The final lab of this section--
again, this one's a little bit more challenging.
I think the first few questions are simple if you go back
and you look at your cheat sheet or if you
review to your courseware.
The Samsung Health one is not.
I want to give you some clues here.
So I already loaded my data into Physical Analyzer.
I opened Axiom as well.
So I have both open.
You are going to find a tool called
Agent Ransack in your VM.
And this is under Utilities on the desktop.
I'm just going to open this.
And here, it's saying, how do you want to use this?
This is personal use only.
And if it ever prompts you, the personal light version
works just fine.
Now, what you need to do-- and this
is where this is really strange, so watch carefully.
Under Look in, where it says C, if you go to the right,
those bubbles will appear to select the folder you want
to go to once you're hovering.
If you're not hovering, it's not there.
So here, I'm going to choose that.
I am going to, just to give you an example, go to--
I'll pick a lab from Day 5, once you haven't seen yet.
I don't want to ruin anything for you.
I select the folder.
What I recommend is when you find the text file of interest,
you export it to your desktop in a directory called Health.
You don't want to point it to your whole desktop
because then you're going to get distraction.
So then, you can start typing words.
So up here, I could type, location.
And it's going to say, hey, this is what I found.
It's telling you the file where it found it
and then what it's actually seeing.
So you could type wifi, and if there's no matches,
it's going to say no matches.
But key words I suggest for, you, maybe stop, start,
exercise, sport, walk, run, depending
on what the lab is asking.
And this is completely optional.
You could also run strings against it.
There are many things you could do.
If you're still working on Lab 2.2B,
now's a good time to press Pause and wait until you're finished
before you see the walkthrough.
The first part of this question is about,
were there any cleanup tasks set to run on this device?
So I'm going to search for ns,db because that is the database
that is going to track this activity.
And in here, I'm going into Packages,
and I'm going to scan down.
And you'll see, it's picking up transactions as well.
Or you could also go out to com.google.andro
id.gms.databases.
But I'm going to see if it's at the end in here.
Here we go-- ns.db--
and let it take me to it.
Pending ops-- in here, we have all these target packages,
the classes, the tags.
This is difficult to look at.
So this is where I start typing things like flush, nothing.
Wipe-- oh, so now, we have wipeout.
It looks like it's going to wipe android.gms MobileDataHub
task--
clear.
Now, we have more.
Look at this one, vacuum service.
So that's the first I've ever seen vacuum service.
And it looks like it's going to go through and run.
You can also see something telephony spasm.
That's interesting what some of these words
that we're seeing here.
So we have clear.
What else can we try?
Wipe, delete, so clean up periodic tasks--
these are all the tasks that are going to run.
So again, you can do multiple keyword searches,
whatever you deem relevant.
But just know you could also just
filter and see all the things.
You could scroll over, and sort by date time stamp if you want.
So remember the runtime?
We can change that timestamp.
And you will see all of these options.
Question 2 is about secure folder.
When I taught this class in the summertime,
I was asked by a student after this lab, what happens
if you delete Secure Folder?
Does it remove it from the device?
So I did some testing.
And just so you're aware, if the user turns off Secure Folder,
it does delete everything it's protecting,
and it's as if it never existed.
So this user folder of users 150 will not
exist if the user wipes their device.
So I'm going to go up here, and I'm going to collapse all.
And I'm going to dig into data, system, users.
And here, we see user 0, user 150.
User 150 is Secure Folder.
And then, in here, we have all different types of files
that we can examine.
So I want to know the possible dates of usage.
So as you start looking here, if you hover above these files,
going to see that date of 1/3/2020.
So what we want to see is if we can find any other dates
other than 1/3/2020.
You can sit here and look through all these files.
But then I want you to think outside the box.
What about screenshots?
So let's go into Media, images.
I'm going to go into Folder view,
and I'm going to search for 150 and see if I have any luck.
And I do-- four snapshots.
Let's take a look at these.
So in Gallery view, you can see here,
it's saying, OK, no information, but we
see that 1/3/2020 timestamp.
No profile information, 1/3/2020.
It looks like video history, 1/3/2020, and more 1/3/2020.
So it's just screenshots of what is
happening when I was setting up Samsung
secure folder or using it.
So we have that date so far.
What about some of the databases that track activity?
So I'm going to try launcher.db.
And in launcher.db, under Favorites, not writing a query,
I'm just going to type secure.
And we have Secure Folder.
Let's see if we can find a timestamp.
Modified-- let's check it out--
1/3/2020 still.
And I would document these timestamps as well.
So we're still stuck at 1/3/2020.
If we go into Snapshots, let me zoom out here, go back
into our images.
So regular user snapshots not just 150.
150 is going to track what that Samsung folder is doing.
But what we want to do here is see, if we look through this,
is there anything of interest that's going to help us?
So here, we see Snapchat.
Now, this is interesting.
This shows some walking, so that may help you in your lab.
Here, we have some text messaging, Facebook,
some black screens, and that's normal.
Remember that.
Here, we're looking at storage on the device under Files.
I believe this is actually when I
was in Samsung's secure folder going through and adding things
that I wanted.
Here, we can see Samsung secure folder was searched for.
If we look over here, we still see 1/3/2020.
Here's where we see Samsung secure folder, right there.
