Alright, so I'm Ashley. Before I get started to my little spiel, how many of you guys are interested in nursing, or the health care field, or EMTs, respiratory therapy, phlebotomists, anything, a couple of you, how many of you guys are like techno, I don't know any part of that. Okay, quite a few of you. Well, maybe by the end of this, you'll either be confirmed that you never want to do it again, or maybe you'll have to change your mind, I don't know. So, again, I'm Ashley, and I'm a registered nurse, also called RN for short. And a little bit more about me, as I grew up here in the Mesa area, I went to Red Mountain High School, and straight after high school, I went to ASU and pursued nursing there. I married my husband's in the military, he's deployed right now.  And we've got two dogs, two cats, it's just me, I'm a little lonesome, until he's back in a couple of weeks. So, anyway, I want to kind of talk about why I chose nursing versus something else. So, I've always kind of been interested in the healthcare field, that for a while I wanted to be a doctor, and I was pretty set on being a doctor until about my junior year here in high school. I just kind of had this switch of realizing that being a doctor is not really what I want to do. Doctors spend a lot more time in school, and it's a lot of work, not that I'm afraid of hard work or anything, but doctors more so make decisions and are only with patients for a few minutes and then they're out of the room. And I wanted to be the one that was at the bedside, hands-on, getting involved in the action, doing compressions for CPR, pushing medications, starting IVs, and just being hands-on and involved, and that appealed more to me. So, I decided, you know, I will pursue nursing. Kind of a funny little story to show that I've always been interested in the medical field is when I was younger, I'd always watch medical shows, and my mom tells a story in particular where I was like seven years old and I was sitting in front of the TV watching like a show of a guy getting a 200-pound tumor removed from his abdomen.  You know, most normal kids are watching cartoons and things like that and now I was watching crazy medical shows. So, I've always been interested in it and decided to do nursing. So, kind of how to become a nurse. There's kind of two routes to get your RN. You get your associate's degree or ADN, what we call it, or your bachelor's degree or BSN. So, I got my bachelor's degree. Both allow you to get your RN afterwards so you still have the same job just to educational groups. So, I decided to do nursing and applied at ASU to do the nursing major. And my first few semesters were just prerequisites, English, math, anatomy, physiology, all those things. You had to maintain a certain GPA in order to apply to the actual nursing program. So, even though you're doing the nursing major, you didn't hold those that high enough GPA you may not even get into the nursing program. So, I obviously got it. And then in the nursing program, it's very different from your traditional classroom setting. Some days you're spent in the classroom studying, lecturing, things like that, learning. But then the next day you could be at your simulation center using mannequins practicing IVs. And then the next day you're in the hospital setting, actually practicing the things that maybe you've just learned the day before. Maybe you've just learned how to start an IV. And the next day you're at the hospital practicing on someone for the first time. You never tell them it's your first time though because no one wants to be stabbed with a needle by someone that's never stabbed anyone with a needle before. So, it's just very, very different educational setting being hands-on.  I like to be in on the action. So, I like nursing school. Anyways, I graduated August 2015 and once you graduate through a nursing degree, yay, you have a degree, but no, you can't work as a nurse yet. You have to actually take your registered nurse's license test. It's also called the NCLEX, the National Licensure Exam. And so, you take that and then you can become an RN. So, kind of a funny story. Right after I graduated from college, I moved like two days after I graduated. I moved up to Washington because that's where my husband was stationed out of and we had been long distance for a while. So, we're like, yay, we're going to live together now. I moved up to Washington, got my test state to take the NCLEX right when I got up there and I lived in a super, super rural area. So, I had to drive three hours to the test center. My test was at eight. Look up at, you know, who knows, like four o'clock in the morning left at 4.30 and drove three hours to the test center. My test took 40 minutes and then I drove three hours back home. Obviously, I passed. But kind of a funny story that I spent all this time for this one exam and it took 40 minutes. That is what determined my career. So, I got my license and my first nursing job was up in Washington at a very rural hospital. I worked on a medical surgical floor, also called Med Search for short. It's just a very general adult health floor. So, people that are sick, that need to be in the hospital, but they're not, you know, like actively, actively dying. That's super, super sick. So, you know, people with pneumonia, maybe they've just got diagnosed with diabetes or they have an infection, that'd be IV antibiotics, appendicitis, things like that. And I managed fortified patients and got really good at time management because you obviously have a lot of patients you have to keep in line, kind of, you know, the different patients. You don't want to be confusing. Their medications are confusing, you know, what they're there for. And so, got really good at time management. But I knew when I started that job that that was not going to be my forever career. I am an adrenaline seeker, so I knew I wanted something a little more intense. I was just up in Washington for the year and then I moved back to Arizona. Before I moved back, I started applying to emergency room jobs and ICU or intensive care unit jobs. I got a job, I interviewed and got a job offer for an ICU position at Banner Desert, which is, like, really close to here, for their medical surgical for. And, obviously, got a job and I've been working there for the past six months. So, I love what I'm doing right now. Critical care, it's fast paced. You really have to know your stuff and be, you know, quick to think and react to the situation. I have two patients, usually, for a typical day. And that's because they're sicker than, obviously, my previous job. They have to be available to monitor them super closely.  They can be, like, on a dozen medications all at once, all IV medications going in. They've got central lines and IVs and catheters and, you know, dialysis lines and a bunch of things involved in this patient's care. We also can do one-to-ones if the patient's really sick. One nurse-to-one patient. So, your sole attention is dedicated to them. Or, sometimes, there's two-to-ones where there's two nurses-to-one patient if they're really, really, really, really sick. And so, yeah, I love what I'm doing now and that's kind of my little background experience. Some pros and cons of nursing. There's definitely lots of pros. One of the pros is I work three days a week, 12-hour shifts. So, I work 7 a.m. to 7.30 p.m. on the day shift. And so, I have more days off during the week than I actually work. But, on the days I work, I've literally gone, like, basically 14 hours because I work the whole day. So, that's nice. My job allows us to schedule ourselves.  You can do that as well. There's not that you guys probably are into this right now, but you will be benefits for being nurses. You know, health insurance, dental vision, 401K plans for retirement, things like that which are all very important in the adult world. So, they offer that. Nurses make decent money for having either two- or four-year degree. It's higher paying than a lot of degrees are right outside of college. New grad nurses at Banner, so the Banner Health System, I can't speak for all hospital systems here, but they're pretty much similar. So, new grad nurses meaning you have zero experience. You just graduated. You're starting as a nurse. Make, like, 27, 50 an hour. And then, if you work night shift, you get 18% differential. If you are certified in certain areas, you can make more money every year. You get an evaluation. If you do well, you make more money. So, there is, it's a great career to grow in, not just, like, personally with learning, but financially as well. And then, obviously, any overtime that you bring in, if you pick up an extra 12-hour shift, that's time and a half. And so, you're making a lot more than your normal hour rate. Another pro is just the amount of jobs in nursing, not just in the hospital setting. You know, even in the hospital, you've got ER, ICU, you have general floors, you have radiology, all these different areas. But outside of the hospital, if you wanted to, maybe you'd work at a pediatric doctor's office, or if you wanted to work at a night doctor's office, or if you wanted to be a flight nurse, or a nurse on an ambulance, or if you wanted to travel nursing, where you are going to different states every couple months, or out of the country, or third world nursing, if you wanted to be a teacher, a nurse teacher, or educator, or if you wanted to be more on the management research side of nursing. So, even if bedside nursing isn't your thing, there's so many other ways that you can work with people and be in the nursing role without, you know, doing what I do, so to speak. So those are some pros. I would say the biggest con of nursing is that it is physically and emotionally draining. It is a lot, especially in the ICU. I see people that are literally like this close to dying, and or do die. I see a lot of people die. I see a lot of people who are just very sick, things that no one should have to see. I've seen people bleed out.  