WEBVTT 1 00:00:00.000 --> 00:00:02.319 All right, ready to dive into some open source intelligence. 2 00:00:02.319 --> 00:00:04.559 We've got a stack of excerpts here from Open Source 3 00:00:04.599 --> 00:00:08.560 Intelligence Techniques by Michael Bizell, ninth edition. By the way, 4 00:00:08.599 --> 00:00:11.439 you really weren't kidding about a deep dive. I mean, wow, 5 00:00:11.519 --> 00:00:12.400 this book, it's. 6 00:00:12.279 --> 00:00:14.279 A lot, but it's fascinating stuff. 7 00:00:14.320 --> 00:00:17.039 It really is. You know, it's kind of wild to 8 00:00:17.079 --> 00:00:20.559 think about how much the world of investigation has changed. 9 00:00:22.800 --> 00:00:26.399 Like the book even mentions how some like veteran police chiefs, 10 00:00:26.640 --> 00:00:29.719 they were totally skeptical of this whole internet investigation thing 11 00:00:29.839 --> 00:00:30.480 back in the day. 12 00:00:30.600 --> 00:00:33.439 Yeah, I read that. It's true though, and now forget 13 00:00:33.439 --> 00:00:38.520 about it. It's indispensable, not just for law enforcement either, journalists, cybersecurity. 14 00:00:38.640 --> 00:00:39.560 Everyone's using it. 15 00:00:39.640 --> 00:00:42.320 You're preaching to the choir. But that's what makes this 16 00:00:42.359 --> 00:00:45.280 deep dive so important, right, Everyone wants to be good 17 00:00:45.320 --> 00:00:47.240 at osent these days, but you got to start. 18 00:00:47.039 --> 00:00:49.399 With the basics, you got it, and there's no better 19 00:00:49.439 --> 00:00:52.200 place to start than with setting up a secure environment. 20 00:00:52.560 --> 00:00:54.399 The book calls it your ocent lab. 21 00:00:54.799 --> 00:00:58.119 Okay, an ocent lab. It sounds kind of high tech 22 00:00:58.159 --> 00:01:00.240 and maybe even a little intimidating, to be honest. 23 00:01:00.640 --> 00:01:02.719 Not really think of it, like think of it like 24 00:01:02.759 --> 00:01:05.359 a detective wanting a clean crime scene. You don't want 25 00:01:05.359 --> 00:01:07.560 your own stuff messing up the evidence, right. 26 00:01:07.439 --> 00:01:09.560 You want that pristine environment where you can be sure 27 00:01:09.680 --> 00:01:11.879 everything you're finding is legit exactly. 28 00:01:11.959 --> 00:01:14.599 So you got to create that digital equivalent. And the 29 00:01:14.599 --> 00:01:17.079 book is great about this because it walks you through 30 00:01:17.120 --> 00:01:20.400 it step by step. It even recommends a free anti 31 00:01:20.519 --> 00:01:22.400 virus called clam. 32 00:01:22.000 --> 00:01:24.799 A clam of v Okay, is that one of the 33 00:01:25.120 --> 00:01:26.079 really well known ones. 34 00:01:26.200 --> 00:01:29.359 Honestly, it's not flashy, but it gets the job done. 35 00:01:29.799 --> 00:01:33.000 Think of it like, hmm, a sniffer dog. It might 36 00:01:33.040 --> 00:01:35.239 not be the prettiest breed at the dog show, but 37 00:01:35.280 --> 00:01:37.760 it can sniff out those dangerous files that could be 38 00:01:37.799 --> 00:01:41.040 lurking on your computer, even if you think your system 39 00:01:41.079 --> 00:01:41.480 is clean. 40 00:01:41.599 --> 00:01:43.519 Okay, So it's like a safety net. Yeah, even if 41 00:01:43.519 --> 00:01:46.120 you're pretty sure your system is secure. Clama v is 42 00:01:46.120 --> 00:01:46.680 there just. 43 00:01:46.599 --> 00:01:49.519 In case, exactly. And once you've got that first line 44 00:01:49.519 --> 00:01:53.079 of defense. Bizelle talks about KEYPASSXC. This is huge. It's 45 00:01:53.120 --> 00:01:54.799 an offline password manager. 46 00:01:54.879 --> 00:01:57.040 Offline, so it's not like those other ones that are 47 00:01:57.120 --> 00:01:58.400 you know, connected to the cloud. 48 00:01:58.719 --> 00:02:02.519 Nope, And that's it. It's like imagine trying to rob 49 00:02:02.560 --> 00:02:06.120 a safe that's been airlifted to like a secret island. 50 00:02:06.439 --> 00:02:10.639 Okay, that's a visual I get it. So offline equals 51 00:02:10.800 --> 00:02:14.439 super secure. What happens if you forget your master password? Though? 