It is now time for Lab 2.2A.
Again, notice there's an A. So when you process this data
and you're complete, don't close it.
Just pause your VM, listen to the rest of the lecture,
and then we'll get to 2.2B.
To
Axiom has been pre-processed for you for this lab. /
But it's going to struggle.
So I want you to make sure you're listening at this point.
So I'm going to load Axiom.
Let me actually close this one.
It is going to struggle because a physical acquisition was
extracted using UFED Premium.
However, the size of it was obnoxious.
When I extracted this, I think the entire size was 160 gigs.
I can't give you that much data.
So what I did was I extracted only the user data partition
that has files that you need.
Axiom doesn't understand how to handle that.
Since this issue, I have provided the exact same copy
and style of extraction magnet so they can handle it.
Now, when you look at this, you're
going to be like, oh, Yeah, that's great.
It can handle it just fine.
Everything goes well until you start clicking.
And as you click around, it will eventually come up and says,
it cannot locate source.
or. when you go into File System and you try to dig in,
maybe it fixed itself.
Maybe I'm wrong .
We'll see if this happens.
Right now, nothing's happening.
But you will find, eventually, where it may, up top here,
say it cannot locate source.
If that happens, there's nothing you can do to fix it.
It actually looks like this version of Android
is liking this extraction.
So they may have fixed it.
So let's hope they did.
You have Physical Analyzer available.
You can just click on that UFED shortcut.
And you have Axiom available to you.
Don't forget.
You can run ALEAPP.
You can start exporting files to dig in with the questions.
If you are still working on Lab 2.2A,
hit Pause in the recording so that you don't have a spoiler
alert when I walk through this.
The first question is about a backup account, which we
covered earlier in Section 2.
In order to know if a backup account is
set, what you have to first do is look at the current user
account.
So on this device, it says there are two device users.
And we can see one of them is called Secure Folder, which
we are going to talk about.
That's interesting to us.
Secure Folder is a way to hide and encrypt
almost in a mobile application management
platform on Samsung devices for free.
We also see something for Bradley Jackson.
So as we look, we need to see what Bradley Jackson's email
address is.
So I'm going to go into User Accounts,
and I start to see here morningbradley@gmail.com.
Now, we are going to go look at accounts.xml
or backup accounts.xml-- sorry.
If backup account.xml says morningbradley@gmail.com,
it means there is not an additional backup account.
You are not forced to create backup accounts
on these devices.
I do on all my test ones just because, if I forget
a passcode, I want to be able to recover
things to get back into it.
I also recommend to all my friends
who have children that have androids,
create a backup account that is your email address
so that if your child's device is ever lost
or something is happening with them,
you can potentially use your login
to get access to their data.
So here, we see morningbradley@gmail.com.
This means the user does not have a backup account set
for this device.
OK, this next one is interesting.
When did the user Bradley become friends
with Dan Geruss on social media?
Who initiated the friendship?
So Geruss is a unique last name.
I'm going to search for in Axiom.
I'm just going to search for G-E-R-U-S-S and see what I come
up with--
not too many hits.
So when I start looking through some of these things,
I want to see if I am able to tell
when the person became friends with Dan on social media.
So if I go down to social media, we can start seeing Instagram
and see if we have a date/time stamp.
Not seeing one there.
Facebook contacts-- still no major timestamp. jumping out.
Instagram direct messages-- no.
So now, let's look at Facebook messages.
As we start looking, we can see say hi to your new Facebook
friend, Dan.
Now, this isn't crystal clear on how did they become friends?
Who established a friendship?
Did she request him?
Or did he request her?
So as you start looking, we can see
if we can find anything of interest here.
And it's not really helpful.
So I'm going to switch.
Let me look at the Samsung message really quick.
There we go.
Perfect.
Samsung messages-- look at this lovely screenshot.
Bradley, Dan Geruss accepted your friend request.
So screenshot, for the win.
I was about to switch to Physical Analyzer, which
also parses these Samsung messages in snapshots.
But a snapshot proved, very easily,
who accepted friend request.
If you go out to the table of interest,
you can always find it there as well.
But you may have to prove or disprove
how friendships were established or how relationships were
formed in many investigations.
All right, now, we want to do some location digging.
Where was the user on January 3, 2020
around 10:00 AM Eastern time?
So I'm going to go into Physical Analyzer for this one.
And I am going to go into the maps
and just see if I get a clue on where
the person was on that time.
So here, we have January 3.
What you can do is start doing retrieve address.
And it looks like 300 Light Street, Baltimore, 300 Light
Street, Baltimore, Friendship Road, Baltimore.
So we start seeing all of these different artifacts.
And all I'm doing is on right clicking and doing
retrieve address.
And it's just pulling out all these addresses-- so Aberdeen,
Maryland, Baltimore, Maryland.
It looks like the user is clearly
around that Baltimore area.
What are some other things you could have found?
So you could do some timelining here that will assist you.
You should be able to-- if I do go to timeline,
let's see if some of these let me hop to the timeline.
Remember, some of these won't let
you always hop to the timeline, which is frustrating.
Timeline-- you should be able to walk the actual path
that I took while driving.
Also, check your order to make sure
that it's going in the order that you prefer--
if it's ascending or descending, so it makes sense to you.
So if I go to timestamp of 1/3/2020,
I'm just going to do-- oh, sorry--
1/3, Geez, Louise.
I'm going to do 1/3 to 1/3.
And it's going to pare this down a bit.
If you don't want some of the junk images,
you can potentially get rid of them.
And you'll see, like, the description
on what some of these are.
