We're now going to do our first lab that's manual.
This is kind of getting a taste of where this course is
going at this point.
You've been relying a lot on Physical Analyzer and AXIOM
to help you along the way.
We now want to start focusing on some
of these scripts that are built to assist you
in your investigation.
We are now going to review Lab 3.3.
If you're still working on it, simply press pause
and continue when you're ready.
I am going to start with Apollo in DB browser.
So you can run and open what you have used in the script,
or use the script output and open this file.
In the first question, we want to know,
on January 27, 2020, Eastern Standard Time,
what did the user download from the App Store?
Keep in mind the time zone offset here.
The January 27, we know, could be 2020 or 28.
We need to look at a few things here.
I'm going to look at--
I'm going to type focus.
I want to see Application in Focus.
And I'm going to look for App Store.
Right away, we start looking at Application
in Focus, App Store.
And we see this date right here.
1/28 at 2:38 in the morning would definitely
be the previous day.
1/28 at 2:38:05 in the morning.
So these are of interest to us.
And then we have this one as well, and this one as well.
So I'm going to start looking and see if we can
find anything of interest here.
So as we look--
and we could also move this slide over here--
you want to start looking for anything of interest.
We see that an app was definitely happening.
It looks like something took four seconds.
Springboard transition.
So we do see information here.
Now, we need to see what was actually installed.
If we go to--
let's change this.
I'm going to clear this one.
I'm going to type install under activity.
And on 1/28 at 2:38, we can see that moxco.bumble
was installed on this device.
Now, I have so many people saying,
why did you download Bumble?
Are you doing this dating application?
I was helping a friend who has a son who is 19 years old.
He met a girl on Bumble.
And they had talked for a very long time.
They had met up a few times.
She texted him one night and said, just so you know,
I'm actually underage.
He freaked out, called his dad, and deleted the app.
That is the worst thing that someone can do,
is delete the app.
So his dad was trying to prove to the police
that he thought she was 18.
Is that even possible on a dating app?
So I decided to download Bumble.
To sign up for Bumble, you have two options
to enter your date of birth, which you must be 18
and you consent saying you guarantee you're 18 years old,
or through Facebook.
So I set up a profile that was as a 16-year-old on Facebook.
Bumble would not accept it.
What I did, then, was lie to Facebook
and say that I was 18 years old, and Bumble accepted it.
So this goes to show that the person was falsifying
their age, and it's not an application where
you meet underage people.
So that's why you're looking at Bumble here.
If we look in iLEAPP and we go to apps installed,
we would have also found this.
And I'm going to change the show entries to All.
And here-- nope, I went too far.
That's a lot of installed apps.
I'm just going to search for Bumble.
There you go.
It's an actual local time.
So it's showing you 21:38:24, Bumble was installed;
Now, we want to know, has Bumble been deleted?
So I'm literally walking you through the situation
that this examiner would be in if they were working this case.
This is one that you need to use Apollo to find the answer to.
So I'm going to go back into DB browser.
This is going to be found in App Info.
But if you didn't know, you could filter on Bumble,
and it will eventually get you down to fewer artifacts.
But I'm going to type info and application info.
We can see the app executable name, app executable name.
Do you see right here?
App deleted date.
Not deleted.
So Bumble is currently not deleted.
Now, we want to see, when Bumble was used,
was it Wi-Fi or cellular?
Here, we are going to look at app usage.
With application usage, I'm keeping Bumble listed there.
And what I just want you to look at is,
can you tell if it's Wi-Fi or cellular?
I'm going to scroll over.
And I realize these screen adjustments aren't necessarily
the best.
But what you want to start looking for is,
can you see Wi-Fi in or out?
What can you actually see for this data?
I actually want to specify this even more.
I'm going to change this to process
data usage to filter even more.
Makes it a little bit easier to see.
And then we can see cell in, cell out is 0.
As we scroll over a little bit, we have Wi-Fi in/out.
We have data.
What I would do at that point is see
what we Wi-Fi the user was connected to.
If you don't know how to do that, go back into--
you could go into iLEAPP and we can see Wi-Fi networks.
We could see when it was added, but it's not
showing the current connection.
If you went back into your tool, you
could go under devices and networks, wireless networks,
and see if you can find a time stamp on what
the user is connected to.
Oh, that's 2019.
That is not the one we want.
I'm just filtering here.
Here, we can see, it looks like on 1/29/2020,
at 2:00 in the morning, they were connected to Wine Love.
So there's different ways to pair
it to put the person out of location when
something occurred.
Now, the user claims that they had an issue with their iPhone.
They wiped it and they restored their data.
Was it restored from iCloud?
The answer for this is not going to be found an iLEAPP.
It's not going to be found in Apollo.
We are going to find this in the sysdiagnose logs.
Now, in order for sysdiagnose to work,
we have to do a few things.
So let's go into Cases, Lab 3.3.
Go into the sysdiagnosed directory.
And this is where you get to see the TAR file that is in GZIP.
Right-click, undo.
Extract here, and then do it again.
You want to have the actual directory that's out.
I'm going to say yes to.
All so you can go in and see the actual files.
Now, this is where sysdiagnose can become difficult.
All of these directories mean something.
So if you're trying to parse Wi-Fi,
there's probably a Wi-Fi plist in the Wi-Fi directory.
What we want to know is something
associated to the backup.
If we go into Logs, Mobile Backup,
we have a com.apple.MobileBackup.plist.
That is most likely the file that we want to examine.
I'm going to leave this here.
I'm going to go back into scripts for class.
And I am going to go into iOS sysdiagnose scripts.
From here, I'm going to type CMD.
So I'm in where I need to be.
Now, what we have to do.
We have to type Python, sysdiagnose.
And this is where you have to change.
I just hit Tab.
I'm going to start typing mobile.
We want mobilebackup.py.
What is our input file?
This is going to be the associated plist.
So I'm just going to drag this in.
And then which script are you running against it?
We have, if you look closely at this,
sysdiagnose mobilebackup.py matches mobile backup plist.
So I'm just going to press Enter.
And here, we get some quick information.
It says that the restore date was 2/5/2020 at 19:52:53.
It was not restored from iCloud.
Let me show you a different one.
If I go into--
I'm going to do Python, sysdiagnose, Wi-Fi.
I'm going to do sysdiagnose wifi-plist.py.
Space, -i, what's your input file.
Let's go into that Wi-Fi directory.
Press Enter.
Here's the Wi-Fi that the person was connected to.
So another thing.
If you're like, I have no idea what the person could
have been connected to at different dates and times,
you can actually take a look, and it's
going to tell you where they were
and what they were connected to for that period of time.
It's a script per plist.
So make sure you're aware of that.