At this point, you're going to start lab 4.4.
Now, in this lab, it's designed a little bit differently.
We give you directories, and you are
going to have to dig for evidence destruction.
We wanted to take the tool away from you
to force you to do some manual analysis.
If we look at lab 4.4, you're going
to see we did process it in AXIOM.
So you can simply go into the Lab4.4, scroll down,
and click on Case.mfdb.
We also ran Alexis's script for you.
So you can see the usagestats.db or the results.sql,
depending on how you want to look at that if you
don't want to run the script.
In order to run the usagestat script,
you have to go into System, usagestats, and copy that out.
Now, what I recommend is that you load the entire user data
partition into Physical Analyzer so you
have two tools of interest and that you run ALEAPP.
So I'm going to show you both ways of doing this.
In Physical Analyzer, you can go to File,
Open case, Add, Common Source, SD card,
and that's how you're going to point it to the folder.
Point it to that entire user data folder and bring in.
Do not point it to lab 4.4 because then it's
going to try to bring in all the AXIOM data,
and it's going to go crazy.
So just SD card, folder, user data.
And let it process.
It should not take long because there's not
much it's going to process.
If you want to run ALEAPP, I'm going to go to ALEAPP GUI.
I'm going to point it to a folder
and point it to the entire user data folder.
Oh, sorry, I chose file.
I want to choose folder.
And my export, I'm going to save it in G Cases ALEAPP.
and say process.
So that way you have three tools to do this analysis.
You could also, if you wanted to leverage some of the bonus
tools, you could throw this into to Cellebrite Inspector.
You could throw it into Paraben E3.
That will work.
So there are multiple options for you.
Use at least two tools.
But don't be afraid to use ALEAPP as well.
It's really quick.
It's going to parse information for you that may add value
to this investigation.
We are now going to review lab 4.4.
If you're still working it, as always, just press pause,
and then resume when you're ready.
For this case that we have here, one
of the first things we want to prove
is, was Discord ever installed and used on this device?
So if you go and you look at Installed Applications,
you're going to see that you don't have it.
We purposely took that away from you.
You could go into Applications and try to hunt for Discord
if you wanted to.
But the easiest way to approach this is to keyword search.
So I'm going to go in the AXIOM.
At the top right, I'm just going to type Discord,
and let's see what we get.
We have a lot of stuff here.
So we could see a few things.
We can see that under /storage/emulated/0/Discord,
we have some hits, which means there's user data that
potentially existed on storage under primary user
Pictures/Discord.
We see some date/time stamps here.
So as we keep looking, we have Google Play.
And what I'm going to actually do
is click on the actual artifacts on the left.
So here, this is interesting.
We have a picture and a date/time stamp of 4/10/2020.
Last access 6/13/21.
Here, we have another picture.
It looks like a computer sideways.
Under Application Usage, usage history is very helpful.
So here we have multiple date/time stamps
of when Discord was used.
And look where this is being pulled from, usagestats.
So this will be great to correlate with ALEAPP.
We could see Discord was installed by mraceventura1980,
when it was last updated, when it was downloaded,
all of that information.
And we are pulling this from localappstatedb,
which means it came from the Google Play store.
Under Custom, we can see that external.db was parsed.
And this is where we could see those actual pictures that were
stored in a Discord folder.
Now, the issue is, if they don't exist any more on that device,
you would have to dig for them other ways, maybe in cloud
or something else.
So Discord was definitely used.
There are so many locations that you can find this.
If we want to compare this to usagestats--
so if I go into ALEAPP, and I go to usagestat0,
I could search for Discord and also get those same results.
For this next one, you may have to break out
a calendar to check it out.
Was the application and use during the hours
where the user was prohibited from
using their device Monday through Friday while at work?
So you have to assume Monday through Friday,
maybe 9:00 to 5:00.
We have those pictures from October 4th.
So when we look at the pictures on October 4, 2019,
you would have to look at a calendar
to see October 4, 2019, is this during the work week?
And it actually is.
So that's a good indication that they
were using it during that time.
Are there any indicators on this that the user was
trying to cover their tracks or cover up evidence?
This is where I would search for things like erase, clean,
so you could do wipe.
So in clean, oh, I got very lucky with that search.
We can see right, here piriform.ccleaner on 1/19/2020.
Let's see what else we have, application usage.
Let's check this one out.
Look here, ramcleaner, cleanmaster, avgcleaner.
So this person was definitely trying to do some cleaning.
They were searching the Play Store.
And we could see app data, app history,
we have time stamps for it.
That's very interesting.
If we go to some of these, you should
see that we'll find it in localappstate.db as well.
You could search that if you wanted
to go straight to the database.
It doesn't matter.
I honestly think staying in the tool
and just keyword searching is just as easy.
Now the things that you're missing--
we didn't give you the entire forensic extraction,
so you couldn't find the wipe time, the setup time.
But these may be important in this course going forward.
So I would start with, can you tell when the device was wiped?
Can you tell when it was restored?
Go to usagestats.
Leverage ALEAPP.
Let it run against that image file.
And see what it can pull out for you
so you know exactly when the user started using that device,
when specific applications were run,
how to search for cleaning applications, and more.