Digital Forensics Now
A podcast by digital forensics examiners for digital forensics examiners. Hear about the latest news in digital forensics and learn from researcher interviews with field memes sprinkled in.
Digital Forensics Now
Insights, Insots, Inseyets!
Get ready to navigate the complexities of digital forensics with the latest industry insights, as we shine a light on Cellebrite's recent rebranding journey. From the quirky 'EYE' twist in their new product names to the strategic significance behind the move, we've got it all covered in a dynamic discussion that promises to clarify and critique the changes afoot. Plus, we'll dive into how Cellebrite is contributing to the tireless work of child protection organizations, aligning tech advancements with noble missions.
We will guide you through our thoughts relating to advertising effectiveness in the forensics domain, and why the quality work of forensic professionals trumps any single tool on the market. The art of communication from businesses about their products and the role of technology in boosting company progression is key.
The conversation turns to the exciting potential of recent password recovery innovations from Arsenal Recon's Password Sledgehammer and new support for location based and messaging applications in the LEAPPs!
As we wrap up, the discussion turns to the thrilling possibilities of Android device analysis and the ever-evolving policies of giants like Google. We're not just talking about the next big thing; we're living it, breathing it, and sharing our experiences with you. So plug in, turn up the volume, and prepare for an episode that’s as informative as it is engaging.
Notes:
Operation Find Them All-
https://abcnews-go-com.cdn.ampproject.org/c/s/abcnews.go.com/amp/Business/wireStory/cellebrite-donates-ai-investigative-tools-nonprofits-find-missing-106321858
Magnet Forensics Acquires High Peaks Cyber-
https://forensicfocus.com/news/magnet-forensics-acquires-high-peaks-cyber-further-bolstering-the-magnet-graykey-labs-research-team/
Arsenal Password Sledgehammer-
https://arsenalrecon.com/products/arsenal-image-mounter/downloads
Life360 Stark4N6-
https://www.stark4n6.com/
Analysis of Android Settings During a Forensic Investigation-
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html
Google Location Data News!-
https://www.forbes.com/sites/cyrusfarivar/2023/12/14/google-just-killed-geofence-warrants-police-location-data/?sh=245f8f422c86
https://www.washingtonpost.com/technology/2023/12/14/google-maps-location-history/
Hello and welcome to the DTF Now podcast. Today is Thursday, january 18, 2024. My name is Alexis Brignoni and I'm accompanied by my co-host, the Cookie Crips to my Fruit Loop, the one that persists and never quits. The snow covered but never cowered, heather Charpentier. The music is Hire Up by Shane Ivers and can be found at SilvermanSoundcom. Welcome, welcome, welcome everybody, and let's everybody show our faces here. There we go. Sorry for the late start. We were having some technical difficulties, but we made it. We made it.
Speaker 2:The technical difficulties were all me. It's all good, it's all good.
Speaker 1:No, no, I think we're rolling. I think we're rolling at this point.
Speaker 2:Yeah.
Speaker 1:So, after a little rush there to get the show going, what's going on? Heather, how are you feeling now that we're settled here?
Speaker 2:I'm good, I'm good, I'm good now.
Speaker 1:What's been happening last couple of weeks?
Speaker 2:It's cold, it's really cold here. You would freeze to death if you were in New York right now.
Speaker 1:Oh my goodness, I don't know how people can live in that frozen tundra. No, thank you.
Speaker 2:I left the house this morning with nine degrees.
Speaker 1:No, yeah, no See, look, florida was like somewhat in the 40s and I'm like freezing to death in my mind. So nine degrees I can only imagine. But I'm glad you're not a popsicle, I'm glad that you're here.
Speaker 2:I just thought out, just in time for the show.
Speaker 1:Exactly, exactly. Our fingers are frozen. That's why we have the technical difficulties.
Speaker 2:Yeah, blame it on that All right.
Speaker 1:So we have everybody. We have a pretty packed show. We're not going to keep you longer than an hour today, so we're still getting the kings out of how we're doing the managing time, but we got a pretty good show, so I think we should get to it. And the talk of the week has been celebrate in all ways and I think they're all good ways and funny ways, so I'm pretty happy about that. So, if you haven't heard, in the last couple of weeks, celebrite has been having a lot going on, and the first one is they're doing a product line rebranding and that's what I believe. It is based on what I've seen in their websites and different social media places. So rebranding and they also came out a couple of days ago with an amazing initiative that supports child protective organizations, so we're going to talk about them. So it's going to be pretty neat.
Speaker 1:So let's start first with the rebranding, and I thought it was pretty fun because they rebranded the whole line and actually I think it's something, and you tell me what you think about this other. I think it was something that's needed because they rebranding in the sense of getting things under one streamlined product line. And I say that because you had right, you had like a UFED, pa, premium and different variations for different, for the private sector, their own variation names, and then PA was divided between PA 7 and PA 8 was ultra, so they had a lot of pieces going on. I don't know what I mean. I thought it was pretty a little bit confusing on the product lines, or at least all the product lines and products.
