For Lab 5.3, you are going to be provided
with four different directories, two from Android, two from iOS
with mobile browser data.
You are going to manually dig through these files.
When we look at Lab 5.3, you can see,
we have Chrome for Android, Ghostery for iOS,
Firefox for Android, and Puffin for iOS.
Puffin is the bonus homework one.
It's optional to do.
I would load all of these like you did the previous lab.
So what I did is I loaded them into Physical Analyzer
as an SD card.
You can see that nothing is parsed,
but I have access to the directories.
I can keyword search.
I can also go straight to Analyzed Data, and Databases,
and leverage the full-screen view.
So I can do the row count.
I can do anything I want.
So I'm going to sort my row count.
Go to the heaviest ones up top.
And I want to point out to you, this
is one of those Realm databases.
And you can see, it's associated with Ghostery.
So when you're looking at Ghostery,
you will see some of the other things
that we've discussed so far in this course.
We are now going to review Lab 5.3.
As always, if you're not ready, simply
press Pause and resume when you would
like to see the walkthrough.
The first question is about Firefox.
So it's telling us to, within Firefox, look for history.
So I'm going to, in here, sort by Firefox.
So now, I have just Mozilla Firefox.
And within this, you can see cookies.sqlite
seems to be the heaviest.
But browser.db, I'm going to start there.
So in browser.db, we have a lot of files here.
I'm actually going to pop this out to db viewer,
so it's a little bit bigger for us.
And what we want to do is start with history.
Now, right away, this should look strange to you.
We have blank titles, blank URL, visits zeroed out,
as we keep going across, a datetime stamp
that's that zeroed out.
So what I'm going to do is I'm going to select milliseconds.
And do you see how it says 1/1/1970?
That's not good.
We go across again.
We have date_local, created, and then modified.
Now, because some of these look weird,
I'm actually going to clear them,
so it jumps out at you on what is actually occurring here.
So I'm keeping it clear.
And then, we have a deleted.
So this is interesting.
Here, we can see, in Firefox, when an item is deleted,
there is a column called deleted, and it is marked 1.
We could also say that on 4/18/2017 around 11:53
that the user cleared their history.
The title is zeroed out.
The visits are zeroed out.
And the URL is zeroed out.
Now, if you click on the pickaxe,
can we get anything back?
And we do.
So here, we can see we have the Brothers Take
New Orleans, HGTV, Bravo TV, living room transformation.
So we do recover deleted artifacts.
We have already answered Question 2,
which is, based upon that first one, what
are three things that change?
So we have covered that.
So now, we want to review tabs and search history.
So let's go into search history.
And here, we can see Disney princesses, Bravo, and HGTV.
We have a date, and then we have the visits.
And under tabs, we have Brothers Take New Orleans,
Bravo TV, Disney princesses.
So what this is showing you here,
that even though the history is cleared,
the tabs still contained it, and search history still
contained it.
Now, let's look for deletion in some of these.
So if I click on the pickaxe, we don't get any there.
We don't get any there.
But you may be able to recover more in different tools.
You may find that they're just replicates
or duplicates of what already exists in that database.
If you exported out these databases,
you could manually go through and convert
the datetime stamps.
You could also take this from your course notebook,
and it will do it for you.
But honestly, the easiest way to convert these timestamps,
again, is clicking on the table and going with suggested.
Let's move on to Chrome.
And Chrome is a very hefty application.
So I'm going to sort by Chrome.
And we want to know, can you determine the account
that was syncing for this?
So what you may actually have to do is go into the file system,
go into Chrome, and look for any preference files.
So as we go through, let's start with shared preferences.
That seems like a great place to start.
We go in here.
Let's look at Chrome preferences.
So in Chrome preferences, we start
to see things that are saying true and false.
We can see sync_account_name, mraceventura1980.
And then you will start to see all the syncing that's true.
So here, you can see sync_acct_type is Google, what
is skipped, and what is set.
So we know mraceventura1980@gmail.com
is our account of interest.
Now, this next one is super important.
So browser data was generated from a Galaxy S6
on this device.
Can you find other devices?
So let's go back into these databases.
We have something called SyncData.sqlite.
That sounds like a fantastic one to check.
And in here, we have this table called metas.
Now, I'm going to pop this one out again,
just so I can make it larger.
And in metas, we have lots of timestamps in here.
I'm going to scroll across and start looking for things.
Now, this is interesting.
Here, we see server_non_unique_name and
non_unique_name.
In both of these, we see SM-G920F.
What you want to do is see if you find any other devices,
such as LC-MacBook-Pro.
So the user has a Mac that they're syncing data from.
And as you scroll down, it looks like there's
a lot of syncing from the Mac.
The commercial tools do a fantastic job
at parsing this for you.
