Truly, all praises God. We praise Him, seek His assistance, and ask His forgiveness. We seek refuge in God from the evil in ourselves and our bad actions. Whomsoever God guides, no one can turn away, but whoever He turns away from will have no one to guide them. I bear witness that there is nothing worthy of worship except Allah, and to Him belongs all praise and all power over each and everything. I further bear witness that Muhammad is the servant and final messenger of God. May the peace and blessings of Allah be upon him, his family, his companions, and all those who follow in righteousness until the end of the world. God says in his book the meaning and translation of which is, O you who believe, be in awe of God as His awesomeness demands, and do not let yourselves leave this world until and unless you have submitted entirely and completely to Him. O humanity, be in awe of your Lord who created you from one soul, and from that soul made a partner and spread forth from that couple, many men and many women. Be in awe of God by whom you ask of one another and as such to those that bore you. Exactly almost exactly ten years ago I was on the other side of the country in New York City teaching a class on Islam at a church, and it was a four-part class, and the topic that day was the life of the Prophet Muhammad peace be upon him. I've been doing this kind of thing, this kind of teaching for many years, and if you talk about Islam, and I'm sure all of us have had interactions where we're asked to explain something about our faith, you often get one of a limited number of reactions, sometimes positive, sometimes negative, but it's rare that you get something that totally surprises you, and yet at the end of that class, a woman who probably was not much older than I am now, raised her hand and asked a question that completely left me dumbfounded. I was very confused, I didn't understand the question. She said to me, in Islam is it okay to pray to God to help you or heal you if you are sick, and I thought to myself I was very confused, I thought to myself, I didn't say this, but I thought to myself probably if we're honest, we most intensely and fervently pray to God when we are sick or scared or worried. That's one of the challenges of faith that when life is going our way, we believe we are self-sufficient that everything is under our control, that we got it. And I went back and forth with her because I was trying to understand the question. I didn't want to leave her with a misimpression, and it occurred to me as soon as she was explaining her question that she believed that in Islam the relationship between God and humanity, between the creator and creation individually and collectively, was one of rigidity, harshness, obedience. It was not room for warmth or compassion. And on the subway ride back to my apartment, it occurred to me that yes this is an impression that sometimes people have of Islam from outside our faith, but sometimes it is an impression we give in our own faith that we do not do full justice to the beauty and strength of our faith. And many of us here may have kids or our teachers or are thinking of having kids or perhaps have grandkids and we think frequently, often, about this question of what can I do to make sure that those who come after me follow in the path of the Prophet Muhammad peace be upon him. Now of course we have no absolute control over any of this, but it is still a concern. There isn't a single person alive who loves someone who doesn't wish for them what is good for them. And it occurred to me that sometimes we fail to focus sufficiently on the most beautiful, powerful and amazing thing about Islam, which is our conception of the divine, of Allah, of God, of the Creator which is so incredible if you dwell on it, that it is different, it is greater than that in almost any other faith tradition as far as I have studied. And its implications are almost too much for us to completely understand. So today in the small amount of time we have, I would like very much to talk about one chapter from the Qur'an, a very short one, Surah Al-Ikhlas. It is the 112th chapter of the Qur'an, it means the chapter of sincerity. The Prophet Muhammad peace be upon him once said that this chapter is the weight of the, it constitutes a third of the Qur'an. Right now obviously literally that's not what he meant because the Qur'an is 6,000 verses and these four verses are quite short. What he meant to say is that in this chapter you find so much meaning and significance that it is as if you have understood or experienced a third of the Qur'an. And so what I want to do is I want to translate the verses and then explain them in the second part of the khutbah. So the chapter begins Bismillahir Rahmanir Rahim in the name of God who loves all and is compassionate and merciful to each and every. Say he is God, the one, the unique, the singular. Allahu Samaad, that he is, Samaad is a name of God that is particularly hard to translate completely in English. I will for now say self-sufficient, right, in need of nothing and no one. Some of the older translations of the Qur'an, they will say things like he begets not nor was he begotten. Another way of understanding this a little bit is as if to say he is neither a parent nor a child that he does not have offspring or is he the offspring of anything. And there is nothing like him or even more emphatically, even more impactfully, there can be nothing like him. And now two things come to mind before we unpack these verses. The first is if you, you know, sometimes if you have a prior impression of a person, like someone says to you hey, did you know so and so, they're really stingy or they're really rude or they say something about a person you over here, you don't mean to internalize it but you do. So many times when people approach Islamic texts from outside our tradition, if they have a prior conception of Islam, that's what they read into it. But sometimes we don't give ourselves the permission to read more deeply into our own texts because if you look at these four verses, right, they sound superficially to imply distance, right, that he's not a parent or a child, there can be nothing like him. He, the divine is different from anything you know or understand. It sounds like the description of a being that is so utterly unlike anything in your experience that how can you possibly connect to that being? And so you do get this assumption that in Islam our relationship with the divine is one that is very harsh and cold, which is in fact incredibly far from the truth. That's not how Muslims experience Islam. But it's also important to understand this because if we want to pass on Islam to next generation and the next generation after that, we have to make sure that we begin with the one thing on which everything else depends. Nothing in Islam makes sense if you don't understand God. Nothing in Islam makes sense without the divine and the heart of it. We begin and end with God.  Right, we begin and end with God and where do we come back to life? In the presence of God. And the second thing I want to tell you because this is something that sometimes we don't get out of mainstream culture, I was a philosophy major but I promise I won't make it too dull because there's a concept in philosophy called description versus prescription and I'm going to explain that. To describe something is just to tell you what it is.  It's not telling you how, it's telling you what you should do. So for example, last night, I'm not from here as you probably gathered, I had dinner with a lovely young man who lived in Redwood City. I went on Google maps to tell me how to get there. Google doesn't make a value judgment, it doesn't tell you should you go there but it tells you how to go there. Similarly, if I give you information it is up to you to decide what to do with it. In the Quran, in the Islamic tradition however, God isn't just telling us things in order that we know an abstract concept. Knowledge is about action. That is a deeper form of knowledge so Allah is telling us this is who I am in order that you may be a certain kind of person and live a certain way and if you have a deeper understanding of the Divine you have a deeper understanding of yourself and you can be liberated from things that pull you down. Ideas and beliefs, even people and forces and institutions that deny your full nobility and stature as creations of God. And we live in a culture unfortunately that is forgetting the nobility of the person. With consequences I think that we see not just physically, environmentally but spiritually, psychologically, biologically, politically we are losing the dignity of the person and the dignity of the person comes from God. So in the second part of the hulqba in the second part of the sermon what I'm going to do is tell you how these four verses create Islam as we understand and live it. That take us from describing who God is to understanding how we connect to the Divine. I say what you hear, I ask forgiveness for myself and for you and for all those who believe seek forgiveness from Allah for he loves to forgive and forgives most often. All praise and gratitude, all thanks is to God the Lord and Master and Sustainer of everything that exists whether we know it or do not. And prayers and peace upon the best of creation our teacher, our example, our leader Prophet Muhammad. In qulhu Allahu ahad say he is God the one, the unique. Why say? Now it's not enough to believe something in your heart that's the weakest kind of faith and sometimes there are places where you have to keep your belief private there are circumstances where it could harm your life but for most of us we are blessed not to be in that circumstance and so we are called to embody faith you don't keep it to yourself you don't hide it you're not ashamed