As Muslims in Nigeria join their counterparts across the world to celebrate this year's Eid al-Fitr, some Lagos residents have lamented the low-key celebration attributed to the new wave of COVID-19 and bad economy. Plos TV Africa's Destiny Mama has more. The holy morn of Ramadan is an opportunity for Muslim brothers and sisters to deepen their relationship with Allah, promote a life of sacrifice, charity and love for one another. However, as the fast culminated in the Eid al-Fitr celebration, a cross-section of Lagos residents say the economic situation has affected the festivities. And the economic effects, you know, things are very expensive. So, unlike before, so the whole economy is a bit hard this time. But despite that, we managed to pull through. Celebration is a low key, like you can see. Unlike other days that at the end of Ramadan like these, people throw parties everywhere, but it is unlike before. In 2015, the purest time was five Naira. Now it is 20 Naira. Look at that. Some people cannot avoid to buy it. Even Parasitamo is now 100 Naira, 150 from 13 Naira. So all those are for things. They have to realize there is a solution. They are supposed to be in my village and I couldn't go because I don't have money. They speak prayers and wishes for the season. Ahead of the celebration, federal government had revisited the COVID-19 protocols, which is to be duly observed in religious gathering and social centres. Was there compliance at various mocks? After all is said and done, a call here is from Muslims to pray for a united Nigeria in the wake of the spate of insecurity bedeviling the country.


This is Melissa Arma with the stocksswitch.com and a review in the market here today. I'm in the room And I was explaining we're going over the market that the markets along here today I actually called the market long is anyone in this call I said you could be in this long and actually it's holding that it will hold today I snaggeted the invisible tech And there was one in the spine the cues What is an invisible tech an invisible tick in the opposite direction of something you're in is give you Confirmation will continue in the right direction and invisible tick in the direction that you're in the train is Confirmation that it is done in the move the invisible tick went down in the cues That means this long will hold so that was a good sign for those of you that are long as you see It's trying to come in and holding either way you're in this all day to get it to the target the target in the QQ Cues today is 105 You're in it all day to get there I Don't know if the strength of the market will actually hold to push it up to that level today If not, we will still be bullish today Then we may need a second gap up tomorrow to follow through could be medium could be neutral car be large The market may struggle a little bit here until it situates itself again Why as I was just discussing what happened yesterday with the third gap down in a row Which was a large gap down in the market yesterday where the market opened was an anomaly now Every chart that was in the market was affected by this yesterday There was no thing that traded in the US market yesterday that was not affected by this gap down that happened In fact right now. I'm looking at the volume here. I didn't even look at that look at that I look at that that number you can't fathom the amount of the number. Look at that 1 5 0 8 2 9 8 2 9 8 6 3 And that was in the market yesterday. In fact, let's look at the volume that was in the first 15 minutes 30% of the volume on the day happened in the first 15 minutes of the day when what happened the market opened and swushed and Flip the swush. Look at that 4 9 5 9 1 4 5 So 30% of the overall total volume of the day yesterday in the market because of the Situation in the gap happened in the first 15 minutes of the day This is an anomaly and let's look at the definition of an anomaly Here this is it. Oh, this is amazing This is it. Listen is everyone paying attention when I looked at this and I saw this last night And I also saw it yesterday morning And I also looked at charts today and I scanned through every chart on the planet this morning scanning for stuff to do Which I only found one thing which I wasn't crazy about I said boy every chart now looks funky. Donkey. Why because of what happened yesterday in the market It affected everything in the US market. So every chart now looks skewed and we'll take time to situate itself We must be picky poos every day this week when we trade and I didn't train yesterday And I didn't do anything today, but Wednesday Thursday Friday. We are not doing anything unless it is perfect Why because what the market did yesterday, which will remember the day Even though we didn't trade or do anything which I told you not to do and it was a good decision because the market could have been halted The market could have been halted and we could have been stuck in something and actually there were no good bearish gaps Not even the market because it flipped but anyways when I looked at this, I said, you know what? This is an anomaly. Okay. So what's the actual definition for our dictionary comm of an anomaly? This is absolutely 100% true. It is an odd peculiar peculiar or strange condition situation quality etc and Incongruity or inconsistency does not fit in Irregularity and that accurately describes the gap down in the market yesterday. Why? Because the market is still in a bullish uptrend. What happened was unexpected yesterday Has not changed the trend of this chart, which is Actually peculiar Because normally if you see something gapping down three days in a row in general, I'm generalizing here I'm generalizing here But normally if you'd see something fall and drop and gap down three is in a row or have a big gap down You'd say boy that thing is weak something's wrong with it If you looked at a stock, you'd say something's wrong with that stock because in three days It's lost value and you would say to yourself because if you want to go back here from Thursday on 820 the high of the day and 820 well, no, let's look at the open the open was 109 11 Okay, and the low yesterday after the bounce here. Let's just figure it out exactly 111 minus 84 74 Shoo Market has lost, you know, basically 25 percent or 24 percent or 23 some percent or whatever within three days of trading from the Open of Thursday to the low of the bounce off of yesterday not today But since then so when you see something like that you say to yourself Wow, you know that looks bearish But the fact is it's not and that is what is peculiar It is peculiar that it happened and even more so why because the market is still in an uptrend and many many many many Many people now have lost a hundred percent conviction that the market is gonna hold the trend or is even still a new Uptrend at all which I'm telling you it is but I'm telling you that it When I saw this the only way I could accurately describe it Which is correct is that it is an anomaly because it is something that is unusual a strange condition odd Peculiar and an inconsistency in this chart in the trend But you will see things like this happen over the course of your life when you trade You always see something and that's what we talked about yesterday too It's exciting to trade because you will always learn something new and see something and what will be even more Amazing is when the market continues makes a new high which to be honest with you was still gonna happen this year in 2015 I just don't know the timing of it and that will be even more phenomenal for people that don't understand it and again Guess what all along the way every day I talk I've been talking for a year now or more about the fact that when the market does get over that resistance level of What we talked about it was like 114 something something whatever It's gonna blow in the QQQ's and rally immediately because there's nothing past that number to get up to the 120 number in the previous high in the Q's and now it could almost go straight up vertical over the Q's and over the spy whenever it sets up to do it I said it was gonna do that all along. I always said that's how I saw it happening. I actually saw it I saw it. I just saw it and it's still gonna happen. And you know what maybe that's why that's gonna happen Maybe that's why it's actually gonna go like this And anyone's not long will miss it and then that's what it's gonna create the buying to come in late where people are gonna realize Then oh my lanta the market really is higher quick quick quick Let's get in and then the market just goes and goes and goes and goes and goes and the bullish market lasts into 2016 all of 2016 or over long at last that maybe why I this is happening this way now I did not see this happening. I see what is gonna happen Which I'm telling you was still setting up to happen, but again, this is an anomaly This is an anomaly and it's very unusual, but it accurately describes what happened in the market yesterday And now every chart in existence. I mean, let's just look at some of our favorites Every chart in the world Let's look at all of them. Let's look at Netflix. Let's look at Apple. This actually doesn't look that weird here. JC penny. Let's look at Apple It's mostly gonna be market stocks, but everything looks somewhat strange Apple actually looks like it closed stronger than the market yesterday This chart is still fine This is you know, this is really challenging for people that still have conviction because people aren't fear now People aren't fear people aren't fear when fear comes over you you do things that you would normally do you make quick decisions You make out your apprehensive you make fast quick decisions that you wouldn't normally make You're floating along and you're you're in the cruise ship and you went on this cruise and you paid all this money And you're having a fabulous time and all of a sudden there's a leak there's a leak in the cruise ship And now you don't know what to do You don't know how big the leak is or how small the leak is but as you know There's been many many stories out there in the last I don't know how many years are these cruise ships like sinking and everyone Dying and and then the panic comes over you and there's disorganization everywhere And you didn't go up when they had the lifeboat meeting and you know You should have but you were having a drink in the cabana pool area and you said screw it This is everything's fine. We're only going to Alaska But all of a sudden you realize that there's a possibility that you might sink in a panic mode You jump out in a lifeboat and as it turns out there was no reason for you to do that And they keep going without you and they fix the leak and you're stuck in the middle of the Atlantic ocean By yourself and your cell phone doesn't work You have no reception and you should have never jumped out of the lifeboat because actually they fixed the leak this place this cruise place was more organized than the last one and They there was no reason to panic Okay, and this is sometimes what happens when fear sets into you and panic You make apprehensive quick decisions that you cannot make And and and then they work against you This chart's still fine too. I don't know what to say, but it is Let's look at Tesla. This looks the worst of any of them, but still probably will be fine So let's just go back here very quickly to the market Nice call I made here in the market long today. Is anybody in it? You're going to be in it all day I don't know where it goes exactly. It could get to the target. If not, you're still going to make money in this call Who's in the market long anyone? This was an aggressive call for him to make here Anyways, the market is higher. We'll have to see how it plays out the rest of the week every day counts No, though, I'll tell you every day I get up and I'll be looking at this You could almost rate the market gaps every day Just to get the confirmation and the conviction But as I was describing with the cruise ship leak, you cannot panic. You cannot panic There was nothing but panic coming in yesterday panic all over the u.s. Market It was an anomaly. There was not a valid reason for the panic And actually there you go. That's another thing that you can think