In order to control the environment.
As we start our investigation, we must understand the environment.
Here, digital evidence is being stored, created and accessed.
In most cases, this will be a computer system.
I use the term computer system, and what that comprises is the operating system, the file system and
the hardware bundled together to create this computer.
So to be effective, you must understand the physical media.
The data is stored on so the file system used on the storage device and how that data is tracked and
accessed while on the storage device.
Once you understand the process, you can then implement controls to protect the integrity of the digital
evidence.
So what is the boot process?
Well, when you press the power button and electricity energizes the system, a series of commands is
usual.
So as it executes the commands, the system is taking steps just like on a ladder to achieve the goal
of a running operating system.
So if something breaks any of these steps, then the system will not load.
So it will fail.
So we have a post here.
So what is the boot process is the first step is the boot process is the power on self-test post here.
So this in post phase, the CPU will access the read only memory rom and the basic input output system
and the test to test essential motherboard functions.
So actually it's I will share this file with you after this lecture in assignments or I will create
separate lecture for sharing these files.
So I want to write that everything clearly here.
So when you look at it, you can understand easily.
And so.
This is the CPU will access.
Here.
Angels make a bigger and.
Text.
But CPU will access.
Uh, the great.
It.
Only.
Memory.
Uh, so this is the rum rum here, and.
And the basic input.
Out put system.
Which in this case this is the bias, actually.
You know, I think the bias is the when you enter with f, f 20 or f two, like tail buttons to boot
device here.
So this is where you hear the beep sound when you turn the power on the computer system.
So it is beep sound is not.
Using anymore.
It is with sound Is the old computers using this sound.
If there is an error, this is the system will notify you of the error on the computer fraud use of
the beep codes like if you have an like ram error this will this.
A motherboard buzzer will be three times.
They didn't like that.
So if there's any node, you will know about that.
So, for example, you can search these beeps in Google and you will get the relevant result because
if you if your video card is broken or something not working, you can see these errors or bios, motherboard
can cannot show these errors on screen, right?
So instead of that, the motherboard uses the.
Buzzer to beep several times for searching and finding what's what's wrong with your computer.
So once the post test has successfully completed, the Bios is activated and executed.
Note that the system has not accessed the storage media for now at this phase of our booting process.
All the program executions are taking place at the motherboard level and not in the storage devices.
The user can access the bios by using the correct combination as displayed in the screen.
So the bias then will have the basic information of the system, the amount of Ram, the type of CPU
information about attached devices and system date and time.
The easiest way to document this information is to take photographs of it as it displayed on the screen.
So this is also where you can change the boot sequence.
So typically the system checks the CD, DVD first and then the designed designated hard drive.
So this is where you will be able to change the setting of the boot device when we create a boot media
later on this lectures changing the boot device tells the Bios to access the device we are providing
and not the suspects.
So in 2010 the Bios function was replaced by the United Extensible firmware interface.
This is the I think you know that already.
Actually let's.
United.
This is the UAV.
So.
So these United Extensible firmware interface provides the same service as the bias, but this is the
like version two of the bias.
So this is an unchanged like.
What's different is actually let's let's make a.
Differences here.
So.
Actually, I want to delete that.
Actually, I will read these differences down because I'm.
Searching for the right.
Table for that.
So.
Year in as I said earlier in bios had update so by actually replaced by a.
United extensible firmware interface.
Um actually let me note that down here.
The extensible firmware.
Here.
So it provides the same services as the Bios, but has been encouraged like it has the better security
at Pre-boot process.
It has the fastest startup compared compared to Bios.
It has the support storage device storage drives at larger than 2000GB like two terabytes.
Support for 64 bit device drivers.
And this has the support for GPT partition tables.
So the secure boot feature allows us to.
Using authenticated operating systems when booting the computer system.
So this can be an issue if you are attempting to use an alternative booting device.
So, um.
Well, let me actually make another dry diagram here.
This is the power.
The post post.
The post actually lets me.
Bigger words.
And then we have bias and.
Okay.
Here.
Homes.
And this counselor.
So.
Now, as you can see in this diagram.
Well, actually, yes, yes, yes, you can You can see here once the power is turned on.
Um.
And has completed the post test here.
Depending on the system, it may boot for bios or.
It may boot with Wi-Fi.
Seem so the bias will look for the bias will look for the master boot record of the boot device so fast
will So MBR is a typical for bios.
Here.
NBR So the NBR located at is Sector Zero and holds information about the partitions.
So.
Yes.
So NBR holds the information about partitions.
So.
So host information about partitions and also holds information also filesystem and the bootloader code
for installed operating system.
So once they found at the bootloader here.
And has been activated.
Control is then passed over to the operating system to complete the boot process.
So.
The operating system for completing the boot process here.
Operating system.
So.
After operating system.
The.
Promptly started and you can use a computer like so.
Then we will.
Let's go to Wi-Fi.
So the Wi-Fi United Extensible firmware interface, as you can see here, it's in changed version of
bios.
So Wi-Fi will look for the GPT.
So as you know, GPT is the Guid partition table.
We will talk about it later.
Then let's create a new here.
So if I will look for the GPT.
Actually, it's.
Right.
Deputy.
Here.
So.
It will have a protective image to ensure legacy systems will not mistakenly read this as being unpartitioned
and overwrite the data.
It will also contain the partition entries and backup partition table header so a GPT disk can contain
up to 128 partitions.
Yes, GPT can contain up to 128 partitions for Windows operating system, just like the Bios theme.
Once the active partition and bootloader have been found, the operating system will take over the booting
process.
Here.
So since you understand the boot process, we still want to control the boot environment with creation
of forensics boot media, which we will discuss in next lecture.
So I'm waiting you in.
Next lecture.
Actually, we will have a little test after this actual practice test after this lecture.
So.
I'm sure you can make and complete by 100% of these practice tests.
So after completing the practices, I'm waiting you in next lecture.
Thank you for watching.