52 00:02:14.520 --> 00:02:16.560 Are you like totally locked out? 53 00:02:16.800 --> 00:02:18.520 Let's just say it's important to chose a good one 54 00:02:18.520 --> 00:02:20.919 and keep it safe. But yeah, that's the trade off 55 00:02:20.919 --> 00:02:24.759 for that extra security. Okay, so you've got your secure environment. 56 00:02:24.759 --> 00:02:25.520 You're feeling good. 57 00:02:25.840 --> 00:02:27.719 Now what time to start investigating? 58 00:02:28.000 --> 00:02:32.599 Well, Bizell introduces this really cool tool called Boothscador, And 59 00:02:32.639 --> 00:02:34.800 this this is where things get really interesting. 60 00:02:35.039 --> 00:02:40.159 Boskador sounds like mysterious and kind of powerful. What is it? 61 00:02:40.280 --> 00:02:43.319 So? Imagine you have a toolbox, right, but instead of 62 00:02:43.360 --> 00:02:47.599 hammers and wrenches, it's full of specialized digital tools for OSENT. 63 00:02:47.800 --> 00:02:49.319 Okay, I like where this is going. Right. 64 00:02:49.400 --> 00:02:51.840 It's not just some app you download, it's a whole 65 00:02:52.039 --> 00:02:54.319 custom built Linux virtual machine. 66 00:02:54.360 --> 00:02:56.280 Wait, a virtual machine? Does that mean I need to 67 00:02:56.680 --> 00:02:57.719 learn how to use Linux? 68 00:02:57.800 --> 00:02:59.759 You don't have to be a Linux wisdom't worry. Basically, 69 00:02:59.800 --> 00:03:02.319 it's having a separate computer inside your computer. 70 00:03:02.639 --> 00:03:05.000 Oh okay, so I'm not actually messing around with my own. 71 00:03:04.840 --> 00:03:08.319 System files exactly. It's like wearing gloves at a crime scene. 72 00:03:08.400 --> 00:03:12.800 You're interacting with the evidence, but there's a barrier protecting you. Now, 73 00:03:13.120 --> 00:03:16.039 are you ready for one of the coolest tools in 74 00:03:16.080 --> 00:03:17.360 this buscador. 75 00:03:16.960 --> 00:03:19.319 Kit always hitvy of it. 76 00:03:19.319 --> 00:03:22.599 It's called the Metadata tool. Have you ever heard of metadata? 77 00:03:22.680 --> 00:03:26.319 It's like every digital file, a picture, a document, whatever, 78 00:03:26.439 --> 00:03:29.199 it's got this hidden information embedded within it. 79 00:03:29.319 --> 00:03:31.639 Yeah, like the data was created, stuff like that. 80 00:03:31.639 --> 00:03:34.759 That, but it can get way more specific, like who 81 00:03:34.879 --> 00:03:38.120 authored a document, what camera was used to take a photo? 82 00:03:38.240 --> 00:03:40.199 Even GPS coordinates sometimes no. 83 00:03:40.240 --> 00:03:42.759 Way, So it's like what digital DNA or something. 84 00:03:42.520 --> 00:03:45.080 It kind of is. In this tool, it lets you 85 00:03:45.159 --> 00:03:48.599 analyze even remove that hidden data. So let's say you're 86 00:03:48.599 --> 00:03:51.080 looking at a document someone claims they wrote, but the 87 00:03:51.120 --> 00:03:55.879 metadata says otherwise busted. Or maybe a photos metadata places 88 00:03:55.879 --> 00:03:59.240 it at a suspects house. It's digital detective work at 89 00:03:59.240 --> 00:03:59.879 its finest. 90 00:04:00.199 --> 00:04:03.680 Okay, the Metadata tool. That's seriously cool. It's like having 91 00:04:03.840 --> 00:04:06.879 X ray vision for digital files. But what about something 92 00:04:06.919 --> 00:04:09.319 a little more you know in the moment, like say 93 00:04:09.319 --> 00:04:12.560 there's a live event happening, something breaking newsworthy. Can boost 94 00:04:12.560 --> 00:04:15.000 godor handle that kind of real time stuff? Oh? 95 00:04:15.039 --> 00:04:17.879 Absolutely, it's got this tool called the Video Stream Tool, 96 00:04:18.120 --> 00:04:20.399 and it's not just about watching a live stream, it's 97 00:04:20.399 --> 00:04:24.079 about actually capturing it, like archiving that digital evidence before 98 00:04:24.120 --> 00:04:24.879 it disappears. 99 00:04:25.000 --> 00:04:26.399 Oh wow, I see what you mean. So, like, if 100 00:04:26.399 --> 00:04:29.519 there's a protest happening, or maybe even a suspects live stream, 101 00:04:29.839 --> 00:04:33.560 you can hit record with this tool and save that 102 00:04:33.600 --> 00:04:34.439 footage for later. 103 00:04:34.600 --> 00:04:37.000 Exactly. Think of it as a DVR for like the 104 00:04:37.160 --> 00:04:41.560 entire Internet. It's invaluable in those situations where every second counts. 