in your mind, too Listen, this will help you if there is a valid reason for the panic Go with it, but there wasn't Okay, like if if somebody I'd forbid okay does something crazy Where there is an activity or an action of violence that happens on the planet that results in the beginning of a war for the world You have my permission to panic. Okay, that did not happen yesterday There was no valid rational reason for the panic Okay So if something happens and when I made the original call last year in October of 2014 and I said barring a world war The market will be bullish in 2015 It is playing out to be that way and I said the market would make a new high it already did that The targets have changed now because what happened yesterday was a complete and total anomaly As far as the timing of the targets, but the overall targets for the market for the bullishness of the market long is still in play Timing of that has changed now because what happened yesterday was an anomaly And that will help you when you're you get in that panic mode Is there a reason that this is happening? Okay It has to do with the quality of the gap rating and your unlogic. Okay, and I did rate the gap I mean I rated it and it rated the 16 So there was no reason to short that gap yesterday And you know what it didn't work and one of the things actually that confirmed that That could be the low of the day actually in the market for the entire rest of the year of 2015 And could be for years to come Is the fact that the market opened and swushed now, listen, I'm going to say this is very important The market opened and swushed and the swish reversed I've never seen that in the market I can't wait to find out if that really ends up being the low in the market for a long long time Because the fact is the market opened and swushed And 30 percent of the volume on the day came in into that and it was completely 100 percent reverse So that could be the low of the us stock market For the rest of 2015 and for years because I've never seen anything like it I've never seen anything like it and there is Meaning in that Okay, there is significance in that. Does anyone want to tell me what the significance is before I tell you Does anyone want to guess here the market's long? I've already called it Does anyone want to tell me what the significance is of the swish reversal that happened yesterday in the market? Conceptually in your mind What is what is very significant about that? Just guess and then I'll let everybody go for the day. Does anyone want to guess here? You're almost over the high for in this long Am I talking to myself?  That's true But I want conceptually to you. What else besides it? Asia is leading that has nothing to do with the swush Jagra pa says it shows who is in control. Yes, that is correct That is correct and line 38 says sellers capitulation. No more sellers left I wouldn't say there's no more sellers left. I wouldn't say that at all But there was capitulation 007 I already answered that question 10 hours ago I found it up here in my scanner on my thing in this jiggie in here this morning. Boom Really, you know, no one was wrong and anything they said, okay The person that got it the best really was jaguar pa about the control Trader gal saying I think the three-day drop had to do with china oil fed etc As the news says once people realize it's not a crash all will return Gala had said closed green buyers in control Yes, nice call in the market It is about the control But I want to go back here to the original thing. No one really really really said What I was really thinking in my brain if you could see my brain Although everyone was right in some regard. No one was wrong You made money in my call today in DSW. I'm glad if you made $1,750 in my call today in DSW then once again, you took some crazy crazy amount of size So I hope you know what you're doing I just this is just amazing I am here is 94 23 Low is 84 74 in this one bar One two five 10 10 look at that Look at that volume. So this the market opened and swushed So again somebody said about the control. That's true. It closed green. That's true But what I really was was was thinking What was so amazing about this and very very Significant it's not just the show of the control to hold the market up Which is doing but the fact is that this really actually is real This actually really did really for real happen. Okay, so to reverse This are to the downside. Forget the guy. Okay, just I'm just talking about the swash This this swash could have opened here and swashed Pretend this wishes anywhere. It just opened and swashed the swash itself It's all I'm talking about is what I find the most significant from yesterday Not the gap down not the three-day gap downs We've had not the drop not not anything The most significant thing that I the takeaway from yesterday is number one the anomaly Which I just described to you The anomaly You know what the swish is part of the anomaly now that I'm talking So the anomaly that happened in the market with the gap But the most significant thing that happened yesterday to me Melissa Armon You would never know this if you didn't know what a stock swish was which I invented But it tells you so much information The biggest most significant thing that happened yesterday in my mind when I analyze this So I'm doing with your live right now. So it's good. I'm taping it. I think I'm taping it. Yeah um is that The market opened and swished and then that swish Did not hold and actually got bought Which I have never seen happen in the market and very very rarely ever happens ever in a stock So for that to happen Yesterday is the most significant thing that happened of yesterday's anomaly Is that the market opened and swished you would never know what a swish is unless you did my golden gap class You would never know the significance of that unless you would be here with me and trading and understand what that is it is about The bull stepping in But it's even more than that. It's the fact that this was real I mean, I'm not gonna lie to you this Really actually happened And it was actually selling And it really did sell off ten dollars here in 60 seconds and there's no getting around it And that bar itself is a swish That bar is bearish I'm not arguing that case It fell off a planet in 60 seconds We watched it happen live and we just watched it breathless But I'm telling you the fact that it flipped aggressively and did not hold that sell-off Okay Is extremely significant because it meant that the people Not only showed the force of the control which jaguar a paw pointed out Not only did they show the force of the control that they were in control, which is still the bulls But they were prepared to step in immediately So it's not like listen, this is really important. Does anyone listen to anything? I say It's not just the fact that that we reversed and closed green yesterday and held in the gap down It's the fact that the people that were in control had no hesitation To step in as almost action Do you understand what I'm saying? It's almost as if it was a planned action now that planned action could have taken place between 7 a.m And 8 15 when the gap down happened. Do you understand like it's that it's almost as if the It's not just the control that came in that held the market. It's the fact that that swish reversed In minutes and seconds It's it was that it's almost as if it was a planned action Do you understand what I'm saying that my friends is huge? Okay, and very rare and in an anomaly in something that you see like this in a chart But what that says to me it's giving me the confirmation and conviction that there is no chance no chance No chance of failure that the market isn't higher because the people in control Not only we're willing to stay in control But had absolutely no hesitation despite a $10 bar down with over a million dollars in volume in 60 seconds To come in with all the force of money on the planet that exists within the force of their vaults and buy Which was to them an opportunity to buy more of the market To make more money the billions of dollars that these play people make Because it is so important and and their plan of action to continue to rally the market Do you understand what i'm saying here like it's do you understand what i'm saying because this wash is going to come in Or any drop or whatever and the market could have sloshed around here And then it could have rallied over the high and close green this could have this the bar in the day Which you can't tell from here could have looked like 7 000 different things on the intraday chart But it didn't it looked like this and i'm telling you this is where this is the this is the most Significant thing that happened yesterday of anything that happened besides the anomaly of the gap down But it's a combination and you only see swooshes and gaps and quality gaps anyways or gaps right on the cusp Which you could have you could have you could have said it was on the cusp But really i never would have shorted it but anyways to make a long story short This here is significant for the reason i just described because this could have flipped and held green on the day and not transpired like this It could have done this and then it could have gone And then rally rally rally rally rally and had a just a nice controlled rally instead It opened and it swooshed and it immediately the buying came in with no hesitation and pushed it over and failed on the swoosh And actually i'm seeing this here now I can't make this stuff up if i tried look this actually set up in here triggered flipped failed look I just see that i just saw that now here i didn't even realize that until now Let me just look at the spy Same thing happened here You have this here Failed look It was more aggressive in the cures though noticeably aggressive But this still swooshed too And then this hit failed This is this is a better chart to Teach the lesson here today though And it it's clear to me here It's clear to me here now and the qqqs and it matters more and there is more of an impact And the reason is because the spy has been more bullish than the cues all of the last two years So this has more of an impact because the fact is that if anything needs more strength than anything else It's the qqqs because the qqqs have not made an all time High yet and the spy already has long ago even last year So the reality is that there's more significant in watching what's happening right now in the qqq etf and the spy If you want to determine what to do and there isn't a match up Although there is okay, then you would watch this chart for Clues like we just discussed here and all of these things are clues Again, how do I know because i'm reading and describing you the price action? This is one of the benefits of really taking my class and being with me and I am so grateful that I have a good I'd even see these things I truly truly truly believe now that I just analyze this here this morning that this is definitely the low For the one for the year for the rest of the year in the market. There's only september october november december left You don't buy gap downs, but you're not a hedge fund institution and that was bought The market is higher still is setting up to make a new high yet this calendar year even though There's only four months left. Will the targets be hit? I don't know if they'll be hit by december 31st We will possibly have again. I saw it, you know, it's just a timing like in in october of 2014 I saw what was going to happen And then the year kept going and we were staying bullish Now we had this anomaly. It's like the year I thought we'd have in 2015 for the tremendous bullish year is pushing into 2016 Although we really have had a bullish year in the market. We have we have and no matter how what anyone says We're still in an uptrend and it's tough for people to see it's tough for people to see I understand that But as I said, you can't panic and jump out into the lifeboat if if they're gonna fix the leak Because you may end up out there with no cell phone service and nowhere to go and no food and no one to find you And they don't even know that you're out there Because they just can't even see you the boat's too big a lot of panic that came in yesterday, but