Speaker 2:Yeah, I mean they do have a lot of products, so combining them all definitely will definitely be less confusing for people, I would agree.
Speaker 1:Yeah, so, so, yeah, so I'm pretty, I'm pretty happy that they're doing that. Now, I know the way they divided it and it's in three main categories right, so they have going to go from right to left. The pathfinder type of you know product line, and that's more focused on the closure of the case how you analyze some of the stuff and close that case. The guardian, which is the product line that manages that data after you receive it, and then the receiving part of the data. And this is the part where things, to me, got a little bit funny, because, for the folks that are not listening, what I'm showing now is on the screen is the name of that product line that does the extraction of the data and some of that analysis, and it's called in.
Speaker 1:So the first time let me be, let me be straight here when I read that logo, I read insides, and the reason is because between the s and the t is like an I, but as I release you know circle II, like a big circle, and I said insides, I say that makes no sense. And I said what's an I? So always insights, right? So, and that's what I thought, it was like an insight. Oh, they mean insights. As you would spell it in s I, g, h, t s right.
Speaker 1:No yeah well, it's actually not that, it's not insights. So what they done, for whatever reason, is that I is actually E y e, so it's insights with E y e. All right, and I thought it was pretty hilarious because I like what. Why? Why would they do it? The insights is a pretty, you know, it's a, it's a dictionary word that actually has meaning, right, right. So so folks have here on the screen and again, the product line, rebranding is a good idea, I believe, a great idea. So you go from now on the screen, I'm showing all the product lines from left to right.
Speaker 1:You start with insights with E y e, right. That's why I'm having on my board. I see you with the way celebrate spells. I know it's E y e. So whenever I see that celebrate, put an eye on something, I'm going to put E y e on it. So, look, it's all in good fun, right? So don't, don't get mad at me, all right. So so they got their insights, insight, insights, and they do that part. And then they have Guardian and they have Python. And now what have I gleaned from the, from the, from the insight stuff? Before I started making more jokes, I was worried because when I, when we heard. We heard this for work confused, right? You remember how we came about this information, heather, you remember how we got that name for the first time?
Speaker 2:How we saw it.
Speaker 1:Yeah, what we saw first, you remember.
Speaker 2:I think I think one of us saw it in in like the portal right For the beta version.
Speaker 1:Yeah, I think, I think, I think, yeah, I think. Kevin told us hey, look, there's this name and about, but with the I am like the what he sent me the logo, and I thought it was funny. So I went. I went in my office the other day and I, showing this to people that had no idea nothing about forensic, said read me this, right. And everybody was reading insides.
Speaker 2:Absolutely.
Speaker 1:So I'm doing this to me, am I? Am I in the wrong here, you know? But everybody was reading insides and oh, it's insights, and like, oh, okay, and they get kind of picked up on it. Now we have a whole bunch of eyes in the chat and, by the way, I think.
Speaker 1:Thank you everybody in the chat for being here with us. It's always fun to have you here and put your comments and if you're not listening live, come on over in the chat. It's a good, lively atmosphere. So so we have some jokes about that, right, and again I'll be. I'll be far forget. I am going to tangent. The product line now is going to be this way, so you used to. Now you would have insights is going to be like a big family name or a sweet or product name. That's what I glean after looking at the documentation and asking around. So you will have insights and then insights power by PA and that's I mean. That really made me feel better because let's be real here, I don't believe anybody's going to call it insights, you know it's going to be PA and in you fit.
Speaker 1:Yeah right, I mean, how many years have we been using the term PA or physical analyzer? For how many years now?
Speaker 2:Right, and imagine all the prosecutors that already know you're using physical analyzer, like they're not going to switch over to insights or insights or whatever. Which?
Speaker 1:which, which the first time I saw the spelling with EY. I'm a native Spanish speaker. It's pretty obvious because of my accent, and when I saw it it's like this is not an English word, right, because no English word is written that way. So my Spanish speaking brain natives read in say yes, because that's how I would read in Spanish.
Speaker 2:Exactly what I read, and I don't speak any Spanish.
Speaker 1:I'm like in say yes, I wonder what that means. Oh no, it's insight, right? So the joke I had with some of the you know my friends, like Heather and the like and like in, suggests in sus and insights, you know and we're bringing those, we're bringing in suggests in sus and insights all of them.
Speaker 1:No, but it's a good idea. So I asked around a little bit about what's up with if they're putting everything under a family name. What's going to happen with, say, you fed and premium, right, they're kind of distinct product lines. So my understanding about that is that now, you fit is going to be you fit plus premium, and the description they gave me was it's like this extraction tool in steroids, right, and I mean we don't support steroid use, obviously, but obviously what they meant by that is, you know, it's going to be a really powerful tool, right. And that combination kind of some sort of combination, right? Yeah, I didn't, I didn't. I got somebody in the chat saying that that's a pretty good pun. The whole insights insidious thing, my mom, yeah, there we go, thank you, I know who this person is. Let's, let's a lot for. So, for Kathy. So, anyways, the reason for the whole instead the what was I going with it? Oh, yeah, so it's going to be combined. The both, both tools.
