We are now going to start the second part of this Lab, 2.1B,
same data set, different questions.
If you were still working Lab 2.1B,
please press Pause at this point.
Otherwise, it's going to be spoiled for you because I'm
going to start the walkthrough.
The first question for this lab is regarding,
is the user syncing location information with Google?
Now, this is different than location services
being turned on.
So what I recommend is that you do something,
like, maybe keyword search for sync.
Keep it simple.
See how many results you get.
Now, if you get thousands of results,
that's obviously not recommended.
Something else you can do is you could go and look specifically
at your cheat sheet and say, I'm going to cheat this way.
I want to know where I'm going to look.
And you'll see, a lot of these are not really relevant.
But what we're going to ultimately find
is that in sync, and we can go to the sync directory, which
we see right over here, we have accounts.xml, stats.bin,
and status.bin.
I would quickly look at all those,
but I'm going to look at accounts.xml.
This file format viewer, I think,
is very difficult to use.
There's not a way to make all these arrows
open at the same time.
Some people like it.
I don't love it, especially if I don't
know what I'm searching for.
Now, if I know I'm going to search for the word location
and see if I have any hits, here, it says one hit.
Let's see if it takes me to it.
I don't find that very helpful.
I have no idea where the hit even is
So I don't know.
I'm going to go to Text View.
And in here, I'm going to search for location
and see if I find a hit.
So this, I think, is easier to read.
I see location.reporting, syncable as 1.
1 means true.
It's turned on.
So the person is syncing location data with Google.
Why did I just tell you this or ask you to do this?
Think back to my Google Cloud example.
What I would do is, if I had legal authority or consent
at this point, I would log in.
I personally like using Elcomsoft Cloud Explorer.
If you don't like using Elcomsoft
or you don't have license, you could use Physical Analyzer
to pull that Google Cloud location
information-- very helpful.
As far as two countries-- we already saw one.
In Axiom, we saw Czech Republic.
What you could also do quickly here is go to World map view,
and it's going be very clear, the person
has been in North America and the Czech Republic.
That is not the view I wanted.
I wanted World map view.
So we can see these two locations.
Other things that you can do, you could go into--
and you should be able to do this very easily in both tools.
If you look at Google searches, sometimes the file extension
on Google searches will help you if you see .cz, .fe.
But also, look at some of the language response.
So we can see Czech Republic searches,
obviously, things like Best Deep Dish in Chicago.
Doesn't mean I was in Chicago.
So keep that in mind.
But we do see things like Prague NHL hockey game.
So the Google searches will assist you.
Wi-Fi is obviously a big one.
So you want to check Wi-Fi cell towers, anything like that.
I also like to-- let me go back into Physical Analyzer.
So here, we have wireless networks.
And any events like that, I would check those.
But calendar-- most people don't think about this.
When you set a calendar entry, you
will set it for a place in the world
where you want to be reminded.
By default, it will be your home time zone.
But I want to take a look at this.
I'm following the source, and I'm going to calendar.db.
I'm going to switch to databases,
and I'm going to go into Calendar Events.
And as I scroll across, you can see
that I have in here, Mattia's birthday,
and that I wanted to be reminded in Europe, Prague.
The start time is when you create the calendar entry
or when you want to be reminded of something.
The end-- so when you see date end, it's when that time passes
or if it's a reminder when you check it off as completed.
Don't forget Calendar.
It's super, super important on what you can get there.
Now, we need to do some photo searching here
and you can do this in either tool.
But I want to know, when was the photo with a certain date
last accessed?
So I'm going to do what most people do.
Go into Media, images, and I am going to search for a file
name, which is 20191003_001.jpg--
oh, sorry.
I need a dot.
And you look at this, and you're like, I don't have anything.
So I would check and say, OK, is it really 20191003?
That looks good.
_001.jpg-- nothing is helping.
What do you do now?
External.db-- we're going to this database.
In external.db-- and I'm going to steal this so
I can cheat and not type it again.
I'm going to copy that.
I'm going to external.db, and I'm
going to go into files like we had in the slides,
and I am simply going to paste that same thing I just
searched for.
And I have no hits.
So this is where, OK, where is this going to exist?
As I keep looking, I'm going to remove the--
oh, you know what?
I forgot that single chunk in the center-- sorry.
That's a problem.
I'm going to just search like this, 2009 13--
there's a chunk in the middle, that 204824.
Why are you not working?
My search is broken.
Let's try this.
It's probably a typo on my part.
Yes, it has to be.
OK, I see what it is.
I have this typo here.
It's 205814-- there we go--
001.
Typos are your enemy.
So make sure.
That's a good example of-- people say, you fat
fingered that all the time.
Be careful what you type.
So in here, we can see this.
And what I need is, I want the date
the last photo was accessed on this Android.
So as we look through, we're looking for a date accessed.
So there, we have Unix Epoch dates.
We keep going-- display name, latitude, longitude,
date taken.
Let me zoom out.
I feel like I probably blew past it already.
There we go-- date_accessed.
I'm going to right click.
I'm going to do Seconds from UTC--
11/21/2019.
So that is our answer, at 16:17 UTC.
