Hey everyone, hopefully everybody's having fun at all the parties and the DEF CON general. So I'm going to give a talk today about doing memory forensics on cold drives. Has anyone here ever done that before? Okay, I see a couple of you, so don't give it away. Awesome, so let's get started. So a little bit about myself. My name is Lior, I do blue team research for DeMisto. Playbooks, you know, orchestration, all of that stuff. Before that I used to do some reverse engineering, vulnerability research, malware research, and I recently moved from Tel Aviv to the SF Bay area. So, you know, still very cool guys, lots of technical like-minded people, cool environment, different DC group number. Yeah, so I'm going to speak a little bit about memory forensics in general and hopefully convince you guys that although you have all these different tools that are either commercial open source to do forensics on the drives you get during cases, it's still worthwhile to pull out the memory forensics tools and run those on your drives. So what is your typical memory forensics process? First of all, you need to get the bit copy of memory from whatever system. That can end up being a lot of data, especially in servers where you got like 64 gig RAM or above. So I even did it once on like a 256 gig server and that was quite an experience. And then you need to somehow collect the file over to your analysis environment and that's very, you know, bandwidth consuming. That's why there's recently a trend of doing live forensics remotely directly on the endpoint and running your analysis tools on the endpoint you're investigating and that has its own limitations but in certain cases where you need to do a quick triage, it might be cost prohibitive to copy the whole thing over. In our case, we already have all the data on the drive and it's dead box essentially. So there's no issues around that, right? And then we need to somehow interpret those bits. So maybe you're some kind of a super human who can parse memory images into your head or with a hex editor or with like just a shirking analyzer or something but most of us need some kind of tool to parse those structures out and figure out the state of the machine. And then we need to interpret the results and for that you need to understand the OS, you're investigating all the different objects and there's lots of funny edge cases with like exited processes or processes that didn't exit cleanly, things like that. So there's experience that builds up over time. So why even do memory forensics? Like what's the actual motivation behind taking apart memory? Obviously there's a lot of undocumented structures. There's a lot of changes that get made to the OS. So it's very time and effort consuming to maintain all those tools and do that. So what are the motivations behind it? And in general, it's about creating, first of all, attacker costs and it's also about attacker awareness. So most attackers know that they can be detected on disk if they leave some kind of evidence that can make it to an investigation. Fewer attackers know that they can be detected in memory, purely in memory even if they don't hit the disk at all. And also it's harder to evade in memory. You need to take a lot more mechanisms into account. So by doing that, they're actually forcing the attackers to create more evasions, to spend more time building their tools, which is always good to do. There's also certain evasion methods such as unlinking processes that's been around forever. If you do a scan of memory and you look for unlinked processes, you can find that. Same for network sockets. You can also find objects that are no longer really there at the time of the capture. So for example, a socket that was created way back, even though it's not active, the object will still be in memory. So you can get that out and that can give you, for example, the start time for a certain malware. If the first thing it does is call back home, you can pull out that timestamp and then you get a pivot point for your investigation. Also, some malware will be packed on disk but it's much easier to dump it from memory. So certain mitigations that malware authors do to kind of evade scans will not be effective in memory. And obviously, certain hooks in API calls, et cetera, if you dump the entire structures from the OS, you can detect those, right? So the leading tool for parsing memory images is volatility. There's also Recall, which is an early fork of volatility and that's managed by the Google team. And there's advantages to both. It's always better to use more than one tool. It's like a general, as a general forensic practice, it's better to validate your findings. Volatility has a lot of very useful plugins that you can use to detect certain kinds of activity. And I'm going to go over a couple of them for now. So sometimes it's really as simple as using what you already know. There is no need to go hours deep into an investigation just to later find out that it's actually something that's already well-known. So you can see a process list here and can anyone spot what's wrong in here, by the way? Right, dusk-sk, a process there that's a known WannaCry process name and that's really all it takes to say, oh, okay, this might be WannaCry, better pull it out, pull the process out, analyze it, make sure whether it's really WannaCry or not, but you already found your first hit right there. So do the simple stuff first before you go into the deeper stuff, right? Another example is using the PScan plugin that will get you all the process objects from memory. This is another state, this is actually a memory snapshot of Stuxnet and can anyone spot what's wrong here? Have any of you analyzed Stuxnet before, kind of seen it? So there's more than one else's process and in a normal Windows machine that's not supposed to happen. So just by doing these simple checks, you can already detect a certain malware that's just trying to essentially hide in plain sight, fooling analysts who are just reading through these lists and some of these checks have already been automated and there's volatility plugins to look for these things. So when it comes to looking for just repetitions, counting instances, use automation, don't waste your time, there's also when you do this all day, you can miss stuff. So whatever you know, just automated, volatility has Python, has JSON outputs, so you can actually use or you can include it in your Python scripts and you can just automate all these checks. So network connections, right? In this case actually hit the name of the VMM file. So you're looking at network connections for the PID 1484, so that's a process that's associated with those connections and we get the ports and the IP addresses, right? So that obvious, there's indicators online and documented malicious IP addresses that certain exploit kits, threat actors are using and these rotate fairly often, so these indicators don't last long, but my point here is use what's known. So that one on the top right is actually a known IP address for Cridex, so it was actually a black hole exploit kit that was serving Cridex. So again, you don't need to be