of it in fact you are proud of it you are uplifted by it and you want others to gain by it now imagine in a polytheistic society in a society literally formed by poetry and words your word was your bond literally and so Allah is telling you God is telling you to say he is the one, the unique Allahu samad one of the most powerful verses in the Quran it's two words long God samad means self-sufficient there are other translations I'll get into them but what does self-sufficient literally mean? it means you don't need anything you don't need anything unlike anything else in existence you need food you need sleep you need friends you need love you need money we need lots of things if you sit on the floor too long your body will get stiff even if you're in good health there's only so much work you can do most of our lives are out of our control did you decide what your name was going to be? probably not did you decide who your parents were going to be? probably not did you decide where you were going to be born? probably not many of the things that shape so much about you are outside of your control we are the opposite of self-sufficient God is unique why? because he's self-sufficient another meaning of salat is eternal eternal means what? no beginning no end it's connected if you don't need anything or anyone you are liberated from any kind of weakness or flaw or dependency you don't begin you don't end even trying to understand that makes almost no sense to us because God created time it's beyond our ability to fully grasp lam yalid wa lam yulad wa lam yakulllahu kufwan ahad of course part of this is a vocal it is a response to Christian Trinitarianism it is a response to the polytheism of the time and other forms of idolatry that existed then and exist now saying God is not a parent, not a child he's not part of a family unit in the way that we understand the world he doesn't reproduce genetically he doesn't come from anything he always was and hence wa lam yakulllahu kufwan ahad there can be nothing like him now you tell me if you hear that what does it sound like? elsewhere in the Quran God emphasizes his difference again and again ayatul kursi, the verse of the throne part of it let that khuduhu sanatun wa la naum that he doesn't get tired he doesn't get sleepy he doesn't wear out he doesn't feel exhausted now why is he telling us this? yes, partially in order that we understand who the Divine really is but also because it does something for us and here's what it does why would you worship anyone or anything in need of anything? distance in the Islamic tradition enables intimacy have you ever had to talk to two people at the same time? it's effectively impossible right? why do so many people get upset with texting and driving? because your brain can't handle two things at the same time right? one feels urgent and one is literally existentially dangerous right? we can't handle that and yet the Divine is not just omniscient, possessive all power but omniscient, possessive all knowledge but omnipotent, possessive all power meaning that Allah is in control of and aware of every single thing that happens in every single moment in every single place that ever was is or will be which means you can talk to him whenever you need to and more than that you should and you must but you only will fulfill that obligation if you know that you can you know there was a conversation once after a halak when I was in school many many years ago and someone said does it really matter where I put my hands God has more important things to do and you know it his point was that in the hierarchy of things how do we prioritize life right? now we have to prioritize things right if I want a car wash but my kid needs to go to school probably I should take my kid to school and not get a car wash right like small things but they clearly weigh out but if you are omniscient and omnipotent if you are possessive power over everything you don't have to prioritize because you literally created time and energy Allah is always there for you he's always listening whether you want him to or not it can be terrifying because it means we are always being evaluated but it is also liberating because it means there is a rope to hold on to he is with you wherever you are however you are, whoever you are this was the incredible transformation Islam affected people's lives and produced whole civilizations all over the world from the Americas to the Australia, New Zealand like everywhere in the world there was a Muslim culture that was born inspired by this incredibly empowering belief and recognition and transformation that Allah is in control of all things he is there for us whenever we need him and therefore why go through intermediaries the Prophet Muhammad peace be upon him taught us how to best worship Allah but the path to Allah is for everyone and we have for a long time as Muslims been in a kind of defensive crouch we have focused sometimes excessively on our identity as minorities instead of projecting outwards we should use our faith to inspire ways of living and being arts and culture, institutions, policies knowledge and wisdom, practices, spaces communities that invite people in and grow because what we have is not for us alone we are simply vehicles through which the Divine continues to pass His message onto His creation that is His wisdom and His choice and we have in this country right now we have a challenge as people become disconnected from their nature we see all sorts of crises and I don't mean this in the way of knocking on people or punching down I mean to say that first we should internalize this in our own lives that God is always there and always able to listen He may not respond in the way we want or when we want but that is His will that doesn't mean He is not responding it simply means we don't have the wisdom we don't have the knowledge we are being taught something and then we need to spread this knowledge outwards and share it with others I want to end with this thought I was reading an article a couple days ago when I was on the plane here and it was reading an article about a mental health crisis in the United States which seems to be manifesting in many parts of the world and it's devastated that huge numbers of people in the United States are in a state of existential despair I am not by any means dismissing the value of medical treatments I'm not saying that what I'm saying is that if you have a culture that doesn't nourish people those who are perhaps genetically predisposed existentially predisposed socioeconomically predisposed I don't know I'm not an expert what I do know is that when a disaster strikes those who are vulnerable are hit the hardest we know that I live for a long time in New York City New York City had a problem with homelessness why? because as you know in the Bay Area it is really expensive to find a place to live and as the prices go up people get priced out and if you have money if you've been blessed then you can weather the storm although it affects many people but if you don't or you get ill or you have a family crisis or you lose your job then you have a problem similarly existentially a culture that doesn't teach people that they have a hand to hold on to it all times and show them how to is a culture where if you are wealthy and comfortable maybe you can ride it out but if you face a hardship you're gonna have a problem and our job is to project outwards what Islam did for people and does for people it provides us a connection to who we really are I want you to think for a moment of everything that you know exists all the places in the world all the people every blade of grass outside every car on every street the amount of stuff there is it boggles the mind and yet at every moment not only has God aware of those things but he is sustaining them if for one second he withdraws his power and his will nothing exists therefore everything that exists exists for a reason and was intended before time outside time we don't even understand if you are feeling high on yourself remember therefore that everyone around you was intended by the same God who created you and if you are feeling low and down on yourself that your life isn't what you thought it would be or your circumstances aren't what you thought they would be then remember you were intended you are here for a reason and your creator wants to hear from you he wants to hear from you he made you before and outside of time we experience this unfolding in the ways our limited horizons allow us to there is not a single person here or anywhere in the world who was not intended by God and if we take away their rights we are violating God's plan and if they take away our rights they are violating God's plan accountability may come in this life it definitely comes in the next life but it comes and it comes from God he teaches us who he is not just so that we know something in our heads but so that we live it in our lives not just so we can read it in a book but so that we can become it in the world and share it with others God and His angels send blessings upon the prophet O you who believe send blessings upon him and send him to find his salutations please raise your hands in supplication Ya Allah forgive our sins overlook our faults absolve us of our errors and keep us always connected to you in this life and in your shade and in your garden in the next Ya Allah bless this beautiful congregation sustain, strengthen and continue in this life and in your garden in this life and in your garden in this life and in your shade sustain, strengthen and continue to elevate and guide this community Ya Allah protect and nurture our country and help us to fulfill its noblest ideals for each and all Ya Allah bless our planet help us work towards healing and softening this world growing our knowledge so that we can uplift ourselves and ennoble others Ya Allah save us from anything that has no benefit from hearts that are stubborn from ignorance and obstinacy and how to cry Ya Allah make us always among those who defend the oppressed those who bring rights and freedoms to those who are wronged and causes ever to associate with those who love you and who are loved by you Ya Allah give us peace in our houses and our homes guide us our families and our loved ones to you and to stay faithful to you forgive our ancestors and all those who sacrifice to enable us to live in the world as we do Yaidian may Allah make you remember God commands justice the doing of good and giving to family to Kith and kin He forbids all indecency evil, rebellion and wickedness He instructs us he teaches us He guides us because he loves us and wishes better for us I will give you peace in prayer