Now, when we're looking at these date accessed,
this is a good example here of, where, if the tool is rounding,
you may want to create your own query to handle this one.
So if I go to external.db, and I'm going to save this out.
I'm going to save it to my desktop.
I'm going to open the DB Browser for SQLite.
And I'm going to give you a little bonus query here.
So click Open Database-- never New,
unless you want to overwrite--
external.db.
And it's telling you, if you proceed, be aware that things
can happen to your database.
Create a backup.
I'm not going to create a backup because I never
work from the original.
I always export from the file system and can export again.
OK, so I'm going to go into Execute,
and I'm going to do Select, and I only
need specific things here.
So I'm going to do Select--
and I will zoom in so you can see it.
Title, because that's going to give us the file name.
I want just date_accessed because that's the only one
answering the question.
We don't need all the others--
and maybe display_name, no comma, from files.
Let's see how this does.
So I have a table in here that clearly does not exist.
Oh, I know.
I think it's underscore display name.
But if you didn't know that, if you go over
on the right-hand side, or if you go back into Browse,
you could look and say, what is wrong?
And you would see that the one needs an underscore,
that some of these have an underscore in the table name.
That's going to haunt you.
So I'm going to go back.
I'm going to fix that.
I'm going to do an underscore.
And we have happiness.
Red squiggles are gone.
Now, the date_accessed-- this is a Unix Epoch date timestamp.
So what I'm going to do is I'm going to do datetime and spell
it correctly.
I promised you all these typos, and you're getting them--
comma.
And then what we can do is you could either filter--
or you don't really have to because I think we
see our files of interest here.
But we could also do where--
and I'll zoom in for you--
title like, single tick, parentheses--
make sure it's both red--
and you could type in, again, 20191003_205814_001.jpg.
Oh, we need an underscore there--
.jpg.
I don't want it to be caps.
I don't think that will impact it, but just in case.
Let's see if this worked.
That did not work.
Oh, my gosh-- 1003.
I am the typo queen today.
Do not feel bad when this happens to you.
I'm going to get rid of the .jpg and see if it likes it that
way.
OK, so did not like-- oh, I see.
Do you see my mistake?
Title doesn't have a file extension.
_display_name had the file extension.
So again, it will take some practice.
But what I want to show you, the answer
wanted the number of seconds too.
Physical Analyzer, in this current version,
seemed to strip that and said just 16:37.
So if you look, and if time truly matters that much,
I don't know why it took away the seconds.
It's clearly there.
It's a decoding issue.
So take matters into your own hands.
Do it yourself.
And there is a nice query in the notes for you
to do exactly what I had just done there.
OK, how to make French toast.
So I'm going to start in Axiom.
This is very specific.
I don't want you searching for just French toast
because if you do search for French toast,
you should get some hits.
Now, this is a bug and Axiom, and I did report it.
They are working on it.
Because what you're going to find
is, if you click on Google searches, I think in here,
you actually see French toast.
And it wasn't-- yeah, right here.
It was missing this keyword search,
and they weren't sure why.
So Axiom did take my feedback when I was updating these labs.
And they're looking into that.
In Physical Analyzer, if you type those exact words,
how to make French toast, you are
going to find one hit for the Google Quick Search box.
And it is parsed.
Sarah Edwards and I did a presentation at the DFIR Summit
a few years ago, and I think we called it,
"Rolling, Hating, trying to catch us writing dirty."
And I got stuck with Android Auto.
She got Apple CarPlay, which is so much easier.
One of the key things I found, if you are communicating
to a car, and you are doing this to the car through your phone,
and you're doing it hands-free, this
could really matter in accident reconstruction.
Always examine the Google Quick Search box.
It will have one for the user that's logged in.
It will contain text of what the user was
speaking and the response.
Now, how you know if the person was speaking or typing--
if you watch that presentation-- and I put this in your Dropbox,
so you can go and watch it.
It's also on YouTube.
So you can look up Heather Mahalik Sarah Edwards Rolling
Hating--
whatever you want to type in there,
you'll be able to find it.
You can watch it and see it.
But I said, OK, Google, send a text message to Ronan.
And her response was, I don't have access to your WhatsApp.
However, if you timeline, you would then
see I opened WhatsApp, I typed the text and continue.
And I continue to communicating with her.
So your timeline is key here.
You will be able to see that her response was,
I don't have access to it.
And then I went hands-on, type a message, went hands free again.
Things like privacy dashboard and other things
may assist you with things like that digital wellbeing
if something is in the foreground or background, which
are the advanced decoding that's coming later in this section.
But this is where it could be difficult.
Also, Google continues to listen.
What's interesting is I asked at one point--
I was getting very frustrated with her
when I was creating this test data.
And I said, OK, Google, are we still on time
or still on our way to Tysons Corner, Virginia?
And she responds back something, but then she kept listening
because she recorded in plain text that you can read where I
said, I cannot stand Google.
Siri is so much better.
It's just written there in text.
So think about this.
If there's a car full of people, and the person
is asking for directions or asking
to do something hands-free, it will
pick up other voices around, potentially, and put it
into text.
Could be interesting artifacts for you to examine.