105 00:04:41.639 --> 00:04:45.240 That is seriously powerful stuff. Okay, shifting gears a little bit. 106 00:04:45.439 --> 00:04:48.240 Let's say we're trying to build a profile of someone online. 107 00:04:48.240 --> 00:04:51.360 Maybe we've got their username and email address something like that. 108 00:04:51.560 --> 00:04:54.639 Can Boostkador help us connect those dots? You bet? 109 00:04:55.199 --> 00:04:59.120 Bouskador has what's called the Username Email Tool, and it's 110 00:04:59.199 --> 00:05:02.160 designed to do us that. It's like having a master 111 00:05:02.319 --> 00:05:06.319 key that unlocks a whole network of online profiles connected 112 00:05:06.360 --> 00:05:07.879 to that single identifier. 113 00:05:08.000 --> 00:05:09.839 It's like those movies where they type in a name 114 00:05:10.160 --> 00:05:12.399 and boom, all these files and photos pop up on 115 00:05:12.439 --> 00:05:12.839 the screen. 116 00:05:13.079 --> 00:05:17.680 Exactly, social media, forums, online shopping, you name it. This 117 00:05:17.800 --> 00:05:20.879 tool helps you paint a much fuller picture of someone's 118 00:05:20.920 --> 00:05:21.759 online presence. 119 00:05:22.040 --> 00:05:27.279 Okay, so that's Bouskador, a seriously impressive toolbox. But before 120 00:05:27.279 --> 00:05:29.680 we get too far down the rabbit hole of specialized tools, 121 00:05:29.959 --> 00:05:32.959 let's talk about good old fashioned online research. I mean, 122 00:05:33.120 --> 00:05:34.199 Google's still king. 123 00:05:34.120 --> 00:05:37.040 Right, absolutely, but it's not just about typing in a 124 00:05:37.040 --> 00:05:39.399 few keywords and hoping for the best. The book goes 125 00:05:39.399 --> 00:05:42.240 into a lot of detail about maximizing your Google Foo 126 00:05:42.639 --> 00:05:46.079 and one of the easiest yet most effective tips quotation marks. 127 00:05:46.199 --> 00:05:49.639 Quotation marks really like for an exact phrase exactly. 128 00:05:49.879 --> 00:05:53.480 Say you're looking for open source intelligence techniques, specifically, put 129 00:05:53.480 --> 00:05:55.680 that whole phrase in quotes, and Google knows to find 130 00:05:55.680 --> 00:05:58.079 exact matches, not just pages that happen to have those 131 00:05:58.120 --> 00:05:59.120 words scattered around. 132 00:05:59.160 --> 00:06:01.399 Oh that makes sense. It's like, what narrowing down your 133 00:06:01.439 --> 00:06:03.600 search results? Yeah, making them super specific. 134 00:06:03.759 --> 00:06:06.079 You got it. It's like using a laser pointer instead 135 00:06:06.079 --> 00:06:09.439 of a floodlight. Then there are search operators. 136 00:06:09.600 --> 00:06:11.680 Search operators those sound kind of technical. 137 00:06:11.800 --> 00:06:14.079 They're like little codes you can use to refine your 138 00:06:14.120 --> 00:06:15.319 searches even further. 139 00:06:15.920 --> 00:06:16.000 So. 140 00:06:16.160 --> 00:06:20.959 For example, inural lets, you find websites with specific keywords 141 00:06:21.040 --> 00:06:25.079 in their web address. So you want government websites ineral 142 00:06:25.319 --> 00:06:27.839 dot gov will narrow down those results for you. 143 00:06:28.160 --> 00:06:30.720 Ah. Okay, so it's like adding filters to your search 144 00:06:30.759 --> 00:06:34.000 to weed out all the irrelevant stuff. Very cool. What 145 00:06:34.040 --> 00:06:36.040 about when you need to like travel back in time 146 00:06:36.480 --> 00:06:37.360 digitally speaking? 147 00:06:37.399 --> 00:06:39.720 Of course, I know what you mean. The book actually 148 00:06:39.720 --> 00:06:43.560 talks about using Google's date range filter with the wayback machine. 149 00:06:43.839 --> 00:06:45.959 I've heard of that one wayback machine. Yeah, it's like 150 00:06:46.000 --> 00:06:48.000 what an archive of the Internet. You can see how 151 00:06:48.000 --> 00:06:48.759 websites used. 152 00:06:48.639 --> 00:06:49.600 To look exactly. 153 00:06:49.879 --> 00:06:50.079 Yeah. 154 00:06:50.120 --> 00:06:53.120 So by combining those two tools, you can actually see 155 00:06:53.160 --> 00:06:55.879 how a website looked at different points in time, even 156 00:06:55.920 --> 00:06:58.199 if the content has been deleted or changed. 