Welcome to the journey today. We're gonna talk about how to take your home base business and put it online Let's jump in. I have a special guest our co-host Justin Neely in the house. What's up, Justin? What up? How's it going? Living the dream. Yeah So first thing that comes to mind and I get asked us a lot is Where do you start when it comes to just technology or you know because you say online what comes first? Website or domain well if you're currently offline right as a home business You got to get online and the first way to do that is with a domain name and a website That's your online real estate. That's how people find you online. That's like go daddy comm or coffee and kickflips comm It's how people get to you It's like a street address right and after that you need hosting essentially think of that as like online storage for your Website and then you need something to build the website now many people aren't web designers And they don't want to spend a lot of their time building a website So there are tons of tools out there that just help you build websites or there's WordPress if you're a little bit more Technically inclined but not me you don't have to go overboard Just have a home page have a little bit about what you do Maybe the services you provide or if you're online shop like if you're on a farmer's market You want to really bring that to life and sell your products online you can have a little online shop That's pretty easy to use and a contact page Yeah, so speaking of the farmer's market, let's say I'm out there, you know selling some plant-based soap or okay Or both I'm in So once I get a domain that makes a ton of sense because we're going from offline online Then what's next? Well the probably next step is social and that's kind of where you're the expert You want to be on your favorite platforms Facebook Twitter Instagram? You also want to be on this business directory sites like Yelp Google Pages claim your listings Don't let it just be open to the masses. That's your baby, right? It's your business. Make sure you control it Okay, so once you're on the social media, I know that's a big step But it's not where majority of your time is going to go majority of your time goes into actually Creating content so you connect with your customers, right? So you elaborate on that the importance of engagement and connecting with Potential customers, right? So we'll take the kind of the farmers market example that you have there So if I'm what were you selling hot sauce and what? Plant-based soaps, of course great combination So if I'm after you use the hot sauce I'm selling hot sauce and soap at the farmers market. I want to take it online I really want to take it into social media presence What I don't want to do is just start listing off my products and saying hey This is all the cool stuff you can buy for me What I want to do is basically start opening people up to my world the the hot sauce in all natural soaps Interesting world. So you do that by Basically showing what you do like the Instagram story is a great way to do that Just pop up cool on making the soap or making the hot sauce behind the scenes Try not to get those mixed because you don't want to like be scrubbing with hot sauce soap But open up your world talk about what you do as a business and be relatable people buy from people They don't buy from companies right if you start to really open up who you are as a business owner your day to day The struggles you go through maybe just some of the cool stuff you do beyond your business itself It really helps people connect with you and then they're more up to buy from you tell their friends about you and get a hashtag Yes, about your soap or the hot sauce. Well my soap and my hot sauce brand Yeah, so that way when customers are using my products. They can use the hashtag and then I can reshare that or retweet it right right over and over and over and that's helping you create just more content That's called user-generated content. I know you're an expert of this. It's making people Create posts and having your hashtag in there and that gives you more content to post I'm curious Email does that matter? Email marketing still a big thing should businesses do that if they're trying to go online with their home-based business Yes, email is super underrated Well, a lot of people think of email marketing as spam and it shouldn't be spam It is spam if you go the same approach of like saying, hey, here's all my products. Bye. Bye. Bye. Bye.  They still see your brand each and every time they go in their inbox. That's brand That's saying top of mind. Yeah So with your website a great thing to do to start collecting those emails You can't just say hey sign up for my newsletter. Nobody cares about a newsletter You create a lead generator and what that is is just something free that you can give them in exchange for their email address So if I'm a hot sauce and now natural soap, maybe I say cool sign up enter email I'll send you $20 20% discount or enter email And you'll get five recipes to do this yourself things like that It's kind of an even exchange and then continue to build that list You're giving me some good ideas. I check my email when I wake up. I check it throughout the day I check it in the evening. So it's still with me forever Yeah, it's still very much a channel that consumers are using and checking frequently So it's another avenue if you will to reach that next customer or like you said with your regulars Just stay top of mind, right? You want to be where your audience is and your audience lives on social and they live in their emails All right, so that's a wrap on today's episode. I want to give a huge shout out to my co-host Justin Neely the expert I hope you helped your home-based business get online If you have any questions or comments, we'd love to hear from you Go ahead and share below and in the meantime subscribe to our channel. See ya


Welcome back everyone try hack me just came out with a Windows forensics room and I've had a look at it. I've used try hack me for a while and I really like it. The Windows forensics room specifically covers Windows registry analysis. It's a really interesting room to look at and I'm glad that they're finally doing more with digital forensics. So today's going to be a walkthrough of their Windows forensics room. So to get started, I'm on try hack me.com slash room. Windows forensics one already logged in and this is a free room at least for now. So you should have access to it. No problem. Just going to jump right in here. We don't have to start an attack box or anything like that. Although they will have one. I think a little bit later. Let's go ahead and with task one. So introduction to Windows forensics. If you've been watching my channel at all, you've probably heard me talk about forensic artifacts before. Is my computer spying on me? A lot of people think their computer is spying on them and there are a lot of analytics and trackers built into many different operating systems these days, especially Microsoft Windows. But most of the time it's about user preferences when running the system. So Windows and especially the Windows registry keeps track of a lot of user activities that way the user can easily access those later or Windows can preload things that it thinks the user is going to use. Basically, we just read a couple of things and then what is the most used desktop operating system right now? Most used desktop operating system right now is Microsoft Windows. However, mobile really took over desktop several years ago. And so it's not the most popular operating system anymore, but Microsoft Windows is still the most popular desktop operating system. Let's go ahead and try that. Okay, what's the term used to define a piece of evidence of human activity? Piece of evidence of human activity. I'm guessing they're talking about forensic artifacts. And if you read this, you hear the word artifact. It refers to essential pieces of information that provide a piece of human activity. Really, it doesn't matter if it's necessarily human activity or not. It's an artifact is anything that is used to build up your evidence. If you have some sort of claim that you're trying to prove, you're looking for evidence to support that claim. Artifacts are anything that can potentially contain that evidence. So if you're trying to prove, for example, that the sky is blue, then an artifact would be related to that, whether it was necessarily human activity or not. But I understand what they're trying to say with this. It's kind of easier to conceptualize if it's like a user action. And really whenever we're looking in Microsoft Windows, especially desktop, most of the time we're looking for those artifacts because they're related to human actions. So let's start artifact. Next, getting into Windows registry. All right, we got a couple tools here. An overview of the Windows registry. You can think of the Windows registry like a