It is now time for the first lab of section 3, 3.1A.
Notice it's A, so do not close your parsed image before we do
3.1B.
In your VM, if we look at 3.1, what you've been provided
is the file system.
If you want to go through manually and look at this I,
do not recommend that, but you can.
For Physical Analyzer, there used to be a method 1, method 2
access.
I want you to see what this looks like.
This is now all merged into one advanced logical extraction
on the UFED.
So we have an advanced logical extraction.
Just click on iPhone_Merged.
I pre-processed this in AXIOM for you.
So if you go into AXIOM, click on Case.mfdb, it will parse,
and you could start your analysis.
We are now going to review lab 3.1A.
If you're still working on it, simply press pause on demand
and continue when you are ready.
The first question is about Wi-Fi.
Where in the world is the user when they connect to Starbucks?
And I know that may seem annoying to you,
but Starbucks is a common place where
people go to get on Wi-Fi.
So if you go to Wireless Connections
and you search for Starbucks, it will quickly
pare down where it is.
So we could see that the user is in Starbucks.
We could see the address for it.
If we right-click, you can see if you
can do a retrieve timestamp.
It's not allowing us to retrieve timestamp,
but it does say Go to Location.
So let's try to go to location and see what happens.
And if we zoom in-- and again, apologize for my zooming
skills--
and we keep zooming, what we are going to find--
and I'm going to see if I can retrieve address.
As you start retrieving address, you
will see that it actually is--
here's the one we want--
in Paris.
But some of these may not be possible to retrieve.
So as you find the Starbucks, you
can also see, if you keep zooming in,
the picture of my coffee cup in Paris.
So there are nine items here.
And if you click on the nine, it should appear there--
if I just slowly click and wait maybe.
It'll tell you how many are pictures, how many are Wi-Fi.
But as you zoom in--
if I can keep doing it--
it will eventually break them out into more items.
But all mine are right there in that city center,
so they're kind of overlapped on each other.
You could also use something like wigle.net
to look up the Mac address and see
where the person was, or SSID.
Here we go.
They're starting to split up now.
They're just all in such close proximity.
So the more you zoom in, the more you will see.
How many SIM cards were used?
What I would do is start with the tool
and see what it tells you in the extraction summary.
So as we scroll down, we are going
to see information in here.
We see ICCID, last user ICCID--
which is the serial number of the SIM card--
last MSISDN-- that's the phone number.
But then we have other phone numbers.
So you want to know if it's getting this correct.
And you can see it's pulling it from CellularUsage.db
and com.apple.commcenter.plist.
I'm going to go to CellularUsage.db.
In Database, I am going to go to Subscriber Info.
And right here we can see we have a subscriber ID.
That's the ICCID.
We have the phone number and last update time.
So this is the Mac date timestamp
we're going to convert this--
Seconds from 1/1/2001.
And we see the timestamps.
Now you, can also see a last update time for this,
but more importantly, do you see how it says row 2?
If you go to sqlite_sequence, it tells you the current phone
number is row 2--
so the sequence number.
The tool did get it right.
Proving different phone numbers when activity occurred
and different ICCIDs could also help put you
in a certain location for an artifact.
For this next one, we're going to look at the movie.
I have seen so many students in person time
this movie by watching it.
In AXIOM, it rounds, and I want the actual answer, not
any rounding.
So if we go to IMG_0003.mov, AXIOM will find it.
And as we look at it--
let me find the one where it actually tells us--
it says it's 3.67 seconds.
But that's not good enough.
I want to know the real time-- no rounding.
So in here, we should be able to see that it's rounding up.
So as we look at this information,
we don't want that.
We want the actual time.
If we go into Physical Analyzer, you could search as well.
Again, people will play the movie, watch it.
That's not really going to help you.
So as we look at the movie, and you keep looking at the movie,
we can see that it exists, but we want to know the truth.
This is going to be in photos.sqlite.
So I'm going to search for photos.sqlite.
Show All 4-- and I want to go into the actual photos.sqlite.
Now, in here, I'm going to go to the table Z_GenericAsset.
And I have 11 items.
This is where you could create queries.
You could do all kinds of things that you want.
In Z_GenericAsset, I am going to search for IMG_0003.mov.
It brings it down to one.
Now, you definitely could write a query, but all I need to know
is, where is the duration?
So I'm just going to scroll across,
and there we have the added date, created, ZDuration.
Here is the truth.
So that is how long the video actually is.
Were any photos in a recoverable state
when the device was acquired?
So the first thing you need to know
is, when was the device acquired?
We see 3/17/2018.
Now we need photos.sqlite again.
I am actually going to export this, and take it
outside of my tool and write a query for it.
So I'm going to save this on my desktop.
I'm going to create a folder just called Databases
to keep it clean.
And what I'm also going to do-- and this is super important--
is I am going to save out the write-ahead log.
The write-ahead log of photos.sqlite
stores a lot of transactions before they hit that database,
and without it, your timestamps may not match.
So I'm just going to save that to the same location.
I'm going to leave my tools at this point.
And I'm going to open the DB Browser
and point it to that photos.sqlite.
Open-- now, let's write a query for it.
So I'm going to select, star, from photos.sqlite--
or sorry-- from ZGENERICASSET-- holy moly--
ZGENERICASSET.
And I get everything.
But now I can start saying, OK, what do I actually need?
What am I trying to prove here?
I need to prove what exactly the user had done with deletion
at that point in time.
Now, if this is the point where you're like,
oh, this is awful I'm never going to get this right,
let me show you a cheat method.
Click on your workbook, the star.
Go to Exercises, Lab 3.1.
Scroll down.
And instead of torturing yourself, copy the query.
So here we can see there's the query.
Just copy it.
Say copy to clipboard.
Go back into DB Browser, click on a new tab, and paste it.
So why torture yourself, if you don't have to?
If you're like, that is insane--
I can't do it yet--
I'll do it for you.
It's right there.
So now what we have are all of these files.
We need to know if anything was still in the deleted state.
So here we can see there is one, 3/15/2018.
Would that still be accessible on 3/17?
Absolutely-- so we need that file name, IMG_0001.png.
In your tool of choice, go in and search for that.
So I'm going to search for IMG_0001.png.
And what you're going to see--
here in AXIOM, it says data it was deleted.
So it was taken on 3/11, deleted on 3/15-- great.
In Cellebrite, how this will look--
when we look at these graphics, we see the same thing--
so modify date, deleted date.
So the tools should parse it and show you it's deleted.
Make sure you look at that photos.sqlite just in case.
This was captured during the extraction.
OK, so I'm going to close all my tabs.
I'm going to right-click, do Shift, close all but this.
I'm going to keep DB Browser open just in case
we need it again for that one.
I'm going to keep my e-workbook open,
and an AXIOM I'm just going to clear--
all filters so that, when we get to part 2 of this,
it's not confusing to you.