Speaker 1:Now, tomorrow, I believe the Heather Mahalek is going to be talking on the dig, for I think it's tomorrow, so be on the lookout. It's going to give details on all this rebranding, specifically on the UFET and premium combination deal. So be on the lookout for that, right? So that's that's all I know as of now, but tomorrow there'll be a lot of details on that too. So it's a show to be on the lookout for now. Yeah, yeah, we got word that is tomorrow. So, yeah, so tomorrow, be on the lookout for the dig dig, for that's a podcast that's, you know, run by Heather, and celebrate and get those details. And I think it's. I think it's pretty good. They're moving the right direction. But that insats name yeah.
Speaker 1:So so I made some memes. So for the folks that are not are listening, you know, there's this meme template where there's two ladies kind of like pointing and screaming and just a cat in front of a salad, like you know, kind of looking at these ladies, and I put the logo saying insats on the top, you know, with the eye, and then they're saying insights and the cat is saying no insats. And it's interesting for me because when I did this meme I wasn't aware, still, of the EY spelling, so I wrote insights as I thought it should be spelled right and that's when it.
Speaker 1:That's when it got funnier, because then, you know, I made a meme with the mean girls, mean like stop trying to make insets happen. But too late, it happened already. And I hope that people in LinkedIn were like what does this mean? Change the names, is PA disappearing? So I think it was. You had a right. You went to the portal and you downloaded the beta right.
Speaker 2:Yeah, I did.
Speaker 1:And what did you discover? You downloaded the beta.
Speaker 2:So when I downloaded the beta it, it looks like PA. You're not going to see a lot of changes. So there's the insights logo.
Speaker 1:Yeah, no, yeah, and so I have a meme there. Again, this is I made this because I think it's funny. Hopefully people share that is funny with me. So you got the whole Scooby Doo. They're kind of unmasking the ghost, and the ghost is called insets or insights in with the logo and you pull it out. Is physical analyzer, ultra right, and I mean there's nothing wrong with that. I just think it's funny because, again, when you do a rebranding but all jokes aside, I think it's a good idea to kind of combine those product lines so they make more sense when you acquire them.
Speaker 1:Now, that being said, right, I got, I got another a few big bones to pick here. So this made me think about advertising in this space versus technical information, right, and it made me think who's the, who's the consumer of this information that's coming out, right, that the advertisement or advertising units put out. And then again, this is I'm going to use celebrate and some other companies in the space. I'm not picking on them or anybody and just making some points just to provide a point of view of an opinion, right, so nobody got mad at me here, hopefully. So who's the audience of these, of this, of this content, right, is it the people that use it, the people that buy it. So, for example, some of these advertisements, for example for FTK, they're saying this is the only tool that you need, right, and if you get it it'll be better and faster, right. Or they tell you another company, like said but I said this has to do in the past, you don't need any other tools. Another tool that I have on screen here says you're the only due to our forensics tool that you need. So, and at some point I'm thinking, okay, advertising people, right, if you're all saying the same thing, what are you saying? Well, you're saying nothing, like everybody's claiming the same thing, right? So me, as a tech user, this type of this doesn't motivate me for to anything right, to do anything right.
Speaker 1:I want to know really what's the underpinnings of it, and I say that because, as a matter of a technical expertise, we know that there's not just one tool that we all need. That's just not a thing. Right, in this space, you will use constant different tooling, and I'm not talking about only tooling that you buy, tooling that you develop and you going to looking at the hex, exporting things out and kind of working with it. You are the tool in that sense, right, and I don't mean it like my wife that makes you might think I'm a tool, meaning the sense of, of a Procedure or a process to be able to get this data from one form to another form that's digestible for your stakeholders, right, so you become a tool as well, so you will always need more than one tool.
Speaker 1:So, factually, as an, a statement that you come out like like that, right, I think I don't know. And and then some, sometimes we get confused, right, they say, well, better access with 60% richer data, and I'm like, what's richer data? So I was, I was done a group of ex examiners are my friends saying well, I think Richard might mean that the data is artisanally processed with bytes from pure Himalayan data streams.
Speaker 2:I read that the tool is just gonna cost more.
Speaker 1:Richard, who's who's being richer here now and Look, I mean I'm. The word I got is like tomorrow Heather's gonna bring some Heather Moholy, she's gonna explain some of these numbers. But we gotta be careful, is my opinion, and this applies to companies but ourselves. We're presenting technical data. Right, we can talk about some qualitative at that. A qualitative Description right, something is richer, it's, you know, higher, it's lower, right.
Speaker 1:But the moment, right that you add a quantitative description for percentages or whatever it is you need to tell me, in relation to what you know, 10% of a minute is not the same as 10% of three hours or 10% of a millennium, right? So Quantitative descriptions require way more data for them to be sensible. Specific folks are our tech consumers, like the examiners, right? Another example of some quantitative stuff and qualitative stuff right, qualitative is twice as fast Okay, twice as fast as what you know, like compared to what, right? Or if they tell you you know, well, this is two times faster. And and then, on top of it, it's like a 40% number, which I don't know what's the relationship with two times faster than 40%.