157 00:06:58.519 --> 00:07:02.519 Wow, that is like digital archaeology. Okay, so we've got 158 00:07:02.560 --> 00:07:04.600 Google working for us on a whole new level. But 159 00:07:04.680 --> 00:07:07.839 what about those times when even Google doesn't cut it? 160 00:07:08.560 --> 00:07:10.839 Are there other search engines out there that might have 161 00:07:10.879 --> 00:07:11.720 different information? 162 00:07:12.319 --> 00:07:16.040 You're thinking like a true osent investigator, It's all about 163 00:07:16.120 --> 00:07:19.160 having the right tool for the job. The book recommends 164 00:07:19.199 --> 00:07:22.879 exploring other search engines like showdan for example, showdan. 165 00:07:23.000 --> 00:07:24.959 Okay, what's special about that one? Well? 166 00:07:25.000 --> 00:07:28.040 Showdan is interesting because it's not just searching websites. It's 167 00:07:28.079 --> 00:07:30.600 a search engine for Internet connected devices. 168 00:07:30.600 --> 00:07:33.040 Devices. Wait, so I could search for like all the 169 00:07:33.040 --> 00:07:34.439 webcams in a certain city. 170 00:07:34.519 --> 00:07:38.199 You absolutely could. Now we're focusing on the ethical applications here, 171 00:07:38.240 --> 00:07:42.639 of course, but yeah, Showdan is a powerful tool for researchers, 172 00:07:42.680 --> 00:07:46.160 security professionals, anyone who needs to understand the landscape of 173 00:07:46.160 --> 00:07:49.639 connected devices. Now, if you're looking for information about people, 174 00:07:49.720 --> 00:07:52.199 the book mentions a tool called piple Piple. 175 00:07:52.319 --> 00:07:55.079 Right, that's one of those what people finder type. 176 00:07:54.800 --> 00:08:00.000 Websites kind of but think of it like Peoplefinder on steroids, 177 00:08:00.000 --> 00:08:04.079 designed to uncover those online profiles, social media accounts, even 178 00:08:04.160 --> 00:08:06.720 blog posts that regular search engines might miss. 179 00:08:07.000 --> 00:08:09.879 Oh wow, that's intense. So it sounds like the key 180 00:08:09.920 --> 00:08:12.839 takeaway here is don't limit yourself exactly. 181 00:08:13.120 --> 00:08:15.720 Google's a great starting point, but it's not the end all, 182 00:08:15.720 --> 00:08:19.759 be all. Explore those specialized search engines and remember each 183 00:08:19.800 --> 00:08:22.680 one has its own strength. It's all about choosing the 184 00:08:22.800 --> 00:08:25.360 right tool for the task at hand, and of course, 185 00:08:25.480 --> 00:08:27.079 using them ethically and responsibly. 186 00:08:27.360 --> 00:08:29.839 Speaking of ethical considerations, I think it's time we dive 187 00:08:29.879 --> 00:08:32.759 into the world of social media investigations. That's a whole 188 00:08:32.759 --> 00:08:33.720 other ballgame, right, you. 189 00:08:33.679 --> 00:08:36.200 Could say that again, social media it's a gold mine 190 00:08:36.200 --> 00:08:39.200 of information, but it's also a mine field ethically speaking, 191 00:08:39.240 --> 00:08:40.360 you have to tread carefully. 192 00:08:40.759 --> 00:08:43.279 So before we even think about creating a fake profile 193 00:08:43.399 --> 00:08:45.840 or anything like that, what are the ground rules for 194 00:08:45.879 --> 00:08:46.960 social media? Ows it? 195 00:08:47.399 --> 00:08:50.519 Well, the book is really clear about this. Transparency and 196 00:08:50.639 --> 00:08:54.960 legality are key. No hacking, no impersonating others. You've got 197 00:08:55.000 --> 00:08:57.879 to respect people's privacy and operate within the law. 198 00:08:58.080 --> 00:09:02.840 Okay, so digital detect not digital spies exactly. 199 00:09:02.919 --> 00:09:06.679 We're gathering information ethically, not trying to, like, you know, 200 00:09:06.879 --> 00:09:10.559 ruin anyone's life. Speaking of which, the book highly recommends 201 00:09:10.559 --> 00:09:13.840 creating separate accounts specifically for your ocent work. 202 00:09:14.000 --> 00:09:16.480 Oh yeah, that makes sense. So your personal life and 203 00:09:16.519 --> 00:09:18.600 your investigator life don't get all. 204 00:09:18.480 --> 00:09:21.399 Mixed up exactly. You don't want someone you're investigating to 205 00:09:21.440 --> 00:09:23.840 suddenly see you liking their vacation photos. 