there was no hesitation No hesitation from the money And whether it was a planned action that happened early in the morning or planned action that was planned out to happen At any time that those price levels happened to be hit if it ever were if they ever were hit Who knows who knows who knows how far in advance that planned action took place but I will tell you that there was no hesitation and I've never seen anything like it And my call is still going to come out to play through I'm not on television yet. But honestly, I wish I wish that I was today right now and even yesterday on Monday because I would have been the only person saying the things I'm saying now I would have been the only person talking about swooshes because I invented it and no one else knows about the swooshes But me and and you know what people would follow me and follow me and follow me and eventually what I'm saying will turn out to be true, but I'm Taping this here will put it on you too But I'll be out there in the universe for people to go back and listen to I Really really just this stuff is so good people It's reading the price action It's amazing to me. Let's see here a trader gals talking about the cues went from 114 In 8 to 85 in less than 30 trading days I don't I don't know what that has to do with anything where you're coming up with the 30 trading days I don't know why you're why you're saying 30 trading days is something that is something In fact it dropped to april 2014 price I don't know if it did or not, but again, I don't know why that matters Uh, you listen, but the fact is that the drop had had to have hit a lot of people stopped So a lot of people lost money Did people lose money from that drop-off yesterday Yes, people may very well have lost money from that drop-off yesterday Now remember in reference to overnight's we're talking about stops There there is no stop you have a paper stop or a mental stop But this is what I was talking about about the idea of the control I'm going to say one more thing before everybody go Let's just say trader gal or any of you Are in a train and an anomaly happens like happened yesterday It could have happened in any stop that you were could have been long in yesterday in the market or the market itself Now this just describes again when I'm talking about about jumping out a lifeboat when the ship hasn't said it's going to sink yet An anomaly comes in An anomaly that doesn't have a reason and a gap that you rate that turns out not to be something melissa armour with short You already are down There's nothing you can do. Are you listening to me? You already are down. There is nothing you can do You are down You are down when you get up out of the bed in the morning because the gap down in the market You are in a paper stop. So your stop isn't hit theoretically. It's through the number What are you going to do?  As an intelligent rational human being who has taken the golden gap class You could call me on the phone and ask my advice so you could listen to me in the room or you could sit and rate the gap When you rate the market gap or the stock gap of the bearish gap of something you're in if you're in a long position And determine that it is not a good bearish gap you would know that it wouldn't follow through Even though you might not believe it because you're so consumed with fear because your account is absolutely upside down you would still Not want to panic because whether you killed the trade at 7 a.m. Or 8 a.m. Or 9 30 in the market open you are down therefore Go with the gap rating the gap rating tells you that the gap isn't going to follow through and you can't short it on the day You believe in the gap rating system and you have conviction When you get up out of bed in the morning and watch it you see the market And in fact here did anything else swish hold on. I didn't even check that Hold on. I didn't even look at that Just wait a minute Did anything else swish yesterday besides the market? If anybody I'm not going to look at every chart in the world No, I can tell this didn't either But if you if somebody finds something that swished yesterday besides the market and flipped let me know I'm not going to look through every chart, but anyways the market did Anyways getting back to what I was saying you get up out of bed in the morning. You're down You see the swash Come into the market not in your stock, but in the market for example Or are the market if you're in the market long or whatever, but you've rated the gap You're trying not to panic you're trying not to panic because there's nothing you can do It's out of your control. You didn't do anything wrong. It's an anomaly You have to make a decision now and use your head It's damage control. Okay, so what do you do? The swish comes in You wait You wait to see if the gap rating is going to follow through and not end up being a short Which is what the rating tells you You wait to see if the market's going to hold because you know the uptrend is still intact How would you know that but taking the trends class? You wait to see if everything you know all the knowledge is going to play out to be true and instead of panicking As it turns out the swoosh is reversed the market rallies you Wait And as the day goes on you're realizing you're going to be okay And that the money that you were down you're no longer down You could be even back to be up again or flat And if you had panicked or not had the gap rating system or lost Control or didn't hold the conviction and focus on the knowledge you took a huge hit Which you would have taken at 7 a.m. Or 8 a.m. Or 9 a.m. Or if you sold out During the market swush There was no way to avoid What happened it was an anomaly But when it did you Were a highly evolved intelligent being that used your amazing brain and made the correct choice And this is nothing to do with intuition. This is about you better take seriously What's going on here now and you are down a lot and what are you going to do? Well, you can panic But that isn't going to prevent you from losing If you had rated the gap however, I'll tell you right now and the gap had rated 24 points I would have sold out of it as soon as I could or you wait for the open But I'll tell you when you get in something and you're upside down The best thing you can do is what? Wait wait for the first five minutes of the day to play out because that is the most significant thing that I taught you No one knows how to read it like me and even if you're in something in panic mode You can wait for the first five minutes of the day It's not going to kill you unless you get up and rate that gap and that gap turns out to be some amazing incredible fabulous phenomenal Gap because it could fall three dollars from the time you rated it at 7 a.m Until 9 a.m. And you could be worse off, but that was not the case in the market yesterday That was not the case in any gap down yesterday. And that's why we didn't short yesterday Otherwise you can wait five minutes for the market of the stock to open and read it the way that I taught you And determine what to do and you go with the gap rating Okay, but the way that I just described is not what most people do they do not know my system They don't know how to read swooshes the first five minutes of the day don't know how to read gaps And most people in the planet are in fear and panic they panic when they're down and some people panic when they're up We've had this discussion before it's crazy people sometimes panic when they're up and people sometimes panic when they're down and you know Class I'm trying to be tough on you this week because it's your first week training after the trial And you've only done a portion of the class and you're making sick amounts of money every day But we haven't had a great gap all week And I question myself because I say you're just pressing the button with 10 000 shares And I'm concerned about you because I understand people. I understand the human brain I understand confidence and conviction and risk and fear and greed and I get it And I'm telling you right now the most important thing you could do It's focus on the knowledge it's beyond the money even Because if you do in the long run you will make millions of dollars in the market over your life Or even in a year or even if you want to at any point in time you've got to listen to what's going on Do people lose money yesterday trader gal is right they did they lost their shirts And I hope that your brother or sister or uncle or whoever that was doing mutual funds didn't lose his shirt But the reality is that if you did what I just said You didn't lose your shirt if you waited in the first five minutes of the day You would have saw the reverse swishing you would have saw it reverse and you would have rated the gap down in the morning I know you could have held out and waited five more minutes because at the end of the day That isn't going to make a difference if you are clobbered and something happened that was an anomaly It was out of your control And will there be times when you're in trades and things happen out of your control and you lose money The answer is yes the answer is yes, and that is part of trading But in the long run it doesn't happen that often yesterday was an anomaly and I wish I would have been on national television to discuss it in the way that we just did But I did take the discussion this morning and That was a perfect way to describe it But the most significant takeaway from yesterday and this week is that we have to be very picky on everything We short from now until Friday the market and every stock in the planet has to situate itself I'm okay with the fact I didn't do anything today if you shorted dsw made money today great I don't think anyone should have taken any sizable risk in that though And I don't think anyone should have done the second call and I didn't make it And in reference to the overall day of yesterday and how it transpired The most significant takeaway is the fact that the market opened and swooshed and reversed the swoosh I've never seen the market do a bearish swoosh. I've been trading now for seven years Not only that I've never seen a swoosh like that reverse itself And that to me shows not only who's in control Not only that the chart is still bullish in the market, but the Fact that there was almost To me was we watched it trade out and seeing it now flat going back and looking at it flat It is almost as if it was a planned action because of the aggressiveness of it And I'm telling you that that is Really really important Because it means not only are we higher But there's almost no stopping us because if something like that can happen Which is a ten dollar swoosh that came into the market from a gap down from the market dropping three days And everybody panicking on the planet if the powers that be does choose to buy at that point And not only that had a plan of action to do so I'm telling you that there's nothing stopping that money There is nothing stopping that money that money is full force full on full Full on like full on melissa arm out and I'm telling you there's nothing stopping it There's nothing stopping it There's nothing stopping me from continuing to make money trading something stopping me from getting on national television There's nothing stopping me from getting better as a trader and a teacher for you Don't let anything stop you there's nothing stopping the money in the market There's nothing stopping the bullishness in the market and don't be against it And if you want to panic because something happens the side of your control go ahead But i'm telling you sometimes if you wait and you just step back and you take a five minute break If you just take a two minute break if you just take if you just take a break for five seconds You can get a clearer perspective. I'm not saying take go to back to bed and take a nap and come up at noon I'm saying just to pull back for five minutes And I have this thing. I made this thing up. I don't really use it that much in the room But I've been using it with my friends and people it's called the 24 hour rule We can maybe make a five minute rule when we're gonna we're gonna do a five minute rule We're gonna do a five minute rule in the market if something happens and