database that keeps track of all of the settings in Windows. So whether you're changing your background image or whether you're going to a website, the Windows registry will have several different registry keys that are updated whenever you make any type of action. All of them are stored in different registry hives. And basically they're going through each of the different registry hives here. Each hive contains different information from the system. So it depends what you're looking for, which hive you're more likely to find it in. And sometimes you'll have information across different hives as well. But if you're looking at it on your own system, you can use regedit.exe, but be careful about this because if you do start changing registry keys, you can break Windows. So if you're running it on your own system and not a test system, be careful. And then they're going through all of the different hives and interesting things that might be in there. So what we normally do in digital forensic investigations is access the registry hives offline. And for that, we're getting, for example, a suspect hard drive and then we're parsing out that hard drive and looking at the file system. Once we reconstruct the file system, then we get full paths just like you would have whenever you're looking at a suspect's computer while it's on. And then we have to look, for example, in C drive Windows system 32 config for the majority of the system hives. And then we also have NT user and user class dot dat that are usually found in the C users username. And then you'll have your NT user dot dat and then app data local Microsoft Windows is usually where you'll find the user class. They're going over the locations of these hives because they contain so much information and they're extremely relevant to pretty much every investigation you're going to do. So one of the first things you want to look for whenever you're doing an investigation of Windows computers is where are the hives and start to parse those hives out? What's the short form for H key local machine? Shorten it by just doing HK to stand for H key. That way we know it's a key in the Windows system and then take the first letter from the next word. So we have H key, HK, LM. So let's try that. HK, LM, K. What's the path of the five main registry hives, default SAM security software and system? Notice this has nothing to do with the user per se. Basically they don't contain the user's settings. So we're looking for the system settings and I can already see here that there's probably a drive number. This is a little bit misleading because this is probably asking for, for example, C drive. So like C drive slash Windows. The problem is you don't have to install Windows in the C drive. You can install it in another drive. So don't always assume that it's going to be in C drive, but 99% of your cases it's going to be. So we're just going to do it here. So we're looking at C drive slash Windows, if I spell it right, slash system 32 slash config. This is where our registry hives are normally located. Let's try that. What is the path for the amcache hive? The amcache hive stores information about programs that were run. And let's look at the format here. It looks like probably they're looking for the system folder. So C drive Windows, assuming it's installed in C drive. And then they have the dot here with the three afters. So most likely they're actually looking for the hive file itself, not just the path. All right, so let's do C drive Windows. That's our system folder, or at least the default system folder. We have app compact and then we have programs amcache.hve. Let's try that. And that's it. See, they also listed up here as well. So you could have just copied that one. Okay. I shouldn't have typed it out. So next going to Windows registry. We are looking here at a couple different tools that they have available, several open source tools. This winder is the system directory. So for example, it would be C drive Windows in most cases, but you can change the location. So you do need to try to parse out the Windows registry to understand where the Windows system folder is installed. It's one of the first things you should do before assuming C drive. And then we have Cape, a really nice tool. And I think that's what they prefer for this exercise. Autopsy, another awesome tool. I use this all the time for investigations. FTK imager for doing acquisitions. FTK imager is really good for acquisitions as well as the hex viewer and the file viewer. So if you just want to do a really quick investigation in Windows, you can use FTK imager to do almost everything as keyword searching, hex views, a lot of things. And it can also acquire not only disks but RAM. So there's access data registry viewer. Access data just got bought by another company. I don't remember what their name is, but the registry viewer is very interesting. The problem with it is you can only load one archive at a time, but it is pretty good for doing research on Windows registry changes. There's also Zimmerman's Registry Explorer, excellent tool. Also for just exploring obviously the registry and doing searches through it. So another great tool and a little bit more powerful. And then Reg Ripper is kind of the de facto standard for registry analysis. It's a collection of scripts for parsing out different data types. And Reg Ripper is actually built into autopsy. So if you're running autopsy that was listed above, you'll already kind of get Reg Ripper. But if you want to be able to customize it a little bit more, you can run Reg Ripper by itself. They just say study the tools. Okay, so basically download some interesting tools. And if you subscribe to this channel, I will be talking about all those tools. I already have videos on FTK imager, autopsy, and a couple of the other tools I will get into more later. So like and subscribe if you want to see more of that. So we know where the registry hives are located in Windows. We have tools that can parse them out. Now we're going to start extracting some system information and system accounts. And this is where registry analysis gets really interesting. Unfortunately, a lot of the investigators that I work with don't think about analyzing the registry that's been changing recently. But a lot of investigators still don't really include the Windows registry explicitly in their investigations. They'll just do file system analysis, for example, looking in the user's folders. But the registry tells you not only about which files are on the system, but how the user was interacting with them. Now you can get some of that user information just by doing disk analysis. But really, if you want user action analysis, the Windows registry is the place to look. We have the operating system version. We're looking in the software key or the software hive. Microsoft slash Windows NT slash current version. Current version has a lot of really good data. So they're getting the registered computer name. If the system is on and you're in a live environment, you can see it in the properties menu. But if we're looking for the computer name in the suspect system in a post-mortem analysis, we're looking at the system hive current control set, control computer name, computer name key. So this registry key and then we have the, for example, computer name. Same for time zone information in modern systems, especially modern file systems. Time stamps are saved in UTC. And the time zone of the system that you're looking at is used to calculate the offset on the fly.  The thing to think about whenever looking at time zones is file time stamps on hard drives. What is the file system that that data is stored on? That's really the interesting question here. So if we need to get that time zone information that we know what that offset would actually be. Network interfaces, even if you're using DHCP and really most people are these days, you're going to get that DHCP lease and that lease is going to be stored or some lease information is going to be stored in the Windows registry. Whenever the DHCP IP address changes, then obviously the old address is going to be lost in the registry and then we have to look at, for example, registry backups or shadow copies or something like that. Just because it's not in the current version of the registry doesn't mean we can't get it back somehow. Auto starting programs, especially if you're analyzing malware, you really want to be looking in auto start locations because malware has to get persistence somehow. So it wants to try to insert itself into these auto start locations. So you really want to check them and see what binaries are being executed for auto start. So the SAM hive and user information, basically account information, login information, group information, anything to do with the security access management of the user is going to be found in SAM. So what's the current build number of the machines whose data is being investigated? If we're talking about build number, we're looking at system information. So let's see what screenshots they had up there. So we are in software Microsoft Windows and T current version and we select current version. It kind of looks like a folder dropdown and it contains a bunch of different keys. So we're in software Microsoft Windows and T current version. So we select the current version key and we see all of these values under current version. We're looking for current build and 19044 is the current build and current build number. So let's just try 19044. 