Speaker 1:And with that narrow right. I Don't know. I mean it's like a speed gauge. I don't know what that means and then they tell you it's based on internal usage. What was that? What was it? What does internal usage mean, you know, as opposed to what external usage and what is external usage? You go to the parking lot and do it.
Speaker 1:I don't know what that means and it may be a bit facetious, I don't know, we're trying to be funny, but the point I'm making with that is us, as consumers of advertisement and products, right, we need to be also smart consumers. We need I believe we need to really tell our vendors, say this, this is this, this, this is really hype language, and you know, thank you for the hype language, but I need to know what's the real deal from a technical perspective For that. Actually, I have some points that I want to make on that, and again, I'm in my softbox section, so, heather, bear with me. All right, so, and again now, this point is it's not about seller by the ftk or cyber tree eyes. This is more general sense, right?
Speaker 1:So what I'm saying now is not directed at them, is in general, in the, in the sense, in general Comment for vendors and even you as, as an examiner, avoid the use car salesman pitch right Like oh yeah, look at, this is the best thing in the universe, gonna be revolutionary, and it's the same thing that you have before. Right, don't oversell anything and and that applies to you that as that you're selling or listening when you're talking to your prosecutor or whatever stakeholder don't oversell the analysis because you want to make it look good. Right, you got to be careful. You're gonna make sure that you're accurate and factual and and give the tone that the evidence requires, because a difference in tone, even if you're not changing the evidence, does change outcomes.
Speaker 2:Right, and that's dangerous if you're not even if the prosecutor is trying to get you to oversell the analysis, because that happens all of the time. Can't you just say this?
Speaker 1:Mm-hmm. Oh, my goodness, you know what that. That requires some. You know my mind blowing animations here.
Speaker 2:So the folks are listening, neat little tricks of the new laptop and we're all gonna have light shows every week now.
Speaker 1:It was a light show coming behind me on the screen. It was a mind-blowing comment. No, but it was actually true. That property, oh my goodness, and you're so, you're so on it, the people might have the seal to get this case done right. But it just because you have all these lines of evidence that prove a case doesn't mean that it has to fit with what I, with the digital Evidence that I'm providing. The digital evidence is what it is.
Speaker 1:If it matches or not with your other points, I don't care. Like, this is what it is right, and that that desire to get things moving forward should not affect you. Right? Don't oversell it. Don't be that use car salesman because you're trying to please somebody and that's a Natural reaction from human beings. Right, we want to be liked, we want to be part of the team and Us examiners. That's not, that's just not it. We're not it. We're not doing any of that and we have to be really conscious about it. All, right? So Well, let me get back to my presentation here.
Speaker 1:So I Like a focus on technology. Say, look, this is the tool and these are the things that I were doing that will make your life better from a technical perspective. Right, on the, the qualitative quantitative differences, I don't care, because at some point I'm gonna test it myself and it's gonna. It might be most likely to be different from what the benchmark in the company does, and that's just how it is, because my system is different, their system is different, they're most likely doing it in an ideal Software hardware environment and we are not right. So at some point I don't want to be disillusioned, so I'm gonna test it and test it myself. Right, explain your competitive advantage. Right, that's part of that tech.
Speaker 1:What makes you different? Just saying we're the only tool that you need and everybody's saying the same thing doesn't tell me anything. Right, what's what? What do why you bring into the table? Well, and I mean and again for the celebrate sample, they have other comments that I do like, right, like, look we're, we're streamlining our workflows and there's that's something that's important to delve into which I think Heather Mahal is gonna Mahalik Barnhart Is gonna be talking about tomorrow. Right, how do explain that? And Highlight your latest advancement, as you're putting something out and I got a few examples here, for example, celebrate. I love when they came out with a media origin Analytics, telling you where the image came from. If it came from the phone itself, it came from an app. That's something worth knowing, right? I care more about that Than kid, than caring about what the name of the thing is, if it's insights, insides or insides right, I care about, about more about that, right? I mean what? What do we care about?
Speaker 2:examiner, sir, just yeah, so I I Care about the tool working right. I want it to get all of the latest applications I want, when it does support an application, I want all of the data that's available, that's relevant, to be parsed out in in the data for me. And I think the other thing I care about with the companies is the support tickets right. So if I'm putting in a support tickets because I need something done and I would rather focus more on the technology and the support for Maybe issues that might arise, then then the rebranding. But I do like that they're streamlining everything.
