OK, we're going to play some games now.
I am going to show you these slides on how
to execute these queries.
And then we're going to play a game where
I'm going to make mistakes and point out
to you what is going wrong before you do this lab.
What you see in black font and bold, SELECT and FROM,
those are not optional.
Every single query must have that.
If I did select star from ZKIKMESSAGE,
that would provide every single column possible
because it's a star.
It's a wild card.
Keep that in mind.
This tool that you're looking at here,
this is the DB Browser for SQLite.
It is free.
It is amazing.
Look at the colorization of it.
So we could see SELECT and FROM are the same color.
It looks like all the columns are one color.
And then the tables are different.
If the colors don't match, you probably have a typo,
or you're making something up that does not exist.
It's a great clue.
What's also important is, if you put a comma before from,
you're going to get a crazy looking error.
And I'm going to show you what this error is
going to look like.
So I am going to--
I'm going to export--
I'm going to choose an easy table of interest.
Which one shall I choose?
I don't want to choose anything that's super enormous.
OK this looks very random.
I don't know why that table's called Jane,
but this is the one we're going to go for.
I'm going to export just a table of interest.
And we're going to examine this outside of the tool.
I want to choose one that I've never
seen before so you can see how mistakes are actually made.
So I'm saving it to my desktop, and I'm getting rid of it.
You don't have to do this.
You're just going to do the lab.
Under Mobile Device, Tools, I'm going
to choose DB Browser for SQLite.
Now, this next step is very important.
Do not choose New.
This is not a forensic tool.
This tool lets you edit databases.
If you choose new, you're going to overwrite your data.
You want to choose Open.
And I'm going to choose tts.db.
Now, on the next tab, under Browse Data,
we have this table called Jane.
Not really sure why it's called that, but this is what we have.
And in here, it looks like we have text, paths, update_time,
storage_type, and text_type.
Now, this is a perfect example.
If you were only looking to see if someone reported oil
on a road, you don't have to write a query.
You could simply type oil, and then you have those results.
So you can leverage the tool very simply like this
if you're just looking for a quick answer.
But if you're looking to include something, what you want to do
is go to Execute SQL.
So we're now over in this tab.
And I just want to show you.
So I would type SELECT star FROM Jane or whatever that table is.
Do you notice my colorization?
Everything is happy.
I press Play, I get results, the world is a happy place.
Now, where things go bad--
boom.
Underlying red squiggles means very unhappy with you.
You have to read the message.
And down here, it says, near comma syntax error.
That means something's wrong.
So something doesn't make sense here.
It does not like that comma.
You get rid of it, everything goes back to happy.
Now, what I'm going to do here is
I'm going to get rid of my star, and I'm
going to type text comma path comma update_time.
And now, it narrowed it down.
It will put your columns in the order that you have up top.
If I put the comma before from, its really unhappy again.
It's, like, no, I can't show you anything.
So just make sure you watch that.
If you don't know what these items mean,
this is where you have to do some research and testing.
It's very, very important that you don't just make up
what you think it means.
You need to do some testing in this point.
Here we're looking at an iOS device.
How do we know that?
We have Z, and we see that time stamp starts with 4.