For lab 1.4, you are going to do a few steps to just dip
your toe in the Android waters.
In section 2, we're going to dive full
into this pool of Android and swim through all the evidence.
But for now, what I want you to do is go to your VM--
if you go to G Cases and look at Lab 1.4,
you will see that I created a backup file using the UFED.
In the UFED, I chose file system,
and it left me with a backup.
So if you wanted to parse with UFED,
just click on Samsung right here, and parse the data.
For those who like to do things manually,
I gave you access to the manual data.
There's backupab.
There's shared.ab.
Here's a Samsung directory with the backups.
For those who want to use AXIOM, I pre-process this for you
just for the speed.
So go into AXIOM, and click on case.mfdb,
and it's been pre-processed for you.
There's no waiting.
This lab should process very quickly in Physical Analyzer
as well.
So you will see, I have it loaded in Physical Analyzer.
I'm going to look at it in AXIOM, which is opening.
I recommend that you use at least two tools.
Now, the two tools could be--
OK I'm going to load it just in AXIOM or Physical Analyzer,
and then I will use DB Browser for SQLite,
or I'll export the file and look at it manually.
That's acceptable.
The lab is going to walk you through how to load in Physical
Analyzer, how to load in AXIOM.
And then there are three questions.
Was the Android device rooted prior
to the backup being created?
What supporting evidence can you find?
Question two is not questioning if Snapchat was deleted.
Snapchat was deleted prior to creating the backup.
Can you recover the username from Snapchat?
And what other artifacts were left behind when
the app was deleted.
And then, list two websites that were bookmarked by the user.
So things that should be simple, but the different tools
may do some strange things for you here.
So take your time.
Dig through it.
Access should happen quickly.
It's a small backup file.
And enjoy the lab.
If you are still working on lab 1.4,
just pause the on-demand recording
until you're ready for the review.
For the first part of this lab, we
wanted to know if the device was rooted.
There are many things you could do to detect this.
I'm going to start in AXIOM.
And I am going to go under Application Usage
and look at the Installed Apps.
And right away, we see a few things.
We can see this oneclickroute, and we
can see chainfire.supersu.
These are related to root.
So we can see that.
That's a good indicator that a root was actually installed.
You can actually see the full path
as listed on the right-hand side.
What you can also do is just search for the word Root.
And here, we can see there's Google searches for root--
which, a search does not mean it was installed.
So here we see searches for towelroot.
As we scroll out, we could see more searches
for different root keyword terms.
Under Media Pictures associated with root-- not relevant.
But here, Google Play, we see rootcheck,
Root Checker for the account, goodbyefelicia11.
Now, Root Checker checks to make sure your device is rooted.
Most people wouldn't download that unless they were paranoid
that someone was on their device or they wanted to check
and make sure they had root.
We have rootcheck.
And then we have oneclickroot, which actually shows as
installed, so that's helpful.
Under Operating System, under Android Downloads,
you can see that the person did download
towelroot and oneclickroot.
Now look at this towelroot.
Look at the timestamp.
So it's towelroot APK, towelroot-1.apk,
towelroot-2.apk.
Malware in roots and anything that
could be malicious in nature with the same timestamp
will download multiple versions to make sure they land
on your device.
I will mention this again in section 4,
but I like to mention it here.
And then there's obviously keywords and snippets.
You should be able to find similar results if you
search for a root in Physical Analyzer
and look at your results.
So same thing.
You'll see installed applications,
you'll see the searches, you'll see what was installed.
It's just up to you on your preference.
You don't have to use two tools for this one.
So chances are good that the device
was rooted because we found the actual install of the root.
For the next part, Snapchat--
so again, this is not up for debate.
Snapchat was deleted.
But what I want to do is, I want to go into Tools.
And I'm going to run Fuzzy Model plugin and let it Run.
I'm just going to do a quick glimpse
and see if I see anything associated to Snapchat
that jumps out.
And I don't.
