We are now ready to start lab 4.1.
In order to prep for lab 4.1, what I would like you to do
is go into G Cases.
And we see Lab4.1 AXIOM has been pre-processed for you.
You have been provided with a backup file.
So I'm going to Open Physical Analyzer,
and I'm just going to click on this Three Dots
here and say Close--
and if it wants to close or crash.
OK, I'm going to launch Physical Analyzer.
And when it opens, I'm going to show you how to load this.
Now, you have to pay attention to it.
If you're not paying attention, you
will miss where you're prompted for the backup passcode.
All right, let's click on File, Open Case, Add, Common Source,
Backup, iTunes Backup.
We want to select a folder.
Navigate out to Lab4.1, and Single-Press the Directory.
If you keep going inside of the directory and out,
you may get stuck in the loop of failure
where it doesn't properly parse.
I'm going to say Next.
Click Next.
You don't have to add anything additional.
It won't assist you really with this one.
And press Examine.
And now, pay attention.
You are going to be prompted for a passcode.
The passcode is going to be 0000,
but it takes a period of time to prompt you.
And while you're waiting for that,
if you wanted to, you could go back into the Lab4.1,
AXIOM pre-processed, and click on Case.mfdb.
You may be also prompted to provide a notes passcode.
Just Cancel if you see that.
We don't provide that note passcode to you.
OK, so it's saying, hey, this is encrypted.
What this means is either you encrypted it
during the extraction, or the user
has encrypted it previously.
The passcode is 0000.
And you say OK, and let it process.
We are now going to review lab 4.1.
If you're still working it, simply press pause,
and then continue when you are ready.
In the first question, we want to know,
is there an email address syncing to the device that
was backed up?
We talked a lot about this in section 3.
So if you leverage your cheat sheet,
you would maybe think that you could go to Mobile, Library,
Data Access.
And in Library, Mobile, Data Access,
we can see AccountInformation.plist,
but we also find this directory for jackattacks1329@gmail.com.
That is the email address that is
syncing with this device that was backed up.
OK, now let's have some fun.
On what date was the backup created?
I want you to leave the tool.
And let's hope that the plists want to actually participate
with us.
Let's click on G Cases, go into Lab4.1, into the Backup,
and scroll all the way down to the bottom.
Now, in here, we have Info.plist, Manifest,
and Status.
And I want to see if my plist Editor will like these.
Part of me thinks that, when the other tool grabbed it,
it locks it down.
OK, good, so there's Info.
I'm going to move Info over here.
I'm going to load two more.
I want to load Status, and I want to load Manifest.
I want us to look at all of them.
Move Manifest down.
OK, so I'm going to kind of put these
in order of what they mean.
Manifest on the left, Status in the middle, and then,
ultimately, Info over here.
So when we look at these eight time stamps,
we see 2/5/2020 at 04:04:19.
That is the last time encryption changed.
When we look at Status, we see 1/5/2022.
Now look at that drastic difference.
The encryption has not changed on that device
from 2/5/2020 to 1/5/2022.
That's a long time.
That's almost two years that backup password has been 0000.
So this is our best time.
And then here, we could see that it completed on 1/5/2022
at 01:55:12, so 11 seconds later.
And this is something else I want to point out.
My VM is in UTC.
This user, you may have to figure out
where they live local time.
When we look at this time stamp, it says 1/5/2022 at 01:55:01.
This will be 1/4/2022 if we're looking at it in local time.
OK, how many notes are in the backup file,
and did you recover any deleted notes?
So I'm going to go into AXIOM first.
And under Documents, I see Apple Notes.
And here it's saying we have 1, 2, 3, 4, 5 notes.
And this one was recently deleted.
So it's saying five, one of which is deleted.
If we go in to Cellebrite, under Memos,
it's saying we have 2 Native, 4 Notes.
So let's take a look at all of these.
So it's disagreeing a little bit,
but let's make sure it's legitimate.
So here we have this one that just looks generic.
I would say that most likely is not a deleted note.
What that is, if you look at the file,
its Library, Notes, Notes.sqlite.
This is Gmail notes.
And I know that because it's looking at the Gmail account.
It marked it as deleted.
So that's actually not valid.
So I would Uncheck that one and not include it in my report.
But here we have Groceries, Test lock.
Did you get in?, Just a boring note, and I moved this note.
So here we see Test.
That is deleted.
Now look at Just a boring note.
Just a boring note is a notes.sqlite.
I moved this note is a NoteStore.sqlite.
NoteStore.sqlite is the file that tracks
Apple Native and iCloud Notes.
The other one, notes.sqlite is any third-party app.
So this is the Gmail notes.
You should go to both databases and look at them.
Now, if we go to Just a boring note,
I'm going to click on that, I'm going to go to Database view.
And I am going to click on this little Pickaxe.
That is supposed to recover deleted items.
And then, over here, I'm just going
to start clicking down the line and see if I have anything
that's marked as deleted.
So here we have two.
But sadly, sqlite_master isn't anything
that's exciting or helpful.
We want to look for like NOTECHANGE, NOTEBODY, ZNOTE,
and we have nothing that's deleted.
If you go to ZNOTE, we have 1.
It's that Just a boring note that was parsed by the tool.
So let's go back and do the other database.
NoteStore.sqlite, switch to Database view,
do the same thing.
Click on the Pickaxe.
Start looking.
Do any of those 0s turn red?
sqlite_master-- not relevant, not exciting.
So we keep looking.
And according to this, it's saying no.
So what's interesting is let's see how it parsed it.
So it did have a deleted note, this one.
If we look at it, it says it's parsing this
from ZICLOUDSYNCINGOBJECT.
Let's take a look, zicloudsyncingobject.
So what we want to see is, is there
a column that shows maybe that it's deleted,
and it's right here, and it doesn't go to the free pages?
Or is the pickax not working.
And you will find that that occurs as well.
So as we start looking through here.
We're looking for a column that says ISDELETED.
We have a MODIFICATIONDATE, CREATIONDATE,
ZDATEFORLASTMODIFICATION.
Now we're getting to identifiers.
I want to come back to this one.
Do you see PASSWORDHINT?
When you lock a note, you only can set one passcode.
So for mine, it's one passcode across all my locked notes.
I can unlock it with my face or by entering that passcode.
Each individual note cannot have its own unique password.
It is one for all.
So this one, it says PASSWORDHINT, lock.
It actually is lock if you want to reparse it.
So we keep looking.
I see ZSNIPPET, ZTITLE.
Here we have ZNEEDSTITLEFORSORTING, Recently
Deleted, Recently Deleted.
So what this seems like is that it's
tracking the deleted by something being called Recently
Deleted.
Now you may find in different versions
where it says Is Deleted 1 or 0, or you have a deletion
date/time stamp.
So the tools did a pretty good job with it.
Now, some of these in here, if you
use John's script, which you could,
it would have detected these binary plists.
So it would tell you, hey, there's
something hidden in there.
This has a lot of information in it.
We can see iPhone.
We could see modified date/time stamps, when
things were being recorded.
It could be relevant to your investigation.
So make sure you are looking for these plists and things that
could be hidden.
OK, I'm going to close out Physical Analyzer.
I'm going to close AXIOM because the next lab is
going to be completely manual.