But you're also going to see network usage, where
the user was connected.
We're going to see apps that are in use.
So what I'm going to do now is I'm
going to get rid of some of this stuff.
I'm going to Deselect All.
I'm going to say, I want images, network usage,
wireless networks, and see how that starts.
And as we start looking through, we still
need to get to our time of interest, around 10:00
in the morning.
And you're going to start seeing.
So this is actually a Facebook post.
This was a picture taken at BWI.
And as you start crawling down this,
you're going to see cellular background,
the fact that it looks like they were connected to H Denali.
So as you go through, you will ultimately
find different Wi-Fis, applications,
things this was connected to.
But the device location is correct,
and it was Baltimore, Maryland.
There are other files of interests
that are really cool here.
And I want to show you one because it's super creepy,
and it's coming up in the slides, and I love this file.
And I also have this in the Android location cheat sheets.
WeatherClock.db, this file is interesting, very interesting.
When you look at this, you're going to have table weather.
And you're going to see this COL_WEATHER_TIME.
1/3/2020 at 14:32, as you look, IT
says it was cloudy in Baltimore, which is the current city.
Baltimore is in the United States of America.
It may provide latitude/longitude.
It gives you the time zone.
It's going to tell you sunrise time, sunset time,
how much rain is predicted.
It is going to track the most recent city the user was in.
Now, what's really awesome is, if you look at the wall,
file the write ahead log, which we have not talked about yet,
this write ahead log, as you dig through it,
is going to track at least the second to last location,
if not more, on where the user was city-wise.
So it's really cool what you can get from these two files.
This is the widget just in case you ask for weather.
How many people use Facebook?
So for this one, I'm going to go back into Axiom,
and I'm going to search for Facebook.
So I want to know how many people and how do you know?
How did they leverage it?
So as I look for Facebook, I can see, right away, I have web.
I have communication.
So I want to see, first, can I see what the person's Facebook
name is?
So as I go, let me go back in to Cellebrite Physical Analyzer.
Let's go into Analyzed Data, User Accounts.
Do we know this user's Facebook name?
So here, we can see morningbradley.
We can see Jackson.
I'm going to search over it here.
Bradley Jackson, Facebook ID.
So I'm going to try to exclude something in Axiom
to make this easier.
So I'm going to try a search that says--
oh, it doesn't want to let me do that in here.
I think I would have to do it in Physical Analyzer.
Let me see really quick.
If I do Facebook--
I want to see if I can say and not Jackson.
So I have my search hits.
So if I search for Facebook and not Jackson,
I have no idea if this is going to work.
This is the first time I'm trying this.
So this could be a total failure of a demo,
or it's going to be amazing.
So this took us down to, still, a lot of hits.
Yeah, it's still too many.
I'm going to go back to Axiom.
So in Axiom, what we're going to start
seeing as we look through this, we're
going to have some of these Chrome cache records.
I'm going to look at Chrome Web history.
That seems like a good place to start.
So here, we start seeing Facebook and saying,
OK, we have Facebook, Google search, facebook.com.
This starts to get interesting.
Please confirm your identity.
When you see that, the person is trying to log in as someone.
And whether this be those quizzes where it's like,
show five pictures of your friends.
Could I tell you how difficult it is on my test devices
to remember who my friends are?
It's really, really tricky.
Please confirm your identity.
And then we could see some oauth.
So here, it looks like facebook.com redirect
to sign into Google accounts through Chrome.
This is getting more interesting.
Looks like the person is now trying to leverage Chrome
to sign into their Google account.
And then here, we can see Facebook.
We have friend requests, adding friends, and going through.
But then, we also see Chrome Web history again.
And ultimately, we see facebook.com, Hank Livingston.
So now, this is interesting.
What I'm going to do is I'm going
to add Livingston because we know it's not Bradley Jackson.
Who is Hank Livingston?
So here, we can see Chrome logins, 1.
livingstonhank11@gmail.com was used from that login data.
His password was obtained there.
Remember when I told you, if you ever see that password
and it's not making sense, go into Physical Analyzer.
So here, I'm going to go into Search
and Web, Web History, Chrome.
I'm going to search by Facebook right here in this table view.
And as I start looking, I see Hank Livingston.
And we should be able to stumble upon it.
If you can't find it here, go to User accounts or passwords.
Insert for Facebook here and see if we have luck.
We want to see if we can uncover that passcode that he used.
So that's Bradley Jackson--
not very helpful.
I'm going to go into User Accounts now.
I'm going to try here, Facebook.
OK, now, we see livingstonhank11@gmail.com.
We see his passcode, Justin1329.
We can see that he used https://facebook.com
through Chrome to log in.
Chrome logins had that passcode for livingstonhank@gmail.
Now, what you cannot say is that Hank was physically behind that
screen because what if Hank has used Chrome on Bradley's laptop
before?
Those passcodes could be synced.
So Bradley could technically go and access the Chrome login
and log in as Hank.
But Bradley logs in through the app, Hank Livingston
logged in through the browser.
So just walk this path and try to make
sense of this information.
Four key takeaways from this lab--
location artifacts are everywhere,
user account information is everywhere,
you are going to have to balance between multiple tools
to really solve these questions.
Now, had I given you the entire image,
ALEAPP would have had much more information for you
that would have been helpful.
Because the way I redacted it, a lot of it
is not extremely helpful, although you should
be able to find this BWI--
Baltimore Washington Airport Wi-Fi
for that one location artifact.
But it's my restriction of the data
to make the lab data smaller that prevented you
from getting all of the information you could have.