19044, okay. Which control set can contains the last known good configuration? So we're looking for control set and under system select last known good. Last known good is set to control set one. So let's go ahead and try that. Next, what's the computer name of the computer? All right, this is also under probably system properties. So system current control set control computer name, computer name. We have the computer name key, THM-4N6. You'll also see forensics spelled 4N6, okay. So THM-4N6, THM-4N6. All right, what's the value of the time zone key name? So time zone keys we saw earlier. So system current control set control time zone information time zone key name send Pakistan standard time. So let's try, so let's try Pakistan standard time. Okay, what's the DHCP IP address? The IP address that was given by DHCP the last time this system was up. We're looking at network interfaces. So system current control set services TCP IP parameters interfaces. So it looks like they've already selected an interface here and then we have the DHCP IP address and it's 192.168.158. All right, we also have subnet mask default gateways at least times how long it's going to take. Let's try 192.168.158. 192.168.158. What's the RID of the guest user account? Okay, so some user account information. We have the SAMHive user information at SAM domains account users and we are looking at groups users. I have the guest account and I'm looking for the user ID which is 501. We also have another account THM4N6 which is 1001. Whenever you see anything over 1,000 this is a non built-in account. Everything under 1,000 is a built-in account. So our guest account is 501. So it's built in. Okay, so now we're getting into uses or knowledge of files folder. Okay, so we're looking at things like recent files but we're still in the Windows registry. We are getting more into into user.dat So user activities specifically and in this case they're looking at in the user's recent docs. So these are the things that their user has recently accessed. Shellbags are a super interesting location for information. You can do a lot in reconstructing. For example, the way that folders looked all the icons in the folders even after like a USB has been removed you can reconstruct everything except the data that was in that USB stick. It's super interesting location to learn more about. Okay, so when was easy tools opened? In this case, we're probably looking at links. So let's look at recent files. So into user.dat software Microsoft Windows current version explore recent docs. We're in the recent docs and we're looking for easy tools. Easy tools was opened on 2021-1201 at 1,300-34. So let's go ahead and try that. Yeah, okay, that looks like the right format. So 2021-13,134. Okay, all right, next. At what time was my computer last interacted with? So we're looking for the last interaction time. I'd say it's probably Shellbags and then it's my computer. So we have the value of my computer in Shellbags and we have a last interaction time on 1201-1306-47. So 2021-1306-47. What's the absolute path of the file opened using notepad.exe? So here we have the open slash save and last visited dialogue in our use. So whenever that dialogue box pops up asking you where you want to save something. Of course, that is also saved in the Windows registry. So it remembers where which directory you in for the last time you want to save or for the next time you want to save something. So we're in NT user software Microsoft Windows current version Explorer calm dialogue 32 and then last visited PID MRU or open save PID MRU. This is probably the open save. So if we take a look at the last visited PID MRU we have notepad.exe executed the open save dialogue and then it's looking for the absolute path C drive program files. Amazon EC2 config service settings. You can kind of tell it's probably program files because there's a space there as well. EC2 config service settings. EC2 config service settings. Okay, there we go. That was coming from the open saved and last visited dialogue MRU's. MRU stands for most recently used list. When was this file opened? Okay, so we go back and then it was opened on 2021 11 30 10 56 19. Let's try that. There we go. Okay, so you the user we get a lot of things like which program were they using? What were they doing with the program and what time were they doing it? Now, once you start to combine these things you can build a timeline of events for different files and folders that have been accessed and what programs they were using while they did that whenever you create that timeline you really see the story of what was going on around the time whenever you're investigating. User assist user assist is interesting because it keeps track of how many times programs were executed. You got to be a little bit careful with user assist. I've seen it off by quite a bit sometimes depending on how fast a program is executed. Yeah, just sometimes the number isn't updated. Sometimes it's updated twice. It's a little bit finicky. So don't trust user assist 100% but it can give you a pretty good idea. Last execution time seems to be accurate but the run counter doesn't seem to be super accurate and then the focus count seems to be pretty good actually. So into user.dat software Microsoft Windows current version Explorer user assist and then the GUID and then count. So we're looking at for example the run counter here. They talk about the background activity monitor. So how many times was file explorer launched? That would be in user assist and we get to the count key. That's probably way too small to see but we have file explorer link and it says it was run 26 times. So let's go ahead and try that. File explorer run 26 times. Okay, what's another name for shim cache? It's probably app compatibility cache. Let's take a look. Let's look at it. Also called application compatibility cache app combat cache. I bet that's it. App combat cache, shim cache. Which of the artifacts also saves shall one hashes of the executed programs? That would probably be in amcache. Yep, here we have the shall one. So just amcache. All right, which of the artifacts saves the full path of the executed programs and then that is probably the background activity monitor. It even gives us the hard disk volume two for example instead of C drive. So the logical mapping, it gives us the physical disk for the background activity monitor. So they want BAM slash DAM, BAM slash DAM. Okay, what they're actually trying to do if you notice we're basically looking up where all of these different things are and there's a lot of different locations with artifact information. One of the things you start to do whenever you start investigations is start memorizing the locations of the most common artifacts. So for example, user assist, very common artifact. And if you know exactly where it's located, you can find it much quicker whenever you're analyzing it with a tool. A lot of tools now might just pull out user assist directly and show it to you. But for tools that don't, you might explicitly have to say where it's located. Basically, I think they're trying to get you familiar with a bunch of different artifact types and where they're located and this is exactly what you should be doing whenever you first begin. Now it's a little bit tedious to try to remember all of them and all of the information that's in there. So we have cheat sheets, of course, that we produce. Sands has some really good cheat sheets for artifact locations like this. External devices, USB device forensics, we use this a lot. So we use this in real investigations a lot. So device information or device identification can be found in system, current control set, enum, USB store and current control set, enum, USB. And then you can kind of see we have timestamps, for example, and depending on which view you have, it looks like this view, this is probably some of the easy tools. This view is taking in some information about, for example, when the USB stick was first seen, when it was installed, first installed, last connected. So we can actually see first connection times, last connection times. And if you're building a timeline and you have other sources of information, you might be able to reconstruct different times that that USB stick had been inserted, USB device had been inserted into the system. You can also see things like device name, serial number, manufacturer, timestamps associated with it. Just be careful about this timestamp. This timestamp is probably the timestamp of the key itself, which means that it can be updated. But then we have, for example, the last connected time, 11, 24, 18, 40, that's after our key update time. So it's a bit odd. I don't know what this timestamp key here is, but then we have installed first installed, last connected. That's probably what we're interested in anyway. Yeah, so I don't know what this tool is. Otherwise I could hopefully tell you what that timestamp is. So here we have the current control set, enum, USB store, VIN, product version, serial number properties, and then an ID. And the number value represents the information like first connected time, last connected time, or last removal time. That's where they're getting that information. So I would say this timestamp is probably when the USB store key was updated, and then they're getting the connection times from everything else. And if it's a separate key, it kind of makes sense that it could be a slightly different time. So this might be, I don't know, I'd have to look at that further. Don't just trust what the tools are telling you. Make sure you're questioning things like that. Like, why is the last connected time after the timestamp update for this device? Like, how are those timestamps related? That's going to be really important information in a real case. What's the serial number of the device from the manufacturer of Kingston? Oh, no, do we have to type a serial number? Okay, so we have our device, Kingston, and that's the serial number, and it's quite long. Okay, so let's try that serial number. Yep, okay. What's the name of the device? It was also listed, Kingston Data Traveller 2.0 USB