a top expert to do these simple steps. Use what's known and then go into the most more complicated steps, right? And when we look up the process that's actually responsible for these connections, so let's say you don't get any hits on the IP addresses, try to figure out does it make sense for this process to be communicating over these ports or to be communicating at all? Maybe it's not supposed to create network connections. In this case it's explorer.exe, so it's definitely worth looking into, okay? Another thing you can do in memory is look for mutexes, so those are just used by malware to essentially flag the system, the fact that a certain piece of malware has already infected the system. What the malware authors do not want is to hit the same machine again and have two instances of the same malware competing against each other, breaking each other, right? So what they will do is they plant these mutexes which are legitimate Windows functionality, but once we know the name that the mutex uses and they have to stick to certain names, certain strains of the same malware, different strains might have different mutexes, but if you just have a list of those and there's plenty of people curating those online, if you see that, then very clearly it's a piece of malware, right? So the Avira mutex there, it's known for certain zoo strains, so you do the mutant scan, you run that plugin, you run it past your list of known bad mutexes, done, right? Super simple, no reason not to use it, right? Sock scan, we mentioned unlinked sockets before. It can show you sockets that are no longer there, it can show you sockets that are hidden or unlinked and the timestamps are super useful if you're doing forensic investigations on timelines and you need a pivot point to try and figure out, okay, where did this actually start? How long has this been there? This is a very useful artifact to have. So, okay, at this point you might say great, but I do not have the memory capture, so how do I do all this cool stuff that you just mentioned? If all I got in my case is a hard drive, right? All I got is a cold drive. How do I get this out? I was actually considering putting, I looked for cold disk online and I got the cover for the CD of the frozen soundtrack, so I was like, hmm, my lawsuit, not so much, okay, don't forget it, I'll just use the ICM drive, I like it anyway. So, if you've looked on your C drive, you probably have seen these guys, so you can actually use these to do all this cool stuff I just showed, even though you do not have the memory image, so even though your evidence recovery team or whoever gave you the machine, unplugged it, and kind of destroyed all that evidence, you still have some memory forensics artifacts that you can explore and why not use that, right? So obviously, the hibernation file will be appropriate to the last time the machine hibernated, that might be a while ago, but still in many cases, especially when the malware has been there for like eight months, that's still useful, okay? So the first thing to look at is actually the write and modify times for these files that can give you sort of a clue. You cannot access these while the machine is alive because it's locked by the OS, so you will have to either mount it from a second OS, like boot from Kali or SIFT, workstation, whatever it is, or if you're getting the drive cold and obvious write, you just mount it. So the first thing you wanna do, again, start with the simple stuff, strings, okay? Any kind of IOCs or strings that you know you're looking for, you can scan for those, right? Any kind of indicators, URLs, IP addresses, domains, start with those. If you're looking for a specific type of activity, like mining or black market activity or something related to certain companies, other companies, competitors, in cases of industrial espionage, you might wanna scan for those. That'll give you a good clue, right? And you haven't yet parsed anything, you do not need any expertise. So, and obviously, you can have a wipe list to filter out strings that just come up all the time, right? And there are a couple caveats to that. The hibernation file is compressed on disk, so you will need to convert it first. And you do need some context for all this data. In the case of the page file, it's essentially a bunch of pages that were moved to disk, right? There's no real context there. You're missing some tables from memory. If you have the hibernation file and a matching page file, you may be able to reconcile those. But the page file, essentially, you just need to iterate over all these pages and there are some tools to do that. I'm gonna show you right now. So, the next thing you can do is file carving, right? So, other than just simple strings, and you should use both ASCII Unicode, if you're dealing with non-English text, you might wanna make sure to test your tools, make sure that you're actually getting those other languages as well, so you don't miss important evidence. And then for file carving, we're essentially just looking for the headers for known file types, and we can find images, documents, encrypted volume sometimes. So, there's a lot to be found and there's known tools to do that. They have the databases of magic numbers who just look for the different file types and you'd be amazed what you can get from these tools when you just scan and get out all kinds of documents and stuff people thought they deleted, but not so much. So, the page file, where is it? Usually, it's at the C drive, pagefile.sys, just like I showed earlier, but really, windows can have up to 16 different page files and they can be anywhere. So, do not assume that it's on the C drive. Go, hit the registry, look for this key, then you can get exactly where the page files are, where, how many there are, et cetera. So, what's in a page file? I actually already said that it's a bunch of memory pages that were swapped to disk. So, there's no particular order, there's no real context tying those together, but there's a tool called pagebrute and I have the GitHub link on here. Essentially, that can run the YARA scan on each page separately. So, you can use your entire YARA arsenal to scan against that entire page file, look for hits. You can find fragments of malware, you can find IOCs, et cetera. The swap file, that's actually a less common one. It's newer, it's on Windows 8 and 10 and it's actually used by the newer apps that are on the Windows UI that are Metro style apps. It's a separate swap space for those. So, if you're looking into any kind of activity used by those apps, you kind of have it separately in a dedicated file. So, that really helps you weed out all the other stuff you don't need. In those cases, it's really worth looking at. In general, if you're not sure what you're looking for and it's not very focused, I would probably have a look at that, see maybe there's some useful data in there. So, crash dumps. You know, when you run some kind of software and it crashes and it creates those nice dump files, that's actually data from memory from that process. So, it really depends which process crashed. So, if it's a browser, you might have some