If we have to prove an app was used,
this is actually a lot easier on Android
than it is iPhone if you don't have a full file system
acquisition.
So keep that in mind.
Look at all of the italics that we're starting to see here.
You're going to see slides going forward,
you're going to have italics.
Also, depending on the time of the acquisition--
Knowledge C and some of these other files
will only retain data for a period of time.
I am currently working on an investigation,
and the issue is, the crime happened in April,
but the phone was not acquired until that following November.
That's a really long time.
So there's no knowledge C data, because it
is no longer accessible.
So keep that in mind.
If you do have a full file system acquisition
and you obtain it in a timely manner,
you're going to have a great experience
with trying to prove the applications were used.
One of the first things I want you to do--
consider the time stamps.
Does the timeline make sense, and do the time stamps
make sense?
Now, when I say, do the time stamps
make sense, look at the time stamp
of the external container, and then look
at the contents within it.
So let's take a look at this.
If we go into the VM--
and I am going to choose an app.
Let's say Safari.
And we start to see all of these date/time stamps
in here, like 1/29/2020.
If we keep looking, look at your date range,
just of what you have--
1/3/2020.
And then what I want you to do is actually
go click on the source, follow the source file,
and hover above that database.
If these date/time stamps do not make sense--
here, we could see date changed to 1/29/2020.
OK, date modified.
1/29/2020.
When you look at these dates, if you see something where
the container has data that--
let's say the container is 1/1/2020.
And then you look inside of that,
and you see that there's stuff from 2022.
That could be a symptom of the person wiping their device
and then restoring it.
We're trying to delete things and restoring
or syncing data to it.
Look at the container date/time stamp versus the contents.
When you download from iCloud--
and I will mention this a few times.
So if you wipe your device and you restore from iCloud,
when you wipe that phone, most of these containers
get a created date of when that phone first
rebooted after the wipe.
However, when you restore from iCloud,
you would see that the creation date of, I don't know,
sms.db or one of the applications
could be today's date.
And then you see information inside of it
from three years ago.
And you're like, how is it possible
that something was created today but has old contents?
It's because the user restored using that same iCloud account.
To dig a little bit deeper, crash logs.
Remember how I showed you, in iBackup Bot,
that we connect the iPhone live to the system
and we collect those crash logs-- we export them
to a case folder?
Great evidence proving an application
was used at a certain period of time.
We're going to take a look at datausage.sqlite
here in a second.
And it's exactly what it sounds like.
It tracks the usage of data for applications.
itunesstoredto.sqlite is going to track what
was downloaded from iTunes.
Now, we have two that are in italics,
which means we need a full file system acquisition.
Uninstalled applications plist and mobile installation,
and then the log files associated.
So this is going to be tracking apps that
are installed and uninstalled.
If you don't have a full file system acquisition,
you can still look for mobileinstallationhelper.log.
You could look at the ads.
What ads is the user typically going to get?
What is the guest language?
applications.db is going to help you with where
the apps exist on the device.
And then the two that are extremely helpful,
and you're going to focus on in your lab,
rmadminstorelocal.sqlite.
This is screen time.
So everything that you're doing on your device, how much time
you're spending in the different apps, how you even
navigate to the apps, is going to be tracked.
Knowledge C is the brain behind everything.
Without Knowledge C, iOS investigations
are very difficult to do.