P426 - Setup

hey everybody just want to real quick uh talk to you about the project 4.2.6 I know you have an asynchronous day today so just wanted to go ahead and share with you um what I found out last night uh it was an issue that we did so basically what amounted to was we try to be cute and download all this stuff to the guacamole Drive the guacamole Drive is a special drive that's actually created for the use of being able to move things from the virtual server to our server and by doing so it Clips

it grabs whatever you currently have there and locks it down the problem with the system that we're using the fdk imager and the autopsy when we're using these tools it's it's putting things in it's still adding things there and so when I actually moved to guacamole it didn't grab everything it just sort of captured what was there immediately and that's why we ended up with our heirs so when I did this again I actually ended up with the appropriate thing we just have to do it the way that it was actually intended not get so

cute and do what we need to do so I'm going to show you real quick this is our pltw site I'm going to go into tools and I'm going to go into the access data ftk imager now we're going to do everything exactly the same the only difference is where do we put our destination file we're just going to put everything on the desktop and then we're just going to leave it there and that seems to work so just wanted to let you know I verified this today this morning it worked again I had one

of my students look at it this morning it worked for them as well so hopefully this will work here so I'm going to close this up right now and just look at our ftk Imager all right so this is just fdk imager we're going to create a new file so create disk image physical drive hit next we're going to grab the second one again nothing different than what we did the first time and then finish then we do over here we click on ADD we're going to use an e01 next case number just for the

sake of it I'm going to put pldw Dash p426 evidence number is going to be zero five one zero two two three and then examiner is Mr I there we go and I'm going to go ahead and click next the destination folder right here the destination folder I'm just going to make it the desktop all right and then for the file name I'm just going to go ahead and put test four to six okay and at this point I'm going to hit finish and then I go ahead and hit start now we didn't have any

problems with this except that one of the things that I did is I went through and put it directly to guacamole that seems to have been the problem now when I do this I can close this I can take these files and I can move them to guacamole if I want to and I would strongly recommend that you do that from there we can close this access ftk manager go back into tools open up autopsy it's going to take a little bit of time and while this is happening if I wanted to I can go

into creating another right click on this go into File Explorer I can go into guacamole I can take these two pieces right here I'm going to right click and I'm going to copy here those two and then I can take those and I can move them download while I'm doing this now you see I've moved them to download those are my copies and it's working on that so I'm going to go ahead and close this out right now you'll see autopsy is started up so everything's running a little slow right now you can see that

I've got my two copies on my hard drive I also have them right here so everything seems to be up and up okay keep our fingers crossed let's take a look hopefully autopsy will show up here any second there it is I'm going to close this like I did before so that I can shrink this down shrink that bad boy down and then we're going to move this up so that I can see the whole thing go to case new case name we're going to call it pltw Dash p426 right and then the base directory

that we're going to use we're going to just go into the desktop right there we're going to go ahead desktop select and then we're going to go to next you'll notice it created a folder for pltw we're going to call this case plpw Dash p426 name Mr I and then I'm just going to leave it alone like that I'm going to click finish and it's going to go ahead and create the case database now we didn't have any problems with this yesterday and so everything is looking exactly like it did as if this were just

another day in class as soon as this gets done it's going to load it up into my little piece here my little window it's going to give me a pop-up right there we go there's our pop-up this is where things started to go a little wrong so hopefully we did this right this time because everything is now on the desktop up here we're going to go and click next we're going to leave it as disk image click next the path that we're going to find is the desktop and there's my test 426e01 click on that

open click next I'm going to deselect all like I've done in the past and I'm just going to click on the ones that I need which are basically all the way down to email parsher that's all I needed and then I'm going to click next and here we are adding the data source and this gave me an error nope it did not give me an error notice how there's no error here there is no air and notice how things are being added here so you'll start to see things that are added I'm going to click

finish here and now when I look at my deleted files things are being added now you notice I have added files I have recent documents all of this stuff see how it's just populating right now give it some time here's the thing as long as they didn't get that air pop up I'm fine now it's still creating it see this right here analyzing from test we never got that before now we're getting it so let it go through it's creating this thing it's at five percent right now it's gonna take some time you need to

just let it do what it's doing and then hopefully this gets home in the next two or three minutes and then we'll be good to go to save this to our hard drive as well so then we'll have three things on our hard drive we need to make sure that we have the database so hopefully all this stuff is going to be there so again we're at 15 16 so this is moving at a pretty decent clip right now thank goodness um we do have a cautionary here again this caution says that it was not

a notable hash set so notable file search will not be executed um I'm not as concerned with that because I'm seeing everything else seemed to be working just properly now when I did this morning I didn't even get that pop-up so I don't know what's what's the deal there but you'll notice that it's populating this piece up here as it's extracting files from that hard drive that we had just made that image and we're over 60 right now as we keep going you're going to see this stuff populate more and more I can expand this

out and I can look at the different file types that I have I can look at files by extensions there's images archives databases documents there you go there's Microsoft Office right there so I can see those remember that this was a spreadsheet by Microsoft so this is something where we would actually start looking to find that Excel spreadsheet that Gene supposedly had made we're at 96 so we're really close to being done here I can also look at all of the deleted messages here so if you look at the file system there is quite a

lot of them and you can see all of them populating right here there's a ton of them and so you can see all of the different pieces here um you can go to thumbnails if you wanted to I like to just click on each one of these and they'll actually tell you what's in each one so you can actually do that as well and then just scroll down and find them now if I wanted to go to all you can see all of them and do all that but I'm done so you can see everything

is done now at this point so I have my autopsy and it's working and it's populated and everything seems to be fine but it's all located in this folder right here so if I double click on that folder here is my autopsy right here so now I can use this or what I can do is this and this is something that I would do is take this folder right here right click it and I would send to desk I would send to a zipped folder I would now that it's done it's done with the percentages

everything seems to be good I would just go ahead and go to a compressed zip folder and it's just taking everything that's in there right and it zipped it so you'll notice that I've got this one with a zipper on it and I've got this one that's got all of my files this one right here is a compressed zip file the only difference between the two right here is that you'll see that there's the folder with this word compressed folder tools and now I can take this folder right here and I can go to guacamole

and I can move this compressed Zip drive copy it here and I can move it to downloads right there and now I have my entire autopsy unzipped and everything else ready to go now that I have that if I go in here and I close all this stuff out I can now take this come on it's going to take a while to close apologize if I look at my guacamole I'm just going to put this off to the side right now right here okay and I'm going to move this ZIP file into the trash can

and so now if I open up this on my desk so shown folder this is my computer on mine I'm going to go ahead and take that drag it to the desktop it's taking files transfer and it won't show up on my desktop it should show up in my guacamole folder okay so let's take a look at the guacamole folder and there it is and now I can take this double click on it and I could take that and I can drag it over here and now because I already have that folder what's it going

to do it's copying that and it's going to ask me to replace all these now if I started new I wouldn't have those folders it'll automatically just work and so that's how you can go through this every single day is I now have all of that Integrity in place okay so hopefully that helped I I didn't want to make this video too long I wanted to basically watch it so that you could create your own files today so that we can actually start to use them tomorrow okay with that hopefully you have a pretty good

day hopefully there's no interruptions and no problems hopefully that made sense to you um and with that I'm going to stop the recording and say goodbye we will see you on Thursday