It is now time for Part 2 of this lab.
We're looking at 3.1's data set again and working on part B.
We are now going to review Lab 3.1b.
If you're still working on it, just
simply press pause, and then resume
when you're ready to continue.
The first question is about, where in the world
has this phone been?
And I realize that could be a difficult question.
And it's one that, if I read that,
I would work the rest of the lab and come back to it.
There are so many approaches that you can do to get to this.
You could simply go into location artifacts.
So I'm going to go into AXIOM and just
switch to world map view and see if I get a clue.
Here, it's showing just France.
So it's saying, OK, there are pictures taken in France.
We already knew that.
We saw that artifact from before.
I want more information on where it's been.
So I'm going to try location artifacts and Physical
Analyzer.
Let's see what it tells us.
And remember, you have to validate this.
Here, it also agrees.
It's saying France.
So what else can you find?
If we go to Wi-Fi and you start right-clicking and try
to do retrieve locations if it will allow you,
you may find different information.
But look at some of the Wi-Fi names.
We could see wireless network in Paris.
Here, we see some others.
You could also grab some of these addresses
and look them up in wiggle.net.
Now, where you have to be careful is, if the user is
connected to a home Wi-Fi, you may not
get the exact location of that Wi-Fi network.
So for example, winelove.
Some people look it up.
And this one right here.
And it may show you Chicago, or outside of Chicago,
or outside of Tennessee.
And this could be where my network service provider is
or where my router is.
It's not going to show you my exact home address.
But that would put the device in America, New York.
So that's a different one that you could do.
Another thing that we can do is look at--
if you remember, we talked about this yesterday.
So I'm going to switch my view in AXIOM.
I like column view.
Look at Google searches.
Here's a perfect example.
Do you see how it says google.fr?
This is in France.
It's interesting that the person is looking at "am jailbroken?"
But here, we can see tours in Paris being searched.
So that FR helps.
We can look at calendar.
We talked about that on Android.
Let's see if there's anything of interest here.
I'm going to go out to calendar.sqlitedb,
database view.
And calendar item.
And I have a lot of calendar items here.
So we could see, there's all kinds of information in here.
But as we scroll across, you will
see that there's a start_tz.
What this means is the time zone that you
want that event to start.
If you see float, think about this.
What do you think float means?
Float is simply, wherever you are in the world,
that calendar reminder is going to float with you.
Here, we see Europe, Paris.
There is a start date.
Do you notice there is not an end date?
This was a reminder that was set.
It would not get an end date until the user checked the box
for completion.
So I always just look at start_tz.
And down here, we see two for America, New York, as well.
So those are two additional time stamps.
Weather is another good one.
And if weather exists on it, AXIOM--
or Physical Analyzer should parse it.
They've listened to me, finally.
Weather.
The last time the person looked up weather,
they were in Paris, France.
And you may have found some others.
Location traces are everywhere for these devices.
Is cloud sync enabled on the device?
So I want to start with com.apple.backedupd.
So I'm going to search for backed up.
Just backedup.plist, sorry, not backedup.d.
I'm going to go out to here.
And what we can see when we look at this,
it says cloud sync enabled--
true.
Cloud sync enabled modification date on 3/3/2018.
What this means is, the person is syncing to the cloud.
They changed a setting on 3/3/2018.
If we keep looking, we can see modification dates.
Looks like they possibly modified something on 3/17/2018
and that the language is English.
So that's what we have from this file.
Now, where you have to be careful.
Cloud sync is different than iCloud backup.
So if you look at the Settings here,
cloud backup enabled-- false.
That is for iCloud backups.
What I asked you about is cloud sync.
Remember how I said Google collects information
on Androids even if it's not creating a backup?
Apple collects things in the cloud,
even if it's not a full backup.
That is if that's enabled or not.
And then you can also look at cloud configuration details.
There's lots of information on cloud that you can get.
Now Bluetooth.
Now, Bluetooth can be very, very tricky.
So I'm going to start in AXIOM.
And I'm going to go into Connected Devices.
And here, we can see Bluetooth devices seen
versus seen Bluetooth devices.
And we are looking for a surge.
I want to know, did the user ever connect to surge?
When we look at it, this is where
they need to normalize how they're wording this.
You need to know what the actual source is.