data from the cache, you might have some information on pages that were open at the time. So, it can be very useful, especially if it's a miner that crashes the browser, you might have that miner still in memory, right? And if it's a password manager, I actually haven't done this research yet, but that could be a next step for any of you guys. If you want to try running a password manager, crashing it, looking at the memory dump, see if there's anything useful in there, because if that's the case, then it's definitely worrisome. Definitely want to make sure those are not in there, right? So, now we're going to move to talk about hibernation. So, the hibernation mechanism in Windows, everybody knows when you close kind of your laptop, you can either suspend it, kind of keep it in low memory, lower power mode, or you can entirely take the memory, move it to disk, save it as a hibernation file, and then it does not consume any power, right? That's essentially turned off. So, Windows will actually mark the page file, if it becomes corrupt, it will change the magic number at the beginning. Yeah, so when you get a page hibernation file, you can take a look at that magic number and see the current state of that hibernation file. When you get the hibernation file, you want to convert it to a format that's usable by volatility, and then you can actually use all those cool plugins that I showed you earlier on that, on that resulting raw image file, right? So, the image copy plugin for volatility, you run that once, you get a raw memory image out of that, and then you can use that from now on. You can also operate directly on the hibernation file, but it will need to do decompression every time, that's kind of a waste, so just do that once, work on the raw memory file from there on. There's also a tool from Kame, from Matt Swish, Hybrid2Ben, so he's one of the first people to do research on this whole hibernation file forensics and analysis, and he wrote some very useful tools around that, so you might want to check out his website as well, if you're interested. So, some caveats. In certain cases, the hibernation file will be zeroed by Windows, especially in later versions. Volatility has some brute forcing kind of handlers to work around that. If you want to know more about that part, I recommend The Art of Memory Forensics, it's a very cool book, very comprehensive if you want to get more into that, and also getting the profile, so volatility does need to know the OS it's analyzing, so it needs to know the profile of the OS. So, if you have an offline drive, and you do not have enough information around the case, you might need to go into the registry and pull that out, so you know which profile to use, and then you can go from there. Another caveat about the hibernation file is that before the Windows system hibernates, it will actually close all the network connections. So, you can still scan for resident sockets in memory of connections that were closed, but you won't see any connections still open. So, just keep that in mind when you're analyzing hibernation files, and that's why it's also important to know when you get a raw image of memory, you should ask where did this come from? Is it from like a hibernation file? Is it directly from a box? You might be able to figure that out yourself, but it can just save you time, so it depends on the context. And obviously, if malware is hooking that functionality, it can actually realize that oh no, the system's going into hibernation, I might want to shut down and clean everything up before that happens, right? So, in those cases, you might not see malware inside of the hibernation file. So, that's not easy to do, but it's technically possible because the malware controls the OS, it can see that as well. So, that's important to keep in mind. So, the last thing I wanted to mention is the volume shadow copies.  So, in recent years, that's becoming increasingly popular because of ransomware, trying to clear those volume shadow copies so that you can recover your files. But in this case, I'm actually mentioning another useful part of volume shadow copies that's useful for defenders. The volume shadow copies will include previous versions of those files. So, even if some crash dumps were deleted, if it's a server, volume shadow copies will be turned on by default. So, you will have multiple versions of the hibernation file to work with. You can actually diff those and you can find changes, you can find processes that have been opened the whole time, right? You can do a timeline of that, right? So, you can take all of those different hibernation files, do a diff on your findings, throw all of those into plazo, log to timeline. You can have a huge amount of data to work with. So, just keep in mind those volume shadow copies. You can find very useful stuff on there. Always remember to look for those. And when you do that offline, SIFT Workstation has a very useful tool to do that. You can just mount any of those volume shadow copies, get the data out, and you're pretty much done. Okay, so, I actually ran that a lot faster, through that a lot faster than I thought. Are there any questions, any follow-ups?  I see a question back there. Sorry? Yes, it does. Yes, awesome. Yeah, go ahead. Absolutely, yeah, you can definitely do that. You can turn on your power cfg slash h, turn it on, and then you do a shutdown. And yeah, absolutely, so that's a very good idea. If you have access to the machine to run commands on it, you can do that, drop the hibernation file, and get it later, just grab the disk and go, right? Thanks for that. Okay, great. So, thanks everyone for coming, and have a great rest of your nap time. Thank you.


Hello, I'm your host Alex Friedberg and this is the Alex the Analyst show. Thank you so much for joining me today We are going to be discussing the difference between an entry level a mid-level and a senior level data analyst position Now most people are going to start off in an entry level job or a junior job That's just typically how it goes although some people do skip right to the mid-level jobs typically that requires a Master's degree like you just graduated from a master's program and they might take that as years of experience Sometimes they'll take that as two years of experience give you a mid-level job So that is not uncommon But I'm gonna kind of walk through a few key topics that I think are going to kind of give you a good picture of When you know Where you should be, you know, are you an entry level? Should you be a mid-level? You know, when do you ask for that raise or when do you look for another job at the next level? These are really important things. You do not want to stay an entry level or a junior level data analyst forever Contrary to what that one job posting in one of my previous videos said if you are a junior data analyst for two years You should not be looking for another junior data analyst position. That's what it said on that that job posting I don't know if you guys remember that it I found it extremely funny So I'm gonna start off with kind of my experience as an entry-level data analyst and then Kind of