Now, that example that I just walked through
was the perfect way to piece all the artifacts together.
You start with your tool in triage.
You follow the source.
You verify what it parsed.
You then go to the directory, you
look for any other files that can contain valid information,
and you verify it.
Ride sharing is huge.
Whether you're using Uber, Lyft, something else,
there's a lot we can do with ride sharing.
So we see a screenshot on the left-hand side.
And this screenshot could be recovered on the device.
Remember that.
So we have these screenshots.
Look at the screenshot too.
We can see all kinds of things that the user
had going on on that device.
We see TikTok.
We see Snapchat.
We see these actual rides with date/times,
how much money the user paid.
Now, look at the difference in the top one versus this one.
Do you see the differences there?
And you're like, oh, the user is in a different country.
Here, the user is in a different country.
How you're paying will help you.
Now, where are you going to find this information?
So again, it's hard to hide Uber when the file name says Uber.
In database.db for iOS, you will be
able to get this with an iTunes backup.
Again, I always say encrypt it.
It's going to contain search information, not necessarily
the details of the trip.
For Android, under ubercab/files,
and you follow that path, you're going
to see the CACHED_SHORTCUTS_MAP_KEY.
This is only available on physical and full file system
extractions, but you get all of the trip details.
Also on Android, under KEY_PROFILES,
user info and payment.
So who is the user, and how are they paying?
Credit card information, home address,
that type of information.
Under CACHED_UBER_LOCATION on Android,
approximate last cached location-- sorry about that.
And then under userlog, historical trip data from crash
logs.
All of this information is there.
Now that crash logs were mentioned, if you have iOS,
grab those crash logs.
Maybe you'll find additional information from Uber
as it's spinning, it's trying to find you a ride,
map you with a ride.
Those location artifacts may exist in the crash logs.