I've seen people that live, that shouldn't have lived, and just, you know, it's emotionally draining.  But at the same time, it's so rewarding and so fulfilling to know that I am that person that is dealing with, not dealing with, that sounds bad, but working with this patient and the family on the worst, potentially worst day of their lives.  Well, there's a select small percentage of people that do.  That's an exciting time.  They got in a car accident or things like that. And so that obviously brings a lot of emotions and I feel honored as a person to be trusted with communicating and listening and being involved in that patient's care to hopefully make their stay better. Whether it's a positive outcome like the patient gets better and goes home or maybe a patient passes away and I can be that person to be emotionally available for patients and their families. So that is probably the main con. It's just some days are very hard but also super rewarding at the same time. So those are pros and cons. So my YouTube channel, this is the really reason why I came. I just wanted to get more subscribers. Just kidding. So I have a YouTube channel that I started in nursing school. It was like my third semester in. I had like two semesters left and just decided to start it. Actually like two years from this exact time because it was my spring break and I was bored on my spring break and I'm like, why not start a YouTube channel? So I was doing makeup videos and recipe videos like a military advice video all types of things. And I had one nursing video I did called House of My Nursing School that gained a little more popularity than my other videos. And so over time I had one of my buddies I met through YouTube who also did nursing videos. He's like, Ashley, you should stop doing those other videos and just do nursing videos. And I was so like upset and offended at first. I was like, how dare you tell me what I should do in my YouTube channel? I can do whatever I want. And for a while I was like, I'm going to do whatever I want because I like all these things so why not do videos for these things? And after a while I was like, I'm just going to do nursing videos. That seems to be why people are subscribing to my channel. And so now there's close to like 19,000 people on there that follow my channel. I do advice videos and talk about my experience or journey educational videos and really have to form this community of people who are just like you guys who maybe are interested in nursing or people who are in nursing school and can just go there to talk about their experience or ask for advice and things like that. So it's been kind of like my, it's like my hobby but it's also kind of like my part-time job outside of nursing and I love it. So anyways, go subscribe first. You can if you want. But yeah. So third quarter we're probably going to do those points again where you do like millions of points. So if you take out your phone right now, can you call? I don't know. Ashley, why do they want to follow you? Why do you want to follow me? Because look at me. I'm awesome. I have people that follow me on there that are high school students. I have people that follow me that have been nurses for 27 years. I have doctors that follow me. Anyone who's, maybe your mom's a nurse and they're just interested in nursing. And people follow me just because they like to hear what I have to say even though they don't care about nursing. So it just really depends but I have lots of haters that follow me too so you can go be on the anti-hater crew. It evases me when people stay on the internet. Anyways, so. I want a million points. I know. So anyone have any questions or specific things that you want to ask that you've got me personally or nursing or college or anything. Another million points for a good question. Here's a game like 10 million subscribers. Will you like to ship more to YouTube than your nursing job? That's a great question. Actually I have a lot of people that have asked me like, you know, if this became financially enough to support you like would you do that? And at this point I don't think so. Who knows in the future?  One, I feel like how could I offer advice on a nursing channel if I'm like not even a nurse anymore? I feel like people wouldn't really respect that as much. But, you know, maybe in the future I would maybe work less shifts or something and just focus on this. But for now I'm happy with what I'm doing.  So I, like I said, I would just work three days a week. So I have four days off. My husband's gone so I don't have, you know, that sounds bad. But that person occupying my time and I don't mean that in a negative way you know, I'm pretty much by myself and I do this partly to keep busy. I also do, I have other hobbies I like. You know, I like hiking and cooking and things like that. But I guess I don't have a specific way I manage my time. I just feel like you make priority for things that are important in your life in all aspects of your life whether it's school or your job or your family and this is obviously something that's important to me. It's not the most important thing but you just make, you sacrifice and make time for things that are important. Absolutely. About college about what it's like to be in there. Is it really stressful? Is it stressful? Yeah, I literally, the job I do I literally have people's lives in my hands. I can literally go and turn off my medication and they would die. So it's stressful in that aspect that you really have to know what you're doing and you have to be careful to check yourself to make sure that you're doing things appropriately and correctly because you have a large amount of responsibility. So yes, it's stressful but I kind of like live off of that you know thrill and that stress of knowing that I have such power such control. I mean that sounds bad but like I like I've always been a very like independent leadership type of person and so in ICU we have a lot of autonomy. We work very close with doctors they respect our opinions because we're so in tune with our two patients and so involved that if I come to a doctor and say hey this business is going on they'll be like alright do this or I'll go to them and be like hey this is going on I already did this and they'll be like okay whatever like that's fine so we have a little bit more leeway so to speak in the ICU just because I know if a patient has chest pain I know I'm going to go to the doctor and do this test and this test and this test and then I'll go to the doctor with the results whereas most areas if a patient has chest pain you have to call the doctor get the orders for those tests and then you know do that but in ICU it's like I'm not wasting time if you've got this I'm going to order this and then I'll tell the doctor what I did but in most worlds doctors have to just order everything you can't just do something without knowing I was so set on being an OBGYN like before I decided to be a nurse and when I decided to become a nurse I wanted to be a labor delivery nurse and I did my labor delivery rotation in college and I loved it it was great but I realized that I just I'm such an adrenaline seeker and even though you do see those situations in labor delivery it's not as much as like what I see it's different from what I see and so I just realized that was more my 4k so to speak but I really I still like OB nursing I think it's wonderful and awesome and who knows maybe one day I'll do it but for right now I really like ICU ask them where if you want to like make use of this time yeah I'm like I'm already here you might as well just like do my work maybe and if you guys think of questions after class or maybe there's something you're like too scared to ask on my YouTube channel all my social media is there you can comment ask me questions email me and have a website all those things and you can reach out to me I get asked a ton of questions every day and I get a ton of emails and comments and I read them all but I don't respond to everyone but if you say like hey I saw you at Mesa Hi and I have this this question I will respond to you just cause obviously and yes how about what? I have a YouTube video at a school how about I don't want to school no and actually I'm recording right now so you guys will be on a YouTube video all my secret is that it? no I haven't I haven't done anything like this before it's that's be a good question I mean what the plug is for a lot of the aspect so do you mean like intentionally? yeah yeah so sometimes we'll have patients who they're just not going to get better there's like statistically medically everything is just family they're not going to get better they have a breathing tube in