You will see that it will say from device in the results.
So it's not something you typically have to do,
but it's important to note that the database exists.
Were any downloads initiated from the Chrome browser?
So what we want to look at is, IS there a location
where it's going to be stored?
So if we look at the files here, is there a place
where any downloads exist?
So at Chrome, I want to go into Default user.
And we have download. service.
Let's check this out.
Under Download Service, it doesn't look too exciting.
And then this is where this gets like a little bit confusing.
So in here, we have something called
Offline Pages and archives.
And in here, it looks like we have two things.
Here, we can see saved from Blink.
It's a snapshot content of YouTube, Taylor Swift,
"Delicate."
Here, we can see Today Show, how supermodel Karlie Kloss helps
young girls interested in computing.
And then we keep going.
We have Sessions.
We have Sync Data.
We have-- let me zoom in a little bit.
Let's look at Session Storage.
That just looks like log files.
But I think you get the concept of what you have to do.
And that's why this one is extremely overwhelming,
because there's a lot of information in it.
We want to find offline pages.
We want to see any type of download activity.
Now, is there a database that's going
to be tracking downloads or offline pages?
Yeah, we definitely should be able to find this.
So if we go into our databases again for Chrome,
and we start looking at some of these,
you can see this top one right here--
Downloads, that I just picked.
We can see that a PDF was downloaded.
You want to look for anything that
says offline pages, downloads.
Anything like that that is of interest
will be helpful for you.
For tabs, how many tabs were open?
We are going to go into Chrome.
I'm going to minimize Default. And we
are going to find app_tabs, its own directory.
And here, you can see these ones called cryptonito.
Cryptonito, these are going to be encrypted.
This is in private browsing.
But for the other ones, as you click on it,
you can see that it was a Chrome new tab, amazon.com,
online shopping.
And it tells you from amazon.com what the user searched for.
All of these will have that for you.
But any time you see cryptonito, it's in private browsing.
Ghostery is up next.
So I'm going to close all my tabs except Databases.
I'm going to change to Ghostery.
And we have just a few databases.
So the first question is about private browsing
or in Ghost mode.
So can you find file names and paths to the files?
And how many records are there total?
So let's start with browser.db and see what we have here.
So in browser.db, we have 13 items for history,
and they're listed here.
And we can see some DuckDuckGo within here as well.
Now, we want to see if the user downloaded anything.
So let's see where downloads are stored.
What I would typically do is start with the database
and see if you find anything of interest.
We do see tabs in here, so we may as well
discuss that right now.
There, we have tabs.
Let's look at ghostery.sqlite.
We have the default realm, which doesn't
seem to be very interesting, something
called ReadingList, and index3.
So where are we going to find potential downloads?
Let's go to the file.
So I'm going to minimize Chrome.
And here, we have Downloads.
Two files-- AccessData FTK Imager and Android-Usagestats.
Each application is going to be different on how
it's storing its downloads, bookmarks, private browsing,
and all the things.
So the next one is review the bookmarks.
When we review the bookmarks, are there
any sites that are just lacking from browser history?
And what you would have to do is compare back and forth
and say, OK, does this have anything that is missing?
Because if it does, chances are good
it was done in private browsing.
So as we look through, I'm looking for bookmarks.
And I can see Available Horses Thoroughbred Placement
Resources, The Mid-Atlantic Great Dane Rescue.
Now, what we want to do is compare that to history
and see if we see it.
So I'm going to pop this out, switch to history,
and you don't see them.
So the user was most likely in private browsing
or in Ghost mode, whatever you want to call it,
and they bookmarked items.
And then the final question is essentially where we just were.
So if we go back to bookmarks, these two items right here,
no matter where you search, you're
not going to find anything else for them.
These were done in private, incognito, in Ghost mode.
But they still exist here.
So if you can not associate a bookmark to history,
chances are good it did not happen on that device,
or it was done in private browsing.
OK, I'm going to cover the bonus one with you
because it's important, and you may see it again.
So puffin is interesting.
If we go out to Puffin, and I think it's super easy to work.
I'm going to just walk you through this directory.
So under Documents, we have DownloadRecords.sqlite.
So if you look at DownloadRecords.sqlite,
it is going to tell you exactly what was downloaded.
The downloads hit a Downloads directory.
So we can see FTK Imager and exiftool.
History is going to be stored in these log files.
So if we open one, this is what it's going to look like.
The file name is the date.
And then we have timestamps, and we have the search,
including the search engine--
pretty simple.
Let's look for bookmarks.
So we keep going down.
We can see that DownloadRecords.sqlite.
The bookmarks are in a plist.
So this application uses plists, sqlite, log files,
all of the things.
So here, you can see the bookmarks--
pretty easy.
All right, that is the end of Lab 5.3.