It is now time for the first part of Lab 2.1.
Now, I realize you're taking this class at your own pace.
What I recommend is, when you process that data for 2.1,
don't close it.
Just pause your VM so that when it's time for Part 2 or B,
after I'm done lecturing a little bit more,
it's already processed for you.
I've already pre-processed in Physical Analyzer,
and I just want to show you how the data is laid out for this.
So we go to Lab 2.1, you can see Universal_Android Access.
This was created using Cellebrite Premium.
Click on the UFED access.
You don't have to check any special boxes.
Just let it process.
And then AXIOM was pre-processed for you.
So we just click on Case.mfdb, and it will open.
And you'll be ready for analysis.
As a reminder, your e-workbook--
here we go.
You want to click on Exercises, 2.1A,
and you now are going to start using more than one tool.
Remember, you have db browser for SQLite.
You have different options in here that you can examine.
If you are prompted for the wickr password, select Cancel.
If you're prompted for the IMEI, select Cancel.
If you're prompted to Enrich data, it's your choice.
But I would say, cancel.
It's not going to add relevance to this investigation.
Those are things I would maybe do for the challenge.
You have four questions to answer.
Now, this is where simple things, where you're like,
aw, why didn't Heather get a simple extraction for us?
Simple things-- full name, email address, Facebook password,
current phone number, and date last logged into the phone.
The second part, a conversation.
Now, this is tricky.
It could be phone.
It could be third-party apps.
It could be chat messages.
It could be texting.
A conversation happened on October 3, 2019.
Who was it with?
And where did you find it?
This is a real conversation between two humans,
not a welcome to Snapchat, welcome to T-Mobile,
nothing like that.
How many times did the user attempt
to talk via a phone call to that West Virginia phone number?
And then we want to finally look at some EXIF metadata.
Locate the photograph taken on October 1.
Where was the photograph taken?
Please list the city and country.
From this point forward, be very careful
choosing Eastern Standard Time, or Pacific Standard Time,
or whatever time zone the phone says it is.
These phones have traveled worldwide.
If you are still working Lab 2.1A,
please stop at this point, press Pause on the OnDemand recording
because I'm about to review it.
We need to identify simple items about this user--
her email address, primary accounts, phone numbers.
What I would recommend is that you look at the extracted data
to see if you get anything of interest.
So one of the things we see here is this phone number,
703-944-0355 from SimCard.dat.
I would click on it just to verify that that is
the most recent phone number.
And in here, we can see we have some unique identifiers.
So we have that SIM card serial number,
which, if you hover above it, you can see is the ICCID.
And we have the SIM card Change Time.
And ultimately, we have the SIM operator and the phone number,
which is correct.
So we have a portion of it.
But we have to keep digging.
So if we look down here, we're not
seeing anything specifically about account information.
What I would do next is go into Analyzed Data
and into the user accounts--
so Device Users.
And then User Accounts is the second.
So now, we have some more information.
We know her full name is Mable Oxford.
We can see this Last Logged In date.
Now, I always recommend verifying this
because you want to know what the source is that the tool is
parsing that from.
And then, we can see that she's the owner on the file system.
So over here, it's telling us, 0.xml.
Let's go and check it out.
0.xml gives us a lastLoggedIn date,
this Unix epoch millisecond.
Hover above it, 1/3/2020 at 18:36 UTC.
OK.
So now, we are missing her Facebook password
and her Gmail account.
So I'm going to go back into Analyzed Data.
And this time, I'm going to go to User Accounts.
And some of you may have gone straight to the databases
and dug it out that way.
That's completely fine-- whatever
makes the most sense to you.
So in here, right away, we start seeing mableoxford@gmail.com.
We see her phone number.
But what's interesting is, we see these passwords, Grizzly11,
grizzybones, password.
When we look at grizzybones, this is interesting.
Do you notice how it says, com.facebook.katana?
The user used Chrome to log into Facebook through the browser.
And Chrome knows everything about you.
We are going to talk about Chrome in Section 5.
Chrome is the ultimate stalker of the browsers that we use.
I live for Chrome because I need it to remember
my passwords most of the time.
But here, we can see it grabbed it from Login Data.
Now, what I want to show you is what Axiom does with this.
