Now, I just want to hit on one more thing before we start even noting it into
our executive summary of the wrap up of the skill.
And that is, where do we take notes at?
Well, this is more of a shooter's preference thing.
All I'll say for sure is that there needs to be a surefire way of backing that
up and being able to call upon those notes for reference later on, be it an
investigation or verification or whatever the case may be.
Now, my method of taking notes is usually pen and paper and something as simple
as a regular notes booklet is and I keep one of these per
pen test or investigation that I use.
And the reason I do this is because some of these, if you can see up at the top
right there, it has month and date that I could just simply circle on there and
the title up at the top.
Now, I put bullet points in there, things like I walked up to the system, I
began my pen test.
This is the tool that I use, this is the command that I use.
Now, for the purposes of this course and being that we are computer based
training online, I know that this is not always applicable to the things that
we do because I'd have to be able to write and scan every page that I took
notes on.
That being the case, as you can see over here on this screen, I have a Word
document opened up and I just want to pull that over here in just a second and
show you a couple of tricks real quick.
So here I am in Microsoft Word and I promise that this is elbows at hand, but
it comes in handy if you want to use it.
So I'm going to go to file and go down to options real quick and make sure that
in my customization river ribbon that on the right side, I have right there
developer checked for us to be able to do this.
Once that's done, you should be able to go to the developer tab, which is what
I'm on now and up on the top left is I'm going to zoom in for you real quick is
the macros button.
Inside of macros, you can see that I have one in there called timestamp and I
've exported this and I want to put it in as an attachment right below this
video.
Go into edit it. You will see that I just put in a simple selection there that
allows me to be able to do the timestamp of your month day with the actual time
itself.
By all means, with this as you want based on how you are your organization does
. But the reason I've pointed this out is because I also go through and go into
file.
Options.
Customize ribbon and then go into customize keyboard shortcuts. And if I go all
the way down to macros on the left, you'll see that I already have one set for
timestamps, which is that macro we just created.
Along with all control one as being my actual keyboard shortcut to that. So
long story short, if I go inside of word now and specifically inside of this
document or I have a separate word overall.
But if I go through and say all control one. There's my actual timestamp right
there and I can say opened case or pen test.
And then and then all control one again and then say.
Assigned Eric to pen test.
And you get the idea is we can go through and hit the timestamp anytime that we
need on our keyboard. So that way, as we're making notes and annotations about
different tools that we use different things that you ran across.
We can put the actual timestamp in there correlate with what we've learned
inside of Cali by going through and comparing it to the actual bash history or
even in the terminal itself.
And this allows us to be able to alleviate times to all together. So that way,
when we do get to our executive summary, we can nip this in the bud and make
sure that everything's all on the same sheet sheet and use it.
We can also annotate in our notes here if there's a time zone difference or if
there's a problem with the virtual machines.
Specifically with the other site, not always have an access to NTP or yeah.
Now you may think that's a 10 bit silly, but I'm here to tell you that not all
networks out there have NTP or
GPS available to them for time synchronization. You will run across different
networks, specifically in sign of DoD
That are secret and above that don't have access to regular internet resources.
And there are GPS and NTP solutions on those specified networks of class
ifications. However, they're not always readily available, especially in I give
you a little bit behind the curtain here in those mobile command environments
where you don't always have access to the rest of the actual
network. So if you set everything up and you're running internally, they should
have all their systems sync to the domain controller or a central point within
that network.
And if you're brought in the pen test, you need to make sure that whatever time
it is in real time,
along with the notes of what time it actually shows on those individual systems
, because in those closed network scenarios,
you will see timescue happen all over the place. And with the advancement of
CPUs and GPUs and all the other fun parts that are a computer nowadays,
there is still a little bit of timescue the longer those systems are left on or
being utilized. So it's not like that day. It's not as bad as the days is
286, 386 and 46 and having to manually set your time at Pascal. Yes, I remember
those, but it does happen over time and it can cause discrepancies within your
reporting.