206 00:09:24.200 --> 00:09:27.000 Not a good look. But okay, let's say we've got 207 00:09:27.000 --> 00:09:29.120 our separate accounts all set up. Where do we even 208 00:09:29.240 --> 00:09:33.200 begin with social media investigations. There's so much information out 209 00:09:33.240 --> 00:09:35.399 there it can be overwhelming. 210 00:09:35.279 --> 00:09:37.840 It's true, but the book breaks it down really well. 211 00:09:37.919 --> 00:09:40.679 Like it dives deep into Twitter, showing you how to 212 00:09:40.759 --> 00:09:44.559 uncover those hidden connections between users even how to view 213 00:09:44.720 --> 00:09:46.919 deleted tweets using the wayback machine. 214 00:09:46.960 --> 00:09:49.639 Wait, hold on deleted tweets. You mean those can still 215 00:09:49.639 --> 00:09:50.559 come back to haunt you. 216 00:09:50.759 --> 00:09:54.279 Oh yeah, the Internet never forgets. Even if something's deleted, 217 00:09:54.720 --> 00:09:58.120 traces of it often remain. It's all about knowing where 218 00:09:58.200 --> 00:09:58.639 to look. 219 00:09:59.080 --> 00:10:01.799 So like, some of could try to erase their digital tracks, 220 00:10:02.039 --> 00:10:04.480 but a good osent investigator could still find them. 221 00:10:04.720 --> 00:10:07.159 You got it. And it's not just about what people 222 00:10:07.159 --> 00:10:11.000 post publicly either. The book also talks about analyzing things 223 00:10:11.080 --> 00:10:13.000 like likes and other interactions. 224 00:10:13.039 --> 00:10:15.639 Oh that's interesting. So like, what I like on social 225 00:10:15.679 --> 00:10:18.120 media says just as much about me as what I 226 00:10:18.279 --> 00:10:20.000 post myself, maybe even more. 227 00:10:20.120 --> 00:10:24.919 It reveals your interests, your connections, your online behavior patterns. 228 00:10:25.240 --> 00:10:28.279 It's like being a digital psychologist or something. But social 229 00:10:28.320 --> 00:10:30.960 media is just one piece of the puzzle, right, I 230 00:10:31.000 --> 00:10:34.480 mean we leave digital traces everywhere online, not just on 231 00:10:34.519 --> 00:10:36.559 our social media profiles exactly. 232 00:10:36.759 --> 00:10:39.159 Social media is just the tip of the iceberg. Every 233 00:10:39.200 --> 00:10:43.200 website you visit, every online purchase, it all leaves a trail. 234 00:10:43.720 --> 00:10:46.759 The book calls these data trails, and it goes deep 235 00:10:46.799 --> 00:10:48.759 on uncovering those hidden connections. 236 00:10:48.879 --> 00:10:51.240 Okay, data trails, I like it. So we're talking about 237 00:10:51.279 --> 00:10:54.360 like following the digital footprints people leave behind, exactly. 238 00:10:54.720 --> 00:10:57.240 And just like a single footprint can tell a detective 239 00:10:57.279 --> 00:10:59.960 a lot about the person who left it, those digital 240 00:11:00.559 --> 00:11:03.320 can be incredibly revealing if you know what to look for. 241 00:11:03.840 --> 00:11:05.879 So give me an example. What kind of digital breadcrumbs 242 00:11:05.879 --> 00:11:06.840 are we talking about here? 243 00:11:07.000 --> 00:11:09.639 Well, let's start with something I bet you've used before, 244 00:11:10.320 --> 00:11:11.399 reverse image search. 245 00:11:11.679 --> 00:11:13.960 Reverse image search, Oh yeah, like when you want to 246 00:11:13.960 --> 00:11:16.039 see if someone's using your photo without permission. 247 00:11:16.399 --> 00:11:18.960 That's one use, but the book talks about how it 248 00:11:19.000 --> 00:11:22.120 can be much more powerful than that. Let's say you 249 00:11:22.200 --> 00:11:24.120 have a photo of someone and you want to learn 250 00:11:24.120 --> 00:11:28.080 more about them. Reverse image searching that photo could uncover 251 00:11:28.159 --> 00:11:31.840 their presence on platforms you might not even think of, Pinterest, 252 00:11:32.360 --> 00:11:34.799 dating apps, professional networking sites. 