So I'm going to click on that.
And it takes us out to ledevices.other.
If you remember, in the lecture, I
had said these are devices the person came in contact with.
If you pair with it, it would get moved to this database.
So let's see if we find surge in that database.
Paired devices, 0.
So there's nothing, according to this.
However, we also have that plist file of interest.
So I'm going to go into Physical Analyzer.
Click on Bluetooth.
And I'm going to search for surge.
And see if it agrees.
And you can see it saying it's from ledevices.other,
which means it was not paired.
It was simply detected.
But I want to show you something else here that's interesting.
I'm going to clear surge.
So here, you can see the person is
connected to Hank's AirPod Pro.
We have a time stamp.
Now, this is super important.
And if I was not in Paris when a detective asked
me to research this, I would have never gotten
the correct answer.
So this detective that I met through IASIS
was working a situation where, actually, in Pennsylvania,
where I live, a female was intoxicated, crossed
lanes of traffic, and killed a family.
So they needed to know if she was driving handsfree or not,
because I guess in the state of Pennsylvania,
if you're handsfree during a fatality,
your prison sentence is different
than if you're distracted and drunk.
The issue?
She says she went to a party around 6 o'clock.
The accident occurred around 11 o'clock.
UTC minus 5 is Eastern Time.
So he was like, is it--
are these dates stored in local time or are they stored in UTC?
So I was like, I will help you.
The issue is, I didn't have a vehicle to connect to.
I only had my AirPods.
So I kept connecting Hank's AirPods and looking at it.
But what was so confusing to me is,
the data wasn't making sense time frame-wise.
I was like, it makes no sense.
I would document when I connected
and then look at the file.
The connections are stored in your home time zone.
So all of my time stamps were showing America, New York,
and I could not make any sense of it.
I had no idea what was going on.
So I was expecting it to be UTC +1,
or whatever Paris was at that time.
But it wasn't.
It was showing me UTC minus 5.
So I was trying to make sense of this.
And then I realized, oh, my goodness.
It is when you set up your iPhone
and you select your time zone.
The Bluetooth file is tracking that time zone.
I have no idea why.
So if you're ever working in an investigation, you're like,
this is weird.
If the person never leaves their time zone, you're safe.
But if they do, this makes a big difference.
So what he had to look at was, it's
stored in local time of your home time zone.
It's very important that you read this article.
The vendors weren't aware of this.
So since that paper came out, the tools have tried to update.
I would say try.
Make sure you verify.
Showing the home time zone.
Alexis updated iLEAPP to also reflect
this, because most people were unaware.
I would honestly say I was also unaware
if I was not in Paris testing something that was showing me
America, New York.
So imagine if you're in your home time
zone trying to test this.
It's not going to be very helpful.
This is the first clue of Apple doing weird things
with time zones.
Is the user syncing photos to iCloud?
If so, when is the last sync?
I'm going to go into my file system here.
And what I'm going to do is, I'm going to just contract all.
So I'm going to press on this button
and say collapse all of these.
So I can navigate out.
And I'm going to go into the file system.
I am going to go into photo data.
And what I'm looking for is this directory,
CPL, cloud photo library.
And in here, we have these different plists.
We have this one here called initial sync marker.
Let's take a look at that.
So this says just a date--
3/15/2018 at 18:05:29.
OK, I'm going to keep that open.
What about sync status?
Now, we can see that there was a last update check on 3/17/2018.
We have an initial sync, we have a last sync, last sync date.
These are good pieces of evidence.
So the person is syncing photos to cloud.
Now if you have photos that exist in cloud,
they will exist in that photos.sqlite file, as well,
that we looked at in Lab 3.1a.
Key things to take away from this lab.
The first weird timestamp that we have seen so far
is from Bluetooth-paired devices.
It is going to be in the home time zone
when the users set up their phone.
I had someone ask, well, what if I move.
So if you live in Eastern time and I moved to California,
when will that change?
That will only change if the user resets their phone
and logs in and says, I'm now Pacific time.
So I travel all around the world with my phone.
Just because I'm changing it temporarily
is not affecting that home time zone.
Make sure you know how to keyword search in your tools.
Make sure the value of these plist files.
Sometimes the answer is right in front of your face
if you know the correct plits to look at.