This is the first lab that we are introducing
in this on-demand studio.
So when we look at this, any time you
see the slide that says lab, you want
to go to that lab in your workbook.
You have a few options.
Some people prefer to work from the PDF.
Some people prefer to work from the electronic workbook.
The choice is yours.
I am going to get you through the steps
of loading this extraction and following the instructions.
I will then review it.
So what you will hear me say is at this point,
if you don't want to hear the review, pause your VM--
or pause on-demand.
Stop because I don't want to give you any spoilers.
So make sure you're listening and you're paying attention,
not just zooming through and then you're
disappointed when you hear the answers to the lab.
In your VM, I'm going to launch the E-Workbook.
Under Exercises, I'm going to click on Lab 1.1.
And in here, it tells you the objectives
and what you're going to do.
This lab is very easy to load, and if you look
at the instructions it tells you to go to Lab1.1 in G:
and double-click on the UFED shortcut.
The G: drive is right here.
We have Lab1.1.
We click on it.
You just click on this file.
Physical Analyzer's going to give you some options,
and I want to walk you through this.
Now, I already have it loaded, so I'm not
going to say yes to some things.
It's asking me do I want to open it as a separate project
or add to the extraction?
If you ever see this, please do open as a separate project
because otherwise, you're going to be merging
your labs, which is not good.
Now, at this screen, follow what your lab recommends.
Here it's telling you, hey, you can carve for locations.
It can do additional things.
If you click Learn More, it's saying
you can track your progress and everything.
I recommend you just go with the defaults
unless I tell you otherwise.
Do not do Selective app decoding because it's going
to hinder everything you see.
Cryptocurrency-- only if we tell you to.
You can also run this on-demand at the end.
Same thing with Media classification.
I recommend running these after the fact
because it gets you access to your data faster,
but it's up to you.
If there's ever anything that you cannot run and I need you
to check the box during processing,
it will be crystal clear in your lab instructions.
So then you just click Examine data, and when it's done,
it's going to prompt you and say,
this time zone was recognized.
Do you want to adjust all timestamps to that time zone?
Be very careful with that.
If you wanted to--
I always say no, but I am currently
working a case where it's a cold case murder,
and it took place in Central time,
so it makes sense to put all the things to Central time.
It depends on your investigation.
With these devices, they traveled worldwide,
so be very careful with that.
You can always go into Tools and Project Settings
and verify what your time zone setting is.
So here we can see the time zone is UTC,
and I want to keep it that way.
And I say OK.
Another thing I want you to verify when you're in here
is, if you go to Tools and we go into Settings,
as we start looking through this--
and this is very important-- if you're already parsing,
do you not change anything for this lab.
But if you change this while it's loaded,
it will take effect for all your future labs.
Under Decoding, and where we are right here, General Settings,
Decoding-- this is super important--
if you do not have Use deep carving for SQLite checked,
in labs that start with Section 2,
you will not get the same amount of deleted information
that I have.
So I will remind you of this.
I also like to have Recover data from archive files checked.
Enable AppGenie on all app categories--
I am not going to check that yet because I
want to show you what the error looks like when you get it.
So again, I check Use deep carving and Recover
data from SQLite.
If you don't check those, they're not going to--
your lab answers won't look the same as mine essentially.
Also, this will not take effect until you reparse.
So do it now, and then when you hit your next labs
going forward when we use Physical Analyzer,
it will take place.
Any time you update, do not assume these boxes
will remain checked.
So you just click OK, and that's all that you need.
So at this point, I release you.
Go do Lab 1.1.
Become familiar with Physical Analyzer.
The key points are for you to learn
how to navigate the file system, keyword search,
understand bugs in keyword searching,
and then how to hop from a specific artifact of interest
into the file system to find the offset.
We are now going to review Lab 1.1.
And a few things I didn't cover in the overview
that we're actually going to see here
is the Settings on Physical Analyzer.
So I will tell you when to pause your VM.
But if you're still working this lab,
you may have seen this screenshot come up.
Be careful when you use it.
So here it's saying the time zone detected was UTC-05:00,
and it is going to--
if you check this box-- automatically
adjust all the timestamps to that time zone.
In this class, Lee and I travel worldwide, so
be careful if you choose this.
However, there are some situations
where you may want to do this.
I am currently working a cold-case homicide that
took place in Central time, and we have specific time frames
of interest.
So it makes sense to convert the time stamps
because we know when the murder actually happened.
