>> Forensics tools.
The learning objectives for this lesson are
to demonstrate forensics collection tools,
described forensics analysis tools,
and utilize other forensics tools.
Let's get started. The first thing
you're going to want to consider as
a forensics workstation.
You can think of this as a hub that will be used to
perform all of the forensics work
on any data or devices you've collected.
This workstation needs to
have the capabilities to read from
many different common media types such as EIDE,
SATA, SCSI,
SAS, USB, Firewire, and Thunderbolt.
You also want to ensure that you have
ample storage space to store all the images.
These images can get very large since you're
taking images of entire hard drives.
So you want to make sure that
your forensics workstation has
enough storage space to store multiple images.
Then lastly, you want to consider your software suite.
These are the programs that you'll use
to perform the analysis.
Some examples would be in case,
the forensics toolkit and the sleuth kit.
File carving tools.
Now, most of the tools we're going to
discuss in this lesson are Linux-based.
Not all of them, but most of them are.
Foremost is a Linux utility that can be used
to extract deleted or corrupted data from a partition.
The key to remember about foremost is,
it will be able to do this
even if there's no file system in place.
Strings will recover text strings and then you can
discover the attributes regarding
the internal structure of a program.
Binary analysis tools.
Hexdump is used to extract data from binary files,
and then it will present it in either hex,
decimal, octal or ASCII.
Ghidra, this is a tool that was developed by
the National Security Agency and it's written in Java.
The purpose is for doing reverse engineering.
Next, we have the good new project debugger.
This is used to identify what is
occurring in an application while it's running.
Then we also have OllyDbg,
which is a debugger, is focused on
Microsoft Windows and it also has a GUI.
Next we have Readelf.
This is able to read the executable and linkable format
or ELF within an object file.
Objdump is similar to Readelf.
It's used to analyze
object files and also includes the disassembly.
Strace is used to identify
interactions between processes and the Linux kernel.
Ldd will display a program's dependencies.
This will display the type of
file by inspecting its content.
It uses the magic byte of a file,
and then it compares it to a list of
known magic bits to identify the file type.
If you've got a file without
an extension and you have no idea what it is,
file will look in there and see if it can
find the magic bit and then compare it to
the database of others that are known
to help you match that file type,
so that you can start working on it from their.
Firmware inspection.
Now firmware are upgrades
or consider the operating system
for lots of different devices.
For example, firewalls and switches
and routers all will get firmware updates.
Sometimes we need to look inside
those firmware to find out what's going on.
Binwalk can be used to
inspect the binary firmware image files.
That way we can better understand
what is inside the file itself.
It can also determine if an image file is
compressed, obfuscated, or encrypted.
It does this by calculating
the trophy in the file contents.
Live collection tools.
The first is DD, and this is a really good one.
This is a command line tool for making
forensics copies of block level storage.
It copies everything at
the block level rather than the file level.
By doing this, you're getting
an exact copy of the entire drive.
Netstat, we'll display
the current network connections and their state.
Ps or process status is used to
display the running processes on a Linux system.
It will also include the PID
and the user that is running those processes.
Vmstat is a command line tool to
display real-time information on system memory,
running processes, interrupts, paging and I/O stats.
Lsof, or a list of open files will
display files that are currently
open and their associated processes.
Netcat as a tool for reading and writing from
network connections using either TCP or UDP.
Now this is a bland description
for what Netcat actually is.
It's considered the Swiss army knife of tools for Linux.
It can do so many things.
In fact, for penetration testing,
you can set up a Netcat listener
that will respond to connections.
It has so many capabilities,
but for forensic purposes,
we're only going over a very small bit,
but you might want to look it up and
find out some more information about it because
Netcat is one of those things that can be used
in so many areas of your cybersecurity career.
Next, we have conntrack. This allows
for the interactions with
connection tracking systems and
they can read data from IP tables.
Tcpdump, we've gone over this before in other lessons,
but this is a command line packet analysis tool.
It will capture the network traffic data
and then it will save it as a recap.
Then we can load that up for analysis.
Wireshark is a GUI based packet analysis tool.
Hashing utilities, sha256sum.
This is a Linux command line utility and it will
generate a SHA-2 hash for a file,
and it will produce a digest length of 256 bits.
This is good for us to be able to
ensure that we have a hash of a file.
We know what the hash value is
before we do any analysis on it.
Then after we've done analysis,
we can hash it again to make sure we didn't do
any changes to the file
in the course of our analysis process.
Ssdeep is commonly used by antivirus programs.
It is used to compare files to identity matches.
It utilizes contexts triggered piecewise hashing or CTPH.
Let's go over some other forensics analysis tools.
ExifTool, this is used to read and write
file metadata from many file formats.
A way to help make this a little clearer
is photographs all contain EXIFdata.
This data would contain information such as
the GPS location of where the photo was taken,
the type of device that was taking the photo,
the exposure, and you'd
be surprised at some of the information that's there.
EXIFTool will allow us to go in there and
view all that information because
sometimes in the course of the investigation,
we need to know a lot of
information about this specific photo.
The photo itself is important.
All of the EXIF, information it
contains could even be more
important because it can help us to
identify the device that took the picture.
Nmap is an open source
IP Scanner for hosts and network discovery.
We've discussed in map in other lessons.
Like Netcat, this is a bland description.
This tool is one of those tools that
can be used for so many things.
Even for the penetration testing side,
it has the capability of running
scripts to help us with penetration testing.
But for forensic purposes,
we can use it to scan,
to get IP addresses to find out
what's active and what's not at a given moment.
The same would be true for aircrack-ng.
This is more of a penetration testing tool,
but we can use it for other purposes for forensics.
This is a suite of tools that is
used for assessing and analyzing Wi-Fi networks.
We can use it to monitor.
We can attack, test,
or crack Wi-Fi networks.
Volatility. This is a command line tool
used to perform memory analysis.
It can be used to view the contents of a memory dump.
Let's summarize. We discussed file carving tools.
We also went over binary analysis tools
and firmware inspection tools.
Then we discussed file hashing tools
and other popular forensics tools.
Let's do some sample questions.
Question 1, a blank is
a device where forensics analysis is performed.
This should have all the common interfaces and
sufficient storage space for forensics analysis.
Forensics workstation. Question 2,
this command makes block level copies
of data rather than file level copies.
Dd. Question 3 this tool
is a graphical protocol analyzer.
Wireshark. Question 4.
This is a suite of tools for
Wi-Fi assessments, analysis, and attacks.
Aircrack-ng. I hope this lesson
was useful for you, and I'll see you in the next one.