253 00:11:34.960 --> 00:11:37.200 Oh wow, I see what you mean. It's like using 254 00:11:37.240 --> 00:11:39.720 a single photo to unlock a whole network of online 255 00:11:39.720 --> 00:11:40.960 profiles exactly. 256 00:11:41.480 --> 00:11:45.559 It highlights how interconnected everything is these days. But sometimes 257 00:11:45.600 --> 00:11:48.240 the information we need isn't just sitting out in the open, 258 00:11:48.399 --> 00:11:50.519 It's hidden in the shadows of the internet. 259 00:11:50.960 --> 00:11:54.360 Okay, now we're getting into some seriously cloak and dagger territory. 260 00:11:54.440 --> 00:11:56.440 What kind of hidden information are we talking about. 261 00:11:56.480 --> 00:11:59.679 Well, you've probably heard about data breaches, right when hackers 262 00:11:59.679 --> 00:12:02.799 get in to accompany's systems and steal sensitive information. 263 00:12:03.000 --> 00:12:05.720 Oh yeah, those are always in the news. It seems 264 00:12:05.720 --> 00:12:07.200 like it happens more and more these days. 265 00:12:07.440 --> 00:12:10.679 It's a huge problem, and it's a reminder that digital 266 00:12:10.679 --> 00:12:15.200 security is an ongoing battle. But for ocent investigators, these 267 00:12:15.279 --> 00:12:18.440 data breaches can actually be a valuable source of information. 268 00:12:18.840 --> 00:12:23.279 Really, you're saying that investigators sometimes use this stolen data. 269 00:12:23.360 --> 00:12:26.399 It's more nuanced than that. It's not about condoning these 270 00:12:26.440 --> 00:12:30.440 brooches or exploiting anyone's misfortune. It's about understanding that this 271 00:12:30.519 --> 00:12:34.159 information is often already circulating online and knowing how to 272 00:12:34.240 --> 00:12:38.080 access it and analyze it can be crucial for certain investigations. 273 00:12:38.159 --> 00:12:40.399 So it's like infiltrating the hacker's layer, but instead of 274 00:12:40.399 --> 00:12:44.000 stealing anything, you're using the information to I don't know, 275 00:12:44.039 --> 00:12:45.200 catch criminals. 276 00:12:44.840 --> 00:12:48.720 Or something exactly. It's all about using this information ethically 277 00:12:48.759 --> 00:12:52.639 and responsibly. The book talks about the importance of understanding 278 00:12:52.679 --> 00:12:56.360 the source of the data, verifying its authenticity, and always 279 00:12:56.399 --> 00:12:58.759 being transparent about where your information came from. 280 00:12:58.879 --> 00:13:00.679 Okay, that makes sense. You don't want to be presenting 281 00:13:00.720 --> 00:13:04.399 information that turns out to be unreliable or obtained the 282 00:13:04.399 --> 00:13:05.559 illegally exactly. 283 00:13:05.759 --> 00:13:07.559 And that brings us to another important point. 284 00:13:07.840 --> 00:13:12.159 Pastes pastes, I think I missed that one. What are those? So? 285 00:13:12.399 --> 00:13:16.519 Pastes are basically snippets of texts that people post online, 286 00:13:16.840 --> 00:13:20.039 forum posts, code snippets, even parts of documents. 287 00:13:20.120 --> 00:13:22.840 Oh okay, and why are those important? They sound kind 288 00:13:22.840 --> 00:13:23.320 of random. 289 00:13:23.559 --> 00:13:26.399 Well, you might think these little bits of text are insignificant, 290 00:13:26.759 --> 00:13:29.960 but they can actually linger online long after the original 291 00:13:30.000 --> 00:13:30.759 source is gone. 292 00:13:31.000 --> 00:13:33.559 Ah. I see. So it's like finding a scrap of 293 00:13:33.559 --> 00:13:36.519 paper with someone's handwriting on it. It might seem like nothing, 294 00:13:36.519 --> 00:13:38.600 but it could be a valuable clue exactly. 295 00:13:38.879 --> 00:13:42.279 And these digital crumbs can turn up in some unexpected places. 296 00:13:42.360 --> 00:13:44.039 It's all about knowing where to look. 297 00:13:44.240 --> 00:13:47.639 My mind is officially blown. This is all so fascinating 298 00:13:47.720 --> 00:13:50.440 and kind of overwhelming at the same time. I hear you. 299 00:13:50.639 --> 00:13:53.679 But that's the thing about osin. It's a constantly evolving field. 300 00:13:53.799 --> 00:13:57.039 There's always something new to learn, a new tool to discover. 