we don't like go up to the wall and just okay but patients or their families may decide you know there's no quality of life there's no potential for life let's withdraw care and make them comfortable and so we have certain orders and protocols everything gets basically discontinued and we just have pain meds, anxiety meds things like that for comfort things that make them comfortable and when the family is ready we will take the breathing tube out and most people don't just like stop breathing right when you take the tube out most people die like you know it could be a couple of minutes but most people still breathe the breathing tube out depending on the situation but so we do we do take the tubes out we do make people comfort care when they're ready when families are ready we don't just say oh you decided to withdraw care okay take the tube out it's a process you know and really it's all the family members and when they're ready yes is there any drug in the medical field you wouldn't like be willing to do would be willing or wouldn't be willing would wouldn't be willing would it I do not want to ever do psych and I did a psych rotation and I learned a lot from it but it's just not my forte and I respect nurses who do psych tremendously because one they do that job so I don't have to do it and two it's just it's just not something that personally interests me I do get a lot of psych still you're going to have people with anxiety or depression or suicidal or things like that so you do have to know how to work with patients who are maybe actively withdrawn with alcohol or have psychosis things like that but obviously in psych that's all you see and then when we get it in ICU we've got a whole lot more things like that to you know help with the situation and so I do get psych but in smaller doses I just couldn't do it all the time and I respect people who do it all the time a lot because it's not for me but other than that I mean there's really no other field in nursing that I absolutely hands down and be like nope I'm not doing new questions comments life stories you said you're at 6.8 did you have to do the hypocritical hope the like what doctors do yeah the nursing was just like more of the no we don't no we don't do the actual or anything but where they swear into whatever they say but I mean I mean technically by being a nurse you're as a nurse if something is doing harm to a patient if it's an ethical issue I've had situations where we're keeping someone alive that should not be kept alive and that sound maybe that sounds terrible to you guys but there comes a point where someone on their own they were artificially feeding them through a tube they can't move any of their arms or legs they can't speak they are not responding maybe neurologically and for most people and not everyone obviously at that point we would decide you know what it's their life not that their life is not worth it but they have lived their life in the quality of life that they would have afterwards is nothing the person that they were they're not anymore so to speak so what was I saying? what? but yeah I don't know I forgot where I was saying this oh okay so yeah so is there a situation like that where a family is like no let's keep them alive keep them alive keep them alive but now it's running into this gray area like okay we're keeping them alive but we're actually doing them harm by keeping them alive like this is basically tortures or doing a bunch of these tests and poking them and all these things when they have no quality of life so that becomes an ethical issue and as nurses we can bring that to the ethics committee we can call and be like hey this is an ethical issue but usually it's a doctor's decision whether they continue even doctors can be like I'm not getting involved in this person's care because I don't want to say there's no point but I don't ethically believe that so we can ask more questions or are we going to challenge her video you guys want to do that? I know yeah just to be sure I think those questions don't make it I think those questions don't make it


Part 11. Now this part is actually being recorded in April of 2020. The original Space Invaders series was programmed in 2015. It was posted in November so it's been almost five years and even to this day this is still my most popular tutorial. If I had known it was gonna be so popular I would have done a better job with it. So what I want to do is kind of update it for Python 3. Just do some basic updates based on a lot of the questions I've gotten over the last five years. So let me show you what I have so far. I'm gonna run this and this is what it looks like. Okay so we've got our player at the bottom. I have to hit the arrow key each time to move which is not true to the original. The Space Invaders are kind of all kind of randomly if I push a space bar. Okay it shoots which is what we want to happen. This is working fine. You can see how the invaders kind of reappear on the screen. It was really just a demo. It was one of the first things I'd ever really done with the Python Turtle module. Yeah again if I'd known more or I'd known better or I'd known that this was gonna take off so much I would have done a much better job. It has almost a half a million views right now. Just this part of the tutorial and the next one has a couple hundred thousand. Crazy popular and so first let me apologize for you know not finishing it and not doing a better job with it. So what I want to do today is with this one is to yeah move on. Do a little few updates based on some things I've learned since then and kind of get it looking a little better. So why don't we get started. So what I want to work on today is the Python 2 to Python 3. Now on my computer it works perfectly fine. Python 2, Python 3 it doesn't matter. It is actually compatible with both versions but I will show some of the changes. There's another little thing that I'll show you a little formatting thing. It's just now it drives me nuts but I didn't know back then. I didn't know any better. And what we'll do is we are gonna change the movement of the player so that it moves more like space invaders. You push the right arrow it just keeps moving. Okay so let's get started. The first thing I want to talk about is this. The kind of preferred formatting for a comment is hashtag space. You don't need it but it drives me nuts now that I look at it that I've been coding for much longer in Python. So I'm just gonna go ahead now I'm using something called BB edit. So your editor whatever you're using will have this function as well. Now this is something it's Mac only. I don't actually use this anymore but since I use it in the original tutorials I thought I'd use it in this tutorial as well. So I'm just gonna go to where is it search. I'm gonna click find and that's it'll be a little different on yours possibly for not using BB edit. And I'm gonna search for hashtags and I'm replacing with hashtag and a space and I'm gonna click the replace all button. Okay so you can see here 34 occurrences of hashtag were replaced with hashtag space. So I'm gonna go ahead and close that. Now I've made a change and this is something I always tell my students you made a change and 34 lines were changed. Let's make sure we didn't screw anything up. So I'm gonna go ahead and run it again and you can see it's still running you know exactly as we expected oops I missed that guy exactly as we expected before. Okay so next up is Python 2 to Python 3. Again this works fine on my computer in Python 2 and Python 3. What I found from viewers is that this part here where I register the shapes has been causing problems particularly on pie charm. It's giving them warnings and saying this is not working blah blah blah you know it does work just fine. So the reasoning is that from Python 2 to Python 3 there was a change in the turtle module and these certain methods that were part of the module itself originally are now part of the screen object. Okay so I use WN here I should use screen now that you know looking back but it's too much to change. So when we register the shapes we should use the window object the WN in this case and register the shapes then. We should also down here for the keyboard bindings same thing WN and WN WN WN. Also I should note that in Python 3 it is now on key press even though on key still works but it is on key press. Okay so so I made a bunch of changes I'm gonna test it hopefully it will work the way it did. Okay so so far so good so again there's there's really no change in functionality but it is updated a little bit more Python Python 3 style it does get stuck there sometimes I never really figured that out but you know that's that's life. One more Python 3 thing actually couple more Python 3 things one's very simple it's way down here at the bottom I had put this in originally in the code before I knew about win.main loop I didn't know anything about that method five years ago now I do you could put win.main loop but if you notice because there's a while true loop here that runs forever it's an infinite loop this actually is never reached so you can just cut that out and yeah you don't really need it anymore so again I'm gonna test it make sure just in case okay so everything's still working oops missed that guy I do want to like got me on that one yeah I'm very terrible at