0 gostou
•
516 visualizações
Desmond Devendran
Seguir
Tecnologia
Denunciar
Compartilhar
Denunciar
Compartilhar
1 de 65
Baixar agora
Baixar para ler offline
Recomendados
File000128
File000128
Desmond Devendran
File000124
File000124
Desmond Devendran
File000125
File000125
Desmond Devendran
File000131
File000131
Desmond Devendran
File000129
File000129
Desmond Devendran
File000174
File000174
Desmond Devendran
File000123
File000123
Desmond Devendran
File000121
File000121
Desmond Devendran
Recomendados
File000128
File000128
Desmond Devendran
File000124
File000124
Desmond Devendran
File000125
File000125
Desmond Devendran
File000131
File000131
Desmond Devendran
File000129
File000129
Desmond Devendran
File000174
File000174
Desmond Devendran
File000123
File000123
Desmond Devendran
File000121
File000121
Desmond Devendran
File000126
File000126
Desmond Devendran
File000127
File000127
Desmond Devendran
File000122
File000122
Desmond Devendran
CHFI 1
CHFI 1
Desmond Devendran
File000138
File000138
Desmond Devendran
File000115
File000115
Desmond Devendran
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
OlehLevytskyi1
Ch12
Ch12
Raja Waseem Akhtar
File000136
File000136
Desmond Devendran
Ch11
Ch11
Raja Waseem Akhtar
Ch07
Ch07
Raja Waseem Akhtar
Ch04
Ch04
Raja Waseem Akhtar
Ch10
Ch10
Raja Waseem Akhtar
Debian Linux as a Forensic Workstation
Debian Linux as a Forensic Workstation
Vipin George
Notes for LX0-101 Linux
Notes for LX0-101 Linux
Chris Henson, CCNP
File000141
File000141
Desmond Devendran
File000139
File000139
Desmond Devendran
Ce hv6 module 53 hacking web browsers
Ce hv6 module 53 hacking web browsers
Vi Tính Hoàng Nam
Ce hv6 module 41 hacking usb devices
Ce hv6 module 41 hacking usb devices
Vi Tính Hoàng Nam
Memory forensics
Memory forensics
Sunil Kumar
File System Implementation - Part1
File System Implementation - Part1
Amir Payberah
File000173
File000173
Desmond Devendran
Mais conteúdo relacionado
Mais procurados
File000126
File000126
Desmond Devendran
File000127
File000127
Desmond Devendran
File000122
File000122
Desmond Devendran
CHFI 1
CHFI 1
Desmond Devendran
File000138
File000138
Desmond Devendran
File000115
File000115
Desmond Devendran
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
OlehLevytskyi1
Ch12
Ch12
Raja Waseem Akhtar
File000136
File000136
Desmond Devendran
Ch11
Ch11
Raja Waseem Akhtar
Ch07
Ch07
Raja Waseem Akhtar
Ch04
Ch04
Raja Waseem Akhtar
Ch10
Ch10
Raja Waseem Akhtar
Debian Linux as a Forensic Workstation
Debian Linux as a Forensic Workstation
Vipin George
Notes for LX0-101 Linux
Notes for LX0-101 Linux
Chris Henson, CCNP
File000141
File000141
Desmond Devendran
File000139
File000139
Desmond Devendran
Ce hv6 module 53 hacking web browsers
Ce hv6 module 53 hacking web browsers
Vi Tính Hoàng Nam
Ce hv6 module 41 hacking usb devices
Ce hv6 module 41 hacking usb devices
Vi Tính Hoàng Nam
Memory forensics
Memory forensics
Sunil Kumar
Mais procurados
(20)
File000126
File000126
File000127
File000127
File000122
File000122
CHFI 1
CHFI 1
File000138
File000138
File000115
File000115
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
MacOS forensics and anti-forensics (DC Lviv 2019) presentation
Ch12
Ch12
File000136
File000136
Ch11
Ch11
Ch07
Ch07
Ch04
Ch04
Ch10
Ch10
Debian Linux as a Forensic Workstation
Debian Linux as a Forensic Workstation
Notes for LX0-101 Linux
Notes for LX0-101 Linux
File000141
File000141
File000139
File000139
Ce hv6 module 53 hacking web browsers
Ce hv6 module 53 hacking web browsers
Ce hv6 module 41 hacking usb devices
Ce hv6 module 41 hacking usb devices
Memory forensics
Memory forensics
Semelhante a File000132
File System Implementation - Part1
File System Implementation - Part1
Amir Payberah
File000173
File000173
Desmond Devendran
11 linux filesystem copy
11 linux filesystem copy
Shay Cohen
m+storeMemory storage
m+storeMemory storage
Owen Funnell
Hardware course
Hardware course
gurukullinfo
Fortissimo Foundation: NVMe All Flash Array and NVMe Hybrid Array
Fortissimo Foundation: NVMe All Flash Array and NVMe Hybrid Array
Emilio Billi
filesystem-120405093921-phpapp02 (1).pdf
filesystem-120405093921-phpapp02 (1).pdf
TESTFALTU
ChinaNetCloud - Zabbix Monitoring System Overview
ChinaNetCloud - Zabbix Monitoring System Overview
ChinaNetCloud
Db
Db
VJ Aiswaryadevi
db
db
Aisu
11. Storage and File Structure in DBMS
11. Storage and File Structure in DBMS
koolkampus
Mac2
Mac2
RecoverEmptyTrash
File Management in Operating Systems
File Management in Operating Systems
vampugani
Access over Ethernet: Insecurites in AoE
Access over Ethernet: Insecurites in AoE
amiable_indian
Unit6pdf__2024_03_ 27_08_31_05.pdf
Unit6pdf__2024_03_ 27_08_31_05.pdf
tejpatel0010
AWS re:Invent 2016: Deep Dive on Amazon Elastic File System (STG202)
AWS re:Invent 2016: Deep Dive on Amazon Elastic File System (STG202)
Amazon Web Services
Basic Archive System overview
Basic Archive System overview
Jan-Ivar Bøyum
Mac2
Mac2
RecoverEmptyTrash
Mac2
Mac2
RecoverEmptyTrash
Recover Empty Trash Efficiently Using The Fast Mac Data Recovery Software
Recover Empty Trash Efficiently Using The Fast Mac Data Recovery Software
RecoverEmptyTrash
Semelhante a File000132
(20)