But for this, I'm going to say no.
The next thing I want you to do is go into Tools and Settings.
And I want everyone to do this, no matter where
you are in the lab because this is really important.
As you scroll down, I want you to make sure
that these two boxes I just unchecked are checked--
Use deep carving for SQLite and Recover data from archives.
And again, this is just in General Settings
under Decoding.
If you don't do this, when we parse labs going forward,
you will miss information or your answers
will not match what's in that E-Workbook.
So please make sure you check these boxes.
And again, it's Use Deep carving for SQLite and Recover data
from archive files.
Now, it won't help you in this lab
because it's already parsed, but it's also not
relevant to this lab.
It will be relevant to labs starting Lab 1.4,
so very important that you do that.
If you are still working the lab,
press Pause in your VM or your on-demand recording right
now because I'm going to spoil the answers for you.
For those ready to review, the first question
is about keyword searching.
So if you searched for "the pool" up here in the top right,
you get no hits.
If we then go over to Advanced and we
search for "the pool" and press Enter, we get 0 hits.
You're like, OK, this Is not going well.
So I'm going to cut that one and put it into All of these terms.
So now I'm searching for "the" and "pool."
If you're not getting hits for any,
chances are good you're not going to get hits for all.
So then you may say, you know what?
I'm going to try Search in file contents.
And when you press this and you press Search,
you will get hits.
So you can definitely do that and you'll get keyword hits.
Something else you can do while that's running
is you can go into the file system and search that way.
So here we can see that we have hits
for this main.db associated to Skype.
Now this is what's interesting.
When Skype for Business was released,
the file main.db was used only for call logs.
And sflusername.db started storing all the chats
and other interactions.
Physical Analyzer has always parsed this file,
this main.db that we're highlighted on
right here, until version 7.52.
So remember, when I told you as tools update,
sometimes you find bugs.
Sometimes you find older apps just aren't supported.
I did report this as a bug because the issue
is main.db is still used for call logs.
So this is a file you want to make sure
that it's always parsed.
If you want to be even more thorough, what you could do
is what I mentioned in the walkthrough--
Run fuzzy model plugin, and let's see what this hits.
Let's see if it even found anything.
So under Analyzed Data, Manual Data Collection--
and as we look through here, I want
to see if it found main.db.
And guess what?
It did.
So if you ran fuzzy model and you look, we have accounts.
If we look at Fuzzy objects, we have main.db.
Here we have contacts.
We have main.corrupt.
Now main.corrupt is really interesting.
What that is if you're using Skype and it crashes,
it creates a new database called .corrupt,
and then it relaunches and creates a brand new main.db.
So when you're looking at this, you
can see it's just showing you contacts.
It's not actually showing you what we're
seeing in our search hits.
And if we look at our Advanced search,
I'm going to close some of these tabs.
So we search for this, we can see that it's
saying it found it in main.db.
So what I want to do is I want to click on main.db,
and in Database View, we should have some kind of chats where
the words "the pool"--
I'm just going to type it in here--
was found.
And it's like, OK it's not there.
So you can go back and say, OK, if it's not in chats,
what could it be in?
Could it be in Conversations?
Maybe.
Let's try that.
And that's where this can be frustrating.
If you're like, where is this, where is this?
Instead of doing what I'm doing right now, what I recommend you
do is switch to the Hex View.
Click on the magnifying glass.
Search for "the pool."
So here I'm searching for "the pool."
I'm going to click Find, and it will dig through and tell you
if it's in there or not.
So as it's searching, you can see we have a hit.
And here is your message, "I saw you at the pool!
Haha."
Another way some people find it, if you didn't
find the database first--
you can go into File Systems, scroll all the way to the top,
click on your Memory Image in your FileDump.
Click on your magnifying glass, and you'll
notice it knows I searched for that in the database.
You use that same thing.
Press Find.
And then you can see it finds two hits.
It's saying, hey, I know that this one
is "I saw you at the pool!
Haha."
And in here, there's something about the pool as well.
So this is where this is very important.
It could be wear-leveling but different ways
to keyword search.
Again, if you want to close all the things,
right-click and do Close All But This or Close all.
If you ever forget where your extraction is,
click on your home and it comes back.
The next question is about a calendar entry.
When did the user have scheduled to pick up a gurney?
So I'm going to click on Calendar,
and under Default calendars, you can
see we have "Pick up gurney."
Now my question for you all, how many of you
got this answer wrong?