you're caught in something But you can do a 24 hour rule actually too with with trades I don't know if you can afford to stay through it for 24 hours But I have this thing called a 24 hour rule something happens to you and you get really upset and you get mad at Someone you have a big argument tom are you listening and you want to yell at the person and scream at the person You're never been angry with them in their life and you know what you should just wait 24 hours You shouldn't say something you're gonna regret because you know what you could say something you regret because you're really really emotional upset You gotta have the 24 hour rule in play if you get up tomorrow morning You're still Really really mad at that person for something they said or something they did then fine go off on them Let it fly but sometimes we get really emotional and if we don't wait 24 hours We might say something that we really really really really really regret and then there's there's damage done And that damage may not be able to be repaired. So you've got to have the 24 hour rule I think it applies to business and personal stuff And maybe we make the five minute rule for things that happen when people are in things that are anomalies And because you don't know five minutes is like 24 hours in the market Gallaudet said yes, he agrees. Yep I don't think I've been talking about that in the room because we're never together for 24 hours uh, but We really the 24 hour rule I made up this year and we have to do it I mean And I made it up for myself I made it up for myself because there was something that I said to someone and then I then I made it up And I'm like, you know what I gotta I'm applying the 24 hour rule I said something then that later I regret it and I was like, you know what crap 24 hour rule now Starting now because then I regretted it And then I had to apologize to the person because I can get emotional myself And say things that sometimes I don't mean If I'm upset about something and this this whole thing has been like that for me And so the 24 hour rule is really in play for me now with the whole television stuff like 24 hours 24 hours 24 hours But if in 24 hours, I still feel the same way that I know that I'm right and therefore There it goes Seattle traders is totally agreeing jagra plus is totally agreeing great gas He says can't attend but I'm telling you sometimes you need more than 10 Sometimes you need 24 hours. That's what I'm saying great gas He's someone really has you on the rail and so something really happened that totally sets you off track And you know what I'm not married But I know a lot of you are and those of you that have spouses that have been married for even more than 24 months Know exactly what I'm talking about. I'm a baby when it comes to relationships because I've never never been married I'm like cinderella just out there dating But I'm telling you right now those of you that have been married Know what I'm talking about because I can't even imagine I'm so you know, I can't even imagine what it's like to be married to someone for for more than 24 seconds Let alone 24 hours or 24 months or 20 years Those of you that are married you this is marriage.  Oh my lanta I hope you have a big house We can spread out when you have arguments To have a marriage last you have to have some sense of self-control Well, that's why you have the 24 hour rule. That's what I'm saying because when you're angry You can you can you can say you want self-control all day long It doesn't mean you're gonna have it because emotions are high Your trader gal has a huge mansion and it's a pain to clean, but it's great Let me just see who else is writing stuff Uh spy and doubt right on the day Q's holding. Let me just look. Yeah, the Q's are holding here Let's see if this is holding the stop too Yes, so everything's holding the stops I gave in fact you could buy more of the spy here You could buy more of the Q's here I told you to give the put the stops at the right place the Q's do look stronger than the spy right now Which they did yesterday into the close as well Let's just briefly look at what we have tonight And then let everybody go great discussion today. I I'm exhausted though And I really didn't have enough caffeine this morning I don't see anything of any significance tonight. Let me just check tomorrow Oh tomorrow Hold on I'm saying this is this is not tonight tomorrow morning is a and f any xpr There you go All right, just wait for tomorrow morning and you get up and you see it on your scanner All right, so these are the watches for tomorrow And cost you are taking an extreme amount of risk to be to make that money that you made today in that Extremity have a great day everyone good discussion in here today amazing discussion in here today I hope you learned a lot This is Melissa Arma with the stocks whoosh. Have a great day everyone. I will see you all tomorrow morning bright and early I would love a good one But we really really going to be picky poos the rest of the week because of what happened in the market It's fine. We'll just do our thing and we'll continue to do our thing All right. Have a great day everyone. You're welcome


Welcome back everyone. Today is an introduction to Volatility 3 and Volatility is a RAM analysis tool that we use from the command line. It has a lot of different options for parsing information out of a memory image. On a computer, there's a lot of things running in memory that will never be written to disk. If we want to be able to extract things that were not saved to disk, they might still be in memory. We use it a lot for malware analysis and personally, I use it a lot to reconstruct user activities. So to install Volatility 3 on Windows, we need a couple of things. First off, we need Python 3. Go to python.org, go to downloads and make sure you're downloading Python 3 and installing Python is very easy. I'll have the links for all of these below. Next, you'll need Git for Windows. If you've been watching my channel for a while, I download a lot of these forensic tools using Git and knowing how to use Git is very handy for digital investigators.  The next thing we're going to need is the visualstudio.microsoft.com, visual studio CPP build tools. This is to build Python modules, that way we can run volatility. Click download build tools and then follow the installer and the C++ build tools should install. Next is the volatility foundation, so volatilityfoundation.org. You can go to downloads and then if you click on Volatility 3 tab, you'll notice that they have volatility 3, but it's version 1, the Python 3 rewrite. So instead, we want to go to the GitHub release page. This is at github.com, volatilityfoundation, volatility 3. And then we can see the code and you notice that under the releases tab, we have volatility 3 2.0. So this is actually an updated version and they haven't updated the link on their website. So this is why I prefer getting everything directly from GitHub. And then even volatility 3 2.0 was released in January, but they've had updates since then. So I want to work with these development branch directly, that way I can get all of the features that are currently available. So assuming that you've already gotten Python, you have Git, you have Microsoft C++ installed, we're now at the volatility 3 GitHub, I'm going to click the code button and copy the HTTPS URL, then I'm going to open PowerShell, for now I'm going to go to my desktop and I'm going to clone the volatility code into my desktop. So I will do git clone, right click, and then it'll copy that whole URL, hit enter, and then we'll download the current version of volatility. Now if I want to update volatility in the future, all I have to do is type git pull, and then rebuild any of the code that's pulled in. So this is an easy way to keep your software up to date. Before I actually build this, I need to install one thing and that is the Python snappy extension. And in Windows, I had a lot of trouble installing snappy. This is really the only place where I could find the wheel file that would actually work for it. For me, I'm using AMD 64. So I want to click on Python snappy when AMD 64. If you're using a different system, make sure you choose the one for your individual system. I'm going to save that file. And it's saved into my downloads folder. So next, let's check that we have Python installed. So let's type Python and then dash capital V. And you should get Python and then its version number that you have installed. Make sure that the first number is at least a three. Now, if we have Python installed, I'm going to type pip install and then I'm going to give the full path to where I downloaded the snappy dot whl or the wheel file. Python will install this wheel file directly. I already had it installed. So everything's okay. You shouldn't really get any errors if everything went well. So next I have on my desktop the volatility three folder. So I'm going to CD volatility three type LS or dir. And then you should see a list of all of the files inside the volatility three folder, I have ball dot pi. So I know this is the right folder. What we need to do now is install all the requirements to run volatility, you can do requirements minimal, and it will stall fewer things you need to download fewer things. But if you want all of the features of volatility, you should do requirements.txt, which I recommend. So what we need to type inside the volatility three folder, we type pip install dash R requirements dot txt pip install dash R requirements dot txt, press enter. And then what should happen is everything will go through and check if everything is installed. If you don't have a package that's already been installed, it will try to download the package and compile it. So this is where installing the Microsoft C++ build tools is really important. If this is not installed properly, you might have errors at this stage. So if you do have errors, go back and check that Microsoft build tools are installed properly. So we see if everything was installed correctly by running Python ball dot pi inside the volatility three folders of Python ball dot fi, and then dash lowercase v. So for Python to check the version, it was an uppercase v for volatility. It's a lowercase v. Now whenever we run this, we see a couple of things. We have the volatility three framework, and then the version of this is two dot zero dot two. So this is volatility three, version two zero two. So it is newer than the most recent release that we saw. And then I have a couple of things here. For example, the symbols path is interesting. This is where any symbols will be downloaded for analysis, and we can download additional symbols if we need to, as well as where the plugins can be installed. So volatility does have a lot of plugins that are separate that you can install into these main packages. This is the location folder where you would want to install those plugins. If that ran, then volatility is at least working. It's just installed in the volatility three folder, which is fine if that's where we want to run it from. So the next thing we need to do is actually get a memory image. So I'm going to open up and I have a folder on my Z drive called memory image. And the image that I'm going to be analyzing today is the ACTF dot mem. So I need to get the location of my memory image, Z drive memory image ACTF dot mem. And then the first thing we normally want to do is run Python ball dot pi dash f. This is the file that we're going to be analyzing. I'm going to paste in memory image and then the ACTF dot mem. So Python ball dot pi dash f and then wherever your memory image is located. And then we want to get the information about this memory image. So I'm going to run windows dot info volatility three is a little bit different in that the plugin that we're using is specified at the end here, like I'm analyzing windows and I want to get the info for windows. I'll show you how to use this as a filter shortly. So let's go ahead and run that. So now it's scanning through the memory image and this will take a little bit. We get some basic information here about the system itself. Now all this is read from memory. So for example, we have number of processors could be interesting. The