File System Implementation - Part1
File System Implementation - Part1
File000173
File000173
11 linux filesystem copy
11 linux filesystem copy
m+storeMemory storage
m+storeMemory storage
Hardware course
Hardware course
Fortissimo Foundation: NVMe All Flash Array and NVMe Hybrid Array
Fortissimo Foundation: NVMe All Flash Array and NVMe Hybrid Array
filesystem-120405093921-phpapp02 (1).pdf
filesystem-120405093921-phpapp02 (1).pdf
ChinaNetCloud - Zabbix Monitoring System Overview
ChinaNetCloud - Zabbix Monitoring System Overview
Db
Db
db
db
11. Storage and File Structure in DBMS
11. Storage and File Structure in DBMS
Mac2
Mac2
File Management in Operating Systems
File Management in Operating Systems
Access over Ethernet: Insecurites in AoE
Access over Ethernet: Insecurites in AoE
Unit6pdf__2024_03_ 27_08_31_05.pdf
Unit6pdf__2024_03_ 27_08_31_05.pdf
AWS re:Invent 2016: Deep Dive on Amazon Elastic File System (STG202)
AWS re:Invent 2016: Deep Dive on Amazon Elastic File System (STG202)
Basic Archive System overview
Basic Archive System overview
Mac2
Mac2
Mac2
Mac2
Recover Empty Trash Efficiently Using The Fast Mac Data Recovery Software
Recover Empty Trash Efficiently Using The Fast Mac Data Recovery Software
Mais de Desmond Devendran
Siam key-facts
Siam key-facts
Desmond Devendran
Siam foundation-process-guides
Siam foundation-process-guides
Desmond Devendran
Siam foundation-body-of-knowledge
Siam foundation-body-of-knowledge
Desmond Devendran
Enterprise service-management-essentials
Enterprise service-management-essentials
Desmond Devendran
Service Integration and Management
Service Integration and Management
Desmond Devendran
Diagram of iso_22301_implementation_process_en
Diagram of iso_22301_implementation_process_en
Desmond Devendran
File000176
File000176
Desmond Devendran
File000175
File000175
Desmond Devendran
File000172
File000172
Desmond Devendran
File000171
File000171
Desmond Devendran
File000170
File000170
Desmond Devendran
File000169
File000169
Desmond Devendran
File000168
File000168
Desmond Devendran
File000167
File000167
Desmond Devendran
File000166
File000166
Desmond Devendran
File000165
File000165
Desmond Devendran
File000164
File000164
Desmond Devendran
File000163
File000163
Desmond Devendran
File000162
File000162
Desmond Devendran
File000161
File000161
Desmond Devendran
Mais de Desmond Devendran
(20)
Siam key-facts
Siam key-facts
Siam foundation-process-guides
Siam foundation-process-guides
Siam foundation-body-of-knowledge
Siam foundation-body-of-knowledge
Enterprise service-management-essentials
Enterprise service-management-essentials
Service Integration and Management
Service Integration and Management
Diagram of iso_22301_implementation_process_en
Diagram of iso_22301_implementation_process_en
File000176
File000176
File000175
File000175
File000172
File000172
File000171
File000171
File000170
File000170
File000169
File000169
File000168
File000168
File000167
File000167
File000166
File000166
File000165
File000165
File000164
File000164
File000163
File000163
File000162
File000162
File000161
File000161
Último
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Drew Madelung
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
The Digital Insurer
How to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
naman860154
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Principled Technologies
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
HampshireHUG
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
Enterprise Knowledge
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
Malak Abu Hammad
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
Gabriella Davis
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
soniya singh
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
Delhi Call girls
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
Puma Security, LLC
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
RTylerCroy
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
Pooja Nehwal
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
shyamraj55
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
Rafal Los
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
Allon Mureinik
Google AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAG
Sujit Pal
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
Michael W. Hawkins
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
BookNet Canada
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Alan Dix
Último
(20)
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
How to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
FULL ENJOY 🔝 8264348440 🔝 Call Girls in Diplomatic Enclave | Delhi
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
WhatsApp 9892124323 ✓Call Girls In Kalyan ( Mumbai ) secure service
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
Injustice - Developers Among Us (SciFiDevCon 2024)
Injustice - Developers Among Us (SciFiDevCon 2024)
Google AI Hackathon: LLM based Evaluator for RAG
Google AI Hackathon: LLM based Evaluator for RAG
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
Swan(sea) Song – personal research during my six years at Swansea ... and bey...