Speaker 1:Oh yeah, yeah and and that's I mean we're making fun of the whole. Insights, insights, insights. But the other day we care about that, we care about the process Behind the scenes, how you manage my tickets, that you're being responsive, and this is not so. And again, I'm not picking on solar, but and this is the more a general term right, are we doing all the things that that we care about? Right and things, and I miss pick that. Well, let me not get ahead of my myself. So, same thing with F2k. Another example they have a new interface. They had level DV capabilities that I haven't seen really delved into by other tools. Bring that up constantly. Right, do that. Right, you're acquiring. We have an example later You're acquiring new or buying companies. I want to hear that, I want to hear that tea of what, how, them, where the company is moving towards, even if you don't tell me the detail. But hey, look, we bought this company that does X. That gives me an idea. Right, and Tell us why you're in this business. Right, and so that by has a great example of why they're in the business.
Speaker 1:I'm gonna get discussed shortly, but before, before I move away from the, from this topic, um, you know, I, I. I had some comments people told me and I'm thinking about, should I go there? I'm gonna go there, it's not a bad thing. But I have people telling me Look, that kind of joking, but serious, hey, you, you. You kind of being vocal about a company renaming or a company Product or saying, hey, you should do this better, right, like in a public forum. You know that that might, that might get mad at you and then that might limit your future Opportunities. Right, and I get what they're saying right, and let's just be real here it's, but it's specifically or especially with the law enforcement community.
Speaker 1:Everybody hopes that whenever done with their years, then they're finished their first career in law enforcement, retire, they want to go to private sector and make some money. That's just what it is right and that's a reality. I know that I'm also in that long-term plan, right, but the fact of the matter is that the reason I say all these things and why do I care? Is because I'm a big fan of the companies. I'm a big fan of the products. I use them daily and and they are Closer than friends. The actual tooling, if that makes sense, right, the tooling has has helped me, or, you know, giving me insights as a matter of fact, on cases that have changed people's lives, right?
Speaker 1:So, as I believe that as a community, we should be more vocal about it and when I say vocal, I don't mean be mean about it, right? Hopefully my jokes come across as good nature because they honestly, sincerely and are, and I am. But be vocal about what you need be vocal about what do you think about, how, where the companies are moving towards, and and be kind when you do that right, and be all yourself, as a user, open. And I say that because Sometimes you don't know what you don't know and companies need to be aware of that. Companies can't, I believe, cannot, just say look, we're gonna do only what the users request, because the user sometimes doesn't know what they don't know, right, every before they told them.
Speaker 1:If Henry Henry Ford said, look, if I had asked the you know folks what they wanted, they would have told me they want faster horses, right? And and that leads to a point, this come, any company, not, not, not just in this space any company, you have people within yourselves, right, your employees, your, your, your folks that are really close to the users. They come from the user base and then become part of the company. Listen to them right, they will let you know if this is what the audience is requiring. Okay, make sure that you take into account their perspectives. And I understand that they might not have MBAs, they might not be advertisement gurus or have degrees on it, but they come from the user base. They're the ones that those streamlined workflows, they're the ones that create them, because they know how the job is done right and and that input should be larger.
Speaker 1:And this is not. This is for every company. I've seen this happening in all organizations, including mine and when I was doing private sector. The same thing. And if you're listening and you're like a manager of a group or people or a company, make sure you have that Proper, open channels of communication, of communication within your organization, and don't lose that, that knowledge, that that you have internally, because sometimes we lose track of that. And two more, two more thoughts so we can move on, because we Almost have to show on. Just on this, Up first.
Speaker 2:So back to the highlight the latest advancements and the technology and products should also be a great report and or reader or a portable case or whatever tool you're you're using. I just I love that comment because I'm always harping on.
Speaker 1:I need a better report, so oh, my goodness, and and that's so true, it has to be end-to-end right and end-to-end and own that support. I think. I think we're moving in the right direction. You know, we we need clarity. And there's the last point I'm gonna make on that, even though and goes back, harks back to who's the consumer of this advertisement.
Speaker 1:I am not the one buying the tool, right. I have no purchasing capability, right, but folks like ourselves were the ones that will inform the people that make the purchase, okay, and they might look at the advertisement, but at the end of the day, they're gonna come to me and ask me what the deal is right, how many licenses do we need, or what's the capability that's needed based on our budget constraints and and I think that clarity is needed that To us to be informed, to then tell those stakeholders are gonna actually make the buy, make the best purchase, or whatever tooling is that we need. So, and really understanding and having coming across what's our why as an individual and as a company, why are we doing what we're doing? What's the deal with our products? Why are we here?
Speaker 2:Great 100%.
Speaker 1:Boom, there we go.
Speaker 2:So, still continuing on with Celebrite as our topic, they recently let me see if I can show it here Nope, okay, operation find them all. So they launched operation find them all, which is an initiative where the company is going to donate its technology to nonprofits to help find endangered children, and this includes NECMEC as one of the nonprofits. If you don't know what NECMEC is, it's the National Center for Missing and Exploited Children. Celebrite is also making financial donations to organizations like NECMEC, and I think this is a really, really great initiative that they've launched. I think it's wonderful that they're going to donate and give back, and especially for such a such a noble cause.