my own game okay so got one die anyway and the last Python 3 thing I want to show you is with the format method this was added I forget when so we have this here this score string and this again it still works there's nothing wrong with doing it this way but it's kind of you know I'll pass a for lack of a better term so what I need to do now instead is I'm going to put here I'm gonna put some curly braces I'm use dot format and I'm gonna put score there okay and I think there's another place in the code I'm going to copy that there's another place in the code where we have that where is it just kind of scrolling down here missed it didn't I either score string equals and again this is the current well there's actually now a what there's now f strings or something like that but this is a bit more of an updated thing so this might even be going on the way out I'm not 100% sure on that one and by the way I am running Python 3.8 so we run that and again just making sure nothing changed okay so score is there and the score is updating so no errors we are happy also something I've noticed people always ask me about this when they close it and then you get this error there I think there's a way around that I'll put that into a future video because I'm not sure how to do that but it's not it's not a big deal it's you know the program still running don't lose any sleep over it yeah I get a million questions about that and the program's over it's okay so the last thing I want to do so that was the Python 3 stuff the last thing I want to do is to change the way the player moves like when I first made this again I did that stupid thing where you have to push the arrow key each time and I don't want it to work that way so what I'm going to do is here where we got create the player turtle we've got this thing player speed and again I didn't know any better back then but now I do so what I'm gonna do is I'm gonna change this to player dot speed and I'm actually gonna change that to well even I'll leave it 15 now for that what I want to do now watch what I do here is when I push the left arrow okay I want to change the player speed to let's use minus 15 okay when I push the right arrow I'm gonna change player dot speed to 15 so that's positive player speed is negative if you're moving left and now what I need to do is make a new method called move call it move player and define that tab over and back then also I was using tabs now I use spaces but since it was already in tabs I'm gonna keep it as a tab so what I need to do is I'm gonna cut this out of here and I'm gonna put it here now watch this carefully because if you don't you're gonna get an error I'm gonna get rid of it I'm gonna cut that out also actually I'm just gonna cut this part out here the border checking and again this is you know you should have gone through the whole tutorial first before you got to this one this is this is in addition to a 10 part tutorial so if you're just tuning in now go back to number one so move player so here's what we want to do is we got to change that to plus so what will happen is when we push the left arrow it changes the player speed to minus 15 when we push the right arrow it changes it to plus 15 and then what we want to do is we want to move the player every single time okay so we take the x coordinate and add if it's right plus 15 if it's left it's gonna end up being minus 15 and then setting the x but what we got to do different in this one is we need to put here move player and we could put this at the end of this but I just put it there for now so I'm gonna hit I'm gonna run it and see what happens okay so now I've got an error okay so again this is the other thing with people that watch my channel is they say I've got an error or my say my program is not working okay I got an error well what error do you have there could be a hundred different errors okay so it is telling you where the problem is in this case line 104 it's telling you what the problem is player speed is not defined if you recall I just changed it to player dot speed so that's line 104 so I'm gonna go 104 and there we go so it's player dot speed so we go ahead and run it again okay it's running okay so you can see how it went all the way over and push the left arrow okay right arrow left arrow so it's moving a little bit more like space invaders did back in the day the only thing I didn't like was when the game started it was already moving I don't remember if the original game was like that it may very well be but what I want to do is I'm gonna set the player speed to zero when the game starts okay now I'm gonna run it and this is what I'll see okay so so I can go ahead and push all right oops missed it okay so again it's a little bit more you know accurate to the way the original game was played so that is that for this particular video so this was part 11 we changed some things from Python 2 to Python 3 we added a bit of an updated movement so just a quick review we changed turtle to WN for register shape we changed turtle to WN for the keyboard bindings as well we changed the see what else the score string we use the format method rather than the percent method again they both work but this is a bit more updated and there's other things you can do with the format method and then we changed the player speed variable and we made it actually a part of the player object if you don't know what that means that's okay just a quick thing this player speed is a method this player speed is a variable so this just changes the built-in animation speed it's kind of hard to explain but just you know you need to put that where it runs really really slowly and then this basically gets rid of this whole method is no longer accessible so be careful here you're calling the method and here you are making a variable so this has to come first and then you can do this so I think that's it for this one so stay tuned and what we're gonna do is we're gonna add a bunch of aliens and make it look a bit more like the old-school space invaders in video 12 thanks for tuning in there's yeah I'll talk to you later bye bye


I am the author of the digital forensics blog and ion forensics which I will wholeheartedly admit that I have not done a very good job of updating lately. There's been a lot of talks going and we've been kind of insanely busy. I'm a certified forensic analyst, I've been in MCSE since the NT4 days and I am a QSA. Here's the agenda for the talk, we're going to go over what Mac times are, where they're stored, what a forensic timeline is, why it's useful, why do it the way that I do it and then a little bit about actually doing it the way that I do it. A new tool that's come out recently that's really just made the way that I do it almost entirely automated and then we're going to get into a little bit of time stamp alteration and time stomping and the reason we're going to do that is because we've done a lot of cases in the spider labs where hackers have been using time stamp alteration to hide malware. So we're going to show you how to defeat time stamp alteration. If we have time, I'm going to try to do some demos where I'm actually going to run through creating a timeline, a super timeline, extracting the master file table and parsing it and showing you guys what some of these modified time stamps look like. We'll go through some of the tools that I'm going to use and then we'll do the conclusion. So Mac B times, what do they stand for? The Mac B times are derived from the file system metadata and they stand for modified, accessed, changed, which in this case means the MFT has been modified, and birth, which is the file creation time. The B is in parentheses because not all the file systems that we work on record a birth time stamp. For the purposes of the presentation, I'm focusing on NTFS. It's still the most common that we're seeing and we're seeing this in a lot of investigations. So where are the time stamps are stored? They're stored in two places. They're both located in the master file table. The first is the dollar standard info attribute or the SI attribute. It stores the file metadata like flags and SID and data about data, the file owner and one set of Mac B time stamps. This is the time stamp that's collected by Windows Explorer when you sort by date or by utilities like FLS and map time and time stamp. All the other utilities related to the display of time stamps. This is where they pull them from, the standard info. And that did come straight from one of the technet blogs. I've got a reference down there at the bottom if you want to read it. The second attribute is the dollar file name attribute or dollar FN contains the file name in Unicode and another set of Mac B time stamps. So it doesn't contain nearly as much information as SI. The important thing there is that it contains a second set of Mac time stamps. So the difference. Standard info can be modified by user level processes like time stamp or any other editor, Perl scripts, things like that. Dollar file name can only be modified by the system kernel. There are no known utilities that can accomplish this. Anti forensic or not. There's nothing out there right now. At least not that I know of. It's possible. Maybe somebody in the room knows. What is a forensic timeline? Forensic timeline is a string of digital events that's sorted into a format that can be easily read and interpreted by human being. Extremely useful in breach investigations. It can contain events from a single source like just the file system or log files, registry hives, event logs, just about anything that you can think of that records some kind of time stamp in the file system can be dumped into a super timeline. And it's really the only way I know if you get that sort of 30,000 foot view of what happened on a particular host around a specific time.  