File000132
1.
Module XIX –
Forensic Investigation Using Encase
2.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited News: Verizon to Use Guidance Software’s EnCase eDiscovery on a Pay-Per-Use Basis Source: http://www.tmcnet.com/
3.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Official Licensed Content Provided by EnCase to EC-Council
4.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Objective • Evidence Files • Verifying the File’s Integrity • Hashing • Configuring EnCase • Searching • Bookmarks • Viewing the Recovered Files • Master Boot Record • NTFS Starting Point • Hash Values • Signature Analysis • Email Recovery This module will familiarize you with:
5.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Module Flow Evidence File Configuring EnCase Hashing Bookmarks Searching Verifying the File’s Integrity Master Boot Record Viewing the Recovered Files Hash Values Signature Analysis E-mail Recovery NTFS Starting Point
6.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Evidence File Evidence file is the core component in EnCase The file can be referred as a forensic image file It is widely known throughout the law enforcement and computer security industries • Header • Checksum • Data blocks • Footer It consists of:
7.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Verifying Evidence Files After burning the discs, run Verify Evidence Files on each disc to verify that the burn was thorough and that the evidence file segment is intact
8.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Evidence File Format Each Evidence file is an exact, sector by sector copy of a floppy or hard disk Every byte of the file is verified using 32-bit CRC, which makes it virtually impossible to tamper with the evidence once it has been acquired EnCase compresses large disk into a small size reducing up to 50% of the disk’s size
9.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Verifying the Evidence File Integrity Whenever an evidence file is added to the case, EnCase will begin verifying integrity of the drive for corruption, bad sectors etc.
10.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Hashing EnCase calculates MD5 Hash when it acquires a physical drive or logical drive
11.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Acquiring Image Click File -> Add Raw Images to acquire images To acquire USB image, the USB drive should not be connected to the forensic computer prior to the boot process Select the device type to make an image
12.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Configuring EnCase Click Tools > Options to configure EnCase in various settings
13.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited EnCase Options Screen
14.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited EnCase Screens TREE PANE TABLE PANE FILTER PANEVIEW PANE
15.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited View Menu Various utilities can be launched using View menu
16.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Device Tab Device tab shows information about the currently selected device
17.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewing Files and Folders Files Folders
18.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Bottom Pane Bottom pane
19.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewers in View Pane Text Hex Doc Transcript Picture Report Console Details
20.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Status Bar
21.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Status Bar (cont’d) • PS physical sector number • Logical sector number • Cluster number • Sector offset • File offset • Length Status bar provides the sector’s details for a selected file:
22.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Searching EnCase provides powerful searching capabilities Keywords searches can be performed at a logical level (file level) or physical level (byte by byte)
23.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Searching (cont’d) EnCase has the following advanced search capabilities to find the information of investigative importance: • Concurrent search • Proximity search • Internet and email search • Email address search • Global Regular Expressions Post (GREP) search • File finder • Search options include: • Case sensitive • GREP • RTL reading • Active code-page
24.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Keywords Keyword must be added before you can start searching They are saved in keywords.ini file They can be added based on what you are investigating For example, you might want to add keywords such as: • kill, suicide, cheat, Swiss bank, San Francisco etc.