301 00:13:57.360 --> 00:13:59.960 Well, speaking of learning and discovering, what other osent secret 302 00:14:00.200 --> 00:14:02.279 does the book have in store for us? I'm ready 303 00:14:02.320 --> 00:14:02.679 for more. 304 00:14:02.919 --> 00:14:05.679 Well, get this. The book doesn't just stop at the basics. 305 00:14:06.159 --> 00:14:10.279 It goes deep on some seriously powerful tools. I'm talking 306 00:14:10.399 --> 00:14:11.960 advanced Linux tools. 307 00:14:12.279 --> 00:14:16.279 Okay, Linux, I'm not gonna lie. That always sounds a 308 00:14:16.320 --> 00:14:19.200 little intimidating. Is this part of the book just for 309 00:14:19.279 --> 00:14:22.360 the tech wizards out there? Or can a regular person 310 00:14:22.440 --> 00:14:22.960 handle it? 311 00:14:23.080 --> 00:14:25.080 You don't need to be a coding genius. Don't worry. 312 00:14:25.399 --> 00:14:28.360 The book actually does a great job of explaining everything, 313 00:14:28.399 --> 00:14:31.240 even the complicated stuff, in a way that like anyone 314 00:14:31.279 --> 00:14:32.039 can understand. 315 00:14:32.120 --> 00:14:33.120 Okay, that's reassuring. 316 00:14:33.240 --> 00:14:35.879 Think of fit this way. You're a detective, right and 317 00:14:35.919 --> 00:14:41.879 you've got your trusty tools, magnifying glass, fingerprint kit, the classics. 318 00:14:43.000 --> 00:14:46.399 These Linux tools, they're like adding a whole high tech 319 00:14:46.480 --> 00:14:48.320 forensics lab to your arsenal. 320 00:14:48.399 --> 00:14:50.639 Okay, now that's an image. I like the sound of that, 321 00:14:50.919 --> 00:14:52.879 but I gotta be honest. The idea of like messing 322 00:14:52.879 --> 00:14:55.879 around with Linux on my computer makes me a little nervous. 323 00:14:55.519 --> 00:14:57.679 And you should be cautious. But you don't have to 324 00:14:57.720 --> 00:15:00.200 be scared. The book walks you through this whole whole 325 00:15:00.279 --> 00:15:03.600 process of setting up something called a virtual machine. It's 326 00:15:03.639 --> 00:15:08.039 basically like imagine running a completely separate operating system, a. 327 00:15:07.919 --> 00:15:10.120 Separate operating system on my computer. 328 00:15:10.320 --> 00:15:13.519 Yeah, inside your computer. It's like a computer inside your computer. 329 00:15:13.600 --> 00:15:16.600 And in this case, that separate operating system would be Linux. 330 00:15:17.000 --> 00:15:19.600 Oh okay, So it's like a safe space. If I 331 00:15:19.679 --> 00:15:22.480 mess something up, it's not going to affect my actual 332 00:15:22.519 --> 00:15:23.720 computer exactly. 333 00:15:24.200 --> 00:15:26.720 It's self contained. It's like imagine you're a chef and 334 00:15:26.799 --> 00:15:30.159 you have a separate kitchen just for experimenting with new recipes. 335 00:15:30.600 --> 00:15:32.840 You wouldn't want to risk messing up your main kitchen. 336 00:15:32.919 --> 00:15:36.840 Right, that's a great analogy. So I've got my virtual machine, 337 00:15:36.879 --> 00:15:40.039 my safe space all set up. What kind of tools 338 00:15:40.039 --> 00:15:41.919 are we talking about here? Give me the good stuff, 339 00:15:42.440 --> 00:15:42.799 all right. 340 00:15:43.120 --> 00:15:45.399 One of the first ones the book introduces is called 341 00:15:45.440 --> 00:15:46.000 the harvester. 342 00:15:46.399 --> 00:15:49.240 The harvester, okay, sounds intriguing. What does it do? 343 00:15:49.559 --> 00:15:53.279 So imagine you're investigating a company, right, and you need 344 00:15:53.279 --> 00:15:55.519 to find out all the email addresses they use or 345 00:15:55.519 --> 00:15:58.840 maybe uncover any subdomains they might have. The harvester is 346 00:15:58.879 --> 00:16:01.519 like sending out this team of digital scouts to gather 347 00:16:01.600 --> 00:16:03.360 that information for you automatically. 348 00:16:03.639 --> 00:16:07.000 So instead of like manually searching for hours on end, 349 00:16:07.080 --> 00:16:09.159 the harvester just goes out and finds it. 350 00:16:09.120 --> 00:16:12.600 All for me exactly. It automates that whole initial phase 351 00:16:12.639 --> 00:16:16.519 of information gathering. Then there's METAGOOFHIL. Remember how we were 352 00:16:16.519 --> 00:16:17.840 talking about metadata earlier. 