Speaker 1:Well, and that speaks to the point of the why right, what's your why? Celebrite as an organization is telling us look, we're here because we have a mission and one of our priorities is to make sure children are safe, and we are going to put you know our resources where our mouth is right. We're going to provide this tooling for NECMEC and not only that, we're going to provide resources across the community to tackle this pressing issue with the rights of the internet, peer-to-peer sharing. Abuse of children has been exponentially, has exponentially grown. I've been, I've been working these cases for the last 16 years, and that's something that we need to continue to work on and really protect those children, right. So that's, that's the why, and I think it's a great initiative, and I can make fun of the insets thing, but I fully support yeah, we will fully support this initiative. There's, there's even. They're doing even more than that.
Speaker 1:So Jared Barnhart is also part of Celebrite. He has a podcast coming out. It's called Uplift, and be on the lookout for that. He's going to be talking about these type of cases in the context of how, as examiners or people working this case, how can we have some protect our mental health? He's going to be talking about you as a civilian. How could you help out? Is there any way that we can all pitch in to help with this problem? You don't have to be a police officer or an examiner only. There's a lot you can do even if you're not. And he's going to be talking about all these topics coming up and that's a podcast, a series that he'll be heading.
Speaker 1:So I think it's again, it's a great initiative of Celebrite, not only telling us what they, what they value, but showing us what they value as a corporate culture. The CEO called it a I think it's a holy mission or some wording like that and I like and I don't consider myself religious, but I like the religious nomenclature or verbiage because it speaks to how deeply they involved and how deeply they believe this cost is worth. So I can't say any any more good things about it. I hope other companies in the space follow suit and if they do that, they make it more known to everybody. Yeah, it's pretty, it's pretty good. So let me see here.
Speaker 1:Yeah, so, talking about different companies in the space, I want to cover with quickly. I mentioned before that quesitions. Well, there's some good acquisitions coming up. Recently, magnet Forensics acquire high peak cyber and they're going to be combining that IP or your detector property and some of those that human human power from that company into magnet, including their great key group right. And you know, to me that means that they're really focused on developing exploits to actually get the access that we need and I'm extremely happy to see that. I'm hoping that the time of new operating system coming out to lawful access being obtained, that that lag time becomes shorter and shorter and shorter, like between iOS 16 and 17. I mean, how much time did it pass? Do you remember more or less?
Speaker 2:I don't remember exactly, but yeah, a little bit of time.
Speaker 1:Yeah, it was months. It was months and months, right.
Speaker 2:Yeah, it was months, yeah.
Speaker 1:Yeah, and I mean it's better than years. But let's say the lag time is six months. How many cases get stalled for six months? Right, because we don't have lawful access to a device.
Speaker 2:Okay, Well, and how much data is being lost, right? Because I mean there's a time limit on some of the artifacts and we're waiting for support and the data is just going away.
Speaker 1:Yeah, the SeqBee files in the bio folder and or Knowledge Seed. You have an older phone. You got 30 days and it's located. Oh yeah, Seven.
Speaker 2:On some yeah.
Speaker 1:So 30 days some of that gets lost and I mean who knows right. So I'm really happy to see that focus. I love competition. I love magnet and gray keeping combined. That competition was celebrate and then both of them also competing with MSAB, which also competes, with Belkosa, which also competes. I think we're living in a golden age of technological advancement in our field and it's kind of funny, you only realize that when the age is gone. But I think it's right now. I make a prediction that that golden age is now. So I think it's a I'm pretty happy to be alive through it.
Speaker 2:Right.
Speaker 1:A lot of tools coming up.
Speaker 2:Yeah, so I've talked about arsenals tools in a prior episode of the podcast, but they recently released a new, a new method with their, with their image mounting tool. So it's called Arsenal password sledgehammer and I'm just going to pop up I have a few little slides with it so I actually was testing it out. So it's a new database driven password attack with arsenals password sledgehammer database. So the database has over a billion passwords and you can see in the dropdown here up on the screen. It was a pin brute force which there was support for that in previous versions, but there's now support for password attack and I have some slides here with that too. So with the pin brute force that I've showed previously I didn't show this screen before, but it actually pops up on some and shows the estimated time for a pin brute force. This was a six digit pin and it estimated the time being four minutes, but it got the six digit pin in less than a minute to this, this computer that I launched as a virtual machine.
Speaker 1:That's, that's awesome, I mean yeah, it's really cool.
Speaker 2:It was so fast.
Speaker 1:Well, and it showed you this is the pain, or this is the password, and that leads not only to access to that computer, you know, but access to who knows what right that that password can be reused, and, because that's human nature, on all sorts of other things, right.
Speaker 2:Yeah, absolutely.
Speaker 1:Yeah, and I mean this. That's a big database. I mean, do you know how many Macs or gigs in my, in my take?
Speaker 2:Yeah, oh, how big the database was yeah, I have it here. I want to say it was like 50, like 50 what 50 gigabytes?
Speaker 1:I'm pretty sure. Yeah, it's pretty hefty. Again, I'm done with that. I mean, the more the more passwords, the better right.