25.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Keywords: Screenshot
26.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Adding Keywords Right click Keyword and select New
27.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Grouping Keywords can be grouped for organizing the search terms Right click in Keyword > select New Folder and type the folder’s name
28.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Add Multiple Keywords Right click the Folder > Keyword list
29.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Starting the Search Searches can be carried out using file/folder or entire drive Check the keywords that needs to be searched Click Search button
30.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Search Hits Tab Search Hits Tab reveals the search listings
31.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Search Hits
32.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Bookmarks EnCase allows files, folders, or sections of a file to be bookmarked for easy reference Click View > Cases Sub-Tabs > Bookmark
33.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Creating Bookmarks Bookmarks can be created by clicking ‘New Folder’ in right click menu
34.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Adding Bookmarks Right click on any file > Bookmark Data
35.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Bookmarking Selected Data Highlight the text and select Bookmark Data
36.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering Deleted Files/folders in FAT Partition Right-click FAT drive and select Recover Folders
37.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering Deleted Files/folders in FAT Partition (cont’d)
38.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewing Recovered Files Select the Recovered Folder to view the deleted files/folders
39.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering Folders in NTFS EnCase searches the unallocated clusters in Master File Table (MFT) to recover the files/folders Use the same method as FAT system to recover the files This process can be slow and may take 60 minutes (1 hour) for 100 GB hard drive
40.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering Folders in NTFS (cont’d) Right-click on the volume and select Recover Folders Choose OK to begin the search for NTFS folders
41.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Master Boot Record Master Boot Record (MBR) resides at the first sector (Sector 0) Sector Offset (SO 446) contains the partition table MBR allows 4 entries: • Each entry is 16 bytes long • Partition entries range from (LE 64 – Hex 55 AA)
42.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Master Boot Record (cont’d) Select Sectors (SO 446 – LE 64) Right-click and select Bookmark Select Windows > Partition Entry Enter a name to bookmark
43.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Bookmark Data Partition table
44.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited NTFS Starting Point
45.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewing Disk Geometry Highlight the case and click Report in the bottom View pane
46.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering the Deleted Partitions • Search for the following in the unused disk area: • MSWIN4.1 (FAT Partition) • NTFS (NTFS Partition) • Look manually at the disk end of the first volume Two ways to check for deleted partitions:
47.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Recovering the Deleted Partitions (cont’d) To delete the partition, right- click and select it Right-click the area to recover and select Add Partition
48.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Hash Values
49.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Creating Hash Sets Select the files to be included in the hash set Right-click > Create Hash Set
50.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited MD5 Hash EnCase can create a hash value (digital fingerprint) for any file in the case It uses 128 bit MD5 algorithm Hash sets are a collection of hash files Chances of two files having the same hash is 2128 which is nearly impossible
51.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Creating Hash Click Search > Select Compute hash value This will create hash for every allocated file
52.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewers EnCase can use external viewers to view files Viewers makes a copy of a file to the temporary folder before launching the file Encase uses the following viewers: • External viewer • Program registered in Windows • EnCase viewer • Timeline
53.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewers (cont’d) Click viewers in View menu > File viewers Create new viewer and enter the application path
54.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Signature Analysis ISO and ITU work to standardize the types of electronic data For the standardized file types, a signature or header is stored along with the data Applications use the header to correctly parse the data You can view the file signature to identify the data even though its extension has been renamed Example: jennifer.exe jennifer.dll
55.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Signature Analysis (cont’d) Select View menu > File Signatures
56.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Signature Analysis (cont’d) You can search using signature analysis
57.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Viewing the Results
58.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Copy/UnErase Files or Folders Encase provides a feature to recover and unerase files byte-per-byte Right-click a file/folder > select Copy/UnErase
59.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited E-mail Recovery • Documents and Settings[username]Local SettingsApplication DataIdentities[userid]MicrosoftOutlook Express Default path for Outlook Express 5/6 in Windows XP is: • Inbox.mbx • Outbox.mbx • Sent Items.mbx • Deleted Items.mbx • Drafts.mbx Outlook mailbox filenames are as follows: View the above files in EnCase
60.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Reporting The final stage of the forensic analysis is reporting Report must be easy to understand and should cover in-depth information about the evidence Click the Report in Bookmarks menu
61.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Final Report
62.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited IE Cache Images
63.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited Summary Evidence file is the core component in EnCase Each Evidence file is an exact, sector by sector copy of a floppy or hard disk EnCase calculates MD5 Hash when it acquires a physical drive or logical drive EnCase provides powerful searching capabilities EnCase allows files, folders, or sections of a file to be bookmarked for easy reference EnCase searches unallocated clusters in Master File Table (MFT) to recover files/folders EnCase can create a hash value (digital fingerprint) for any file in the case
64.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
65.
EC-Council Copyright © by
EC-Council All Rights Reserved. Reproduction is Strictly Prohibited
Baixar agora