If you find that you don't have enough information
or you want to go further, that's
where you have to reach out and ask.
I'm about to review with you the search warrant that
gives you legal access to certain data on these devices.
For you all, it is your option to present to the instructor.
It is 100% to you.
This is due before you end your on-demand course.
So this isn't something that you complete the on-demand course
and then you take six months and finally present to Lee and I.
This must be done during this process.
If you need an extension or you have some kind of circumstance,
please just reach out and ask.
Now, do not cheat.
On-demand, you have access to the questions and the answers.
We will know if you looked at them.
The answers, also, are pretty vague.
It's not going to give you everything you need.
So please don't cheat please do not
listen to the walkthrough that is coming next in section six
if you intend to compete for this.
But let's quickly take a look at your Dropbox.
In your Dropbox, under Day 6 Challenge--
Do Not Peek Early, you have a file that is very clearly named
"do not peek."
That's the solutions.
I don't want you to look at that.
But what I want everyone to look at right now is this handout.
It reminds you of the passcode.
And it's going to give you the scenario here.
So this is very important.
I'm going to summarize this for you.
On the evening hours of February 28, 2018,
police were called to a scene.
Neighbors reported the sound of a gunshot,
and it took Philadelphia PD a little bit of time
to get there.
Will O'Connor was shot in the chest.
When he was found dead, he had his iPhone that
was beside him that was locked.
The police guessed that his passcode could possibly
be his birthday, and they were correct.
They found that.
When they were searching his desk and his home,
they found his iCloud password-- so user ID and password--
and they pulled his cloud data.
So any cloud data associated with will was extracted.
Now, when that says Philadelphia, Pennsylvania,
this is on or near Philly.
People always say, why aren't you giving us the address?
I want you to find the address where the body was found.
I want you to find the time of death.
What's really important here is, following
the report of Will's death, a good Samaritan
named Grace Appster came forward and said
that she believes felicity O'Connor is
responsible for the murder of her husband.
She said that their marriage was estranged
and she thinks that Felicity is the killer.
Grace hands over her Android willingly
and tells the police they can do anything they want
to extract that information.
Will dies on February 28.
On March 12, a search warrant for Will's wife's
phone is obtained.
She was in the state of Texas when
her phone was seized by Texas PD and acquired.
Now, here is what is interesting.
We have passwords that I provide to you for Will, for Felicity,
for Grace.
The current search warrant enables
you to examine data at rest.
What that means is the data that is on the device.
If you want anything additional, you
have to ask Lee and I permission for it,
and you have to have a really good reason.
You can't just say, I would like Will's Facebook,
because I'm curious.
The answer is going to be no.
When we look at the data in the VM
that's been provided to you--
remember, you bring ISO B into this.
You load your case data.
And then we are going to take a look at what we have here.
So in my forensic capstone, your search warrant
allows you to look at anything that's right
here in these directories.
I hope that is crystal clear.
If you want anything additional, you
come to the judges, Lee Crognale and Heather Mahalik, myself.
So let's start with policy.
Felicity's data has been pre-processed in AXIOM.
And in Physical Analyzer, there is an extraction.
Any passwords are provided in that document.
She does not have any passwords.
Grace.
AXIOM's pre-processed for you, and then
you also have an Android image.
Now, this one's interesting.
You have a backup file for an Android.
The passcode for this is listed in that PDF in your dropbox,
but it is 5555.
You can load that into any tool of choice and parse it.
AXIOM pre-processed this.
Now, these files right here, these ad1s, these
are the access data files.
So we need to open FTK imager.
And I want to show you quickly how to do this.
You click on the plus sign.
You click on Image file.
Next.
Browse to the very first one for Grace.
81.
Press Enter.
It will load the rest of them.
And what you have is emulated storage of her Android device,
just in case you didn't get anything otherwise
from the backup.
We were a little bit paranoid on that.
So Grace, we did our best with her.
And then there's Mr. Will O'Connor.
We have AXIOM pre-processed.
AXIOM was pre-processed only on what's in the Physical Analyzer
directory.
So in here, you can see method one and method two.
You can load those into your case.
iCloud.
You have one container with multiple snapshots.
How I recommend you load this is load that parent container
as a raw capture of cloud data.
And then you have an iTunes backup.
His iTunes backup password is will, all lowercase.
And this is in that PDF that's in your Dropbox.