So Axiom-- if we go into--
I'm going to actually search for Facebook and Chrome Logins.
Do you notice how Axiom can't parse the passcode?
And if you look at this, this is how it appears in the database.
So most people would say, oh, I'm going to go to login data
and look at that.
You would see the blob appear exactly like this.
It's encrypted.
Physical Analyzer was able to decrypt it,
most likely because it was a universal Android
access created with a Cellebrite UFED product.
But if you're seeing something like this, and you're like,
I wish I had those passcodes, use another tool
and see if you can find it.
Now, where Axiom, I think, makes things a little bit easier--
if you didn't to go to 0.xml, if we look at Application
Usage, Android Usage History, sort by Last Accessed,
you're going to start seeing a drastic amount of 1/3/2020.
That is typically what I would do to prove last usage.
We're going to start relying on usage stats, which
we mentioned, if you think of--
remember when I was doing the dumpsys demos in Section 1
and Section 2 at the beginning AND
showing you different ways to interact?
We're going to start leveraging that now.
So this is user activity, and this
is what we're seeing under here under usage stats.
So you looked at it manually through command line.
Now, we're seeing what it looks like in the extraction.
OK, a conversation-- and same thing with this one.
You could timeline in Axiom.
However, Axiom does; not decode the user name exactly
as we need to see it.
So what I'm going to do is, first, I'm
going to switch to Conversation view because, remember,
it's going to take everything I see
and just narrow it down drastically.
So now, I have a smaller data set.
And I'm going to filter by Date/Time.
And I'm going to do dates between October 3, 2019
and, let's say, October 4.
So it's going to really narrow this down.
Now, this is where you have to find a real conversation.
So what I didn't want is any of the things
back and forth, like, say Hi to your Facebook friend.
I wanted actual messaging.
So as I keep going through, this is
a lot of say Hi to your Facebook friend.
Do you want to wave?
But here, we start to see something else.
So we have an actual message.
Hey, love.
Hope all is well with you and Hank.
And it looks like it's between Mable Oxford and another party.
Now when you look at this, this is where this gets interesting.
So we have display names--
Mable Oxford.
And we know that she is the one that ends in 686.
So this one is the mystery.
This is the one that we need to figure out who that is.
We could go into threads.db2 here,
but I prefer to look at this in Physical Analyzer.
So what I'm going to do is I'm going
to go into Physical Analyzer.
And I am going to go into Messages, Chats,
Facebook because I know this word is.
I am going to search for Hank.
So hi, love, hope all is well with you and Hank.
Now, this is something that's interesting.
If you hover above that little icon, it's telling you
it's from a mobile device.
If you hover above it and you see a PC,
that means a Mac or PC.
A good example is I use WhatsApp all day long on my PC
and on my Mac.
It syncs to my phone.
But at least you would know, hey, Heather
wasn't behind the device at this time.
She was actually syncing from another place.
So that can be really helpful to you.
This is another place where you maybe
want to take a screenshot of what
you're seeing here because it's not going to be in the table.
But here, we can see it gives a name, Felicia Jones.
So how is this different?
If we look at the sources, and we go out to threads2.db,
it's telling us it's parsing it from messages.
If I go to Database view, Messages--
and I will zoom in here in a moment--
and I search for Hank, we can see
it's a one-to-one message, a thread key.
And if you scroll across, we could see Mable Oxford.
We don't see Felicia Jones yet.
That's what we're looking for.
Can we find Felicia?
And we're going to keep going through this,
and nothing jumps out.
Now, this is where table joins are going to come into play.
And I love table joins.
A lot of people think I'm a crazy person
for loving the table joins.
But we see this unique ID right here.
So what I'm curious about is, if we look over here at a table,
is there a table that is possibly going
to tell us who this user is?
So if I start looking, I see threads users, maybe.
And I look at 82.
I'm going to sort by ID and see if I can find it.
And I don't see it here.
So I'm like, OK, not here.
What about threads participants?
And I look, and I say, OK, here's an E2.
Let me see if this gives me a name at all.
And this is where it is going back and forth
and trying to find the right table.
And this is where it's not always easy.
So if I keep digging, thread users by user key.