device. Okay, trying that device name. Yep. What's the friendly name of the device from the manufacturer, Kingston? All right. We have a volume name. That's usually the friendly name, and then, okay, yeah, it does say friendly name here. We don't really know which USB or new volume is the Kingston. We might be able to do it by timestamp, but those are both the same timestamp. Let's go ahead and check this. So I have the disk ID here, and this first disk, which is the Kingston, starts with E25192. I have the USB 3.0, and it starts with F529A. All right, so let's go ahead and look down here. The GUI ID again is E25192, and then F529A. So the Kingston E21192 has the same disk ID as this first entry value with the friendly name USB. So this is what I mean by multiple registry keys kind of interact with each other. You might have some information stored in one place, some information stored in another place, and then you have to get both pieces of information, especially IDs, before you can make sense of the other. So I would say the friendly name is USB. Okay. All right, now we're getting into the hands-on challenge. We'll see a few folders, triage, and easy tools. The triage folder contains the triage collection collected through CAPE, which has the same directory structure as the parent. So basically, where are the registry keys located? This is where artifacts are located. The easy tools folder contains some tools that we've been basically looking at. All right, and then we have a couple of different questions here. So let's go ahead and start this up. So I've written registry explorer up, and I'm going to load at the SAM hive. Let's go to file, load hive, and desktop triage system. The SAM hive is part of system, so I'm going to go into windows, system 32, config, and then we have SAM. Okay, so I've loaded up the SAM. I'm in root SAM domains account users, and then I have a couple of different things here. The resolution is not great. The user ID, so from the user accounts, how many user created accounts are present in the system? Remember what I said? If anything is above 1,000, or 1,001, you're going to be a user created account. So we have three user created accounts. Let's go ahead and try three. Okay, what's the username of the account that has never been logged in? So here we have total log in count, and this one has zero. So let's see what the username is. THM user 2, THM-user 2. THM-user 2. What's the password hint for THM-forensics? So THM-forensics is 1,001. And if we go over a little bit, we have the password hint. Let me expand that. And then the password hint just says count. So let's go ahead and try. COU2, that's probably it. All right, when was the file changelog.txt accessed? This is kind of an interesting question because I would be looking at both the disk and the registry. In our case right now, we have what looks like a logical acquisition. So they just copied out all of the files. I can't really trust any of the file system metadata. So we would be looking at the Windows registry to find changelog.txt. I also don't know which user they're talking about. So I'm just going to guess it's probably the admin user, the first user created account. So we're looking at changelog.txt. Let's go ahead and load up the intuser.dat for our main user account. And that would be at file, load hive. And then on the desktop, we have triage, C drive. Then we have users, THM-forensics, and then intuser.dat. Click open. Sequence numbers don't match. I would usually reconstruct this. I'm going to say no this time.  Yes. All right, so now we have the intuser.dat for our main user loaded up. Let's go ahead and expand root. And then we're looking for software, Microsoft, Windows, current version, Explorer. And we should find recent docs. So now we have recent docs. Let's see if we have the changelog.txt. We have our text file, changelog link, changelog.txt. And then it was opened on 2021, 11, 24, 18, 18, 48. So let's go ahead and try that. 18, 24. I need to check that again. 48, 18, 18, 48. 48. Okay, submit. Yep. All right. So next we're looking at what is the complete path from where the Python 382 installer was run. So we're looking for whole paths. So it could be the background. But I see this is probably C drive. So most likely we're looking at something like user assist. So we can just go back in. Hopefully it's the same user. I'm in recent docs right now. So to get to user assist instead of recent docs, we should just be able to scroll down, go to user assist. And then the GUID, let's just kind of search through here. So I found count with some activities in it. I'm going to scroll down and see if we find anything. We have a couple of different actions here. Notepad was run and we have D drive set up. So we look like we're on the right path. Z drive set up. Also a network share in Firefox installer from Z drive. Python 382. So the question was, what's the complete path where Python 382 was installed? So inside user assist for the default user, we have count and then count has 48. And we have the Z drive set ups, Python 382 EXE. Z drive set ups, Python 3.8.2.EXE. Okay, submit. Yep, when was the USB device with a friendly named USB last connected? So we have a date time format it looks like. USB devices are going to be related to system information. So I'm going to file load hive and then we're going to, instead of going users, desktop, triage, C drive, go back to windows, system 32, config. And then I'm looking for, instead of software this time, I'm going to look for system, click open. All right, so now we have the system hive loaded, click on route. And then we are looking at probably current control set, enum, let's do current control set and then enum and then USB or USB store. So we have USB and then what's the USB device with a friendly name when was last connected? So we're looking for USB and we don't see the friendly name here. USB friendly name is probably in software. So let's go ahead and open software. Okay, so we have software and we need Microsoft. Let's check windows portable devices. That looks like it's probably our device. So USB, so here we have our friendly name is USB. And then we have a GUI ID of E251921F. And then now I'm back in the system config. Let's look at USB store and then I have E25192 and then the F. So we have E215. This is our interesting one. It's the Kingston again. And what's the USB device when was it last connected? Last connected, 2021, 11, 24, 2021, 11, 24, 18, 40, 06. 18, 40, 06. Nice. In that case, I mean, it was a little bit confusing because USB store didn't have the friendly names. We had to open up the software hive, get the friendly name plus the GUI ID that was assigned and then go back to USB store, sync them up via the disk ID and then find the last connected from that. And that's common whenever you're in the windows registry to have information that is related to each other that you need to sync like that. Now hitting the conclusion, what do we have here? We have, wasn't that interesting? Yeah, it was pretty interesting. Windows registry is always interesting and I hope easier than what people think. A lot of people think the windows registry is hard, but it's really just a database. And if you remember even half of the locations that were talked about in, in this room, you can access so much additional information in your windows forensic investigations. If it's hard to keep track of all of the artifacts, very few people remember, I don't think anyone remembers everything about it, you have cheat sheets. So they actually created a cheat sheet for this. Nice. Sands Institute also makes cheat sheets that they release quite often or they update them every year. Basically everything that they were talking about, they've covered in here. So I would download this cheat sheet, print it out, put it up on your wall whenever you're doing your investigations, just have a look at it because it is actually stuff that we use constantly. Now, a lot of tools like autopsy, for example, will automatically find registry hives and then try to parse them using Redripper. You don't necessarily need the locations in your mind all the time, but it's good to have them and it's good to be familiar with them. And then sometimes you do have to go in and check things and verify things yourself. All right. So that should get us the windows forensics one. It's a really interesting overview of windows registry. And if you've never done any type of windows registry analysis, hey, this is a great start. Read all of the documents that they have. I kind of explained in a really quick overview the things that I commonly use, I guess, in investigations, but they had a lot more detail that I didn't cover. Do practice going through and looking at windows registry. If you have a windows computer, it's worth taking your windows registry file, obviously making a copy and then analyzing that copy and seeing what you can find because you know what activities you've done on your system and you can recover a lot of different really interesting things. Even knowing these basics is an excellent way to start windows forensics. Don't forget the disk analysis part of things and whenever you're building these timelines, they complement each other. So if you find a weird timestamp on the hard drive, you can use the windows registry to say whether that timeline makes sense and vice versa. Let me know if you have any questions and if you want to see more walkthroughs of different rooms on TriHackMe or any other platform, especially if they're related to digital forensics. Please let me know. Give it a like if you like these kind of videos and make sure you subscribe because I'm going to be posting tutorials on how to use each of the tools and I already have some tutorials on things like autopsy and FTK imager. So I hope you enjoyed it. Thanks a lot.