Well, what else was happening on that machine at three o'clock on Friday? You generate a timeline, bump it up, make it a super timeline, add some logs, and all of a sudden you can get an amazing picture of everything that was happening on that machine. So why is it useful? They are infinitely useful at pinpointing all or most intruder activity at a given point in time. It's also an excellent place to actually generate initial case leads and keywords. If you have an idea of what timeframe you might be looking at for a breach, you can just kind of go straight to that period and look at that day or that, you know, those few hours in a timeline. Periods of intruder activity will stick out like a sore thumb. If you, once you start using timelines and actually going through them, you'll see executable births and DLL births in the middle of, you know, the day where there's no, there's nothing else going on. Pretty obvious what's going on there when you see that. And identifying a starting point of intrusion is absolutely invaluable to finding other pieces of malware and kind of more of the total activity that took place on the system, right? So you see, maybe you see some enumeration tools and 15 minutes later, you see some unknown executable and you can go ahead and pull that other executable out there and start looking at what it does and what it is. So when you actually add in the registry timeline info, you get a more complete picture of code being dropped, services being installed. You can even, in some cases, you see hacker activity or intruder activity where they've moved a window and that actually leaves what are called shell bags in the registry. So you can actually tell, you've got proof that there's an interactive session going on. So it's pretty amazing what you can actually see inside of some of these timelines. In some cases, you see definitive proof of the user ID that was used to compromise the system. You might see the NT user got that file or some other files in a particular user profile get updated. So now we get to why we do it my way, right? Everybody's seeing some of the forensic suites that are out there or probably have that will sort stuff into timelines and you can do some of this stuff. It's very limited. My way's fast. It's super easy and it's extremely easy to search. Whether you're more comfortable with command line or the search prompt or the find command, it's amazing how searchable it is. So instead of doing your traditional shotgun forensics where you're looking for anything bad, you can use your scalpel and go after what you're actually looking for and what you wanna find. And it's free, more or less. There's really only one piece of this that I detailed that's not free. The rest of this is open source stuff. I can generate a timeline including full file system data and all the registry hives and search it for keywords, identify altered files before any of the GUI based utilities have even loaded an image or verified it. Sorry to all of you NKC users, you're slow. In a few minutes here if I've got time and I think I will, I'm gonna show you guys how I'm actually doing this stuff. So the first piece of this of doing it my way is the command FLS. This is open source. It's available as part of the Sleuthkit which is a free download, a free download from sleuthkit.org. I highly recommend going out there and checking it out. I've got the command here or a sample command FLS-M name your mount point. This could be slash for root. This could be a D, a C dollar, whatever you want. It really doesn't matter.  Designate the file system and it supports I think 16 different file systems. Not just NTFS. Recursively you wanna search and then you're gonna point it at either a physical drive by name. So that could be replaced with physical drive seven, physical drive two, whatever you have it plugged in. Or you can point it at a drive letter. You get varying results by pointing at a drive letter and I haven't figured out why. But for simplicity here I just pointed at a Z drive. And then you output it with the greater than two, an actual body file. In this case I just called it FS body file. So and I've got a little detail here about what this command is actually doing. Dash M is just output in a standard format. In this case it's time machine format. Dash C names the mount point and again I said there could be D, could be var, could be root, could be whatever you're working on. Dash F designate the file system type. Dash R you display everything recursively and then point it out at a logical device. And then that the greater than dumps it out to whatever kind of file you wanna call it. Doesn't matter, just whatever you want. Now here's one of the interesting pieces and the piece that's not free. You can actually do this while you're on site using F response. F response will actually let you using some magic and eye scuzzy. It will actually let you mount a local draw or a machine over the network as a local read only drive on your investigative machine. It's pretty amazing piece of software and it is very, very worth it. I don't know if Matt's here, he may actually be here from F response. No, that's too bad. But it's great software and I highly recommend it. It is like I said the only piece of this that's not free. You can obviously also do this against a previously gathered image but F response lets you do it while you're on site instead of sitting there reading a book waiting for an image to finish. FLS can also be running it's a static image or a post-mortem image and you just point it same thing slightly different with a little offset there. FLS-M, name your device and you do have to add an offset sometimes where the actual file system starts. Sometimes it will pick it up by itself, sometimes you have to add the offset dash R so it's recursive again and then you just point it at wherever your image is sitting. So there's your path to image and that could be on a USB drive or on your local drive or wherever your evidence sits. And then again just spit it out to the body file. That sector offset can be found with the MMLS tool which is also free and part of the toolkit very, very easy to use. You can also do this against a split image. If you could have 100 different 001, 002, 334 files you just go 001 space, 002, 003 and it works the same way. Again, the offset's there. So here's what a body file looks like and it's admittedly ugly. It's not user friendly at all. You'd actually have to know how many seconds from 1969 or 1970 is what these numbers here designate for each time stamp. So obviously that's not something that you're gonna wanna look at and try to use. But something interesting to look at here on this slide is this, I have it highlighted in red here. You have this Inet Manager executable and we're gonna see that here again in just a second. So turning FLS output into something that's actually useful in Human Readable is done with the Mac Time Perl script. It's also available as part of the Sleuth Kit. And here's your, here's the sample command again. Perl, mactime.pl-d-b pointed at your body file and again just output it out to a CSV file. The dash D is gonna output it in a common to limited format. So it's really, really easy to use with Excel or OpenOffice or Command Line. You can search it, do whatever you want. And then dash B just designates your path to the body file and you're outputting it to a timeline, FS timeline. So this is probably not gonna show up very well and I apologize, it's hard to catch what a timeline looks like in Excel. But obviously once you've got it full screen on your own machine, it's pretty easy to use. And control F is extremely effective when you're actually looking at this stuff in Excel. So if you could see what I've got up here on the screen is actually some intruder activity that I pulled from a real case.  Pretty scary stuff, not something that you would normally see on a little POS register or back of house server. So kind of a cool example there. So there's your standard file system timeline which can be incredibly useful but you start adding information to it and you really get a much larger picture of what's going on. So call it a super timeline when you start adding more information to it. I like to add the registry times and I don't usually add a lot else. You really get data overload extremely quickly but that being said, sometimes you're not finding a lot. Adding everything you can can be very useful. So obviously you just gotta use your best judgment there. So you can actually add the registry MAC times. They're recorded more or less the same way as the file system timelines and you can do that with reg time. Reg time was not publicly available until fairly recently. It's a Perl script written by Harlan Carvey and it's actually included in the SANS incident response and forensics toolkit and he's also made it available fairly recently on redripper.net. So it is out there. You just really have to kind of look for it. Now we also get to log two timeline which has just about rendered me completely obsolete in the last three weeks. It's great utility was written by Kristen Gunjinson. It adds in at the Windows event logs Dr. Watson logs, IIS logs. There's 32 different modules. There's probably 40 by now. It's been two weeks since I looked. Just about anything that has timestamps in it, it will parse it and dump it out into a body file for you. It's amazing. So thanks a lot, Kristen. Probably gonna lose my job. We'll talk more about it here in a few minutes but it's really good stuff. It's a little difficult to get it working the first time but really, really worth it. So the process. You extract the registry hives from system root Windows system 32 config and the NT user.dat files for each of your respective users. XP, C documents and settings, it's username and in Windows seven it's under C users username. And then it's a very simple pro command again.  