353 00:16:17.919 --> 00:16:20.679 Yeah, that hidden data in digital files, right. 354 00:16:20.919 --> 00:16:25.519 METAGOOFHIL is like a forensic expert that specializes in extracting 355 00:16:25.519 --> 00:16:26.240 that metadata. 356 00:16:26.320 --> 00:16:30.000 Okay, so it can tell you things like what who 357 00:16:30.039 --> 00:16:32.639 created the file, when it was created. 358 00:16:32.320 --> 00:16:34.840 That's just the beginning. It can even tell you things 359 00:16:34.879 --> 00:16:37.159 like what software they used to create it, where it's 360 00:16:37.200 --> 00:16:40.000 been saved, and a bunch of other technical details that 361 00:16:40.039 --> 00:16:41.519 most people don't even know exist. 362 00:16:41.720 --> 00:16:44.720 Wow, that's amazing. It's like finding a hidden signature on 363 00:16:44.759 --> 00:16:45.879 a document or something. 364 00:16:45.919 --> 00:16:48.279 It kind of is, and that kind of information can 365 00:16:48.320 --> 00:16:52.399 be incredibly useful for verification. Like let's say you have 366 00:16:52.480 --> 00:16:54.519 a document and you need to know for sure if 367 00:16:54.519 --> 00:16:57.679 it's authentic. Metagoofl can help you figure that out. 368 00:16:57.919 --> 00:17:01.320 Okay, so we've got our digital scouts, got our forensic experts. 369 00:17:02.000 --> 00:17:04.599 What other specialists are in this Linux toolkit? 370 00:17:04.720 --> 00:17:07.079 Well, once you've gathered all this information, you got to 371 00:17:07.119 --> 00:17:08.359 make sense of it, all right. 372 00:17:08.559 --> 00:17:10.599 Yeah, it's one thing to click data, but it's another 373 00:17:10.599 --> 00:17:14.240 thing entirely to actually understand what it all means exactly. 374 00:17:14.599 --> 00:17:16.920 And that's where a tool called Maltago comes in. 375 00:17:17.079 --> 00:17:20.119 Multago, Kay, I'm ready. What does Maltago do? 376 00:17:20.440 --> 00:17:24.079 So imagine this. You're in a detective movie, right, and 377 00:17:24.119 --> 00:17:26.559 you've got that classic scene where they're in a dark 378 00:17:26.640 --> 00:17:30.480 room pinning photos and notes to a giant corkboard, trying 379 00:17:30.519 --> 00:17:33.680 to connect the dots. That's basically what Maltiego does, but 380 00:17:33.839 --> 00:17:34.799 in the digital world. 381 00:17:35.079 --> 00:17:37.880 So it's like what a mind mapping tool for investigators? 382 00:17:38.000 --> 00:17:41.319 Exactly. It's a data visualization tool that helps you see 383 00:17:41.400 --> 00:17:45.359 the relationships between all those different pieces of information you've collected. 384 00:17:45.400 --> 00:17:48.240 It's all about connecting the dots and seeing the bigger picture. 385 00:17:48.680 --> 00:17:51.759 That's amazing. But I got to ask, all of this 386 00:17:51.880 --> 00:17:54.480 relies on actually having data to work with in the 387 00:17:54.480 --> 00:17:57.240 first place, right, So where are we finding all this 388 00:17:57.440 --> 00:17:59.359 raw material for our investigations. 389 00:17:59.480 --> 00:18:01.880 That's a great question, and it brings us to one 390 00:18:01.880 --> 00:18:06.559 of the most controversial yet undeniably valuable sources of information 391 00:18:06.759 --> 00:18:09.799 in the oscent world, data breaches and leaks. 392 00:18:09.960 --> 00:18:12.799 Okay, so we're talking about those situations where hackers break 393 00:18:12.799 --> 00:18:15.440 into a company's system and steal a bunch of sensitive information, 394 00:18:15.559 --> 00:18:18.119 like I've definitely seen those headlines exactly. 395 00:18:18.200 --> 00:18:21.440 It's a constant reminder that in the digital age, no 396 00:18:21.839 --> 00:18:26.640 system is foolproof, and unfortunately, these breaches often result in 397 00:18:26.839 --> 00:18:30.039 massive amounts of personal information ending up in the wrong hands. 398 00:18:30.160 --> 00:18:32.799 It's like the digital equivalent of someone rummaging through your 399 00:18:32.839 --> 00:18:34.920 trash and finding all your personal documents. 400 00:18:35.119 --> 00:18:37.759 It's an unsettling thought and it's a huge problem. But 401 00:18:37.880 --> 00:18:41.480