Speaker 2:Yeah, don't quote me, but it was something like that. I had it in the download here somewhere, but yeah, so the pin, it popped in in less than a minute, but it also has the capability to do passwords. So this was a password for another, another image that I was provided, and it got that in in like less than a couple of minutes. So I was really impressed with the speed of it and the fact that they have the new password capabilities as well.
Speaker 1:Oh, absolutely. It's another way of being able to kind of attack those, because, I mean, do we have tools to try password, the password and others? Of course we do, but having this other capability within a tool that you own, that is fantastic. I mean, and I'm a big fan of Arsenal, their Monter, and really big fan of the level DV. They just love the speed-急 system. I mean they put it in the ad while they are doing the advertising.
Speaker 2:It just makes me feel happy Joanna and go take a look at them because it was cool, really good stuff.
Speaker 1:Yeah, and I like those capabilities, even if you don't how I say this. I'm a big fan of this type of things that we do here in regards to showing the tooling, because you have awareness and you might come across a case that you needed. Then you know where to go get it and, like Jessica, jessica is agree with me. She's also a fan of the Arsenal level DV viewer. We might have to talk about that in the future, so it's pretty neat.
Speaker 2:Yeah, I love the level DV viewer and I actually, on a previous episode, showed a few slides of the level DV viewer, but it's definitely worth trying out. I love it.
Speaker 1:Well, and if you have a license for Arsenal Recon, if you have a license for the level DV viewer and maybe you were not aware, so if you already buy it, go get Arsenal and run it, and that license should be able to give you access. So that's a good thing.
Speaker 2:Arsenal's in here tonight too. So to add to that, ideally one of our immediate DPAPI bypasses will work against your disk image, but if not, then we have the pin, brute force and database driven password attack within seconds to minutes. And I tested it and it's within seconds to minutes.
Speaker 1:There you go. So another tool for that toolbox which we're talking about. Tool for the toolbox, and I know Kevin is around here. Kevin has done a lot of good work with the Life360 app, so that's gonna be pre-need. So it's already available both in iOS and Android. Parsons that we do for the leap, so Heather's gonna explain a little bit more about it.
Speaker 2:So Kevin Pagano Stark Forensics has some blogs up on his page both for the Life360 app in iOS and in Android. I am super excited about this one because I've had the Life360 app in quite a few cases and I don't know of any other tools that support it at all. So what I was doing is I found in iOS, my cases were iOS and I found the log files and was just looking through the log files myself and I'm gonna show you right now what he has done with it in the leaps. Let me just take that down. Okay, so he has the iOS locations for Life360 parsed out with latitude, longitude, timestamp, speed, the activity type. If it was vehicle driving, that pops the Android so in the iOS locations.
Speaker 2:And the Life360 app also has the capability for users to send messages back and forth, which he currently has supported for Android and will shortly be supported for iOS. So you'll see the messages in the Android slide coming up, actually right there. So the Android messages from my test phones of the two users messaging back and forth, and there's a latitude and longitude and location timestamp on some of these messages as well. That well, this one was where I checked in at home, so you can in the Life360 app send a message to another user that you have arrived at somewhere, so that'll show up in the messages database.
Speaker 1:Yeah, and if you're not familiar with Life360 app, they claim to be right like the premier right Family tracking app. So that just screams geolocations and we're so focused on. Well, where's the geolocations in iOS? Where's the geolocation on Android? As in the operating system? Look at the apps. Right? I think you said already right, this Life360 is parsed by who right now. What tool parses it?
Speaker 2:Nobody.
Speaker 1:I mean us. I say us, but Kevin and the Leaps, right, yeah, now we do, right. So use an examiner. Don't get that tunnel vision right. Look at those apps. That geolocation data might not be kept, for whatever reason, on the operating system stores, because maybe it doesn't collect it as often as we would like, but this app might, so it's something to consider.
Speaker 2:I've looked at my data from the Life360 app too, and it is spot on with my locations, so definitely a valid, reliable source for location data, which a lot of location data sometimes, you know, doesn't isn't as reliable as others. This one is very reliable.
Speaker 1:And Heather knows that, not because she guessed it, she tested it right, and again, you'll hear this with us on every episode. That testing and that verification is super important, and Kevin is saying that he's working on iOS chats, as still, so that information might come out soon, so keep keep trying that.
Speaker 2:He's really fast with this, so I bet you it will be soon. I think I gave him the test data and he had it done that afternoon, so no pressure, Kevin.
Speaker 1:How about working that was?
Speaker 2:fast. So let's see what you can do.
Speaker 1:Get out of the chat and start coding.
Speaker 2:Yeah, what are you doing here? So in the Android also he found some data that I actually hadn't even seen in the log files. But in the log files there's also a device battery level and a value for whether it's charging or not. So a lot of the trips that I took with the Life360 app the test phones in the car I had them plugged into my car so you'll see if it was charging or not and what the battery level is.
Speaker 1:That's awesome.