Do not assume what's in iCloud is the same
as what's in iTunes or the same as what's an AXIOM and Physical
Analyzer.
You have three-- essentially, three acquisitions
of Will's device.
Leverage what you learned in the course this week.
Don't be afraid to try some of the scripts
that, maybe, you didn't do during labs.
Refer back to your workbook, leverage your cheat sheet,
and follow the scenario.
You are trying to solve a homicide.
Will was shot in the chest.
You need to figure out who did it, why did they do it,
when did they do it, and present that to us.
So good luck.
Have fun.
Take your time with it.
Maybe walk away and come back.
Think about different scenarios and different pieces
of evidence that may lead you down a path
to solve this murder investigation.
If you are still working the forensic challenge
and you're hoping to earn a coin, please do not proceed.
We will know if you've heard these results.
We will understand that you accidentally peeked.
But if you're just curious and you're playing along,
or you're ready, go ahead and watch this.
If you present it to us and you earned a course coin,
congratulations.
We know it's a lot of work and we
appreciate you taking the time and making the effort
to do this.
Let's now dive into the review of the homicide
of William O'Connor.
The goal was you to say essentially
who, what, when, why, and how.
Who killed him?
Why would they do it?
When did he die?
And how do you know?
Some basics here.
We know Will was murdered.
We know that he was found dead under suspicious circumstances
on February 28.
We know that his wife stated she was in Texas
at the time of his death.
And we know that Grace was the good Samaritan
coming forward and pointing her finger at Felicity
to blame her.
The evidence-- what was initially provided.
So that's a little keyword for you there-- initially.
Will was found dead.
He had his iPhone 6S.
He had his iCloud backup.
The police created an iTunes backup.
Felicity.
She had an iPhone 5S, and just a file system image
was completed.
Also, it was not encrypted.
So if you notice that there were gaps in her data,
it's because the extraction was not encrypted like Will's was.
Grace.
She had that Samsung galaxy 6S.
At the time of acquisition and the time
that this crime occurred, we could not get full file system
on her device.
We can not get chat capture.
We tried APK Downgrade, which probably
looked like massive deletion.
If you take a closer look, we also did the backup,
and we used access data FTK Imager
to create that emulated SD card approach
to make sure you got the most information you could.
We tried to root her device, and it ended up wiping it.
Remember how I talked about that during the course?
This does happen in real life.
Here, we have Will O'Connor.
We have some identifiers for him--
his Facebook, his Google, his Gmail information,
where he lived.
Haverhill Road on West Pikeland Township, Pennsylvania.
That's where he was on 2/28 around 21:36,
when his phone last recorded any information.
His last Wi-Fi was Winelove, and that information
is provided to you here.
Felicity.
We have lots of identifiers for Felicity--
her airdrop ID, the fact that she
does have an iCloud account.
You can see some of these things in blue--
or in bold.
Two different phone numbers.
Felicity and Will, at one point, had the same phone number.
Was this intentional?
Was it not?
You will have to ask Miss Felicity.
There was some SIM swapping going on.
Location services were enabled.
Her message retention was forever.
Her Apple ID listed here is beachwalker72@icloud.com.
You can also see the last activation time on her device
is 3/2/2018.
That is after Will died.
So did she get a new iPhone?
Did something occur?
Identification of subjects.
Grace Appster here.
We can see her KIK, grayseegirl, her email, her Facebook ID,
and Will states that she is a friend on Facebook,
where you can see that if you look at their Facebook IDs.
Now, there's an outlier.
You were not initially presented with this information.
Paul Lazaro is UK-based guy--
sorry, Paul Lazarro.
We have all of his identifiers listed here.
He has a throwaway Blackberry device
that he used in this crime.
The motive.
Will was having an affair with Grace.
Felicity finds out.
So we could start looking here in the messages.
You can see that she's saying things--
"I'm sick of seeing your stuff on your phone.
I feel like you're rubbing it in, flirting.
Who does that?
Fix the iCloud thing."
That's a clue to you right there.
Their iCloud was accidentally syncing messages.
I warned you in Section 3 how much of a nightmare
this could become.
Every time will send a message or Felicity sent one,
it hit both of their devices.
So you can see here how it looks like duplicates,
like "Not much left to say.
I'm sorry.
I messed up.
I love you.
I'm leaving for Dallas."
Where it looks like it's duplicates,
it's because of the iCloud sync.