walk through these different topics with you to share those topics, you know, what exactly Does each level do kind of what's the overall Difference that's really it's hard to kind of say but then looking at the skill level in sequel Python Tableau would all these kind of main skills As well as additional skills that you'll get that as you get to each level There will be additional skills that you should be picking up And so that's important to know and then as well as education level So these are some of the things we'll talk about I you know me I will go off on some tangents and it's just as it flows if I'm thinking of things What comes out of my mouth is what you're gonna get you guys know this So let's jump right into it as an entry-level data analyst You are not expected to know a ton and because of that you require quite a bit of oversight I don't want to say You're gonna get micromanaged. It depends on the boss. I guess but you do need some additional management And that's not every person some people are extremely independent, but when you're in those roles They probably just don't trust you a ton to do everything that they've asked you to do, right? If they ask you to go build this or do this or analyze this, they're probably gonna check in on you and so that's one of the pretty good indicators that you're in an entry-level position or you are in an entry-level role is That they are going to be kind of more on top of you checking in that could be a daily check-in or a weekly check-in And they're just basically saying, you know, hey, how is this going? Do you need any help? And you can you know typically you can kind of get that feel like They're asking and you know making sure that you know what you're doing making sure that you're doing the projects correctly Making sure that you know that where the data is and all these things In terms of the skill level Your skill level is probably not gonna be that advanced, right? It's an entry-level job So we're starting at the bottom. So for sequel, you know, you know the basics You know how to query data and again that is that is really all you need in an entry-level job You're not gonna be doing sort procedures. You're not gonna be creating any automated processes as an entry-level data analyst It's just it is not expected of you if you can do it that is fantastic And who knows maybe you'll get promoted very quickly But you also may not even be expected to know things like Python or R the programming that kind of the two big programming languages that a data analyst is Normally kind of accustomed a lot of people expect them to know those things But as an entry-level data analyst, you may not be expected to know those And so you may be able to get an entry-level job just with sequel tablo power bi excel those skills And with your education level you're typically just at a bachelor's degree. There are a lot of times honestly but sometimes where you have a master's degree and You know you still take an entry-level job that happens a lot and so You know with your education, you're probably not having you don't have a PhD You probably don't have a master's in like computer science or data science or something or analytics or something like that You can typically find a mid-level role like that But your education, you know is not super high, right? And I can vouch for that And I still can vouch for that although got a little higher than an entry-level analyst right now Let's move on to the mid-level the mid-level to me and this is where I am currently at And I I think I am like right at the peak about to break the cap into the senior level I know I haven't been in this industry super long But I've made a lot of progress in the time that I have been here And I'm like right on the cusp of getting to that next level And so I'll talk about that a little bit later So for a mid-level data analyst You are now expected to know some things and they have a little bit higher Expectations of what you can do what you should be doing Your knowledge on the domain and the data itself To talk a little bit more to that You know As an entry-level data analysts, they are going to be checking in on you often And that's just how it is but as a mid-level they may be checking in you once a week You know, I know just on my team everybody on my team in our whole department. I mean we do weekly check-ins That's just what we do Do I need it for most of the time? No, but it's really nice to get some, you know time to talk to the boss And and walk them through some of the things that might be going through But you're expected to solve a lot of your own problems So if you're having trouble with an issue, you know, you should be confident enough to go solve those issues Talk to the people you need to be talking to And if you can't do that you go to your boss And and so there is a higher level of expectations In terms of how you actually conduct your business and get your job done You're much more independent. You don't need to be doing daily check-ins anymore. And if you do that as a mid-level That's kind of like Micro management territory to me. I've thank goodness. I've had good bosses for the most part I've had one bad boss way back when I know I've told you guys about that before But none recently I've had really good bosses And none of them micromanage me. And if I had a boss that micromanaged me at this level where I'm at I probably would not stay there long that that would not vibe with me because I am I'm very confident in my abilities now Or I'm like, I don't need somebody to be checking in on me. I I just don't need that. I know what I'm doing So you're going to know What you're doing you're going to need you're going to know a lot more in-depth Skills like sequel and the mid-level again, and I have said this in the past You don't need to know a programming languages. You don't need to know python. You don't need to know r But you will probably earn more money because of it And it'll open up a lot more opportunities because of it, especially at larger Tech companies or fortune 500 companies You know those things will help you get those jobs. And so at the mid-level I think I would be recommending people if you haven't already to learn either python. Excuse me or r In order to either get that job, but it's kind of it's starting to be expected at that level to know those things Excuse me. I was taking a drink of my coffee. Some people I just found out I I don't know why I didn't know this but some people just listen to this They don't watch me so I could be doing random things with my hands And they would never know but Sometimes I take long time sipping my coffee And people have to check their phones to make sure that they that it didn't like stop Um, so I've had people message me and tell me that before they're like, hey Like I appreciate you drinking coffee. It's just I keep thinking that The show is over or I cut off or my earphones got unplugged or something. Um, so I'm super sorry about that I don't know what to do about that. I'm just gonna say I'm sorry Um, so you're gonna need to know I I do recommend at mid-level after about two years in the industry when