system time at the time of imaging could be interesting system route was set to C drive windows that could be interesting for the rest of our investigation major operating system version things like that. So this is usually the first thing we want to do. And if I wanted to run the same command and save the output, then I would use a greater than sign and that's piping to a file called ACTF dot mem dot info dot text, something like that. And then I would run it again. And then all of this output would be saved into this text file. So that way I can use it for later reference. So let's say you're starting out with volatility and you have your memory image and you were able to get windows info, but you're thinking, okay, what else can I do with this? Maybe you don't remember the command that you want to use. What you can do is specify your memory image and then specify the plugin that you want to use just as windows instead of saying the entire name, just say windows and hit enter. And then what will this will tell you it'll give you an error. And then it will show you all of the different commands that are available right now. So everything that's installed that I can currently run on my memory image is here for windows, you can do the same for macOS or Linux, but we're focusing on windows today. So these are all the different modules that I can run. And then for each of these modules, you can also access a help menu, which I'll show you shortly. And there's some things, for example, like windows dot mft scan dot mft scan. If you have something that looks like this, where you have two of the same word, volatility automatically tries to search for the most appropriate model. So for example, if there's only one sub module called mft scan, then all you have to do is type windows dot mft scan, but for example, windows registry has multiple modules underneath it. So in that case, you would have to actually type out windows registry hive scan. That way it doesn't get confused with windows registry user assist. So my point here is, you don't necessarily need to type out the entire thing, you can type out the unique module name, and then volatility will type the rest for you essentially. It seems a bit silly now, but it will save you time later. So one of the first things we usually do or at least one of the first things I usually do whenever I'm analyzing memory, I want to see a process list. So that is the windows dot ps list module. And then I'm going to pipe that into more. So I am in PowerShell in windows and more is usually a Linux command line tool, but PowerShell also supports the more anything yellow is a command the PowerShell understands going to print out all the processes that were in windows at the time of imaging, and I'm going to use more so that way it doesn't go by really quickly. So let's go ahead and hit enter. So now we have process, the process list coming out and you can see that I have more here with more if I hit the space bar, then it will go to the next page. If I don't use more than you're just going to have all this text flying by and you won't be able to see any of it. So from this process list, I can see, for example, first we have the process ID, that would be this number four here, we have the parent process ID, in this case, we have a zero, we have the image file name, which is the name of basically the executable, the offset where it was found in the memory image, the number of threads that are currently running the number of handles, which could be, for example, file handles, creation time, exit time and then file output. What I'm usually interested in is image file name, that way I can filter and focus on programs that I'm interested in their process ID and the parent process ID, as well as sometimes how many threads it has, but many times what handles are available. So I tend to focus on things like what files is this process accessing at the time and that's where handles would come in the most interesting. If we take this system process, we have a process ID of four, and then the parent process ID is zero. Well, why is that system is effectively one of the first processes that are started, right? And then everything else is started by system. So you can see that we have zero, meaning that it's one of the first processes, its process ID is four. And then here we have the registry was opened by process four, and the registry's process ID is one zero eight. smss.exe was also opened by process four, and its process ID is 396. So using this, we can basically reconstruct how applications were opened, who were the parents, like, where are they coming from? Okay, so this gets really interesting whenever we're trying to find out how different programs were executed. So we need to know the process ID of the process we're interested in. And then very often it's interesting to know the parent process ID as well. So again, I tend to focus on process ID, sometimes parent process ID, definitely file name, because I want to filter using that. Sometimes the threads and then many times for me, many times handles, if you're doing something like malware analysis, this might be very different. I'm usually use looking at user activities, you can see that as we go down, there's a lot of processes that we're running at the time. If we know what process we're interested in, we need to be able to filter this out. So I could just dump this entire process list and then search through it. But if I'm already interested in a specific process, then I can hit Q to get out of the more. And then instead of more, I can use PowerShell's built in string searcher, select string. Now select string is not part of volatility, it's just kind of helping me to filter. So let's say that I'm interested in anything in this memory image related to the Chrome browser. So I'm going to type Chrome. So here we still have Python volatility.py, our image file, actf.mem, that's my actual data, I'm listing all of the process list, but it's so big, I want to filter it. So I'm going to use a pipe, which is an up and down bar. For me, that's above the interkey. And then I use the PowerShell command select dash string, and it has to be capitalized. And then I'm searching for Chrome. Now what I would do in Linux is basically the same command, except select string would be grep, and I would be grepping for Chrome. Whenever we do that, I hit enter. And then you can see that we still had quite a few few processes, but all of these are related to Chrome.exe. So now we can focus in our investigation on Chrome.exe. And it looks like one of the first processes is 1328. So the parent ID of all of these processes is 1328. If I want to focus on the parent Chrome process, then 1328 is the process that I'm going to be focusing on. So using volatility with filtering tools like select string can help you focus in really quick on certain keywords that you might be interested in. What we're really interested in is the process ID, that way I can use the ID as a filter whenever I do other things. So let's go ahead and see what files Chrome is currently accessing. So instead of using windows.ps list, I'm going to use windows.handles. And then maybe I don't know how to use handles. So I'm going to type dash H to give me a help menu for windows handles. And our option here for windows.handles, we can give it a process ID. I need to do dash dash PID if I want to specify a process ID, otherwise, it will give me all of the file handles in the memory image. And again, it's going to be a lot of data. So if I just want to focus it on Chrome, now we have Chrome's process ID of 1328. So I can specify the process ID and we will just get those handles. So let's go ahead and do that dash dash PID 1328. And then I'm going to pipe this into more again, because I expect a lot of data with the PID, we have the process, the offset in memory, handle value and the type, which we'll use in a second. So let's say that we have these event types, IO completion type. Let's go ahead and scroll down a little bit. We can see that this has a full path to a file. And the type is specified as file. We also have a key type, which is related to the windows registry. So that could be interesting for me as well. But for now, I'm interested in the file type. So I'm going to use the select string keyword again. Instead of more, I'm going to type select string. And I'm looking for file. So I'm going to pipe that into more notice that the the volatility command is exactly the same. I'm printing out all the handles for PID 1328. I'm just filtering based on whether it is a file or not. So here we have our file and we can see the file that was accessed. We also have a registry key in here because the image file name matched our search query. We have a dat file, basically all the files that it was accessing, but not all of these are going to be interesting. Maybe the ones that include, for example, John Doe, our user might be interesting for us, or maybe we're only interested in databases. So let's go ahead and change our query again. Let's add another filter. I'm going to select string. And I'm going to search for history. Because I know that Chrome has a history file. So notice I'm taking the output of volatility. I haven't changed that command at all. I'm piping that into a keyword search filter for file, filtering out everything that's not a file. And then I'm piping that into another keyword for history. So I'm looking for any file that has the word history in it. And then I pipe that into more and we see what we get here. Okay, so we have a couple different files here. So we have what looks like three files were returned. One is the history journal, one is media history, and then one is the history file. So actually, this history file looks very interesting. If I want to understand John's Chrome browser history, I know that I'm interested in this file. And I want to analyze his browser history, you take the address specified for this file. And then I have my basic volatility command, this really isn't going to change ever. And I'm going to specify an output directory, I want to output the file. But before I can output the file, I need to create an output directory. So I'm going to make dir mk dir folder called dump. Okay, so now I've created a folder called dump. And that's where I'm going to save everything that I'm carving out of this memory image. You can go back to our volatility command. And I need to do dash o to specify the output directory. I'm going to say save it into the dump folder. And then I'm going to use the command windows dot dump file. And then I'm going to specify the PID of 1328, which is our Chrome process. And in that Chrome process, I have the virtual address that we just copied. Okay, so what I have here is Python volatility dot pi, our memory image that we're analyzing, I'm specifying an output directory of dump, I'm using the plug in windows dump file to extract a file from that memory image. And I wanted to search by process ID for the Chrome process. And then with the virtual address that we got from the file handle. So then this should output a history file for us into the dump folder. So let's go ahead and press enter a file was created the history dot dat. And we see the history dot that file was created here. Okay, so now we have that history file dot that I have hxt installed. So I could just do open with hxt hex editor. I recommend you get that if you're going to be analyzing any type of binary data. Let's go ahead and open it. And at the beginning of this, we see SQL light format three, which means this is an SQL light file or probably an SQL light file. If we scroll through here, we see some URLs, we see some information. So actually, this does look like a Chrome history file. I would get some sort of SQL light viewer now to view this if I instead of using the hex editor, now that I know that it is an SQL light formatted file, that's how we can find for example, an individual file inside a process, and then dump that directly from memory is using the windows dump file with our PID, give it the virtual address of the file we're interested in, and the output directory. What you can also do is dump all of the files in this memory image for a particular process ID, just don't specify the address of the file. So