Digital forensic examiners are investigators who are experts in gathering, recovering, analyzing, and presenting data evidence from computers and other digital media related to computer-based .They might work on cases concerning identity theft, electronic fraud,investigation of material found in digital devices ,electronic evidence, often in relation to cyber crimes.
เว็ปไซต์ฐานข้อมูลสำหรับ ตรวจสอบ IP address ที่น่าสงสัย เครื่องมือค้นหา IP และโดเมนที่เป็นอันตรายด้วย Threatintelligence มีไว้ check IP address อีกอันหนึงครับ https://bit.ly/2TYjyJT
Before we begin with the videos, let's start downloading the data we'll need for the later labs. We won't need them for a few sections, so you can start them now and let them download in the background.
DIGITAL FORENSICS: Investigation using OSForensics (Part1)
Step 1 - Download USB Drive Images
In this task, you will download the USB drive images from a local intranet site.
These USB drive images were collected from digitalcorpora.orgweb site. Right-click USB zip file and select Extract All…
Step 2
Click Start charm to access the Start screen.
When Start screen opens, type: OSforensics On the OSForensics welcome message box, click Continue Using Free Version.
OSForensics
Step 3
In the New Case dialog box, enter your name in the Investigator text box. In the Case Name text box, type CF-DFE-002 USB drive.
CF-DFE-002
Step4
Click the Add Device button to open the “Select device to add” dialog box, and then click the Image File option button. Click the browse button, navigate to the folder you copied images to, and click work-usb-2009-12-11.E01. Click Open.
Image File
work-usb-2009-12-11.E01
Step 5
Click the work-usb-2009-12-11.E01 filename at the lower right, and then click the Open button to the left to open the File System Browser window.
Step 6
In the Select a partition in the image dialog box asking which partition to use, leave the default setting use entire image file, and then click OK.
Step 7
Click the File Name Search icon in the File System Browser window or the left pane of the main window. In the Search String text box, type Charlie*. On the far right, click the Search button.
File Name Search
Step 8
On the Browse for Folder dialog box, ensure that Devices in case refers to work-usb-2009-12-11.
Click OK. Back on File Name Search window, click Search.
Step 9
After a few moments a list of files found in USB drive is displayed.
Step 10
The files displayed in Thumbnails view.
Click Timeline tab.
Timeline
Create Index
To create an index of files found in the user’s USB drive image, perform the following steps:
Step 11
Click the Create Index button in the left pane. (Note: You might have to click New Index if the window is showing the results from the index of USB drive.) In the Step click the Pre-determined File Types option button, click all the file types listed, and then click Next.
Step 12
click the Add button.
Step 13
On the Add Start Location dialog box, verify that Whole drive option is selected and work-usb-2009-12-11.E01 is listed.
Click OK.
Add Start Location
Step 14
In the Step 3 of 5 window, in the Index Title text box, type: All File Type Click Start Indexing.
Index Title
Step 15
When the indexing is finished, click OK in the message box informing you that some errors might have occurred in the indexing process.
Step 16
The window that opens shows you the files that were indexed, any errors that occurred, and a summary of what was done. After examining the summary, close the window.
You should now be able to create a case, add it to your inventory, scan the files, and perform indexing, which will be useful later for searching.
Case Management: Cases are used to group together findings within OSForensics that can be exported or saved for later analysis.