And again, this is just more for so you know which hive you're looking at in the timeline. So HKLM-SAM, security, software, system and that HK user, you can actually add the name of the user whose NT user dat file you're actually parsing, which is pretty cool. Really, really easy obviously to tell which user was doing what when you do that. So, here's adding it to the body file. Perl regtime.pl-m, same command recursively. And then you point it at that actual high file, C cases, registry SAM in this case and then you append it to that body file. And this is kind of important. Notice there's two greater than symbols there. Use one and you truncate your whole file. So, it's kind of important to make sure that you append and not truncate all the work you just did. Using a single will crush the data and always make a copy of the body file before you start messing around. It's just good practice. Just in case, because it happens. You repeat that for each of the high files that you wanna add, the NT user dat files you wanna add and you run Mac time again. And that's pretty much it. Mactime.pl, point it at your body file, spit it out to a super timeline. Here's a nice example of what it actually looks like in text when you actually do a grep search against this. And it's actually got a really nice format. And remember I told you we were gonna see that INET manager again? There's several timestamps here and you see one in 2003, which is really odd because this machine wasn't even built until 2007. But we're gonna see that here in just a second on the next slide, we'll explain that. Then you also see some other interesting files there. You see two paths, System32, INET manager and System32, INET serve with the same executable name. Definitely kind of odd. So, that's alteration. And that's actually a live example of it. There's a couple interesting things there. There's two several locations, right? That I just talked about since System32 and it's also an INET serve. And the binary in System32 is actually memory dumping malware. The date on the binary doesn't fit the rest of the system timeline. Like I said, the server that this image came from originally wasn't even built until 2007. And I've got a highlight there. You see Sunday, November 16th, 2003. And you see that's actually the modified and the birth date. You see the two timestamps. The M and the B is modified and birth, right? So how do we find out if this is just some kind of anomaly or if this has actually been forcibly altered? It's actually easier than it sounds. But before we do that, let's talk about Vincent Lu who actually created the utility called TimeStomp. And this is a little bit older interview, but this is pretty common what he has to say about forensics people in general. So Mr. Lu said, but forensic people don't know how good or bad their tools are. And they're going to court based on evidence gathered with those tools. You should test the validity of tools you're using before you go to court. And that's what we've done. And guess what? These tools can be fooled and we've proven it, right? Well, I agree, I suppose. Tools can be fooled. That's not that hard. Good investigators can't be fooled. I mean, if you see something like this, you gotta dig further, right? You can't just rely on the output of one single thing. You gotta go verify the stuff. Another quote from him says, for any case that relies on digital forensic evidence, Lu says, it would be a cakewalk to come in and blow the case up. I can take any machine and make it look guilty or not guilty, whatever I want. Yeah, I beg to differ. He's wrong. So here's proving him wrong. And we're actually gonna do, we're gonna defeat TimeStomp alteration or at least show you how you can figure it out, right? So here's where that second set of timestamps in the master file table comes in. Dollar file name, right? It's not accessible to anything but the system kernel. As of the writing of this presentation, there is nothing known that can change these attributes on the system short of extracting it, modifying it, and putting it back on a live system. So it's not feasible. It could be done, but there would be, the indicator, it would be a mess. That I guarantee, or I can almost guarantee that the machine wouldn't even work again if you tried to do that. So how do we get to these attributes and make some sense out of the MFT because it's a disaster if you look at it in raw format? This is Harlan Carvey to the rescue again. He's written a script called MFT.pl. It's also available on Redripper.net and this script parses out all the data for both sets of file stamps and dumps it out into a human readable format. It's a great tool and it's fast. So you rip the MFT with again another little pearl command here, pearl MFT.pl pointed at your master file table and dump it out to a text file and that's all there is to it. That outputs a text file that contains all the attributes stored in the standard info and the file name and it dumps them out and it's really easily searchable. I'll show you in a couple of minutes. So a little bit more grep foo and we've got what we need. Strings that file out or anything else that you want to look to actually read through it. grep-c6-i and look for that executable that we know is bad, inet-manager.exe, right? The c6 is context. It's a context switch for grep. Shows six lines of context surrounding that search hit and it's ignoring case for this search. Not much really to it. It's too bad that it's cut off over here on this screen. This is the output of MFT, that particular search in the MFT there. And you can see file names highlighted here in blue. That's the file we were looking for. Inet-manager.exe and this is the standard info. Let's see if I can point it out over here. Get the fn, inet-manager.exe over there. So this one up here is the standard info and this one down here is the file name attribute. And you can see there's some definitive differences there, right? Standard info, which can be modified. You've got two timestamps that have been dumped back to November 16th, 2003. That same set of file timestamps from the file name attribute shows the actual time that this file was created and modified, which is July 21st, 2010. So I just told you everything that's on this slide, so I'm just gonna skip it. Except that you see there that there's definitive evidence of timestamp alteration, right? I mean, you've got a set of timestamps that are obviously right. They fit to your timeline and the other set just flat, doesn't. So this is definitive evidence of time alteration and we're actually seeing this a lot. The second set of timestamps just blows away the use of timestamp and it really kinda makes it look silly if you ask me. We're encountering this all the time. I would say almost weekly we're seeing different pieces of malware that are employing this technology, that are actually employing time stomping. So it is out there and in fact, there's a couple of keyloggers out there that do it by default when they install. They'll actually pull the date the system was built and stomp their own executables back to that or they'll move it back one year. So here we are back to log to timeline.  Again, thanks, Kristen, I really appreciate it. The latest version of log to timeline is added functionality that automates just about everything I just talked about and more. Here's a sample command. I'm not gonna read that out to you. You can go play with log to timeline by downloading it. Version 6.0 will run on Windows with some finagling. Look for a blog post in the very near future from Chris Pogue on exactly how to get it working if he doesn't already written it. It'll automatically parse registry hives, event logs, MFT, IIS logs, just about anything you can think of that actually logs with a timestamp. It'll do it automatically. You don't even have to really point it at a particular file. It actually does magic number searches. It'll automatically identify an EDT or an EVTX and parse it for you the way that it knows how. It's a pretty amazing tool. I'm actually looking forward to meeting Kristen and thanking him for writing. It's really awesome. So, it's demo time already. Wow, I'm way ahead. So we're gonna create a super timeline from a post-mortem image that I have loaded on my laptop. We use FLS, Regtime, and Mactime. We're gonna do a string search and look for some malicious files, and then we're gonna verify the timestamp of that. Probably only take a couple of minutes, and then while the one command is running, we'll do, I'll show you how to actually extract the MFT and the registry hives a really easy way. So, let me shrink this. Wrong button. I did cheat just a little bit. I already have my command prompt all open. Is that gonna be big enough for everybody to see?  