here we have windows dump file, I still have the output dump directory and I specify the PID, let's go ahead and press enter. This is going to give us a lot of files that we're not necessarily interested in. Okay, it's just going to dump every file related to that process ID. So I usually just dump one file at a time, as I realized that I needed, maybe I'm going to dump every file related to a process, and then do a virus scan of the files, for example. So that could be, you know, a way to automate analysis of a specific process, whether you want to dump everything or focus on a specific file, I tend to focus on files. But if you're doing a bulk scanning, then maybe it's interesting for you. Another thing that tends to be interesting is the windows cmd line command. And I want to pipe this into more because it's usually quite a bit of data. This shows command line usage, but more than that, it shows switches that were used whenever programs were started. So we have a couple of different programs here. And, and for example, we can see the switches that were used to launch these programs. So just looking at the windows registry, for example, we might see the svchost.exe was run. We might see the entire executable, but we wouldn't necessarily see the options that it was ran with. So if somebody was running something from the command line, in other places, you might just see that the command was ran, but you wouldn't see all of the options that was ran with it. This is a really quick way to see what's been run, where things were run from. And if they had any special options while they were running, for example, at the very bottom here, we have fdk imager that was ran to create this disk image, and it was run from the eDrive. Okay, so everything else pretty much was run from the C drive, as we would expect for like system options. But in this case, we had fdk imager ran from eDrive, and it looks like imager light was ran. So maybe that's an, you know, an external USB stick, like where is that drive coming from.  So checking command line might be interesting for that. Next, something that I pretty much always run along with a process list would be netstat. And it's going to give me a lot of stuff. So I'm going to pipe it into more. So what we get here is the offset in the memory image, the protocol that was used, the local address of the computer that this memory image was taken from. And then the local port, the foreign address or the external address that we were connecting to, and then the foreign port that was connected. So let's say that we're interested in Chrome.exe, this is our local address that Chrome was running on, and then it was connecting to the address 185704135. Well, now we can just go and do a quick search. It comes back to proton AG, so proton mail.ch. So at least from this, we very quickly find out that the user either was connected to proton mail at the time of imaging or had just closed it. So now proton mail is interesting for the case because we have a connection back to proton mail, we can go through and check all of these IP addresses and see where they're calling back to. And it might give us some really interesting information about malware that was installed, if it's calling back home, how it was calling back home, or just user activities, like for example, this address is proton mail, most of these are probably calling back to proton mail related to Chrome. So finding out network connections, we're also interested in the name of the process and the process ID. This is how we can go back and see the process list, what things are running, what is it connecting to, what files is it opening, and then also what kind of network connections is it making. So again, if I'm only interested in Chrome, then I can do the same search again, select string Chrome, and then that will filter out everything that's not related to Chrome. So that way I can focus my investigation on only addresses that Chrome was accessing, for example, use filtering often. Another thing that's useful, especially if you're trying to investigate a certain suspect and you want to know their password, and then maybe how that password is used on other systems, we want to do hash dump. What this will do is output the password hash values for this window system. So let's take a look at that. So once we have those hash values, then we can try to crack the hash values, get the password for the user. So for example, John Doe, now we have the password hash. If we can crack that password hash, then maybe that password is used on other systems or maybe it'll give us some insight into how the user is actually coming up with their passwords. So getting those passwords gives us potentially access to another local system. If the password was being used, maybe the password is used in online accounts. So doing a hash dump, getting the password hash and then trying to crack that password hash can really help us in the investigation to uncover more data. And then another thing that I tend to use a lot whenever I'm dealing with windows is windows registry analysis. One of those is the user assist. So we can do registry, registry user assist. And I'm going to use the dash H just to see if we have any options. We have the hive offset option, if I want to focus on that, or we don't have to put it and everything in user assist will be shown. So I'm just going to run this again with more and user assist tells us a lot of interesting things about user activities in the system. So for example, we have the hive offset, the hive name where we're getting all this from last right time. So this is essentially, you can almost think of it like the last time that an action took place related to that key. So if it's related to a program, then that might be the last time that the user ran that program. We also have the count, which is the number of times the program was run, the focus count. So the number of times that's the user focused on that particular window for the program. And then the time focused is the total amount of time that the user was looking at that over time, not in an individual session, you got to be a little bit careful with count focus count and time focus, don't take it as 100% accurate, but it can still establish that, for example, the user did open up this program and did focus on it for a particular period of time. Okay, let's go ahead and see what that looks like. So for example, here I have Ms paint.exe was executed and it seems like it was executed seven times, it was the focus seven times, and then I had a total focus time of like one minute. So basically it was open several times, but not really accessed. Here's another one, Microsoft Edge, the browser, it was opened three times. And then it was the focus 16 times, which means the user kind of went away from the browser and then came back to it so focused on it. And the total focus time was about an hour, 50 minutes, 56 seconds or so. So this establishes that they at least were using Microsoft Edge, they'd focused on and away from it several times, and they'd use it for a considerable amount of time. Are these 100% accurate? Maybe not. But this is already a really good place to start. User assist is really interesting for investigations, especially to establish user behaviors and whether programs were used, how long they were used, things like that. And again, you can use the same filtering technique that we've been using to focus in on, for example, Microsoft Edge, Chrome, whatever it is that you're looking for. But sometimes you might want to find and list all of the registry hives that are available in the system. And then we might want to carve them out, for example. So using that, we can use hive list. So windows.registry.hive list. Let's see if there's any options for that. We have a filter. So string to filter hive names returned, and then dump extract listed registry hives. If we just run it without any options, then we get all of the registry files that we could find. Let's say that we're interested though in John Doe. So let's try to filter by John. Okay, and then we only get back anything that looks like a registry file related to John Doe in the string. So basically, we're using volatility to do the keyword searching for us. And let's say that I'm actually interested in NT user.dat. So let's do a filter for Doe slash NT user.dat. Doe slash NT user.dat. So now we're focused on the file that we want. So let's go ahead and dump. And just like before, we need to specify an output directory. I'm going to put that into the dump folder windows registry.hive list filter Doe slash NT user.dat and then dash dash dump. And then if we go check our dump folder, we have our hive file. So I'm going to open that. And then we have our registry file header here. So I've just dumped johns NT user.dat file. So now I can use another program to actually analyze the NT user.dat registry file if I need to let's say we don't want to dump the entire registry file, I would normally prefer to dump it and then analyze it with a different program. But maybe you have a just one specific key you want to check, we can use windows registry print key. And then let's check the options for that. With print key, we can have the offset to the hive, the key that we're looking for and then recurse. So recurse through all of the keys if we're at like a top level. So what I want to do is print key. And then I'm going to give it a key value and a key that we very, very commonly use is software, Microsoft, Windows, current version. Okay, and then I'm going to pipe that into more because it's going to be a lot. Now we're listing all of the keys inside current version. We're not necessarily getting the values because we haven't gone low enough. If we actually wanted to go lower, then we could do something like dash dash recurse. And then that will actually go into each of the key directories and then look for the value pairs. So recurse, and then I'm going to pipe this into more as well, we can see the key and then inside that key, we can see the values that are associated with this. So this red binary, and then we actually have the data here. If you know exactly the key that you're looking for, and you only have one or two to search for, or if you write a script and want to print out specific keys, then you can use the print key option inside volatility. By far I use user assist the most with a search filter, or I use hive list dump the hive that I'm interested in and then process it with a different tool. But that's my workflow. If you know exactly what key you're going for, and you don't have too many keys to search for, then it totally makes sense to use print key. So with that, we've shown how to install volatility and keep it updated inside a Git repository. We've shown how to process a RAM image with volatility. We've gone through how to do things like get the memory image, we've listed processes, we've listed file handles, we were able to extract files from memory using dump files, we were able to see command line options, we were able to see the network, we could dump windows password hashes that we can later crack if we need to, we were able to query the user assist in the windows registry and then try to find programs that were accessed and how much they were accessed, we were able to both list all of the hives that are available in the memory image, as well as focus on a specific hive and dump it using the hive list function. And then we were also able to focus in on a specific registry key using the print key tool. If you can basically list processes, you understand how to dump a file, you can access the windows registry and do some searching through it or at least dump a registry hive, then you can already do a lot of things with memory. Okay, now there's a lot more we can do with this, there's really advanced stuff that volatility can do, there's a lot of extra plugins that volatility has, but if you can at least list processes, list networks, dump files, look through the windows registry, you already have a great start to using volatility, you just need to get used to the way that the commands work, and everything else will be easy from there. So that's it for this introduction to volatility three, I hope that was useful, thank you very much.


