It is now time to do Lab 5.1.
For Lab 5.1, we gave you directories from an Android
and directories from an iPhone.
Some of the data has been redacted.
So if you're searching for a database
and you're not getting it, it's because we intentionally
did not provide it to you.
In the forensic challenge, if you're searching for a database
and you can't find it, it's because the extraction
didn't get it.
We tried to provide you with every single piece of data
possible for that.
For this lab, it's different.
When we look at loading this lab-- let me go out to the lab
directory, and I go into 5.1, you're
going to see a few things here.
You have a directory called Android and a directory
called iOS.
What you also have is this cheat sheet.
So we gave you a spreadsheet.
There's one tab for Android, one tab for iOS.
And it tells you the application name
in what it is advertised to do.
So for example, Pandora, it would say, plays music.
It's not going to tell you that it stores location
information in the background.
That's for you to kind of put together with your mind.
The reason we did that app list--
one, so you could easily keyword search it.
If we're asking you, what's the weather, what music does
the person like, you could kind of have a hint on where to go.
Also, we realize, worldwide, apps differ.
So just because we live in the United States,
we don't want you to not understand the application
because you may not have access to that in the country
where you live.
What I recommend is that you load the iPhone and the Android
together.
I load all Lab 5.1 and examine it at that time.
So I'm going to open Physical Analyzer,
I'm going to go to File, Open case, Add,
Common source, Storage device, SD card.
I'm going to point it to Lab 5.1 and let it parse it.
Don't waste your time trying to force this through Axiom
or force it to parse.
The goal is not that you have anything in Analyzed Data.
So if we look at Analyzed Data over here,
you're not going to have much.
You may have some pictures, but you do have access
to the databases.
You do have access to the configurations.
You can keyword search.
That's really what you want.
You really only have to put this in one tool of choice
because it's all manual.
Once you're in that tool, everything else is manual.
So choose one.
The lab is going to walk you through how to load each.
Once it's in there, I would say, go to Databases.
And the first four questions will be for Android.
The second set of questions are for iOS.
So what you could also do is in Path
right here, under Databases, just change it to Android.
Say, only show me the Android, and it will take iOS away.
Remember to sort by size, sort by row count.
You can really leverage this table search here.
You could also use Agent Ransack.
So Agent Ransack is on your desktop.
Let's see if I can get it to work in this demo.
We can point it out to Lab 5.1.
Click on those dots.
Point it to Lab 5.1, and Select Folder.
You could even say, you know what, first,
I'm going to point it to Android.
And then, if it asks you about weather, what it's doing here,
it's saying, hey, I know these directories are called weather.
These are databases that seem to have weather.
If you double click on it, it may open DB Browser for SQLite.
But if it doesn't, it tells you the full path and where it is.
And you could then go load it and take a look.
If you want to see the hits, just switch to the hits,
and it's going to tell you what it's finding.
So again, you're not going to see those three
dots unless you hover.
That's how you navigate out to the folder of interest.
And then just enjoy.
We are now going to review Lab 5.1.
Again, if you're still working on it,
simply press Pause, and then resume
when you're ready to review.
You could go into your tool of choice,
and you could dig through the databases.
There are many things you can do.
So for example, I am sorted on Android,
like I had shown you in the lab prep.
The first question is about weather.
What is the most Western US city for which they looked up
temperature information?
So you could type weather here and hope
that there's a file that's associated with it.
But you could also have done this in Agent Ransack.
Point it to Lab 5.1 Android.
I typed weather, and I can see that there's a weathersync.db
and a weather.db.
And you could look at those.
Now, in here in Physical Analyzer,
just because it's easy to manipulate the database
at this point, in weather.db under location,
you can see that there are multiple locations here.
Now, if you look at this--
and you may have to look at a map--
Chicago is the most Western city.
However, I want you to notice some differences
in this database.
Look how this one up here says htclocationservice,
Arlington, Virginia.
And it gives us a latitude and longitude.
This is the user's home location.
So no matter where this user goes in the world,
it's always going to show Arlington, Virginia.
If you wanted to prove that data synced,
meaning the user actually went to that location,
you would look at weathersync.db for this one specifically.
So here, we have 12.