The user was searching for it up here.
So that's another indication of it, but just dig through.
One other thing that I would do is I'd go into Axiom,
and I would go into Application Usage,
and I would search for a secure folder or even just secure
and just see how it does, if it shows any other date
timestamps.
So here, we see an event for 1/1/2020.
And it tells you it's using it from usage stats.
I would trust that.
That's a good one.
So we have a different date.
Here's something from 12/30, usage stats as well.
So clearly, there are other dates
that we weren't able to uncover easily.
They do exist.
OK, I am going to close out some of these tabs.
I'm going to do what I told you to do.
I'm going to run the Fuzzy Model Plugin--
Tools, Run fuzzy model.
I'm going to let it run.
You'll see the green bar at the bottom.
And this next question is difficult.
It's, when did the user last record a walk as a workout,
and how many steps did the user take during that workout?
Now, walk is the key word here.
So if we go out to Samsung Health, and this
is going to be com.sec.android.app.shealth.
There we go--
206 glorious files.
If you go to Databases, I said the word
walk to you intentionally.
So if you start looking through this,
you could spend a lot of time going through.
But the reason I chose a walk and not a run is I
was hoping it would take you to pedometer settings.
So under pedometer setting, I want to click on this.
And we have goal activity.
we have pedometer setting.
So let's take a look in this.
As we look through here, what we are going to see
is a last sport workout time.
So this timestamp right here, this Unix Epoch time stamp,
you could copy this and put this in date decode.
Or you could also just switch to here.
And we see 1/1/2020.
OK, that's interesting.
Now, this 18:00, this is going to be UTC.
So right, now it's showing me UTC.
You have to convert that to where the person lives.
So if you're not sure, you need to go and check
their time zone settings.
So we have 1/1/2020 as a time of interest.
Look at this, right down here.
Pedometer last time zone--
OK.
Now, we know we're in Eastern Standard Time.
So we have some things to work with here.
The next thing you want to do is we have to go find that file.
So if I go out back into--
and I'll zoom in here in a moment.
If we go to Files, remember, we have these logs.
We have these m files and these r files.
And this is where the real fun is going to begin.
So we need 1/1/2020.
We don't want the metadata file of it.
And I'm not sure if that's what m stands for,
but that's a good way that you'll remember it.
We want this r.
I'm going to export this.
I'm going to do Save As, / like I told you,
on my desktop, New Folder, and I'm calling it Health.
OK, the next thing I'm going to do
is I am going to leave the tool, and I'm
going to start searching in here.
So what we want to search for are
things like last sport workout.
And some of you would be like, how do you know that?
I know that because I created the test data,
and it still was hard to examine.
So imagine being the one that's just doing this blind
and not knowing.
So keywords that I recommend--
last sport workout, exercise, stopped, distance.
But first, click on that little bubble.
Go to your Desktop.
I'm choosing Health and saying, yes, there's
only one file in here.
So I'm going to search for laStsportworkuottime, all one
word.
And I probably have a typo.
I'm just going to try sportworkout.
Nothing is working.
Let me make sure it exported my file.
Actually, it might still be exporting.
I'm trying it right here-- last sport workout time.
See if it's-- oh, it's Agent Ransack that's not cooperating.
OK, so maybe we'll have to play the game in here.
So if I do that one more time, so I can find it,
last sport workout time, we can see
that we have a timestamp for it, and it is listed right here.
If you look at that, that should correlate
to what we found in pedometer.
But now, we need to know how many steps the person took.
So is there a distance or something we can find?
So what you can search for--
and we also have a timestamp over here.
We see 13:46.
So I'm going to now search for distance.
And this is where you're like, oh, no, there's
going to be a lot.
There's going to be all these different items.
How do you know which one?
So this is where this is really important.
I'm going to zoom in here.
This distance says 3,863 steps.
It tells you the calories.
Now, what's really cool is this exercise logger
ID is unique to that exercise.
So when you see that sport workout stopped,
it will also reference that 4435.
If you saw a different one, 4436,
that's a completely different workout.
So everything you're doing is tied to that.
So we know the person took 3,863 steps on 1/1/2020
starting around 1:00 PM in the afternoon.
Simple, right?
Now, there's bonus homework.
Where did the activity take place?
Sadly, I have so many students that just
dig, and dig, and dig in here.
That's not going to help you.
What you're going to need is this timestamp,
the 2020-01-01 around 1:00 o'clock in the afternoon.
And you have to go back into your tools.
Where I would go is straight to Location.
And we can filter on timestamp, 2020--
so January 1, 2020.
We say, OK.
And we find two photos here.
So we see this photo, and we see this photo.
If you right click and you do Retrieve Address--
and this is taken at 12:38, so it's
right around one sport workout stopped, and retrieve address.
What you are going to find is that it's
at 1875 Poplar Hill Drive.
Now, what's really interesting--
the files that I had shown you, where I said nearby,
this is close.
The workouts are actually correlating with some of those
that I don't understand when it was pinging information.
So that may correlate to some of this.
Apple Health tracks location right inside of the database.
All of these different applications
are going to do things differently.
This is where you may have to test it yourself
reach out to the community see what other people have done.
Read all Josh Hickman's blogs to see
if he's already uncovered something
before you dive in manually.