you're about to break into that mid-level Job I do recommend picking up Most likely python. That's my personal recommendation or are which everyone your company or your industry prefers Or you prefer So the the skill level is going to be higher. So for sequel, um, you know, you're probably gonna start working a little bit You know, again, it depends on your company But you could be working a lot more with temp tables. You should be Uh, maybe even doing some automated reports. You could be working with sort procedures You might be queueing a little bit more advanced code doing some window functions There's a lot of things beyond the basics that entry level only entry level people know for the most part You're me doing a little bit more advanced things or you should be at that level And you know, that's why they have these technical interviews For a lot of these data analyst jobs is because they want to make sure that you're at the level of a mid-level Data analysts, they don't want to be hiring somebody who just knows the basics And so You know, that's where you should be That's the difference between an entry level and a mid-level skill wise education wise. You could still be just a bachelor's degree You know, but this definitely when you start hitting mid-level, I think a lot of people start thinking You know, if I want to get to the next stage, I'm gonna need to go back and get a master's That's where I'm at right now a full disclosure. Like I'm looking at master's degrees as we speak thinking about when I want to apply when I want to go because uh Although I believe and I'm fairly certain I will make it to the senior level um You know Within the next two, maybe three years I want to be able to get even further, right? I want to go into management, you know director level roles senior vp ceo like those that that's my trajectory. That's where I want to go eventually um, but You know the education level has to be there And so if I'm sitting at a senior level for five six seven eight years and I still have just a bachelor's degree um You know, maybe that's not a bad thing But personally I want to be advancing in my education to not only know the skills but also back it up with a degree That's just my personal opinion. Um, but in terms of what they do a you know, we're gonna now we're gonna switch over to the senior level um, that's just the education for That was the education for mid-level is just you should be thinking about or maybe even getting A master's at this point if that is an option for you So let's move on to the senior level my my favorite because this is um You know, this is the peak for a data analyst, you know, you can there's some different titles That could be a principal data analyst a lead data analyst or it could be a senior level data analysts those are kind of like I think the main titles for that kind of seniority level So for a senior level data analyst, you are Going to be expected To be very good at everything that we just discussed You're going to need to be very good at sequel. Um, and you're going to be needing to know advanced topics Everything that I mentioned in the mid-level, but just even more Right, uh, you will will most likely be expected to be creating some type of automated processes automated reporting Um, you'll definitely be working with well, I say definitely but for my industry or my job at least You'll be working a lot with certain procedures Analyzing the data at a very high level You know, again everything that we discussed except just Even more advanced So with python python for a senior level role or r for a senior level role is pretty much required Again, it just depends on the company if your company doesn't value that or use it then you may not need that But if you are at a company that does use it And you don't know that skill it'd be very very difficult To rise up to a higher level And if you're at a mid-level and you're trying to get to a senior level role at a different company You know, it only benefits you in the long run so Back to kind of what the other things we talked about with the other levels In this level, you are expected to Basically be on your own You know, you come in for the check-ins you'll you'll If you meet with your boss weekly or monthly you do those things, but besides that you were handling just about everything By yourself But you don't need a lot of help and in fact, you're probably going to start taking on I don't want to say like mentees, but you'll be maybe even mentoring the Incoming data analysts or the mid-level data analysts or they could be I don't know maybe even reporting to you. I don't it just depends on your structure But they're going to be looking up to you and for questions and they're going to be coming to you with questions They're going to say, you know the data better than anybody. Can you explain this to me? In the entry-level role, nobody's going to be asking you that In the mid-level role, some people might be starting to become to you.  You know, have you heard of this in the senior level role? They're like, hey, I know you know about this Can you explain this to me? How do I go and access this? How do I what do I what do I do for this? um, that's going to be coming a lot more common as a senior analyst and that's because You're a senior level role. You're expected to know Just about everything as it pertains to the data how it's acquired what it's used for what products it goes into um, the the How the data is transformed, right? These are the things that you have to know because if heads of departments or or you know people you're working with Needs to know these things. You don't want to have to go ask your boss That's kind of defeats the purpose of being a senior level role You need to be able to answer all these questions on your own For skill level, um, I talked a little bit about the sequel Um for the python, you know, you should be very comfortable In in a programming layer or you know, I said python but python or r should be very comfortable in a programming language and using it often um to be to just be very um Skilled in that area that is my personal belief and that based off the research. I found that um I might I'll try to put up the statistic if if I remember to put it up there um, but over 60 of senior level analysts use some type of Uh programming language either python or r which means 40 aren't And so, you know, they may be using Um, just other tools that kind of replace those the need for those But 60 runs 60 say that if they are a senior level analysts, they are using one of those for education level um You know again, I think at this level you should be either getting or starting or already have a master's degree In something related to this field Whether that's computer science um analytics Something like that. I think that you should be going towards or already have that level of um education um One second I'm just pulling something up real quick bup bup um So a lot of the stuff I got from a few different articles that I read People who are much smarter than I Which doesn't Isn't saying much to be honest. Um, it's not a high bar um And so I think that just a kind