Now, we have the user key, but we still don't have a name.
Threads, there's thread key.
So if you're at this point you're like, hmm,
I don't know where I'm going to find the name,
this is what I recommend.
So you could sit here, and you could keep hunting.
Let's switch the Hex view.
Let's do what we learned in Section 1.
Click on the magnifying glass.
I'm going to get rid of where it says Facebook
and just have that identifier, and click Find.
And now, we have some hits.
And as we start looking here, it says ONE_TO_ONE.
What I'm looking for is that name.
Some people would also say, you know what,
I'm going to search for Felicia Jones, which is easier. .
But I'm trying to show you, if you did not know the name, what
you could actually do--
so right here.
And if you hover above it, it's telling you
it's a profile picture, where it's pulling it from.
But we can see Facebook, with that identifier,
is tied to Felicia Jones.
And then you could also see her picture if you needed to.
So it may be a little bit of a hunt.
Cellebrite decoded it for you.
But this is the perfect example of when Tool A does one thing,
Tool B does something else, you need to go to the database
and verify.
The next question is about that West Virginia phone number,
I believe, and how many times was communication established?
So I'm going to search in Physical
Analyzer for 304-657-5000.
And let's see what we get.
It says, seven sources.
So we look at this.
According to Physical Analyzer, two outgoing calls
and one incoming call, and then a chat that says, call me back.
Now, if you look at the timestamp of these,
you can see they're all relatively close in nature.
Sol what I would do is say, let me go into Axiom.
And I'm going to clear my filter.
Also, switch from Conversation view,
or this will really mess up your search.
And I'm going to search for 304-657-5000.
And Axiom says that there are four call logs .
So this is where this gets interesting.
Do you notice how this one right here at 27070 is different?
And you look at this, and we see a date/time stamp.
If we look at this one specifically
that just looks different that says Local User,
you can see it was unanswered, 0.
Now, we have to validate and see what's happening.
So I go into Physical Analyzer.
I'm going to click on calllog.db.
I'm going to go to Calls.
And I'm going to search that table just for that number.
So I'm not writing a query.
I'm not doing anything above and beyond just simplifying
the search.
And now, this gets interesting.
The database says there's four.
This one right here, duration of 0.
We're going to focus on this.
We're going to scroll across.
And you are going to see log type 300.
The person responded with that text message
that said call me back.
The text message is actually stored in this database.
So this is where this is interesting.
Physical Analyzer parses it as a text.
That's true.
Axiom parses it as a call.
That's true.
How do you explain this?
So this is where you see these different log types.
What I would prefer is if the tool said
there was a zero for answered.
And maybe, it would say ignored and then
show responded with a chat.
That's a request I put in.
The vendors seem to think that's a little bit obnoxious.
But I am pushing them to do that kind of thing.
But just know, log type 300, that's what it means.
Now, I'm going to close some of my tabs here.
Actually, I'm going to click on Extraction
Summary, right click, and do Close All But This.
And the final one, it's totally up to you
and how you want to look at it.
I'm going to go into Analyzed Data,
and you could do this in Physical Analyzer,
or you can do it in Axiom.
Let's do this Axiom view.
So I'm going to clear my filter, World map view, Media,
and it narrows it down to 342 pictures-- not too bad.
Now what you can do-- it says on October 1, 2019.
So we could say, all right, I'm going to filter.
And we start to see some pictures.
So as you click on them, you say, View Details,
and you'll see, immediately, that we have this location
artifact.
As you scroll down, you'll see information about It.
But what you have to do is you have to zoom in--
and I apologize.
I am terrible the zooming process here.
So let me see how I do.
I always go way too far.
But we're getting a little closer.
So we can see here, it says Praha,
so we're in Prague in the Czech Republic.
And now, I've lost it.
I zoomed too far.
I'm a terrible, terrible zoomer.
But that is where that takes place.
In Physical Analyzer, you would find the exact same answer.
This is going to help you in Part 2 of your lab
because there's going to be a question about which
different countries the user has been in.
So at this point, leave this open.
Just simply clear any filters or anything you have running.
In Axiom, I recommend going back to your column view.
In Physical Analyzer, close anything
you had open, so it's clean for the next portion of this lab.