Hello everyone welcome to this material characterization course. In the last class we just started looking at the TEM imaging techniques and then we have seen that there are two theories which explains the diffraction contrast and fringe contrast and so on namely the kinematical and dynamic theory and we have also seen the concept of extinction distance where the dynamic theory explains and then which is very useful in understanding the fringe contrast as well as how it can explain the contrast which arises because of the interfaces and other defects in the crystalline material. And also it we have seen that this extinction distance is very useful parameter in order to obtain a thickness of the foil and so on. So we have just we will continue that discussion about the diffraction contrast. So if you look at what we have discussing in the last class that we were looking at the contrast which arises from the wedge type crystal using the phase amplitude diagram. So the diagram with a schematic diagram what you are seeing here is a sample which is correspond to with a smaller s compared to the previous illustration we have seen. So what is that we are seeing now with the smaller s that means you are getting the amplitude phase diagram circle becoming bigger and you see that the intensity oscillation I would say that the diffracted intensity you can see like this and then this is a transmitted intensity. So that the fringe pattern I would say that the distance between the fringe the dark and bright oscillation also increases. So that is one information we are getting from this. We will now look at an actual example for this. We will go through this diagram little more carefully what you are seeing in schematic A is the oscillation of a transmitted intensity beam and this is a diffracted intensity beam through a sample thickness T this is the top of the specimen this is the bottom of the specimen and this is the wedge shaped crystal which we are talk about and you see that a corresponding a bright field image where you see a bright and a dark fringes you can see and what we are now seeing here is we will first go through this figure caption and then we will discuss the mean intensity distribution of the beam that is I0 and a dark field IG beams with the depth of the dynamical condition that is schematic A schematic beam shows the wedge shaped defect free specimen and the position of the thickness fringes in the image and C and D it is a bright field and a dark field dynamical images of the same area of the wedge shaped aluminum foil showing the dislocation and thickness fringes that is C and D are images formed in the dynamical images E the intensity distribution versus depth for the transmitted and a diffracted beam in the kinematical condition so this is the kinematical condition figure F and G bright field and dark field kinematical images of the same area as C and D showing the dislocations but with only a faint thickness fringes in bright field what this schematic try to explain and this micrograph shows is that you have the 2 S conditions that means the images are obtained with the 2 S values and how the dynamical conditions that means where you have the transmitted beam and a diffracted beam completely interacts and then what kind of image it produces or you have the kinematical condition where you have a diffracted beam intensity and transmitted intensity I mean beam they do not interfere so that is the assumption and they these 2 have a 2 S values we will see how we can understand from this so here you see that the intensity oscillation comes with some kind of periodicity where you see that the transmitted intensity is minimum at half psi g or 1 and half psi g and so on and or you can say that the diffraction intensity is maximum at you know half psi g or 1 and half psi g so you have the integral multiple of psi g produces a maxima in the bright field image like this where the dark field intensity is minimum so it is other way around so you can see that the image produced in a dynamical conditions where you see that the fringes are far apart so which is belong to the phase amplitude diagram of this kind that means S is smaller here and you can see that the fringes are widely spaced and you are able to see the dislocation details also in this so this is a bright field image and this is a dark field image or complementary to each other and it is for a small S and this is for a same crystal obtained at the dynamical condition and you can see that the fringe pattern is very close and you see that the details of the dislocations are not clearly seen in this diagram as we seen in the dynamical condition. So it clearly shows that you know this is the edge and we are travelling towards the thickness direction in this way so this is an edge you see that so it is becoming a wedge here like this so this is an edge and this is the thickness we are looking at so we are looking at from the top so you can clearly see this the fringe contrast and which explains by this dynamical theory and kinematical theory this is a classical example how this fringe contrast is understood and I hope you have some idea by looking at this images and schematics how the fringe contrast arises and please remember you have to keep that the initial slide which I showed in a perfect crystal how the electron beam goes and then how the intensity oscillation takes place for the transmitted beam and a diffracted beam and also look I remember the psi g the extinction distance then when it that is for a perfect crystal then when you have any defects like a wedge or a boundary or interface or a pit or a hole then how that intensity is affected is being explained by this two theories so this is where you have to be very clear about it and then you will be able to appreciate with the simple schematic and animations you will be able to appreciate this variation in the I mean intensity oscillation or the the variation of the fringes as a function of yes whether if you have a small yes whether if it is a large yes you know the meaning of yes and then you will be able to see this and understand and appreciate please assume that one one one last point you have to appreciate before we move on to the next contrast mechanisms suppose if you assume that you have a perfect crystal and then electron beam passes through it and you do not have any defect and what you will see in a screen is only a bright illumination you do not see any features the moment you have any defects or a inclined surface then you are a diffracted intensity will get affected by this and then you will see a different intensity coming out of it or theoretically you can also see that you if you look at the first image what I have shown in the last class in order to explain the why particular grains are appearing and darker and gray and white and so on theoretically you can assume that if suppose if your objective aperture is able to collect all the diffracted beam including the transmitted beam then also you will not see any contrast in the in the fluorescent screen then you will be then you can understand how this contrast arises by that way also you can assume for a perfect crystal but you will you will always produce a sample with lot of surface irregularities or non-uniformness or a taper section so you are bound to see these kind of fringes or contours or I mean any kind of fringes what we have seen so far so that is very clearly explained by this kinematical and dynamic theory. Now we will move on to the next contrast mechanisms called a mass thickness contrast first look at the initial remorse then we will get into the discussion. Mass thickness contrast arises from an incoherent elastic scatter of electrons. Rutherford scatter is a strong function of atomic number Z that is the mass or density rho as well as the thickness T of the specimen. Mass thickness contrast is more important if you are looking at a non-crystalline materials such as polymers and it is the critical contrast mechanism for biological scientist. Any variation in mass and thickness will cause the contrast and it is almost impossible to thin a bulk sample uniformly and so all real specimens will show some mass thickness contrast. In some cases this will be the only contrast you can see so this is very important point. So mass thickness contrast is related to the mass and density and the thickness and so on as I just mentioned in the previous contrast mechanisms you will never be able to produce a perfect samples with the uniform thickness. So in general you will have whatever the contrast you are going to see whether it is going to I mean you are going you are looking at a diffraction contrast or a specifically mass thickness contrast every specimen will have some contribution of the mass thickness contrast. So you can only say that a diffraction contrast is the maximum or dominating contrast mechanism which is operating but we cannot say that a mass thickness contrast is 0 there because your sample preparation will never be perfect and you will have a mass or a density variation because of your non-uniform surface on the top and bottom of the foil or any specimen. So this is very important point to remember you will have a contribution from the mass thickness for the contrast always. As electrons go through the specimen they are scattered off axis by elastic nuclear interactions. The cross section for a elastic scattering is a function of Z that is atomic number. As the thickness of the specimen increases there will be more elastic scattering because the mean free path remains fixed. Using a qualitative argument one would expect high Z that is high mass regions of a specimen to scatter