Hey Guys welcome to video 2.5 of the section entitled image acquisition with Guy major in the last video.
We've covered a command line tool D.C. 3D for forensic acquisition.
We saw an example of its usage to acquire a hard drive and an Android device storage.
If you feel more comfortable with graphical user interface programs in this video we're going to introduce
and explore the interface and main features of graphical imaging utility that comes pre-installed with
Kelly Linux.
Also we're going to show a practical example of this usage in an imaging USP Dr. Guy major runs only
on Linux and has been written using the cootie libraries.
It supports both raúl DD and E.W. formats.
It's multithreaded and also includes forensic case management functionalities to launch the program.
We click on applications forensics forensic imaging tools guy Major the interface as we could see is
very simple and intuitive.
The window pane shows the attached drives with the relative information such as the model associated
Linux device size and any hidden areas.
The device is marked with light red color our local hard disks guy major prevents the user from acquiring
them.
The configuration file for Guy major is located at cetera ATC slash guy major dot C-f.
Gee if you'd like to modify something of the configuration you should not edit the file rather edit
the slash ATC slash guy major slash local Dotsie F.G. in this video we're going to leave the default
configuration as it is.
We're going to show the imaging of a small 2 gigabyte USP thumb drive as a practical example.
We connect to our forensic workstation using the right blocking mechanism as usual clicking on rescan
the list of devices is updated and the USP Dr shote in the pan.
If we select it and right click with the mouse three entries are displayed acquire image clone device
and info the info provides us with plenty of the information about the device.
Take it from the output of the Smarts TTL and HD parm tools.
Also it shows that any host protected area is enabled on the drive guy.
Major also offers the functionality of Clonie the device that we've already seen from the acquisition
of the image.
We click on acquire image and this dialog window is displayed.
The first option we could choose is the image format that could be rolled DD or DWF.
In this example we choose the IWM format.
There's also the possibility to split the image file.
In our case we leave the split size set to two gigabytes the size of our USP drive will add only one
output file guy.
Major also provides case management features.
Indeed we could create a case for the image acquisition and add information such as the examiner description
and other notes.
Then we could select the destination directory for the image file its name
and any information we might want to add.
We select a hash algorithm to use.
In our case SH A 2:56 and we choose to verify the image after the acquisition.
Then we click on start to execute the acquisition of the image.
We could see that the set of acquisition is run the program shows the progress of the acquisition and
the average speed and the time remaining when the acquisition is complete.
The state is updated to finished with a green circle and the image has been verified at the bottom of
the window.
The image in the log file are saved in the destination directory awesome.
With just a few mouse clicks with image the drive.
This is much easier than using tools like DC 3D but a forensic examiner must also be able to work on
a command line environment if necessary.
In this video we've introduced a GeoEye forensic acquisition tool and showed a practical example of
its usage.
With us be thumb drive we've also come to the end of the section acquiring forensic images in this section.
We've covered the fundamentals of the forensic image acquisition process and introduced to command line
tools DC 3D D and D Beldi D.
We've also shown two practical examples with an imaging of the hard disk of the Android device used
in the DC 3D explaining the peculiarities of both cases.
Finally in this video we've covered guy major in the next section.
Artifacts extraction and analysis with command line tools.
We're going to cover the extraction and analysis of forensic data or artifacts from the acquired image
specifically using the command line tools available on Kelly Linux.