of a takeaway from this I think that looking at your current skill level if you have a master's degree if you have years of experience You should be looking at your current situation and saying what is my next step if you're right out of college Your next step is probably an entry level job If you have been in an entry level job for three years You should probably actively be looking for a a mid-level role or asking for a raise because After that, it's like how many more years can you be an entry level the analyst really? um So, you know, just take a look at your situation that is to me. Those are the biggest differences, right? There are a lot of other smaller things. I didn't include them because honestly, I I'm not sure How long I'm gonna run? I think I'm already at like 20 minutes. That's a long time. Um That's a long time for the main part and and I I really like My other segments of the show which I like to I like to fit in so Um, those are the main differences. And so I hope that that's that kind of explains um, you know Where you should be at each level and kind of your progression as you grow as an analyst that is um A progression that I am trying to take um And when I was researching this and looking up all these things and finding these articles Which I will try to include it in the in the description if you want to look those up Excuse me. Um, I feel like I'm trying to follow this pretty closely. Um, although I didn't even know about it until This week I've been trying I have been following this kind of closely. Um in my personal analyst career So let's move on to the next segment of the show move three segments coming up my my first one is Uh Thank you to everyone over at patreon You guys make the show happen. I show up every single week Uh, and and I do this for you guys and everyone else who watches you guys are good too I guess But I do this for you guys because you support the show you support me support max who's laying right next to me It looks super cute. I would pick him up and pull him up here, but Honestly, he's having like, um, he's doing that dream thing where you're like runs in his dream I don't want to wake him up. He's too cute. Um, you guys make this happen and I I appreciate you. I I I love you um And if you want to support the show if you want to feel loved and you want to see more pictures of max Which I posted one today It's like 70 degrees in in dallas today December 12th Of 2020 70 degrees in dallas and I took him out back when I was playing took a picture for you guys Posted it there and if you don't and you know if you don't If you're not a patreon member you didn't get to see that and I feel bad for you Um, so there's a link in the description if you want to support the channel shout out to you guys next Segment of the show, which is a very good one. It is question of the week Question of the week comes from mohammed and I'm going to try to pronounce this last name and and I apologize. It's going to be correct boot Shakuja And it says hello, alex great video as usual. Thank you I have a question for you our online certificates from edX coursera and udacity worth it And which of those three is better? Has more credibility in the real world Ooh This is a tough question a really tough question and I personally think it is kind of controversial Um, and so take whatever I'm saying with a grain of salt. I am not an expert when it comes to certifications, um, I have my own personal thoughts. So here's what I think I think that for the most part those certificates really aren't that worth it I think then there's there's and I say that with a grain of salt because I think they're good to put on a linkedin Uh on linkedin. I think they're good to put on linkedin. I don't think they're something that I would personally be putting on my resume Um, the difference is is linkedin is more of kind of a social media You're showing people that you're working on things if a recruiter checks it out They're like, wow, this guy has a udacity nano degree. Um, doesn't make a huge difference But man if they know what that is that's cool or they they took this course in Coursera they spent like 20 40 hours on it. That's dedication So it can show that you're learning the skills. Uh, you're actually learning the skills But I don't think the sort of certificates are as valuable as some people might say Um, and so that's my general rule of thumb for these course websites They are fantastic to learn from I I personally learned so much from them But I'm not putting those certificates or those certifications or whatever you want to call it on my resume I don't even put them on my linkedin account But if I was going to put them anywhere, it would only be my linkedin Um, if I was to get from any of those three that you mentioned edX, Coursera or udacity if I was to get it from any of them Um It'd be a toss between edX and Coursera Coursera, I just have a lot of experience with and I really like Coursera a lot Um, and so, you know, I just I just have a bias towards them But edX is like is is very Um, it's well established people like it. It's very educational. It's I believe it has like You know really credible authors who who post there and so to me that might be the better one udacity I just I'm not a huge fan of udacity Um, and I can't I'm not going to get into why this is just a lot of reasons to be honest We are entering, um Basically the end of the show And it gives me time to just relax for a little bit Made it through the show. Um You know It's a lot of talking I talk a lot Um, and you know, thank goodness I have a little bit of coffee in me because one it's super late. It's almost it's a little past midnight to be honest Um, and so I need the coffee to keep me awake I also and if you don't know I have many kids and so they They keep me awake and so I get no sleep. So I'm running on no sleep I'm talking for like 30 minutes. I did another episode before this The data engineering first data analyst. I shoot all my videos on one day for the week. Um, and then I edit them So my voice I dry as a bone So I'm just super thankful for this coffee to be honest It's getting me through Um, but now my I I'm starting to like I'm starting to be like man, all right I made it. I did it. Um, so I'm happy to be here. Um, but we're entering a very special time in the show It's the keyword that everyone wants. That's the only reason people are watching this long The only reason people just listen to me talk about why I drink coffee and why I'm tired the only reason people are continuing to listen is one It's actually twofold one. They forgot to turn it off Um, it's in their pocket. They don't feel like pulling it out. I get it Um, to shut me off The other reason is they're waiting for this keyword and those people who wait for the keyword are a special type of person they They appreciate and they understand um the value in building their career as a data analyst they value um Growing their skill sets marketing themselves being professional Learning and growing those are the types of people who stick around people who only listen to the main part and left No, they're not gonna make it But they wouldn't know that they're not gonna make it because they didn't stick around But if they did stick around They'd make it You know what I mean the vegetable Of the weak the vegetable keyword This is gonna be a doozy Celery C-e-l-e-r-y One of the worst vegetables it's up there with Radishes it is void of all flavor and joy um it's it's Is a pointless vegetable to me. Why do people add it to soups? It does not add flavor My wife does it and I argue with her almost every single time I'm like, babe. This does not add any flavor to the soup and I have to pick them out. I push them to the side I'm like, I'm not eating this. I refuse people try to Put peanut butter on it. I think again It's you're putting peanut butter on something that tastes literally terrible It doesn't make it taste any more any better and I'm not being healthy because I'm just not eating it Put it on something that I want to eat put it on a cracker.  