more electrons than the low Z regions of the same thickness. So a regions of high atomic number will scatter the electron beam more or compared to the low atomic number regions. Similarly, a thicker region will scatter the more electrons than the thinner regions of the same average Z all other factors being constant. So this is again an important factor. Now we will look at the schematic and then what I was trying to say in the previous slide also I will make it clear. So look at this specimen which contains the lower mass thickness and this is a higher mass thickness electron beam pass through this and this is the ray diagram for this. And what you are seeing in the bottom is the intensity profile which for the two respective regions. So what is shown here is mechanism of mass thickness contrast in a bright field image. Thicker or higher Z areas of the specimen will scatter more electron of axis than the thinner or lower mass areas. Thus fewer electrons from the darker region fall in the equivalent area of the image plane and subsequently on the screen which therefore appears darker in a bright field image. See you have to be very careful here. When you say that the higher atomic number region will scatter the electron more here in this particular ray diagram it is shown in the form of how much the scattered electrons are pushed half the axis that is move away from the axis compared to the low mass thickness region. So that is one way of looking at it so you should not get confused with that. So the more number of electrons are taken half axis are moved away from the axis. So you have very few electrons reaching the image plane. So that means the intensity will be very different intensity profile will be very different for the both cases. So thus the fewer electrons from the darker regions fall into the equivalent area of the image plane which therefore appear darker in the bright field images. So that is the idea and the finally we will discuss about a phase contrast imaging. So contrast in TEM images can arise due to the differences in the phase of electron wave scattered through a thin specimen. This particular imaging is very difficult to interpret as it very sensitive to many factors. The appearance of the image varies with the small changes in the thickness orientation or scattering factor of the specimen and variation in the focus or astigmatism of the objective lens. Its sensitivity is the reason phase contrast can be exploited to image the atomic structure of the thin specimen. The primary distinction between the phase contrast image and the other imaging in TEM is the number of beams collected by the objective aperture or electron aperture. The more beams collected the higher the resolution. So the basic difference between the diffracted or amplitude contrast image or diffraction contrast image here is we are going to select a single diffracted beam or a many diffracted beam to interfere with the transmitted beam. Please understand the as we discussed in the dynamical theory that we talked about a two beam interaction. So there is a possibility in phase contrast image whether you can allow the two beam to interfere to form an image or you can select many diffraction rays or diffracted beams to interact with the transmitted beam in order to obtain the phase contrast image. So let us look at the origin of the lattice fringes. We can understand the origin of the lattice fringes by allowing two beams that is transmitted beam and the diffracted beam to interfere. We can write the total wave function as psi is equal to phi naught z exponential 2 pi i k i dot r plus phi g z exponential 2 pi i k d dot r. This is for a transmitted and a diffracted beam interference a total intensity function where k d is equal to k i plus g plus sg. This is a deviation parameter. Please understand this comes from that vectorial notation of the diffraction. This k can be represented as a g diffraction vector allowing a two beam approximation but allowing sg to be a non-zero here making simple substitutions like phi naught z is equal to a and take this exponential term out as a factor representing the expression for phi g from the total wave function as phi g is equal to b exponential i delta. We can define this term separately b is equal to pi by psi g times sin pi t s effective by sin s effective and delta is equal to pi by 2 minus pi t s effective. So the dynamical theory also recommends to use s effective instead of s which is nothing but s effective is equal to square root of s square plus 1 by psi g square. So where psi g is the extinction distance. We will not get into the details for at this moment. So the s effective is nothing but square root of s square plus 1 by psi g square for the reasons where it takes care of other parameters like absorptions and so on which we will not discuss it here. So you should not just confuse that what is s effective. S effective is another parameter where it also takes care of the absorption which is given by that expression what I just mentioned. So if the specimen is so thin that we can replace s effective with s the above equation becomes psi exponential 2 pi i k i dot r into a plus b exponential i 2 pi g prime dot r plus delta. So the total intensity can be expressed in this fashion. Now g prime is effectively perpendicular to the beam so we will set it parallel to the x and replace delta in this fashion. So the intensity is a sinusoidal oscillation normal to g prime with a periodicity that depends on s and t similar to the thickness fringes. We can establish a relationship between fringes and the lattice planes normal to g prime. Suppose if you look at the how the lattice fringes are formed this 2 schematic will illustrate that point. You have the schematic tilted beam 111 lattice fringes in a silicon form using a transmitted beam and a diffracted beam. Symmetrically placed displaced relative to the optic axis g is normal to the fringes. So g is normal to the fringes like this. So this is the typical fringe pattern you get when you use a tilted beam configuration where you see that this is an optical axis and this is a transmitted beam this is a diffracted beam. So we are allowing only one diffracted beam to the objective aperture to interfere and then you will get this kind of fringes and what you see is an ideal geometry for to produce a tilted beam fringes like this where you have the transmitted beam and the optic axis or you can say that the planes what we are I mean diffracting or looked edge on. So in that case you will see with only g you will not produce s is equal to 0 that is exact condition you need to consider minus g also to establish 0. You will be able to produce these kind of a fringes and if you use many beam diffracted beam you will be able to produce a cross lattice fringes in a diffraction pattern. Please note that though you may have the relation between the distance between the diffracted spot which will have some relation with the the lattice fringe spacing but this is nothing to do with the atom positions in the crystal that is why you have to be very careful. These high resolution images they are not actually a lattice planes they are only a lattice fringes which has some relation with the spacing atomic plane spacings in a real lattice. So this is one typical example of the the Spinal-Olivine interface this is an A. A B is a dislocation at the hetero junction between indium arsenic antimony and indian arsenic here what you are seeing here C is a grain boundary in a germanium phase sitting on an atomic scale D is a profile view of a faceted surface. So so this is a typical lattice images of different material. So so these lattice fringes are not directly related to atomic positions but they have indirect relations like the spacing lattice spacing will have some relations. So I just want to introduce this pattern let us look at the other important point. The trouble is that the fringes look like look like atomic planes that you can be easily misled into thinking that they are all they are atomic planes. The lattice fringes are not direct images of the structure but just give you the lattice spacing information. So I just want you to know what is phase contrast image and what it gives and how this is looking like and what kind of information you can take that is all I wanted to give and in that particular I mean this case we have just taken a two beam interaction that is one diffracted beam and transmitted beam interaction and like what a how we valent equation described in a dynamical theory of two beam interaction. So like that you will be able to produce a lattice fringes and then and if you want to look at the much more detail about atomic position there are things and I mean base and means of doing it and which requires a lot of image simulation and so on which is not the scope of this particular course. So my idea is just to introduce and you should know what is phase contrast imaging to that extent I wanted to bring this imaging lecture to a conclusion and for a much more detailed analysis of this phase contrast imaging you need to go through a specialized and exclusive transmission electron microscopy course. So I hope all that imaging techniques and the contrast mechanisms we have discussed in the last two classes must have given you some basic idea about how the contrast which we see in the TEM is very I mean different from what you see in a conversional optical microscope and scanning electron microscope. So you should be in a position to at least appreciate the differences between these three techniques after going through these courses. I hope these lectures were useful to identify the fundamental ideas. Thank you.