The other searching-- and I'm going to demo all these
at the same time--
this is the Hex searching.
I wrote a good blog for Cellebrite called "Hex Diving"
that you can take a look at it, showing you
why you need to do this.
You could do it across the entire device or just
across a database.
So here, I'm searching interactionC,
which is an important file that we'll look at on iPhones.
And in Hex View, I click on the magnifying glass,
and I'm typing the word vet.
And on the right-hand side, we can see all of the hex
with the keyword vet.
Now, this is a fuzzy search, so if it said veteran,
it would hit on vet.
If it was ventilate, it would-- no,
it wouldn't because there's an "N" in there.
You can't typo it.
But you know what I'm saying.
Like, any word that has v-e-t in it, whether it's in the middle,
at the end, or at the beginning, it
would hit on it because it's a fuzzy type of search.
The hex search is the most thorough
of any mobile forensic tool you're going to use.
So I want to demo some of the searching for you.
On the top right, I'm going to click on Advanced.
And let's see what I could search for here.
So I'm going to search for something that we actually
see in the hit here.
I'm going to search for map, google.
And I don't think the space matters.
Capitalization doesn't matter.
I'm not checking anything else.
And I'm going to hit Search.
And it's going to go through and it's going to search for files.
Now, this is where you may find bugs, where you're like,
I just saw it.
Why isn't it showing it to me?
So here it's saying there are 731 hits for "map" or "google."
And you're like, oh, no, I wanted Google Maps.
Copy that, go to All of these terms, and paste it.
Try again, say Search.
So now it's going through and we're down to 364 hits.
So when you see this, you look over here.
We have fewer hits which makes sense
because we got more specific.
Now what if we did "map" and "google" but not "com?"
I don't know if this is a good choice.
We're about to find out.
And we search.
We have no hits.
So this is a good example of maybe you over-filtered.
Maybe something's wrong with the tool.
So we clear it.
Now what happens if you search for "heather?"
And you press Enter and it searches.
And you get 0 hits and you're like, OK.
What if you choose Search In file contents and press Search
and you get no hits?
That is when you would want to go dive deeper.
And you may want to go dive deeper otherwise.
So to dive deeper you have a few choices.
I'm going to click on File Systems,
and option one, if I want to search
the entire device, the entire thing,
scroll all the way to the top under File Systems
and click on the FileDump.
You should see hex.
When you see that, you click on this magnifying glass.
This is a dropdown that everyone forgets about.
So remember we talked about SIM, and they
said you could search for the serial number?
ICCID will search for every single SIM card that's
been put into that device.
That's helpful.
We're going to choose Strings, and I'm
going to do ASCII and Unicode, just
in case "heather" is not in plain ASCII.
And I'm going to type "heather" twice and click Find.
Now, if I get zero results here, I
am confident in saying that the word "heather" was not
in a decrypted state on this device.
But as you can tell, I already have 10.
I'm going to let it keep running.
Now, "heather" could come up as "heather's." it could come up
as "heathermahalik@gmail.com."
It could come up as many things.
But it's searching.
If you get frustrated, you can always click Cancel
and it will stop.
I'm going to let this one run and we're
going to see how many hits we have for "heather."
All right, so as we start looking through this,
we can see--
as we start looking, here we can see the word "heather."
It's just going to show you the hits.
And honestly, they may not be relevant.
They may be good hits.
This is where you have to actually look through your hits
and scroll through and say, this is what I needed,
this is not what I needed.
So again, the source file is helpful.
And I'm going to zoom in here in a second.
Let me just move my screen.
So as you start looking through, it's
going to tell you where it actually
found it-- wordlist, system information, if it's actually
files of interest.
But that's a good point for you to go.
So this was your hex search.
The top right is your Advanced search,
and you're going to be doing this in your lab.
So that's all I'm going to show you with this because I
don't want to ruin the surprise element of you doing this.
And keep in mind you can do it across the entire device
by going to File Systems, all the way to the top,
or against one database of interest.
And it looks the same way.
You're in hex, so you click on that magnifying glass
and you do amazing things.