Your final lab-- we want you to think like a developer.
We are giving you an image for UFED.
I would say, load it just in UFED because Question 1 is,
were any deleted chat messages recovered?
The answer is going to be no, which
means you're going to do everything manually.
But let's take a look at this.
So when you go to load it, it's going
to ask you for the iTunes backup encryption.
It's going to be Noble.
Press Enter, and it will run.
Now, when this is done, keep Physical Analyser open,
even though after you answer Question 1,
we recommend that you export the database,
and you start looking at things in different ways.
You may want to go into hex.
You may want to do some different things.
While this is parsing, I want to show you a tool that's
in Scripts for Class.
In Scripts for Class, we have this
SQLite-Deleted-Records-Parser.
And I'm going to go into the sqlparse_GUI.
And I'm going to open this.
This is Mari DeGrazia's tool.
She says, show me where database is.
Show me where you want to output it, and process.
It goes into the free pages and tries
to pull out anything that could potentially be deleted.
Now, you may get false positives.
You could have something that was merged from the WAL.
You could have something that is wear leveling.
You could have transactional data.
So it's going to give you clues that you can then
search for in hex.
We are now going to review Lab 5.4.
Again, simply press Pause if you're not
ready for this review.
The first thing I am going to do is look in Physical Analyzer.
And the first part of the question is about,
can you uncover any deleted chat?
So I'm going to go into Messages, Chats, TextMe.
And right here, it says there are six conversation containing
45 messages.
Did it recover anything deleted?
And you can see, it did not.
We don't have any red X's anywhere or anything like that.
So I'm going to follow the source to the database.
Once I'm here, I'm going to export out this file.
So I'm just going to right click and do Save As.
And I'm going to save it to my Desktop.
Now, what I would recommend is that you go into databases,
and you just scroll down until you find the message.
And click on that little pickaxe,
and see if you have any luck.
So here, it's saying 24.
Now, this is where you have to be careful.
Sort on ZBODY, and let's take a look.
You're going to see that you truly did not
get any real deleted messages because Calling
you now is still active.
And what we're seeing here is, this is actually just
wear leveling, or duplicates, or the transactions coming over.
Same with got it.
Same with hey, man.
Same with I'm at the airport, and so on.
There's nothing unique that's in red that is also not
in that black font.
So now, I want to run Mari's script.
You could technically go in the hex and start searching around.
But that's not exactly easy.
You don't want to have to dig around
for things that you have no idea what you're looking for.
I want to get a clue first.
So I'm going to load my database into here.
I'm going to say my output file.
I'm going to save it to the Desktop as well.
I'm going to call it textme2, Process.
And when it's done, you can see, it pops up, and I can textme2.
And what Mari has done is she went through--
I'm just going to load this in Notepad.
It's not going to be pretty, but it's fine.
You could also load it in Timeline Explorer
if you wanted to.
But it's going to give you glimpses of information that
may be useful to you.
So if we look at this--
let's see, if I load this in Timeline Explorer,
how it looks.
See if it looks any better.
Oh, that looks much nicer.
So in here, we can see that we see some phone numbers.
It looks like there's some messaging back and forth,
some countries, some credits, some timestamps.
But some of these are really run on really long.
So it may actually not be better than looking at it in the text
file.
So what I'm looking at here, this whole chunk of information
looks like it has a lot of messages in it.
I sent you a sticker, got it.
How about this one?
Delete this text.
I'm going to search for that.
I'm going to copy this because this
seems like it's an interesting piece of information that's
in that chunk right there.
I'm going to go back into Cellebrite.
In Hex view, I'm going to search for this.
We are trying to determine, is there
a way to say what is deleted in these three pages versus what
is not?
So here, we see delete this text.
Now, this is where we're going to get crafty.
We need to figure out what makes this message deleted
versus something that is active.
So I'm going to highlight delete this text,
and I'm going to do Add tags, so I
can control some colorization.
And I'm just going to make it yellow, and say, OK.
I'm going to make sure the font is black,
so I can actually read it.
And I'm going to just highlight that.
So now, this stands out to me.
That is a deleted message.
Now, what I want to do is find something that is not deleted.
So I want to go back into the database
and just find something around it that
is potentially not deleted.
So text me-- to your text me number.
That doesn't make any sense.
I sent you a sticker, awesome.
So as we start looking, it takes us right to those.
But I want something that's near my other result
because it's easier for me to find it.
So as I look at this, I'm going to scroll up.
And let's look at calling you.
So if we look at calling you, if I go back
into the database view, I can see calling you now.
Let's go back into hex.
And calling you now-- excellent.
I'm going to make this one green because it's still active.
So I'm just going to right click, Add a tag,
change this to green, OK.
So now, we have some comparisons.
We have one that's active, one that's deleted.
Can we figure out what's different?
This is where this becomes a little bit annoying.
But you will notice before every message,
it starts with this u dot.
Every single message starts with 55 07.
So if we just find the 55 07, that's going to hop out at us.
So we could look, and we see 55 07.
We can make this a color if we want.
And what you're really just doing is narrowing it down.
So I'm going to say, this color is going to be this pink for 55
07.
And I say, OK.
Down here, this 55 07, we'll make this one pink.
And then, we have to look at, is there
anything that makes these different?
So as we start looking, and we're like,
OK, we look at the next few bytes leading up to it.
We look at bytes leading up to it.
And ultimately, what you're going to find
is if you go back to Mari's textme,
and you search for the I'm at this place, calling,
delete me, delete this text, what
you're going to find is the only status flag that
is different is this 3C.
So if we search for this, 55 07--
I think if we search for this whole byte of hex--
so just the bytes, hex, paste it.
We have all of our deleted messages.
So delete this text.
We have this image--
oops, delete this pic.
We have another delete this text and oops, delete this pic.
This is how difficult it is for every single application.
So the main point of this is for you to understand
that you can do it yourself.
It's a pain.
I would never do this without Mari's script.
But this is also to set expectations
when you're like, why isn't it parsing this application?
Why isn't it parsing deleted?
You have to remember, it's different for every single app.
It's not like that 3C status flag
is going to work for Snapchat, WhatsApp, Facebook Messenger.
It's not the case.
Every application is unique.
Every application is different.
Do not fear the hex.
Do not be afraid to use some of the free scripts that
are going to at least give you a clue or get you started.
So this entire chunk right here of unallocated space
was really helpful to what we've just done.
Without that, you could have been
searching for days, possibly even weeks for information.
So make sure you leverage what you have.
Always start with your commercial tools,
and then dig deeper.