Mary so my background started out as I just graduated about a year ago with the bachelor's in graphic design and a bachelor's in mathematics initially was gonna go into math education so teach math to high schoolers but I kind of really fell in love with design earlier on in high school and early in college so I decided to give this path a try started out at Red Hat as an intern this summer after my sophomore year of college and then kind of came back as an intern every summer after that so three years an intern one year a full-timer so now I'm on the UXD team as a full-time visual designer. I'll just use the one I know works okay. Hi I'm Stacy McAuliffe and I'm a content strategist on our UX team I started off I got my masters in professional writing I have a bachelor's in fiction writing and never thought that there would be a place in tech for me as a writer but it turns out that there is so I started as a tech writer at IBM and IBM went through this pretty massive design transformation UX ended up being the forefront of everything that we did and I found it super fascinating started working with the UX team more frequently on micro copy copy in the UIs and just discovered how important good content can be for UX to improve just user experience in general and how helpful it was for me as a tech writer to understand user problems and the business problems that we were trying to solve so that I could write better documentation and started as the UX writer and content strategist at Red Hat about a year and a half ago. Hi so I'm I'm Sarah Chisari UX researcher I have been working with the team for about three years now I started as a computer science students like I was a bachelor in computer science and then I shifted my focus to human computer interaction in my master degree then I started working as a instructional designer where I was supposed to design like course materials for students that I had no idea who they are and if this material is gonna work for them so that was the kind of inspiration for me to switch to user experience research where I wanted to learn about the users and how things we design is gonna work for them and how they perceive it so that's why I started doing my PhD in human content traction and information science and I took my PhD and I become a researcher the PhD took me about five years and it's been about three years that I've been working as a UX researcher with the team. That's about me. So yeah I just wanted to give you brief information about our team Red Hat UX team right now is about a hundred and six people and I joined in 2014 and at that point we had 18 people so it's been a huge change over the last five years and it's interesting that our group is actually 50 50 men and one versus women so it's pretty pretty cool place to be. We have some pre like listed questions that we're gonna ask first and then we'll open it up to audience if people have any other questions so I'm gonna start with what does it take to be perceived as open source UX and I'm gonna ask Cat that question. I'm attributed to an open source project so I'm not sure how much of you guys know about Red Hat but we have an open source design system which is pattern fly which all of our group is actually included in so that's one aspect of open source but I'm wondering if Gina could start by answering that. And Sarah Chisari, you want to talk about research? So a little bit about research so what I only do at Red Hat or any other jobs that I got as a research is just to get feedback or collect feedback from users. So in the context of open source things are a bit different than other contexts so there are two maybe three major project that I worked on so far open source ones and one is a pattern fly one that Gina and Colleen mentioned. For pattern fly what I do is basically try to see what community says so and the difference between open source and other companies that as a researcher you got a that the research request really comes from the product manager or the designer they first come to you and say okay I have these questions and I want to know the answers so in open source we have that like that's one part of it but the other major part is that a lot of these feedback or some of these requests are coming from the communities so the community of designers or developers specifically for pattern fly they they adopt pattern fly in their own way they use it in their own way and they as users they come to us and say okay we use it and these are the issues that we found so can you guys like you know dig more into it and see what we can do about it so I think the difference for me like as a researcher in open source was this type of interaction so getting direct feedback from the community and those firsthand experience from the customers or the users were the most valuable ones to me at least because I know they are real and they are not the thing that we guesstimate there's a real problems that that people in the community encountered and that's what we have to focus on because that came from real people I think that's a little bit about research with pattern fly thank you next questions how can you get involved in open source projects based on your background so how you can get involved so again when it comes to research all I care about is feedback from users so if you guys like if any of you guys are interested in research one thing you can do is just to become the researcher while being a user so basically what I do as a researcher is that I talk to users and see what are their problems but basically the feedback comes from the user so if you are one of those users the best thing you could do is just share your feedback like share whatever experience you have with the product with whatever you're doing with the rest of the community and see what they think of so that's the best way of actually doing the research like you know being community see if you are the only person who has a problem or if there's any other person having the same problem and try to do your own research to see what was wrong and and then just try to to make it visible to the team who actually brought that thing so again a specific pattern fly we have github so people can just go in and just adding issues that they encountered that's when we get involved with research so just just showing the feedback that you have with experience that's that's wonderful I would say there are so many other communication methods that we have we have this mainly this we have pattern fly a phone we have pattern fly slack this is like open to public so I would say the main part of research is gathering feedback and you guys like whoever is the user sharing the feedback with the community is the most valuable part of it and so instead of me going to the user asking them to share the feedback with me if they do it themselves it's just like it's just easier job for me basically and it's just much more valuable because it's coming directly from them so I would say get involved show your experience don't be shy honestly if you encounter something the main thing I tried to do whenever I do research is that I tell the participant that you are not the focus of this study or research the the focus is to understand the usability of the product so if something is not working for you is not it doesn't mean that you will have some problem or it's you that have the lack of knowledge it's most probably the product that we developed has some problem so feel free to share anything that comes to your mind and again that's the best type of feedback that you could that we could actually gather so don't be shy and just speak out and just share whatever experience that you have so again as a writer I would never have thought of open source is a place that like needed my skill set but it is definitely an awesome place if you're a writer to contribute open source is all about community getting people involved getting people invested and I think the messaging around your project can help draw people in I think if you're a writer you can help in so many ways you can help clarify messaging for projects you can help improve documentation and help improve usage for the projects I just think as a writer anywhere that you see areas that are confusing I didn't understand what to do next if you have a skill set in technical writing helping with processes and procedures on the website can be super helpful and just like Sarah said like don't get nervous I think the teams are super receptive to any help with writing because especially I know developers are not really amped a lot of the time to write it's not their favorite thing obviously not in all cases but yeah I think if you have writing chops and you're noticing things that can be improved you can absolutely help in that area yeah so I'm actually gonna take a step back and think about this from the non pattern pattern fly perspective so my first two years in turning here I was on a super technical engineering team so I was on the Fedora engineering team so finding a place that was kind of like my sweet space as like more visual graphical person was not exactly an easy feat so I did could do a little bit of digging in order to find kind of where I could make use in that open source population so I think you know beyond pattern flying beyond actual just straight-up design resources really any upstream community especially an open source you know we all kind of know that open source isn't exactly known for having the most beautiful user interfaces a lot of times they would really benefit from having someone take a look at some of those components for them so you know whether it's upstreams that are you know specific to an app so everything that redhead does it starts out as you know an open source project first so all of us work within those groups but even you know Fedora was an open source operating system but in order to be that it needed to gain speed and they had marketing events so they had an entire design team that was pretty much all international and gave a really good opportunity to kind of communicate with people who I wouldn't normally get design feedback from and that's a really unusual place to find design opportunities I think when you actually look deep into the tech and realize that sometimes they have a need that they don't always advertise as well so there is you know this marketing need this need for helping them build out their brand so from a graphics perspective that was a cool space for me to find and like everyone said a lot of these upstream communities because they're always looking for more contributors they have a lot of ways to get in touch with them I think sometimes finding out how to get in touch with you know the groups that you want to do design work for content rating for can be a really hard first step but you know if you just go right to the root even if it's just Fedora project org you know you can see they have all these ways to get in contact and chances are if you just contact someone whoever's on the receiving side of that mailing list or you know just on the receiving side of something even a tweet there's probably someone out there who could send you through this big chain of go talk to this person who knows this person who might somehow know a design person you'll get there and you'll learn and meet some really cool people along the way thanks the next question is there how does communication and open source different okay all right I guess okay all right I'm gonna go now so communication and open source I think in a lot of ways the actual things that you're communicating are the same as they would be at you know any proprietary company you know you're still collaborating with others just you're still you know figuring out where everyone's at so you can come to the best solution but I think how that collaboration communication works and how open the pipelines are a little bit different in open source so we always joke about memo list and how rare it is an open source company for people to kind of not have to gauge