And if you ended up here, Chicago
is still the most Western city.
We can see that the date/time stamps can be converted
Unix epoch millisecond, and you can see the current temperature
and all that information.
For Question 2, did the user leverage any chat messages?
Now, this one's a little bit difficult
because you would have to go through each and every one.
What I recommend is that you sort by row count or size.
So I'm going to sort by row count, descending.
I'm going to scroll all the way to the top,
and I want to see which ones are the heavier databases.
Chat applications are commonly heavier.
So as we start looking through, we have this WordsFramework.
Let's take a look at this one.
We have 333 chat messages.
And this is from Words With Friends,
so that one is helpful.
We should also be able to find, I believe, Telegram.
So as we start looking through, what you could simply do
is scan these databases, and then
keep your eye down here on the left
and see if you see anything that says conversation or chat--
anything associated like that.
So here, we have chat.
So we have chat_hints, chat_pinned, chat_settings,
chats.
And we see this data.
Now, when you look at the data, we
can actually see the words hidden in these blobs.
If we go down more, we should find chat messages, I believe.
Here's encrypted chats.
And it looks like they truly are protected with something.
But you want to make sure you're just parsing everything.
So we had the Words With Friends, and we have this one.
Back to Words With Friends, name two people,
two opponents of the games.
Now, this is leading you down the path
where we're going soon.
When you look at these chat messages,
do you notice how it has a chat_message_id?
So we can actually look at what the user was typing,
and we can scroll across.
We can see created_at.
We see a user_id, but we don't have a name.
This is where we're leading you.
We have a game_id and a user_id.
So if we look at games, you'll see
we just have game_id, opponent_id, user-created ID.
But as you scroll over, you actually
see real names associated to these people.
If you go into users, you can see a list of all the users
that the person may have played games with.
So you just have to hop through the tables.
All right, this next one-- from the Telegram application,
we want to know if you can find a phone number of interest.
So what I want to do is I want to show you
the easiest way to do this.
So if you're in Telegram here, what you need to do
is actually go to this database.
And you could sit here, and you could sort
through all of these tables.
But if you don't know where you're looking,
I'm going to show you the fastest way to do this.
If you want to stay inside of the tool,
go into the File System, go into Android,
or you can even search for cache4.db.
It will take you right to it.
Change to Hex view, and search for that phone
number of interest--
oh, or Lloyd Christmas.
Let's search for Lloyd Christmas.
And now, as we look around, we are
going to find his phone number, right there in hex.
This is the easiest way if you don't know the table.
Otherwise, you're going to sit there and hop between tables
and try to find it.
Another way-- go into Agent Ransack,
and search for Lloyd Christmas.
And here, it's saying we have no hits.
Let's see if we just do Christmas.
Still doesn't like it.
So it's not having a good time searching that one.
It seems like it needs to be a hex search.
If you go into the database, you would
have to go through each of these trying
to find Lloyd Christmas and where that person is.
And you can do it this way.
You could definitely go in and say, OK, this
is Lloyd Christmas.
This is his user ID.
And then bounce back and forth, and say, OK, this
is the associated phone number.
But it's not something that is always simple.
So you want to make sure you can see it's hidden in blobs
with these phone numbers.
We want to be able to determine what it is easier.
The fastest way is a hex search.
All right, now, we're switching to the iOS device.
So I'm going to make some changes here.
In Databases, under Path, I'm going
to change this from Android to iOS.
And now, I have my iOS device.
But remember, we also have plists that
are going to be of interest.
So did you find any file-sharing applications?
If so, can you account the username and email address?
This is not going to be stored in a database, most frequently.
What you will find is account information,
if you recall from the slides of Section 5,
are often going to be in plists.
So I'm going to go into Configurations.
I am going to sort by Name.
You could also sort by file size.
But this is where you could start
looking through to see if you find any file sharing--
oh, that went really fast, sorry--
file-sharing plists of interest.
So what I'm also going to do is I'm going to search by plist,
so it narrows it down even more.
And then as we start looking, I'll sort by size.
So I filtered on plist, filtered on size,
and I'm just starting to go through to look and see
if I see any file-sharing apps.
Here's getdropbox plist.
