One request I do have-- if you come
across a really cool file on Android, and you're like,
I bet Heather would like to include this in the class,
please send me information on it.
I get it.
Even if you cannot send a sample,
I will try to replicate it.
I will find it.
I will research it and add it.
We have tried to find, from this point forward, the key things
you need to know based upon questions that are always
asked.
Starting with, did an SD card ever exist in this device?
Think about how many times you've gotten an Android.
I have an Android right here.
There is an SD card slot right here.
If you needed to know, did Heather ever
have an SD card put inside of this Android,
this file will give you the answer
So here, we're looking at external.db.
And we can see we have files.
Now what this means here is we have 245 files.
We can see the data, and we can see here
that says it's storage/emulated/0, which means
primary user on that Android.
We can see what it's associated with.
We have some screenshots.
We have Snapchat activity.
We have Whatsapp activity.
We have a date_added.
What type of timestamp is this?
If I gave you five seconds to answer,
I hope you said Unix Epoch.
It's 10 digits in length, and it starts with a 16.
But we know the file size.
We know all types of information from this.
External.db is extremely important
in your investigations.
Do not assume your forensic tools will parse this.
So this is a good place to start and say, OK, I
know that an SD card was inserted in this.
Or the person just uses emulated storage.
It will save time in your investigation.
There is a query in the notebook that I will give you access to
during this course that contains information on external.db.