Lab 3.2.
This is one of the few times I'm going to tell
you to just use one tool.
And the reason I want you to is, Lab 3.3 is
the secondary part of this lab.
So let's take a look at this.
Within your VM, if we look at Lab 3.2,
you have been provided with a checkmate extraction.
So here, we can see we have a UFED file.
We have a Cellebrite UFED checkmate extraction.
We have the keychain dump.
We have that backup keychain plist.
Just click on that UFED shortcut file and it will parse.
AXIOM will parse this, but you're not going to need it.
And the reason being, you're going
to answer specific questions.
And what I recommend is, when you're done with this lab,
leave this extraction open.
Because Lab 3.3 is simply me exporting files and folders
of interest from Lab 3.2.
So you're going to do all of your validation in that part.
But I'd like for you to keep it open
so you can go back and forth and kind of see what's going on.
We are now ready to review Lab 3.2.
If you are still working on it, simply press
pause so this does not spoil your lab for you.
Within Physical Analyzer, the first question
is asking about permissions.
So we need to look at TCC.DB.
And I'm just going to close some of my tabs
that I've opened here first.
And then I will keyword search over here
on the right for TCC.DB.
And we want to know which application, if any,
has access to the microphone.
So I'm going to open TCC.DB.
I am looking at access.
I'm going to search by service.
And I see microphone.
And I see this app that looks like it's
called toyopagroup.peekaboo.
You're like, what the heck is that?
What I recommend is, you could Google it.
But let's say you work in an air gap lab
and you can't Google it.
What could you do?
Let's search for peekaboo.
And I'm going to say show all.
And let's see if we get a clue.
Right away, Snapchat.
This is the perfect example of the app
not matching the identifier.
If you ever search for an application
and you are not finding it, search for the creator
or the vendor of that app.
So here, we can see, Snapchat has access to the microphone.
And as a reminder, Liverpool--
location.
Ubiquity-- iCloud.
Now, we're going back to extraction,
and we're going to verify some things here.
Physical Analyzer says that message retention is forever.
And this actually drives me insane,
when they don't put the source file.
So you're like, OK can I trust it or not?
Let's go and take a look.
We are going to look at library, preferences,
com.apple.mobilesms.plist.
mobilesms.plist.
I'm going to click on it.
And if you remember, I told you just to search for the word
"keep."
And we search and we get 0 hits.
Because I'm paranoid, I go to hex and I do the search again.
And we are going to get 0 hits.
Now, if you remember, iOS 13 and below, 0 hits means what?
It's set to forever.
You are going to see iOS 15 extractions in the morning--
or in the beginning of section 4.
So the tool is correct there.
Now, let's have some fun here.
How and on what date was the device set up by the user?
This is one of the most common questions that I am asked.
So if you go into this extraction summary here
and you start looking to see, OK, can I see anything?
I see a last iCloud backup date.
That's not really helpful.
I see a time zone setting.
I see some preferences.
But I don't see anything that's jumping out at me.
However, I see the name of the phone.
And this data.ark.plist keeps being referenced.
Let's just click on it and go there.
In data.ark.plist, I'm going to go to File Format Viewer.
And right away, we see this first purple buddy completion.
I wrote a DFIR peer-reviewed paper
on how iOS devices were set up.
I presented it at AIFS.
It has been peer-reviewed.
Keep in mind, purple buddy is a great file to look at,
if you do not have a full file system extraction,
to get dates and times for setup.
But here, we have this date/time stamp.
So I'm going to copy that.
And I'm going to go into DCode, which is on the desktop here.
And you could use the new version or the old version.
I'm going to pace my value and click Decode.
Now, we can look on the right-hand side.
And it's going to try to decode it every single way.
So 1/1/2001 is the number of seconds from it,
so that is actually not correct.
Let's keep looking down.
12/28/2019 Zulu.
The Z means UTC plus 0, not local time.
If you wanted to change it local time, you could.
You could say, oh, this is actually
supposed to be Eastern.
So let me show you.
OK, let's say--
I think this one is Eastern.
So I need to choose UTC minus 5.
OK.
And then when you look through your time stamps,
if it can decode it into that local time,
it will do that for you.
So we see 12:28 is of interest to us.
Let's go back into that file.
We have a date/time stamp.
And we can see right away, it's restored from iCloud.
We see the time zone right here, as well--
America, New York.
We could see, it was running 13.1.3.
So there's a lot of artifacts that we're
getting from data.ark.plist.
We're going to talk more on how these devices were set up
in Section 4 at the very end of that section, when we talk
about evidence destruction.
Let's do some screen time examination.
How much time did the user spend on Facebook
on January 27, 2020?
Now, something that is a little bit evil.
We did not flat-out tell you how this timestamp is stored.
So if the timestamp is stored in UTC,
if the person was on it late at night,
it could actually go over into January 28.
So if you were working this and you have total failure,
and you're like, I don't see anything
that Heather's talking about, I'm
going to show you how to actually examine this.
What we need to do is, we need to look at our apps.
You're going to have application usage log
and aggregated application use.
Take a look at both of these.
What you want to look for is--
I always go source file and then I
type RMA to see if I'm in the right location.
And here, it's like, nope, nothing.
So that's not the one storing screen time.
Let's go into application usage.
And I do the same thing.
I scroll over.
Source information.
I type RMA.
Now, it has narrowed it down, saying, OK, this is the screen
time stuff that you care about.
The question is asking about Facebook.
So under identifier, I'm going to filter on Facebook.
So now, we're narrowing it down even more.
Now, I want to go into start time.
And I want to either filter for 1/27 or just look.
Here's a good example.
Look at this.
1/28, 4:00 AM, UTC 0, so Zulu, 3:00 AM, 2:00 AM.
The person was using this late at night on 1/27, which
then turned to a next day.
So be very careful with that filtering.
So we have these three items right here.
We have to do some math.
8 plus 1 plus 26.
We have 35 seconds total.
As we look through these, 35 seconds is what the answer is.
Filtering is helpful.
Now, at this point, I want you to keep this open.
Because what I did for the next lab was,
I went into the file system and I exported directories
of interest for you that are going
to work with iLEAPP and Apollo and sysdiagnose.
I wanted you to run these manually
so you can see how the open source
tools complement what we're actually
seeing in this extraction.
So keep this open.
It is the exact same data set.
But we're going to continue with the lecture.