The workspaces-- this is where you
get to become familiar with what I'm talking about.
Now for the next few slides, I am going to show you the slide
and I'm actually going to show you
what it looks like in the virtual machine
because sometimes, I think a live demo is
helpful in trying to break these things down for you.
If I tell you to go home or click on the icon, what I mean
are these icons on the left-hand side.
So you're going to see everything from Home
to Timeline, Analyze Data, File Systems, Insights, Tags,
Reports, Cloud.
And PA 8, when that comes out, or PA Ultra,
as it's going to be called, you'll find locations.
And it's just additional information that's parsed.
We have the toolbar across the top,
and I'm going to walk you through what these mean up
here.
If you haven't seen enough of me in this class,
if you click on Tips and Tricks, be warned--
you're going to see a lot of my face teaching you,
specifically, in the Cellebrite tools, tips and tricks,
everything from beginner to advanced.
Under the Main section here, or the tree,
you're going to have a Search here,
and I'm going to walk you through what
that search is for.
And you have Analyze Data and you have Data Files.
Now keep in mind this is not everything
that is on that iPhone.
This is just what the tool can show you.
We have Insights for apps, which we
can see on the right-hand side of the screen.
We have the Content.
And then we have the search options up on the top right.
Now, when you see UFED CLOUD included,
if you don't see that, it's because your license does not
include cloud, so just something to keep in mind.
I'm going to switch to the VM and I
have preloaded your next lab.
And I just want to show you some of the things
that I just mentioned in that slide.
On the left-hand side, if I click on Analyze Data,
you will see in here this is where
you can go through and look at the calendar, the contacts, all
the things that you want.
If you can't find something-- let's say you're like,
I have no idea where Bluetooth would be--
start typing the word, and if it appears,
it's going to be there.
Now this one doesn't have any Bluetooth, or maybe it's BT,
and you're looking and you're like, nope, not there.
Let's say you're looking for Wi-Fi
as you start typing you're like, OK so there's Wi-Fi.
It's going to tell you which module parsed that information.
This is not a keyword search.
This is a way for you to sift through what
is parsed on that device.
And as you click on something on the left,
it's going to show you the response on the right.
Now, something else you're going to see-- you're
going to get multiple tabs that open up across here.
And let me open a few more just so I can show you
how to close some of these.
So as you go clicking happy, which we all
get when we open so many things, if it becomes overwhelming
and you want to get rid of it, you
could right-click and hold the Control key
and do Close All But This.
It's going to close them all, and then you'll
be back to just your extraction summary,
like, a nice, clean start.
If you accidentally close everything,
if you click on the Home button, it
brings that extraction summary back.
I will refer often to source files.
And what I'm referring to is anything
that you can click on that's going to take you
to what the answer is.
Those are source files.
Now let's look across the top here.
So anytime you see "New," that means
Cellebrite just did an update and there's
something new in here.
You should look at that.
Under Tools, we have a lot of things coming up in the slides.
So I'm going to wait to walk you through these until we
hit that in the slide so I'm staying true to it.
But just know these are where you're going to do extractions.
This is where you can extract additional information,
leverage the Python shell.
Plugins-- these two things will come into play
later in the course.
Creating reports, if that's what you're
choosing to do-- there's many things
you can do from this toolbar.
As we progress on, over here on the right-hand side,
you can see Insights from Installed Apps.
If you click View All, Physical Analyzer
is going to show you all the viewed apps.
And this is also coming up in a slide,
so I'm going to show you this now.
You have two different views of option--
Insights, which are going to show you more of the icons
and how the data exists, or Table View.
There's no right or wrong way.
It's what you prefer.
So I am typically-- when I do my demos,
you're going to see I go to Table View.
It's just something I learned how
to do smartphone forensics in.
So it speaks more clearly to me then the Insight view.
Something I really like-- so let's say
you're examining Snapchat.
What this means right here is Cellebrite decoded something
from Snapchat.
Be very careful.
It doesn't mean all the things.
It decoded what it considers social networking and chat
applications, and I will show you how to verify that.
On the right-hand side, it is going to tell you
what permissions the app has.
It's telling you which categories it parsed
and databases of interest for that installed application.
These are not the databases that necessarily
store all the information you need to parse.
We will dive into that more deeply in the class.
If you want to keyword search, this
is coming up in the slides, and this is huge.
There are so many different ways to keyword search
in Physical Analyzer.
The next lab is going to force you
to keyword search many ways.
Now you may find some bugs.
Here we're looking at PA version 7.52.
7.53, I'm sure, will drop any day.
You could be taking the class and you're like,
wow, 7.58 is out because bugs are found
and issues are reported.
Keep in mind if you update, your results
may not match the workbook.
If you're OK with that and you're up for the challenge,
it's up to you.
But for this on-demand experience,
I'm going to stay with the versions that
are built into your virtual machine until the end of day 5.
At the end of Section 5, or if you're doing this seven
days straight, if you're doing it for four months,
depending on how many days are you
into the course, Section 5 at the end
we prep for the forensic capstone.
At that point, I will recommend if you want that you
can go in and update the tools.
But again, it's at your own risk.