I really do. Uh, thank you for hanging out with me I will see you in next week's episode Uh of the alexi amla show So I will see you then and I'll talk to you at that time next thursday. Goodbye. Thanks for joining me You


Cannabis stocks and CEO interviews brought to you by Rich TV Live. Hey guys, how you doing? This is your boy Rich and I'm here with a very special guest. It is Amanda from Indonesia. How you doing today Amanda? Hey, I'm doing great. How are you doing? I'm doing fantastic. Now we are only a few days away from Christmas and we had a very historic day yesterday. Hemp is now officially legalized. President Trump has signed the Hemp Farm Bill legalizing hemp in America taking an $800 million industry and introducing an $867 billion bill. It is now official. What do you think about it? I was so excited. This is a long run up, right? This is the first step to many. Trump is trying to end the prohibition over there and I'm pretty stoked about it. So yeah, that was a special moment in history. It was. Now today I wanted to talk about trading for beginners. Everyone keeps saying to me, Rich, I need you to do more educational videos. Rich, do more videos on trading for beginners. Rich, do more videos talking about trading for beginners. So let's talk about it. What tools or is there a specific tool that you use or you really like that you think helps you or helped you when you started trading? When I started trading there were so many different tools out there that I used to have to sift through like 10 different things. I would go to my charts and record my charts. I'd go to my news. I'd be on the websites of all the stocks and it took me so much time. And then I discovered an amazing tool that actually does a lot of that work for you. And that is something that we both use called bar chart. Let's pull a bar chart. Let's pull a bar chart. So let's look at it. Bar chart. So let's look at it. We got bar chart now. Now let's show everyone how easy it is to use bar chart. So let's take a look at a stock. Is there a stock that you've been looking at lately you want to look at? Honestly, I'm still P-Jet upset. P-Jet. Okay. P-Jet guys, if you don't know, it's a penny stock that we did very well with this week. I personally made 100% return in one day on this stock. And you can see here that it is a one, oh no, it's an 88% buy with a strengthening short-term outlook on maintaining the current direction. Longer term, the trend strength is maximum. Long-term indicators fully support a continuation of the trend. So based on what this is saying, what does that tell you when you see that? When I see that, I mean, I think it's, I mean, 88%, I'm looking really closely and I'm likely getting in. But I mean, there's quite a few stocks that tell us that we have 100% buy. I like that. Let me show you 100% buy. Callie Inc. Now this one is a caveat emptor. Please be careful. Buyer beware. It has a skull and bones. Remember, Rich TV Live is strictly for education entertainment purposes. Always do your due diligence.  But this is a stock that keeps going up every day. It went up another 37% today. It was a, as you can see, 100% buy with the stronger short-term outlook on maintaining the current direction. Long-term, the trend strength is maximum. Long-term indicators fully support a continuation of the trend. So this is a super risky stock. I wouldn't suggest anybody buys it, but it's going up every day. And this is what I'm talking about a stock that is a 100% buy. Okay. So I'm going to show you guys the opposite of 100% buy. I'm going to show you guys 100% sell. Now, this is a company I really like, but unfortunately right now, I believe it's 100% sell. So let's take a look at it. I knew you were here. There it is. Namaste Technologies. It's been getting decimated. It did go up today 4%, so that was good. But it's been getting slaughtered recently. It is a 100% sell on Barter. Bar chart technical opinion rating is a 100% sell with a strongest short-term outlook on maintaining the current direction. Long-term, the trend strength is strong. Long-term indicators fully support a continuation of the trend. The market is in the highly oversold territory. Beware of a trend reversal. So what does that tell you? That tells me, be careful. Truly, I think you spend a lot of time looking for momentum and no one really knows how to do it when they're new at stock trading. And I really think that Bar chart takes a lot of that guessing out. And you can still go in and look for your details. If you're into weighted alphas and all these, then that's going to give that to you as well. So it's really simplifying this game for us. Absolutely, absolutely. Now, one of the things that I wanted to do is I want to show you guys that it's not just the buying and the selling pressure. There's a lot more to Bar chart that people don't really understand. Bar chart is an amazing tool. So I want to show you guys how I use Bar chart and how you can use Bar chart to really help you find winners. So if you go to Bar chart, yeah, you can put in a stock and it'll give you their opinion. But in addition to that, you can go down here on the left-hand side and you can find other specific tools. For example, if I hit Bar chart here in the corner and I hit stocks, see all these lists here? Market overview, market momentum, market performance, top 100 stocks, today's price surprises, new highs and lows, economic overview, earnings within seven days, earnings and dividends, stock screener. I don't know if you knew all of this was here. I like stocks screeners where you can mark them up and Bar chart lets you do all that. Yeah, so take a look at this. So let's take a look. Let's say the market's crashing, but I want to see some stocks that have momentum. Let me hit the top 100 stocks on Bar chart. So we hit the top 100. These are the top 100 stocks on Bar chart right now and they literally are going to rank them for you. So it's taking all the guessing out of it and you can literally see all the top players right here. Look at this one. TNDM is up 1100% this year. NFEC is up 1200% this year. TPNL is up 400% this year. ECYT is up 457% this year. So these are all plays that are moving on momentum, have been really strong all year