Let's take a look at this one.
So as we look at this, Dropbox Username,
lizzlelemon@yahoo.com.
We could see, we have Dropbox Favorites you can look through.
Here's transactions that actually happened.
If we keep looking, we find this, defaultsAccountInfoKey,
binary plist.
Let's take a look at it.
So in here, we see the username, Liz Lemon.
So lizzlelemon@yahoo.com, we see transactions, we see Liz Lemon.
Did the user have any contact with Ace Ventura?
So let's see if this wants to cooperate with us or not.
Hmm, I feel like it loses connectivity with it.
Let me try to reconnect this because it should be hitting.
Oh, it's on the iPhone.
That's probably my issue.
So Agent Ransack is not doing a lot of work for me here.
OK, we're going back in to Physical Analyzer.
I'm going to keyword search for Ventura.
Now, you have to be careful because Ventura is also
a location.
And here, you can see it's saying nothing.
V-E-N-T-U-R-A, can't find anything.
So guess what this leaves us.
We need to go in File Content.
Let's see if we can force it this way.
So I'm going to do--
actually, let's do all of these.
We want Ace and Ventura--
ace, comma, ventura.
Search in file contents.
Let's see how this does.
Now, we have some hits.
So this is more helpful.
So in here, we can see weather.
So that's probably Ventura, California.
And cache4.db-- that's interesting.
Let's take a look at it.
You could go through the database view.
See, we could look at chats.
We can look at chat_pinned, secure chats.
But I'm going to go into Hex view.
I'm going to search for Ventura.
And it looks like we have Mr. Ace Ventura.
And here, we can see we have a phone number.
And here, same thing--
Mr. Ace Ventura and a phone number.
Let's go back to the search results.
CoCo.db, let's check this one out.
I'm going to do the same thing.
It remembers my search.
And we have a lot of these too.
So Mr. Ace Ventura, we can see a missed call,
a group missed call.
That's helpful.
Here's another group missed call.
So lots of group missed calls from him.
So this is actual communication.
Here, you created a group with Lloyd and Ace Ventura.
More of the group information.
And here, we actually have some text messaging.
Thank you for sending me the terminal and the contact--
will pick up at the airport.
So we actually see message transactions-- so calls,
message transactions, and more.
Now, I think there's one more.
And I don't think--
let's see if the search results hit on it.
Oh, it did-- contacts.data.
So if we look in here and we do the exact same thing,
we can see here, Mr. Ace Ventura and a timestamp.
We also see it looks like Tech Talk.
This is Viber that we're looking at here.
So the next question leads us to this one in Viber.
Who sent the message about Star Wars
in the application in Viber?
So let's see if we can find Viber message--
ZVIBERMESSAGE.
Let's see if we type Star Wars and just filter instead
of trying hex right away.
So here, we do have some information.
And if we scroll across, we have some user IDs.
We have different messages.
So here, you can see, right here in this metadata,
sender name is Tech Talk.
This is a plist that's hidden in there that it's received.
And here, you can see just different Star Wars
communications.
Now, what you could also do is you
could do what we're going to do in the labs coming up,
and you could take these primary keys and go to the user.
So if it's ZUSER or ZMEMBER--
I think it's ZMEMBER and ZPHONENUMBER--
and say who things belong to.
There's no right or wrong way to do it
as long as you're getting the correct answer.
All right, now, we want to do some guessing about the user.
So if you sat here and you went through a lot
of these databases and started looking for things,
can you make a guess on where the user lives?
So what you could also do, you could
have keyword search for location or position in hex.
But because you don't have that whole forensic image,
it makes it a little bit more difficult.
But as you start looking through some of these larger databases,
things like Runkeeper has 423 points.
All of these latitude and longitude
are for Arlington, Virginia.
If you look at some of the other things,
you could find mapping for Arlington, Virginia.
You could find dog parks, I think, 7-11's, and other things
that the user searched for.
But the correct answer is Arlington, Virginia.
Be careful with the airports one because you could be anywhere
in the world when you're searching for airports.
For example, I was looking to change a flight today.
So I was searching San Francisco airport to another location.
It doesn't mean I live in San Francisco.
I was just currently in that place.