The reason you got it wrong is because you
clicked on the source file, you went to "Pick up gurney"
and you reported this hex offset.
That is not correct.
That would be correct if I asked you where in the database.
But this question is specifically asking you where
in the file system.
So what you have to do is go into your file system
and use that trick I showed you.
Click on FileDump, go back to your calendar,
click on "Pick up gurney," switch to your FileDump,
and it takes you to it.
So now when you see "Pick up gurney,"
that is the correct answer--
hex 4FF2BFD.
So make sure you're reading the question thoroughly
and you're looking at what is the offset in the entire file
system versus where it was stored in the database.
This next one this is the first ringer I'm throwing your way.
We have not talked about pictures yet.
I want to know if you are in a situation--
so this question is, the user was
accused of stealing a handgun.
Can you find any photographs to support it?
Put yourself in the user or criminal or suspect's situation
at times and think if you were doing something,
what would you do with it?
We're going to talk about hidden pictures,
deleted pictures, all kinds of things.
But for this specific one, we want
to go into Media and into Images.
And I want to show you some tricks.
So you could sit here--
you could look at the Table View, not preferred
for this specific question.
You can go to Folder View, you could go to Gallery View.
I also don't recommend Gallery View for this situation.
In Folder View, start with if the user physically uses
their phone to take a picture, where is it going to be stored?
This is going to be stored possibly on an SD card in DCIM,
so I'm going to start with that.
I'm going to click on this little green button,
and it's going to pop out all of the photos.
Now, if you think 104 are too many, go back into your Images
and say, you know what?
I don't want thumbnails to start with.
I don't want to include those.
I just want the actual pictures, and you can start with 38.
Now what you see here, these are all the photos
that the person took with that camera.
So as you start looking through, you
will stumble across a handgun.
As you look at this, you're going
to see that we have the handgun.
If you look on the right-hand side,
you have the metadata associated with it.
We can even see a location of where
the person is, the position.
You could-- this should be a good example-- where
we could do hop to location.
It will take you on a map.
And you could say, OK, for this one, if you're online,
you can do right-click and Retrieve addresses.
And it tells you the location where that person was.
Now I can tell you-- because this is a picture of someone I
know holding a handgun--
that is not the correct address.
It is probably a rendered address.
But if you zoom in on that location, it's pretty close.
It was in Vienna, Virginia.
The street is just off.
So again, make sure you're validating
these artifacts, especially location information.
We're going to talk heavily on that in Section Two and Section
3 as we dive in.
But you will find key artifacts in here.
If anyone found it anywhere else, good job for you.
So there is one instance of it.
Now this is where you have to be careful.
If you narrow it down too much, you
could miss other instances of it.
If we look at WhatsApp images, we're
going to find that same handgun.
And now some of you will be like,
how the heck did you find that?
So here we have that same handgun shared in WhatsApp.
Go back to your original image and think about this.
We have 3/9/2013 as the modified date.
Remember the Go to cheat that I taught you?
Let's go to timeline.
Why not?
What you can do is under imaged or type, we could say,
OK we don't care about audio.
Clearly, you're not going to share
a picture of a handgun in audio, probably not calls.
And just narrow down some things here.
So I'm going to keep narrowing down.
I'm not going to say fuzzy events.
Images we want, yes--
Installed Applications.
So just narrow down some things of interest.
And as you keep narrowing it down,
you're going to see right after there looks
to be like instant messages.
As you keep looking down, you will find the WhatsApp message
where this was actually shared.
So as you scroll through it, that's
how some people stumbled upon it.
And they're like, oh, this is definitely where it was.
This is how the user shared that information.
Again, if you're like, OK it's still too much,
go back in and say I don't want all these images.
You can keep narrowing down what you need until you find what
you actually are looking for.
So it's kind of interesting what you
can do with these different types of filters in the tool.
But some people look through all the pictures and they find it.
Some people find the WhatsApp image first.
It all depends on your methodology.
Remember, it doesn't matter as long as you
get to the correct answer.
Key takeaways from this lab--
keyword searching is so important.
Know the different ways to keyword search.
Do not fear the hex search.
It is so important.
I recommend going out and reading my blog
on hex diving that can be found on the Cellebrite site.
If you Google "Heather Mahalik hex diving Cellebrite"
you'll find it.
It walks you through differences on how important it
can be in your investigation.
Remember, finding information in a database
is different than finding it in the file dump.