Let's take a look at Apollo.
So if you have previously used Apollo,
Sarah updated it in 2020, and you
have to change some of the command line on how you ran it.
What you have to do now is, you have
to run Python, apollo.py, extract,
how do you want to output it?
Now, Sarah recommends outputting to SQL.
You can also output to CSV.
The parameter is going to be Apple.
The v, this is where you choose a version.
I like to go with Yolo.
I want all versions, just in case.
And then you have to say where the modules exist,
and then where you want to write this evidence.
So I'm going to show you how to demo this.
So we go into the VM.
And we actually have to prepare our data.
Apollo cannot interact with a zip file.
So if we go into Lab 3.3, we see we have a tar.
I want you to right-click and I want you to do extract here.
And let that run.
Now, we realize, some people just do not like command line.
Because of that, we give you script results
where you will have Apollo results and iLEAPP results.
But I want you to try to run it.
So you see I provided it as DB and TSV,
only because if you use Timeline Explorer, it cannot take a CSV.
So I just exported as--
where did that go?
There you go.
I exported it as CSV and changed the file extension to TSV.
I'm going to show you how to run this
as soon as it's done unzipping.
And you don't have to delete the tar when you're done,
because iLEAPP can run against a TAR file.
So let's take a look at what we have in here.
You can see I exported specific items of interest.
And it's done extracting now.
So I'm going to leave this open and drag it up
to the top right.
I am then going to go into scripts for class
and into Apollo.
In Apollo, when I'm right here, I'm
going to show you a cheat that I like to do.
In the actual toolbar, I'm going to type CMD.
And it is going to open a command prompt rate for where
I want to be with Apollo.
So now, what I have to do is tell it what to do.
So I'm going to type python apollo.py.
Let me zoom in a little bit.
Extract -o.
What do you want your output to be?
I'm going to say SQL, because that's what Sarah recommends.
-p is going to be Apple.
-v, I'm going to say Yolo, because that's my favorite one
to do.
And now, I need to drag in the modules.
So what I do is, I go back out to Apollo.
I click on Modules.
And I drag it in.
You can also type it if you want, but I like simpler.
And then where do you want to write it to?
So I'm going to save this to G, labs3.3.
I'm going to call my demo.
You enter, and it says it's currently working.
It tells you it's going to take a little bit of time
and that it's going to run.
When it's done, you can go into your script results
and you have the Apollo DB or TSV.
Now, I want to show you how to open these and interact.
Getting used to Apollo can take some time.
So I'm opening the DB browser for SQLite.
Open database.
Go out to wherever you saved your output.
And open it.
Now, on Browse Data, there's a lot of information here.
And this is where some people get really overwhelmed
and they say, I don't know where to look.
I don't know what this is.
It may take some getting used to.
But you don't even have to write a query if you don't want to.
You could filter.
So let's say you're looking specifically for Facebook.
Type in the word Facebook and let it start narrowing it down.
If you then look on the left-hand side and you're like,
I don't know what some of this means,
maybe you want App in Focus.
So let's type over here, focus.
Now, you could answer that same question
you just did in the last lab.
So if we look closely here, we have one, two, three,
end times, bundle ID, Facebook.
We could actually see the time stamps
when Facebook was actually used with App in Focus.
So you can go back and forth and do this.
Don't be afraid to filter.
You don't have to do queries.
You can just mess around with the database that way.
Another option.
If you export apollo.csv, right-click.
Rename that file extension to TSV.
You can then go in and leverage Timeline Explorer.
You can go to File, Open, Script Results, Apollo.
And if you haven't used Timeline Explorer before,
I'm going to give you a few hints here.
But the filtering is very similar to what
we've just seen.
You can-- if you have no idea what word to type,
you can type a word in here.
But what you can also do is, if you hover, if you click out,
and then we come back, do you see that little filter appears?
It is going to give you a list of all the options.
So you could also say, I'm going to type focus here
and see if that's what the word is.
You can check the box and it changes it to App in Focus.
You can say Close.
If you went over here, you could just start literally
typing Facebook.
Or you could use the filter.
But do you notice, there are different things here
where it says launch reason, springboard transition home
screen?
So the person was at the home screen
or went back to the home screen.
Launch reason, it says none.
Launch reason-- transition reason home screen.
System gesture.
Idle.
Showing you all of the different things the user is doing.
If you want to clear your filters, just click on the--
let me scroll back over.
You can either delete them here and it will refresh,
or you can click on the little filter and remove it.
So two options for looking at your Apollo data.
At the bottom of the screen here,
I helped with the Connecticut murders.
I think his name was photos Fotis Dulos.
He was accused of murdering his wife
and getting rid of her body.
So I assisted by doing health steps.
The health steps-- they were trying
to find cadaver dogs that could look for the body.
So we were trying to say, OK, this
is the app that's in focus.
This is what he was doing.
And this is the location where it was.
This information was provided back, which was useful.
Unfortunately, the day he was supposed to go to trial,
he turned his car on in the garage with the garage
door closed and killed himself.
But Apollo was helpful at locating where the body was.