You can also see here, where Will sends a message
and says, "I think we have the same iCloud.
How did that happen?"
You can see lots of things.
You can also see some searches for divorce attorneys
in Philadelphia.
The motive.
Here are some screenshots that you could find.
Felicity is reaching out to Grace.
And here, you can see she's saying,
"I'm in Virginia this week.
Maybe you want to drink with me."
If you look back, the first meeting of Will and Grace
was over drinks in Bethesda, Maryland,
and it was a Facebook invite.
So clearly, Felicity is aware of this and is antagonizing Grace.
And then she says, "We need to talk."
And then she says, "Please or I'll handle this myself.
Will is going to regret this."
So now she's doing threats.
And now she's telling her, "I know
that you're in Dallas with him.
I'll keep warning you to keep your hands off my man."
Then they go back and forth and they're arguing,
and then they're calling each other psychopaths--
and threats.
Lots and lots of threats.
The story of Will and Grace.
You will find flight information for both of them
when they were traveling.
They both went to Dallas, Texas together.
It seems like Will took Forensics 585 in Dallas.
Felicity-- or, sorry, Grace--
booked a trip for March 2 to go to Philadelphia
from Washington, DC, to see Will.
He was murdered before she could go there.
As far as Will and Felicity, you can
see things are not going well.
Around 2:17, they're going back and forth.
She's apologizing.
She's begging him to call her.
And they're just going back and forth.
Here is their timeline.
On 2/17, you can see, "I'm so sorry, what a jerk.
I will help however I can.
Want to talk.
I've helped solve these problems before."
So this is interesting.
This is Paul and Felicity.
That was their first message.
And then she says, "OK, I look forward to our conversation.
Do you need a number?
Do you want to use Viber or Blackberry Messenger?"
So they start chatting, but their chats kind of go dark.
Then you see this message on 2/28.
"Last chance.
There's no changing your mind.
I'm in PA."
And then he says, right after that, at 22:59:01--
and this is UTC--
"You may want to say your final farewell."
"You got it?"
And then this one.
"That was too easy.
Do you need proof or do you trust me?"
At 23:14:19.
And then he tells her, "I'm ordering a cheese steak
and I'm out of here.
Thank you for the Wi-Fi password.
Send my money."
And then he confirms, "I got the money.
Let me know if you ever need anything again."
So Felicity hires Paul to murder Will.
Now, the whole cheesesteak thing, I realize, is gruesome.
But I was so afraid we wouldn't be able to put a killer at that
without the home Wi-Fi.
So that's why that little hint was provided.
Approximate time of death is around 23:14:19
with "That was easy.
Do you need proof or do you trust me?"
You could have also associated this to Will's health data,
but where it looks confusing is, the police obviously
arrive on the scene and pick up the phone
and start moving around.
So lots of things-- the coordinates, the Wi-Fi,
all of this information could have been provided to get you
the killer at Will's.
Now, in order to find Will or Paul and Felicity's
communication, if you requested her Google data
or you requested her iCloud data,
it would have given you more artifacts.
I'm going to talk about that shortly.
Anomalies in the evidence.
The first thing you needed to notice
is, Felicity wiped her phone.
So there is a gap between February 17 and March 1.
If you look at Purple Buddy, you would see a guest country
on 3/1/2018.
Now, this is a little bit sneaky,
because I hinted in it in the class.
But if you read my blog that I mentioned,
it would have given you all the steps
you needed to take to do this.
You could have also seen log entries.
It jumps from 2/15 to 3/1.
So she wiped her device.
If you came forward and said, we know Felicity wiped her device.
Can we have her iCloud information?
We would have presented that to you.
Now, something else I mentioned all the time.
Just because Felicity wiped her device doesn't mean data only
exists in iCloud.
If you requested her Google information,
we would have provided it to you.
She met Paul Lazaro on Facebook.
They then moved to this strange, strange platform
called Vampire Freaks.
The reason we chose Vampire Freaks is we
knew that Google collected data on it.
So she meets him.
They talk about it.
She knows about the affair from the cloud sync.
Meets Paul, moves to Vampire Freaks, threatens Grace.
She moves to Texas, hires Paul--
or, hires Paul to kill Will.
Confirms he should do it in plain text--
that's easy to say--
and pays him.
So murder for hire.
The timeline for Grace.
She meets Will in Bethesda.
They meet through a Facebook happy hour.
