At this point, we are going to start Lab 1.2.
Now I want to walk you through loading it just in case
you did not follow along.
So we're going to switch to our virtual environment,
and within the virtual environment, what
you are going to find is I already pre-processed this.
So say that you were taking this class, you took a break
and you came back.
Where you're going to find it is an AXIOM, Lab1.2.
And all you would have to do is click on Case.mfdb,
and it will load.
You don't have to wait again.
If you have not, you need to open AXIOM Process
and follow the exact same steps of Lab 1.2.
It's going to tell you how to walk it through, load the iOS
backup file, things to select, and then
ultimately, you are going to end up with the results.
If we look at the E-Workbook for Lab 1.2,
you see the instructions on how to load it.
You have four questions in here.
So we're going to look at OK, you found a picture.
We looked at the picture of the handgun and location artifacts
in Lab 1.1.
Now we want to know, did this actual device
take this picture?
Is there significance to the term bash?
So you're going to leverage that keyword searching.
We want to know some dates and times
on when something was created.
And then we want to use a specific date
and use that relative time filter in AXIOM
to see what was the user doing 10 minutes
before and after an action.
And then ultimately, we want to see
if you can determine a nickname or any bio
for an application of interest.
So kick off Lab 1.2 and we will review this shortly.
If you are still working Lab 1.2, hit Pause on on-demand
and continue the lab.
Otherwise, you're going to get some spoilers because I'm
about to review it with you.
For the first part, we need to know first what type of device
are we examining?
Now, some people would say, how do you not know that?
It's a backup file.
What if you recover these from a PC or a Mac or cloud.
You may not know what that device is.
When we look at this inside of AXIOM,
we're going to go under--
I think it's under Application usage now--
iOS device information.
And we look over here, and we can
see we're looking at an iPhone X or iPhone 10.
Now what we need to find is that picture that's being asked.
So I'm going to do a search on the top right,
for IMG_0088.jpg.
So all I did was type that in up here,
and we can see we have media and we have custom.
Now, we don't really care about custom.
We actually care about these pictures.
And can we tell any metadata associated with it?
So as I click on each one, here we can see the picture.
And as we scroll down, we can see this
was taken with an iPhone 6s.
Now what you cannot say is that this user did not take this
photo, because this user could have taken this photo 4/15/2017
and then synced it to cloud, got a new iPhone,
restored their data.
Maybe it's syncing from somewhere else.
All you can say is that this picture of this dog
was taken with a 6s and the extraction I'm looking at
is from an iPhone X.
For the next part, I'm going to click Clear Filters.
We're asking if there's any significance to the term bash.
So if we go into Keyword Snippets,
we ran that keyword for bash.
Now what I'm going to do is I'm going to search by item,
and this is the part that's not exactly fun.
You want to look for anything that you can read.
So look at this right here, mobile uploads, dog pics, bash.
So it looks like the word bash is
a directory for whatever this is here from mobile uploads.
Same thing with the second one.
We're seeing mobile uploads, dog pics, bash.
Now we keep going.
Here I start to see Dropbox.
So now I see an actual activity.
It says photos.
It has a date/time stamp, and it looks
like something was uploaded into that bash directory.
So the significance of the term bash
is clearly it's a directory, possibly within Dropbox.
Now this is going maybe a little bit beyond,
but I'm just going to search for Dropbox
and look at Keyword Snippets.
It dropped to four.
So you went from all of those keyword hits to just four.
And now we can look in this and we actually
see that there's traces to Dropbox and that keyword bash.
Keywords can matter a lot, especially if you're
trying to choose file knowledge or prove file knowledge to say
that not only did Heather know that this directory called bash
existed, but she had pictures of all of these stolen dogs in it.
Or if I had something called "Heather's secret files"
or "Heather's stolen work documents."
It obviously proves user knowledge and intent.
So that's something we're always trying to do.
OK, when was the last note created?
So we need to go in and under Documents, we see Apple Notes.
And when we look at this, we could sort by modified date.
And we can see on 1/18/2020, we have
two notes of interest-- something called
"Remember" and this 1/18/2020, but then we
have this 1/7/2022 one.
Let's take a look at this one.
"Don't forget...
Take out the trash."
It looks like a list.
Take out trash, book vet appointment, groceries,
and pack for trip.
OK, interesting.
So we now have a date and time of interest, 1/7/2022.
Now what we want to do is take that date/time stamp
and do the dynamic app finder or the-- sorry-- the timeline
on the fly, relative time filter.
You can do that right from here.
So we have this timestamp.
And the lab is asking you for 10 minutes before and 10 minutes
after.
So if I select 10 and 10--
and I'm just going to zoom in so you can see that--
this is what we want to take a look at.
So I'm going to say OK.
And I want it to show in the timeline.
So it's going to build my timeline.
And here, we're looking at all of the timeline things.
If this gets overwhelming, what you can do
is you can switch this to Artifacts view
to see if anything jumps out in your face.
So what I'm going to do this time
is I'm going to do this again, and I'm
going to change this dropdown into my Current explorer view.
Like, show me things I can actually
read without being overwhelmed.
And now we see we have media.
Media, we can understand.
This is quick wins.
So we're looking at quick triage.
That timeline is going to be more deep diving.
So here what we're looking at, we
can see it looks like Snapchat.
We have some pictures.
We have pictures of dogs which potentially
could be associated to bash.
Now look closely at this.
You're going to start seeing application information.
Here we see TikTok.
And we can see mrlloydxmas0.
So now we have a username, and we have a TikTok.
Looks like we have a movie.
This looks like more details of a movie.
You can press play.
You can watch these within.
So here we can see it looks like some kind of TikTok
feed possibly and additional information.
So start with quick wins.
Again, if the timeline overwhelms you,
just change your search.
OK, the final part-- now that the person
or the user of this device is an active TikTok user,
can you determine his or her nickname and bio information?
So if we want to search for TikTok, let's do that.
I'm going to Clear Filters.
We also saw that mrlloydxmas--
I'm going to search for TikTok in the top right.
And let's see what we have here.
So we can see we have Luv4Dogs.
We have mrlloydxmas0.
But let's look at what this says.
So Identifiers, Column Name, Nickname.
So the nickname for this person is Luv4Dogs.
It's telling you it's a TikTok contact.
It tells you where it pulled that information from,
which I'll get to in a second.
mrlloydxmas0 is the username.
Now, this is where I want you to validate.
If you go over--
AXIOM has said for a while they're trying to change this.
Instead of being the actual backup file
path where it shows you the legitimate file path--
so if we click on this, it takes us to that legitimate database.
And what we can do is, we can look at these databases.
You can actually click on a pop-out,
and Drag the screen over.
And here is where we see custom ID, which
is the name, mrlloydxmas and Luv4Dogs.
So it did get it correct.
But again, verification is key.
And I'm going to click the Home button to go back.
Your key takeaways here--
and I'm going to add something in this.
When the yellow bar up top has shown,
it's because you have a filter in place.
Always clear filters.
Always make sure, in your file system view,
that you are at the top directory
in its decrypted state, if that's relevant.
You keyword search with all subfolders.
Leverage that timeline on the fly or relative time filter.
You can do that multiple ways.
We can click on an artifact that has it.
And you'll notice, not all of them do.
And of course, I picked two in a row that do not.
I'm on a roll--
picking a lot that do not.
We know Apple Notes does because we clicked on it.
When you click on the Filter, key thing,
if timeline overwhelms you, switch to Current Explorer.
And whatever view you're in, it's
going to show you those results in that view.
OK, at this point, you can close AXIOM.
And we are going to continue with the slides.