what they say as much and you know you can kind of say things and you know voice opinions that you otherwise might be a little bit more censored to say before so I think you get much more like raw information and raw thoughts from people which at first can be jarring but you end up was you end up getting a stronger result because you have true like you know valid opinions from people not ones where people you know were tiptoeing around what they actually thought and I think also with open source not being you know this confined here's the only people that I talked to an open source we have the ability to communicate with everyone so you get the perspectives of people that you normally wouldn't get and both within the UX team and the previous team I was on you know a lot of the populations of people were not had a culture really really differently than mine so I think even that cultural piece is really interesting to think about with the communication even how people communicate based on their culture is different the amount of like directness versus indirect communication was interesting to see and I think just a good skill to learn which I think you know is a result of the open source culture overall like I don't think I would have been able to effectively communicate with people who communicated differently than me if it wasn't for open source kind of forcing me to look a little bit deeper and ask really concise questions and ask people questions that may have seemed kind of stupid to them but it I think proved helpful and actually getting to the root of things so I think that having it no limit to who and where and how you're communicating with people is a big differentiating factor between open source and not open source workplaces so I'm gonna take a little bit of a different approach to answering the question and one of the things that I do for pattern fly is help with communicating with the community so blogging and I found compared to some of the proprietary companies that I've worked for communications for an open source project it's so much more important to communicate rationale communicate decision-making communicate everything that you're doing in a way that supports open collaboration and feedback from the community and then also really being sensitive to the fact that you have this community of folks who are super invested in what you've been doing and there are going to be times where not everybody agrees with decisions that have been made so I think blogging has been very interesting and then also the messaging on our website just again being super sensitive to the fact that it's a community we want people involved we want feedback we want everybody to have their hands in it and have accountability and be invested in it and I think it just does impact all the messaging and other ways that we talk about everything that we we put into the into the universe into the community can you articulate the differences between working in open source and open source seems like your previous job open it up to any questions from the audience if anybody's has any questions I can start I think so one of the things I was going to say is trying to evaluate the feedback and I'm assuming that Sarah will be able to speak to this better than me but like literally like finding the trends between what you have and then trying to prioritize from that do you want to expand on that so what we usually do is just to do research based on the feedback we got so it's not like we take all the feedback and we act on every single of them so usually we taking the feedback and we try to go back to the rest of the community and the rest of the users and see what's the prevalence there so it's not just like and it's not it's not gonna be feasible honestly you can actually act on every single feedback that you get from the community the best I would recommend is just to do your own research on the feedback you got doesn't mean that that feedback is not usable is not good it just for the sake of prioritization and just making sure that you are on track and the strategy you're taking makes sense to everyone on the team on the product team and also the community is best to do your own research based on like using the feedback you got so anything that we do any feedback that comes from the community we will see if they shared with me and I try to go and just write a test plan based on the feedback we got to see like basically to address the exact question of the problem that the user wrote up and then we're going to look at yeah where was the what's the prevalence really out there like yeah this group of people thought it's this is a problem but is that a problem for the rest of the community or the rest of the users so and there are lots of ways you can do it it's not just like so the feedback you get might be just a small piece of yeah text or quality of feedback but you can take that feedback and put it in different contexts in different using different methods you can either continue talking to other users in the community you can put that question or like you can put that question into a survey and send it to a much larger population there's so many different things that you don't know the fun methods that you can try just to understand what's the prevalence mainly and how important that issue is just a bit of commercial if you guys are interested to know what type of these research people know about the methods that you can try definitely can check out our booth in the exhibition hall there are at least like seven or eight research activities going on there so it's a really great way to just get some exposure to what type of research I'm talking about a lot of engagement a lot of conversation between the researcher and the user and again a great experience just to see how we do research in open source but yeah I would say my only recommendation would be just do another round of research based on the feedback you got and just see what's the frequency or what's how important that issue is yeah I think it's also interesting because open source has so many people that are so passionate that if you even just hold one usability study with one customer it's like you could almost be convinced by what they're saying to you because they're so passionate but like making sure that all gets put into perspective is really important thank you any other questions specifically to information architecture but I know so what we've tried to do in pattern fly with pattern fly four is recraft our design documentation so that we're not only putting components out there but we're creating documentation that helps you understand what patterns you should use where and why you might use them so why would I use like a list versus a table why would I use this chart versus that chart so kind of helping designers and developers have more of an understanding of the rationale behind why you would choose a specific design pattern over another and just a shameless plug for content or also we put content guidelines and for pattern fly so how to write better for user experience how to write better for components and I do help that I think that that helps with discoverability encouraging people to think about content design with words I think that helps just naturally with information architecture when you're considering language first like how does my user understand this problem yeah can you hear me yep all right this is a perfect Todd question thank you Todd so if we if we knew how to give everybody perfect information architectures as a UX industry there'd be a whole lot of way more usable applications out there so I think as an industry that is that's part of the value that UX practice brings and I don't think there is a one-size-fits-all solution it really depends on the application you're building who the users are what they're trying to accomplish and that's how you have to organize your information and that's the special sauce so I don't think we can build that into a pattern library in any way shape or form yeah I was just gonna say similarly I think we've tried to tackle it a little bit from the UX perspective but at the at the product level almost to try to do not as much a one-size-fits-all but provide some type of conventions that almost sit on top of the design library so you you know you have a pattern fly where it's at the component level and you're using these standards so look and feel you know it sits the same across products but you also have something that sits on top of that design system where you have conventions that are really specific to a product and we're trying to really do a better job of documenting those conventions at the product level to say here's the cases where we use a modal versus a in-page form or here's when we use a wizard versus a progressive form type of thing here's what our toolbars look like in this product for these views so kind of getting more specific not to say that these those other views aren't great maybe for another product but I think providing some type of documentation especially in the open source community kind of your your conventions to explain to help somebody who's trying to contribute stay within that framework I think you do have to yet document some of that and provide those guidelines but yeah it's it's hard with just a component I agree yeah and I was just going to say it's also I think the industry is changing so quickly like a lot of times we're just trying to get products out to market and make it usable so you know at some level we have to make a best guess the beginning to get something out to market quickly there's other areas of the product where we might be able to spend more time and we have more ability to create a better than to have an experience but it's not always like that right okay so I'm a researcher so obviously my answer to any question is just to do research so but honestly in this context this is really good question because so yeah there are a lot of frameworks out there a lot of say like he restricts or a lot of say you know those practices and design guidelines out there and other things that we introduce in pattern flare based on those but my recommendation would be yes those are the things that we thought will work for many people or for many users but they're not tested in multiple different contexts so honestly what you need to do is just yeah as soon as you adopted this framework you will need to do your own research to see so you're in your own context does that does that make sense so yeah my recommendation would be just again just do research because not that we can't actually test this component in every possible context that would exist out there this is not possible and an in-context experience could be really different than out of context explaining for sure so all of this recommendation are mostly out of context recommendations so definitely do research in context to see if these things that we recommend that worked in your context and get back to us I mean if it doesn't work let us know and that would be really nice feedback for us see that is zero i think that's a zero okay well thanks everybody for attending if you guys want to talk to us most of us are going to be in the usd booth throughout saturday so thanks very much


The military exists. We're the warfighting armor of our nation. When diplomacy fails, they call us. And if we get called, we have to be ready. So you have to be ready at all times. And that takes leadership and engagement at all levels, whether you're an NCO or general officer. And to performance is what's expected of us. And so my expectations and my motivation is to try to set a good example and lead. I'd say for those folks out there that have ever considered military service or not sure if it's for you, it's just a wonderful chance to serve your country and make a difference. And I'm hoping that I've made a difference up to this point. And just try to do my best. And if you fall short, get back up, dust yourself off and keep trying and you'll do great things.