She travels to Dallas with him.
She receives the threats from Felicity, plans a visit,
and worries that their communications will be cut.
So she was actually on the phone with Will
when Paul came into the house and shot him.
So if you were timelining, you could actually see this.
Grace was really innocent other than having the affair.
She did not commit any murder or have any involvement in it
at all.
The timeline for Paul.
He meets felicity on Facebook, continues
through Vampire Freaks.
Arrives in Pennsylvania, commits the murder,
connects to the Wi-Fi, and leaves.
You can find all of these little tidbits.
And the file paths for a lot of these
are in the solutions in your Dropbox.
This is where you really get additional information.
If you reported other things without giving Lee and I
valid reason, these are some of the disqualifiers built in.
Felicity. iCloud backup would have been provided.
Her Google cloud collection would have been provided.
Grace's Facebook and then Paul's Blackberry.
Now, Blackberry is going to cut the capability
to actually use the Quebec server to parse this.
So at some point, this Blackberry
is going to become obsolete to even parse in the tools.
You may have to manually dig through that file.
Here's what some of the bonus stuff could look like.
If we look at her, we could see her felicityocon@gmail.com.
willsgirl is her password.
If you presented this information
and said you wanted it with real, valid information,
we would have said yes.
Here's where you can see all the Vampire Freaks
messages between her and Paul and the timelines.
You would also notice, if you timelined Will,
every single time she had a fight with Will,
she reached out to Paul.
Here are some of the bonus items where
we can actually see their chat messages going back and forth.
And I realize this is hard to see.
But it's just all the Vampire Freaks communication.
Now, there are some points of confusion.
And I have a little slide at the end as my disclaimer.
On the day of Will's death, right before his death,
this photo was taken.
A lot of people get messed up by this live photo
of a woman's feet.
Sadly, this is me chasing my son around when
I was trying to complete this murder for this class.
It was an accident.
I meant to delete it.
I was hoping it would be gone, and I forgot to do that.
So that throws some people off.
Grace's activity after the death is also odd.
So if you look at Grace's activity,
here, we can see that she has an attempted root on the device.
If you look at that screenshot on the right,
it looks like she's trying to root it--
visiting Google photos, visiting Google
drive, doing all of these different backups
and weird things.
This is the police acting on this device.
She turned her phone over the next day.
So what you see here is, they're trying to root the device.
APK Downgrade looks like all of these weird apps being
downloaded.
That is the police on her device and their footprint.
Now, this scenario.
The picture of my legs-- that's the perfect example.
Things involve real people.
So the true personas behind this.
At one point, I was Will and Felicity.
I was the husband and wife.
When Felicity left Will and moved to Texas,
Mark Hallman from SANS became Felicity.
Lee was Grace, and Cindy Murphy was Paul.
So we have all of these different personas.
You will see real connections to our home Wi-Fis,
real connections to, obviously, exif data and stuff
that belonged to us.
And we don't mind that that information is there,
but we ask you not to share it.
Keep these case details confidential.
Please do not post things online for people to see and cheat.
We want it to be fun.
We want it to be challenging.
So hopefully, you enjoyed it.
We spent, I think, eight months creating this scenario,
and traveling all around with it,
traveling together, planning this entire scenario
to make it as real as possible.
Keep practicing.
You have test data.
You have all of those bonus labs on ISO B.
You have that additional case that
used to be the old forensic challenge.
There's DFIR NetWars.
NetWars has smartphone questions in it.
Keep yourself smart.
Take these workshops that SANS provides for free.
If you're at a live event and we bring back
at night events, which I hope we do at some point, attend them.
Don't forget to just go out there and grab things
that are provided to you.
I also challenge you to play in the vendor CTFs.
I know Magnet does a lot of capture the flags,
and Cellebrite.
We build capture the flags, where it's questions, answers,
typical scenarios-- very similar to a NetWars style.
Play those games.
Take additional training.
DFIR always has new classes coming your way.
Please consider taking some of these courses.
Sign up for the betas and the alphas.
Sign up to be a work-study.
There are so many ways that you can get additional training
and keep yourself smart and sharp.
And don't forget, the Mac class now
has a certification coming, GIME.
So if you're interested in being one of the first
to have a vendor-neutral Mac cert, consider taking 518.
I hope you enjoyed the course, I hope you enjoyed the CTF,
and thank you for attending.