That'll be all right. So, I have an image on here that I've already scrubbed any data out of so that I'm not actually divulging anyone's private information, and I've actually already ripped out the hives and stuff because it's a little time consuming, and I don't wanna bore you with all the details, but I will show you how I did it here. So, the first step here, hey, wow, this is cool. I can actually move my stuff off-screen so you can't see it. All right, so the first step is to actually generate a body file, and that was the FLS command, right? FLS-M, you name it C colon, C colon, backsplash, whatever you wanna do, whatever makes sense to you. Name the file system, it's NTFS. Look at it recursively, and in this case, I already have my image right here in this C defcon folder so I can just say demo image, demo.io one. This is an end case image. It's the only thing I like about end case is their compression. So, there you go, end case users. Little something for you. So, this takes a couple of minutes to run while that's running. Oop, I forgot to direct it out to a body file. Mm-hmm, mm-hmm, mm-hmm, mm-hmm, mm-hmm, mm-hmm. Sorry about that. Demo fail. Anybody got a drink? I'll just redo it here, hang on. FLS-MC-FNTFS-R for recursive and point it at, at demo.io one, dump it out to a body file. FLS-Body, all right? Okay, so that's gonna take a couple of minutes to run. The way I usually extract all these files is with the FTK imager, which is another open source product. It's really, really easy. You just add the image file in here with FTK, and once that loads up, which doesn't take long, you can just browse right through it here. So, this is read-only, what's that? Oh, I need to scoot it over, thank you. The better. So, here you go, you've got your entire file system, and here's the root of the drive that'll show you the MFT right here, and you just right-click and export. So, it's insanely easy to get a hold of this stuff.  And then the NT user.dat files are in their user profile spaces in C documents and settings or in C users. So, that's really easy, and the body file is now done as well. So, the next step's gonna be to actually turn it into a super timeline, right? Is that what I said I was gonna do? Yeah, super timeline. So, like I said, I've already got these registry hives ripped out, and they're in this C DEF CON thing here. So, I've also modified my path so that this stuff runs natively, which is kind of cheating as well, but it makes it a lot easier to use.  In this case, I'm just gonna do probably two of them here. We'll just do the SAM file, just for a demo here. Regtime.pl-m, name which hive you're gonna do, point it at the path that you're gonna, for the registry hive, dump it out to a super body, and notice I've got the two greater thans there, right? So, we're gonna append. So, there you go. Now you got a super body file right there. Once you've added everything that you want to add to the super body, you just run MAC timing against it again, just like you would regular timeline, and again, this runs very, very quickly. MACtime.pl-d-b-d is the outputted into CSV-b, pointed at a body file. In this case, we're gonna do the super body, and let that run for a second. Looks like, I suppose I gotta redirect it out, huh? Super timeline.csv, right? And there you go. Now, in our directory here, we're gonna have a super timeline, and I should probably look at that and make sure that it's actually got some content in it. It does. And then, again, we're gonna talk about how easily searchable a body file is, right? So, we're gonna do strings of the super timeline, just so you can take a look at it. And in this case, we're going to grep out something that I know is actually on here, called RDP service, which is another memory damper that I found on this case. Uh-oh. Did I blow up my demo? Mm-hmm, mm-hmm. Hang on. Oh, hang on. Let me take a look here. What have I got going on? Sorry, I kind of lost track of where I was. So, I've got my body file. Oh, that's what I did. I didn't append the registry stuff to, I didn't make a copy of the body file first. So, let's do that real quick. Come back. Right, so here's my FS body. I'm gonna copy it. I pasted it. I'm gonna rename it SuperBody. And then I'm gonna append that stuff to it. Sorry about that. It happens. Especially when you're on stage. All right, so now we've got the original body file there, renamed to SuperBody, and now we're gonna append that SAM stuff into SuperBody, and it moves very, very quickly. So now we're gonna take a look at that body file. And with strings and grep again, and look for that, I gotta turn it into a timeline. Okay, that'll take just a second to run through all that stuff. Anybody know any good jokes? Oh, this is one of them? Sure, better. Too far over now. There we go. How much does it need to be shrunk? It's kind of hard for me to see the screens. Better? Okay, that's the bottom of it. So this usually takes, I don't know, maybe two or three minutes. It really doesn't take very long. It's pretty fast. Again, if you were trying to sort this out with X ways or N case, you might have sorted it out and you'd have one set of timestamps by now. So this weighs a lot faster. And again, this can be done while you're sitting there at a customer site pulling these images if you're using fResponse, without affecting the image in any way. Because you're completely set read only. So it's really a great tool. I really like fResponse. It's one of the only ways that I know of to actually get a little bit more efficiency out of an onsite. I've actually seen forensic people pull up, set an image going and pull out a book instead of working. And I don't know about anybody else that's in here that does forensics for a living, but we bill a lot of money per hour. So I don't think clients like to see you sitting there reading a book. Oh, should be just about done. There we go. All right, so now let's take a look at what's in that body file. Again, you can pull this open with Excel if you want and search through it, but it's a heck of a lot faster to do it this way. So take a look at the supertimeline.csv. Again, we're gonna just use a simple grep command to look for a piece of known malware that I know is in here. And so here's RDP service. And there's one hit. And again, we're looking at a 2003 time stamp. And then, lo and behold, the very next hit is a prefetch hit. So that was the last time that this thing was run is actually in 2010, which is really odd. And then we've also got, down at the bottom, we've got an access and a create time in 2010, but the modified and birth time are both in 2003, which is pretty odd, to say the least. So again, we're gonna look at the MFT here. And I've already ripped the MFT, I think. I think I've already got it set. Nope, I don't. Good, I get to do it. Okay, so MFT.pl, really easy. This is probably the easiest one of the whole batch. Point it at the MFT and output it to a text file. And this takes like, I don't know, 60 seconds maybe. And then as soon as that's done, we'll be able to pull those two time stamps out of there and look at that RDP service. This is the RDP service was actually memory dumping malware that was just from a live case. And we actually see, when we see this malware, we see this same time stamping or time stomping just about every single time that we found it. And it's actually done with Pearl during the install. There's a couple of lines in the Pearl installer for this malware that turns around and screws up these time stamps pretty bad. But it's pretty slick.  