and most of these are either top 1% signal strength, 100% buys or close to it. Now if I go market momentum, I'm going to click on mark on momentum, that's how you see the top 100. That's a great place to find top picks. These are all the stocks that are up and all the stocks that are down. It shows it. So you can see there are 683 stocks that were up and there was 803 stocks that were down. So this literally breaks it down. So I really like these tools to see where everything's at. It really breaks down the statistics of everything. Now let's see top signal strength. Here's another section called training signals. Top signal strength. Click on that. So just literally learning how to use these tools can really help you win, okay? And whenever I'm in a little bit of a bind and I just kind of need to win, I go in here and I really dig deep and I start trying to find the next winner. Here's two picks right here that were previously 100% buys. Last week were 88% and 96% buys and now are 100% buys and look both of them went up today. So these are the types of plays and these are top 1% signal strength and Barter's giving you these picks for free and you could have bought these picks today and you could have made free money and these picks are there every single day. Every single day for you to take advantage of but most people don't even know. What I want to do is I want to be able to... Sorry, go ahead. Oh no, I said it just saves hours of time coming in here. Hours. Absolutely, I mean, how many thousands of stocks are there and all of a sudden there's two picks right here that you could have bought today and you could have made money on and Barter's giving you that information for free. Yeah. So why not use it? So I really want to make sure people are understanding how to use these tools. Trading for beginners, trading stocks for beginners is all about learning how to use your tools, okay? And if you go to www.richtvlive.com you will see that we have all the tools available to you for free right there under stocks. You can see bar chart is there. This website bar chart is absolutely free. And for anybody that's starting off or anybody that's even an advanced trader I would suggest you learn to use bar chart because it is a great tool that is going to show you momentum. It's going to show you a lack of momentum. It's going to show you volume. You can see, look here. Volume leaders, bam. Let's look at volume leaders. Here's all the volume leaders. So there's so many different things you can look at and so many different tools that are accessible at your fingertips that it would be silly for you not to at least look and get an opinion before you were to buy or sell a stock. And here are the top volume leaders in America and you can see General Electric, 185 million shares in volume. Bank of America, 160 million in volume. Kinross Gold Corp, 137 million. AMD, 132 million. Microsoft, 111 million. Apple, 95 million. Now unfortunately these are all red because the whole market was selling off today but these are stocks that are showing massive volume. So these are the types of things that I look at. I look at the price. I look at the momentum. I look at the trend. I look at the industry. I look at the global trend of how the global market is doing and as you can see everything is red. So the whole global economy is pretty much selling off right now. So if you can win in a market like this then you can definitely win in a market when everything's going up. And I think the nice thing about bar chart is you can use my bar chart to save all your favorites and I believe that there's not a limit on how many you can put in there. And the app, the phone app is amazing. I've used it on Apple and Android and it's such a great quick reference. You can put your news out of there and you can really see all your stats as well. So there's a lot of great options in here. Absolutely, absolutely. So yeah, I just wanted to share that with you guys. I hope you guys, I hope you guys learned from this video. I don't want to go into too, too, too detail with bar chart yet because I think that that could also get you guys confused. So I just wanted to kind of show you guys how great of a tool bar chart is, especially for you new traders out there. Get on to bar chart. It's free. Learn to use it. Look at the daily gainers. Look at momentum. Learn to get an opinion before you buy a stock. Just type it in there. Put in the opinion. If it says 96% buy top 1% signal strength, you know that's momentum and that could be momentum. That's going to keep pushing the stock up. And if you ride that momentum, you can make money. It's true. We've been making money this week in a market where everyone is using money. And these are the tools that are going to get you there. And we're going to continue because we made a decision that we're going to win. So since we made the decision that we're going to win, we're going to win. And I said this, you know, if you're at war and you're losing, what are you going to do?  Or are you going to get up and you're going to fight back? Well, in this market, you've got to be agile. You've got to be able to get in and out. You've got to be able to buy low sell high stick and move. Maybe even stay in cash. Wait for that next trend reversal. Wait for the debt cap bounce. Wait for the momentum to come back. But in the meantime, there's always going to be sneak attacks and stocks that are going to be exploding out of nowhere. And using tools like bar chart can really help you identify that power and that momentum before it happens. And hopefully you can use bar chart so that you can win too. I hope you do. Enjoy. Ah, it's so great. Now, I don't know if I'm going to see you or speak to you before Christmas. So you have yourself a happy Merry Christmas. Okay. Have an amazing holidays. And let's do another video soon. Absolutely. We'll meet up soon. Merry Christmas to you and your family. And thanks everybody for coming to watch us and enjoy your Christmas. That is Amanda from Indonesia. She is a true angel. She is saving lives and she is making money in the cannabis sector. You are doing incredible work. Keep up doing keep doing all the great work like you are. And your team is just unbelievable amount of angels. I love you guys.  And for all of you guys that are watching at home, thank you so much for all your support this year. We now have 18,000 subscribers. None of it would have been possible without you guys. We've just done so many incredible things this year. In 2019, we want to be able to dwarf those numbers. So let's continue to grow, smash the like button, share the video everywhere, comment down below. And remember, if I win and you win, we all win. It's true. This is your boy Rich. I'm from Indonesia. We're winning. Have a happy, merry Christmas. Spend tons of time with your friends and your family and your loved ones. If you don't have any friends or family or loved ones for the holidays, don't worry. Your boy Rich will be here. We'll be bringing you videos. If there's anything you need, holler at your boy. Go take a look at Bart. Go take a look at Bart. All right guys, we're out. He's out. Peace.