Where are you going to start?
We have all of these apps.
We live in a world where people are obsessed with downloading
apps, using apps.
Some conversations may start in one app
and continue in another.
It can be very confusing.
When we look at the data, what I recommend is,
start with your tool.
Triage.
Take a look at what your tool is showing you.
Look for permissions.
When we think of the privacy dashboard on Android,
we are going to look at tcc.db on iOS
and look for key permissions.
That may also be an indicator on where
you need to drive your research if something isn't parsed.
Always follow the source file.
And again, with the source file, what I mean by this is,
click on the link that the tool is showing you.
And I will demo that again in a second.
And then keyword search.
Within your tool, what we want to do
is start following the source.
So let's say--
I'm going to go into analyze data.
And we'll look at Notes.
So when we click on Notes, following the source
means simply clicking on the link.
And it could look differently depending on your tool.
And it also could look like a simple link,
or you may have to hover.
I want to show you two different ways.
This is the first way.
You click on the notes.sqlite wall.
And notice it's in the write ahead log.
And you can examine the data you're looking at.
That's following the source.
Over here, you can also see where you can go in
and you can export out the files of interest
to look at them in something else
by right-clicking and doing Save As.
If it's a chat message--
and this is something typical that you
need to get used to seeing--
if you click on the chat and you want
to follow the source, on the right-hand side,
click on the source.
And it is going to show you the files that it parsed.
Here, it's parsing a FriendsFor Async
Decode plist and chatConversationStore.plist.
So as you click on it, you get some different views.
If you want to hex search, you could
do that right in the hex view.
If you want to look at the file format viewer,
it's just a normalized way to look at the data.
Now, where it could be frustrating is,
as you click on some of these down arrows,
there could be a whole plethora of down arrows below it.
So just play around with the different viewers
and see what you like.
Within AXIOM, the plist viewer is also available,
and it's really nicely decoded.