When they think they've got malware, they're gonna go looking for everything that just happened in the last six weeks, right? This will completely burn that down. They won't find it. So, all right, so now we've got a text file of the MFT. And we're gonna do the same thing. We're just going to use strings to look at that MFT.text. And grip-i, get some context there, C6. And we're looking for that, we're looking for RDP service again. And it's gonna run through that MFT file. And it'll pop up here in just a second, I hope, with some hits. And there we go. So, we've actually got two hits for RDP service, right? Remember that prefetch entry from earlier? Here's the prefetch entry. Pretty good idea, right? Those time stamps match, right? We've got June 14th, 2010, and June 14th, 2010. Well, here's the actual executable right here, rdpservice.exe. Here's the standard info attributes. And there's that February 12th, 2003, that's obviously wrong. Because here's your file name attribute. Remember, that one can't be altered. June 14th, 2010, right? This is time stomping. And like I said, the look and feel of this is pretty easy to do. You can pretty well blow this open within a couple of minutes. And it really makes time stomping feel sort of silly. So, there's our demo real quick. Uh-oh, lost my page. Are we there? There we go. So, here's some of the tools that we used here. Right, and where you can find them all. And this is all gonna be up on my blog as well, Ion Forensics. So, if you wanna go and download all this stuff, you can go, it's out there. So, tools used and credit to their creators. Regtime.pl and MFT, this is Harlan Carvey's stuff. He wrote Windows Forensic Analysis, Windows Registry Forensics, and he's got the supporting blog for Windows Incident Response. Great blog, Harlan's always got new stuff out there. And he's pretty opinionated, but he's a good guy. Everybody that, I hear people chuckling, they must know Harlan. FLS and MacTime, these were written by Brian Carrier, the author of File System Forensic Analysis, and the creator of the Sleuthkit, available for free out there. Logged to Timeline, this is Kristen Gunjensen. I'm pretty sure I'm torturing his name. GCFA Gold Paper is where this came from. Mastering Super Timelines with Logged to Timeline. And he's also got a blog, IR and Forensics Talk, blog.kittiland.net. The original MacDaddy was written by Rob Lee and was absorbed into MacTime by Brian Carrier. And it's really only fair to mention Rob since he is the original MacDaddy. Great tool, just a really slightly different output for MacDaddy. It's also good for, actually, for Macs, instead of just Windows machines. And a special thanks to Chris Pogue, CP Beefcake. He's right over here in the front row. For teaching me a Sniper Forensics methodology. I don't know if you guys have ever been on his blog or have looked at his methodology for this stuff. It's fantastic. It's really the way that I learned how to do computer forensics, and I just, I love it. I can't imagine sitting there and waiting while all this stuff is running, while sitting on my thumbs. So he's always got the time to mentor me, even when he doesn't have the time to mentor me. So thanks, man. I appreciate it. Real-world anti-forensics, right? This stuff is happening. We're seeing it at least once a month, and usually more frequently than that. In the course of real-world investigations, we regularly encounter malware and attackers that are using these techniques to try to obfuscate their trail. And as they start using these tools more regularly, if you're an investigator, you need to have the tools. You need to be better armed, and you need to be better prepared to recognize these things, and not just go, huh, that's an anomaly. This is easy enough to prove. Figure it out, use this stuff, and blow this stuff away.  It's not right to do your homework there. Everything leaves trace evidence somewhere, right? This is Low Cards Exchange Principle, the father of modern forensics. Know how your tools work, not just what they do, make you a better investigator. And remember that the tools do not make the investigator. It's the investigator's use of the tools that make them effective, right? I have a miter saw, and a biscuit joiner, and a router at home. I am not a Finnish carpenter. I am a forensic analyst. So be aware that these tactics are in use. If you guys are doing forensics, and you suspect malware, and you're seeing stuff that just doesn't fit, give it a shot. It's not that tough, and get some pretty amazing results out of this stuff, all right? So anybody have any questions? Any questions? No, all right. Go ahead. A graphical view of the timeline, there is stuff out there. There's Excel templates and stuff that I've seen people dump it into, but it's kind of a pain to make it all fit. And if you actually look at a timeline as a CSV, it's not just a handful of entries. I mean, it's literally 450,000 entries for your standard hard drive. So, okay, and we'll do a Q&A later. So thank you guys very much for coming. I really appreciate it. Thanks guys.


X-Tar EP9, Gen 2. Let's take a few shots. Nice! Hey there friends, thanks for checking in. Today we're looking at the X-Tar EP9. I know a lot of people love this. When I reviewed the original one, people said it's about time. That thing is an excellent 9 millimeter pistol with a 6.5 inch barrel for an MSRP of 449. This is a Gen 2. There are some similarities, there are some differences. I will tell you that the MSRP has not changed. 449 for the Gen 2 model. And check it out. Now some of the similarities. It is an all-polymer upper and lower receiver and you may notice that the rail goes all the way across. That's polymer and the overall function with the blowback system is very nice. And those are some of the similarities. The Gen 2 models have one thing that stands out is the handguard. Now it is an all-polymer M-lock handguard. That's a bit different. Instead of a flash hider, they have a flash can.  I'm going to show you that in a little bit. They have an adjustable trigger which is pretty nice. I'm happy with it out of the box. It also has a brace.  Okay, makes it nice. It also comes with the Velcro strap to use it as a brace. And one of the things that is I think very cool is that X-Tar came out with their own Glock pattern magazines. This is an 18-round mag. And if you go with this, they will ship with three X-Tar 18-round Glock pattern magazines. And that's always a nice touch. You know, we always want more mags. We want firearms that are chambered with Glock mags. And the X-Tar EP9 Gen 2 is. Now we will see very similar controls to an AR. Alright, you got your bolt release right there. It does have a side charger on the left-hand side. You got your safety and a system that most people are familiar with. Now I have a Vortex AR Spark 2 on there. Took a few shots, sighted it in. And I hope I demonstrated quite well. It comes with a B5 systems grip. Nice texturing. It can be changed out if you're a fan of Magpul or any of the others. But I like it the way it is. Very nice texture. And the weight is pretty light. It's all polymer and that's one of the benefits is that it is very light. Right around four pounds with this. For being such a lightweight firearm, the recoil is very manageable. Like nothing. It, you know, and I noticed this when I reviewed the original EP9. I was very much impressed with the shooting impressions. And this one, I have to say, remains the same. But let's get it out of the table and we'll take a closer look. The X-Tar EP9 Gen 2. A lot of people loved the original. They told me. They said I love that. It offers a lot for a very fair price. There is the arm brace. It comes detached. All you do is take it out and throw it on there. I mentioned it has the Velcro straps right there to use it as an arm brace. The B5 systems grip. Check out that trigger guard. Very cool adjustable trigger. Right there you can adjust it to your preference. Glock style mags. Right. As I mentioned, 18 rounds. It does have the number right there. One side hole indicator. But they've, they've run great at the range here today. It's been great. There's a look at the side charger. It will lock open. The bolt will lock back with the last shot. The hand guard. All polymer. M lock slots on the sides. And down below. Put a hand stop on there. And that's a nice addition with the Gen 2 models. And the rail that goes all the way across. There's my optic. I like this optic because it's, well first it's a Vortex AR spark. All right. Spark AR. It's how you say it. But it is such a nice optic. All right. So I cited that in. Not a big deal. Works great. Here's the flash can. All right. Now the original had a flash hider. It is unloaded. So I'm going to show you. This just screws off. It does have threads on there in case you want to run a can. Not a flash can, but a can. And that's what we're looking at right there. If you can see that. I mentioned it has AR light controls. There's the safety, the bolt catch, even the magazine release. Same position. And check this out. It's got some serious ejection there. Some ridges inside the mag well. Nice overall package. It is very cool. Let's take a look at the trigger. Now the Gen 2s have a steel trigger. The original, I guess, Gen 1s do not have a steel trigger. This does. It is unloaded. We'll take it off the safe. Nice, crisp, strong brake. So it's got, you know, basically it has what you want in a AR-like pistol chamber, 9mm. Man, this is nice. And it's priced right. 4, 49, 3, 3 Glock pattern mags that are 18 round capacity. I think it offers a ton for the money. I like the flash can. I think that not only looks cool, but provides a bit of a benefit there. You know, you're not going to see any flash at you. I like the AR controls. I like that they added this arm brace. And the B5 systems grip is really nice. Adjustable trigger. I can go on. You know, it's very lightweight. It shoots very soft. And in my opinion, has a ton of benefits for right around 450 bucks. I just think it's a phenomenal deal. And if you like videos like this, please subscribe and share. I always appreciate thumbs up button. Thanks for watching and you guys be safe.


A lot of the times when I see me do play in those leagues is because I was not selected, right? So therefore, if I'm not selected for international cricket, I will get offers to play anywhere in the world. So, and that's the goal that I shoot, like the last time I played test cricket was I was 26 years old. Well, do you think that was my decision to stop playing test cricket at 26? I was dropped. I will challenge anybody in the system, former captain, coaches, but whoever was involved at that time to say something else.