If you weren't sure, you could type Snapchat and see,
and you don't have anything.
What I also want to do is I'm going to go into App Insights,
no matter how you want to get to it.
I'm going to search for Snapchat.
And I'm going to run the AppGenie on it right here
and just see what it can get for me.
Because we know it was deleted, so we
want to see if we have any luck.
And you can see no AppGenie artifacts were found.
So that's a bummer.
Let's go into Magnet.
And under Custom, I'm going to look for Snapchat.
I just want to see if anything.
Oh, and I have a Clear a Filter because it's limiting me.
So I'm just scrolling down and quickly
and looking for Snapchat, and I don't see anything.
Now, this is where you have to keyword search in y our tools.
So I would type Snapchat.
And all we need to uncover is the username and anything
that's residual on it.
So here, we have a, Welcome to Snapchat."
The account is goodbyefelicia11@gmail.com.
And we can see, as we scroll down, it says, "Hello,
feliciajones11.
We now have the username, feliciajones11.
Where it's pulling this from is this amazing little file
right here called logs.db.
Now, this logs.db is unique to Samsung.
I'm going to talk more about it in section 2.
What its purpose is, I have no idea.
But let's take a look at it.
It's kind of cool what you can get.
And let's switch to Database view.
And under Logs, this is where you could just type the word up
here Snap.
You don't have to write a whole query always.
So here, we have Team Snapchat, datetime stamp,
when you look at this, I would say Unix Epoch millisecond
because it's too long.
It's more than 10.
So let's convert that guy.
We look at this, and we see, yeah, milliseconds.
So we start looking through.
You can use your Over Arrow.
And there's the message.
Hello feliciajones11, Before you start Snapping,
goodbyefelicia11@gmail.com.
So the tool did it right.
You can look in AXIOM if you want, whatever you prefer.
This is a perfect example of, we quickly found the answer.
We quickly validated.
We did not have to write a query, done.
This file right here is super important.
Under Shared, 0--
0 is the primary user--
you have a Snapchat directory.
It is 0 bytes in size.
Depending on how the user deletes the app, you could say,
do you want to delete all the user-created files,
or do you just want to delete the application for use?
So different forms of deletion will impact what you can find.
All of the tools should show you,
even if it's an empty directory, you still want to see it.
So if I go into File System, click on my Top Directory,
change this to All Subfolders, and then Search for Snapchat,
you should see that we get that empty directory.
So AXIOM does the exact same thing.
OK the final one--
I'm going to go back--
is name-- think bookmarks is what we're looking for,
user-created bookmarks.
There's two websites that were bookmarked by the user.
So if we go into AXIOM, and we go into Web-Related,
what you can also do-- let's see if we can do it this way.
In Artifacts, type Bookmarks, excellent.
I'm going to check these and start here.
See if I can answer the question.
It looks like we can.
So Samsung browser bookmarks--
we can see it looks like we have smarterforensics.com,
smartequinepak, and target.
Now, how do I know these three are user-created.
Look at the differences-- device name.
If I scroll over, we can see when it was
added, when it was modified.
So you can tell the difference in user-created versus not.
It also tells you that the table is bookmarked-- pretty easy.
AXIOM made that simple, easy for us.
And Physical Analyzer, you could search for Bookmarks here,
and you get 0 results.
So it looks like it didn't parse bookmarks.
You could go into--
you could keyword search for it.
You could actually dive into where you knew,
but if you didn't know where you were looking,
and if you didn't have AXIOM, let's go in here.
We're in these databases now.
You could try to search for bookmarks here,
and it finds any hits.
And it found that partnerbookmarks one,
but that doesn't have anything.
These are all non-user-created.
So what we need is the SBrowser.
So you can search for SBrowser.
SBrowser.db bookmarks-- there they are.
So not all tools are created equally.
AXIOM made it super easy.
You can go up and filter and just say, show me bookmarks,
and it worked.
Cellebrite didn't do so well on that one.
This is where you need more than one tool to work these labs.