Speaker 2:Yeah, and then the Android locations, similar to the iOS locations latitude, longitude you'll get the speeds and accuracy, and actually in this data there's access points, bss IDs and connected access points. So the I know the Wi-Fi and the Wi-Fi router here. Trace V3 is for my work, so I was at work.
Speaker 1:Well, and that correlation is important, right, because you can have a geolocation right, and let's say it's a big building, okay, and you're kind of making examples how this could be useful, and 20 story building, right, but you were connected to a particular Wi-Fi or SSID on the third floor, right. So now we're really targeting that connection, okay, yeah, that building, but we're in the building. Well, now I know where and at what time, or at least within what range of that Wi-Fi, right. If that Wi-Fi doesn't reach the first floor or the 10th floor, then I know you weren't there, right? So just always be creative in the data points that you're obtained for your FOM evidence or your pieces of data, and see what you can glean from it. That happened in the real world. Super useful stuff.
Speaker 2:Yeah, there's some more here. Oh, these were saved locations, so you can also save a location in the application. So I saved June Farms, which is a farm near where I live, and Southern Cross Ranch, which is the ranch that I visited Southern Cross Ranch, which is the ranch where I went horseback riding previously. So saved locations are also in here.
Speaker 1:Yeah, and again, that speaks to what the person values, right? Oh, this location is important to me, right? And you can take that from those data stores. Pretty awesome. Thank you, kevin, you're a rock man.
Speaker 2:Yes, thank you so much. This was a really exciting one for me. I really wanted this to be supported.
Speaker 1:Yeah.
Speaker 2:So, and then another application that's now supported in the leaps is TeleGuard, and you did this one.
Speaker 1:Yeah, same. Let me give you a back story of how that came about. One of the local officers in one of the agencies out of Florida. He was telling me hey, look, we have this case and we believe there's some communications in this app, but we're not really sure how to go about it right. And if you show them the next screen there, what we were thinking about is, well, what's this app about? So let's go to the next screen, heather, just to show them real quick. And when we looked at it they said it was like complex encryption and all these things. What else to say there?
Speaker 2:No storage of user data right.
Speaker 1:Exactly, they will never get it. Actually, on the bottom right, there's like a little icon there and that's like the guy Fox mask, if I pronounce it correctly, like the anonymous thing, right, and that was the promotion of this application. So what happened after? After we look into it, right?
Speaker 2:Well, yeah, the data's all there and easily read. You don't even have to do any conversion, like it's not stored, encrypted or anything like that. It's right there in the database. So, excuse me, with TeleGuard there are contacts, messages, you can subscribe to a TeleGuard channels and TeleGuard posts, so those are all now supported in the database that you're interested in for that application is teleguard underscore databasedb, so that's where you'll find all of this data that's now supported.
Speaker 1:Yeah, and it's a SQL database, so it's pretty easy to work with. Now there's the good thing about this artifact that I made for the leaps is that I can put together now the conversation with the actual media with the picture that was being referenced in that chat, so you can see it all in one kind of view. Right, it's my understanding that there's no support for it, and the requester told me hey look, we got this. I'm not gonna disclose it, but a big amount of chats, a big amount that were relevant, or a large amount that were relevant to the case. So I'm pretty happy with this and I look forward to vendors also supporting it, because I believe they will need to support it in the near, near, near future.
Speaker 2:Well, especially if criminals think it's encrypted and they're safe, they'll be using it until they find out it's not.
Speaker 1:Exactly, and that's exactly what I'm saying. Again, you're always hitting the nail on the head. That's exactly what it is. I foresee this app folks kind of moving towards it based on that advertisement and hopefully vendors start supporting it. In the meantime, the leaps are there to kind of help you with that parsing.
Speaker 2:So another great blog from Matia, so analysis of Android settings. He did a blog and I'll put the URL up there. So in the analysis of the Android settings he talks about three ways that you can extract Android settings. And why would you want to extract the Android settings as a triage on an Android device? You don't have to get the full extraction to be able to extract settings from an unlocked Android device. So his blog talks about how to do it live from the device via ADB commands, how to also create an Android backup and also, if you do get that full file system, how to pull those settings files out and convert them, because they're in an ABX format so they would need to be converted to be able to view when you pull them out of the full file system. So I am going to show how that's done. Let me just get this off here.
Speaker 1:Yeah, and Matia, again, a really knowledgeable, well-known examiner from Italy. He also teaches for sands. You'll be well served by following his blog reality net or underscore net, the actual we have it on the notes.
Speaker 2:It's on Xenoforensics for the blog.
Speaker 1:Yeah, actually, I think we have it on the banners, so I'm going to show the folks there. Here we go. Let me show you one more time as you're getting there. Okay, so yeah, and we'll put all those links later on the show notes.
Speaker 2:Okay, let me just pull this up here, if I can get it to open. Technical difficulties have been my entire day, so bear with me. I definitely have had issues today. All right, there we go. So, yeah, I'm going to go on. So, using platform tools, which you can download from the internet. So I have the Windows version because I have a Windows laptop that I'm using. But using platform tools, I connected a Google Pixel right here to my workstation, set up the, enabled the developer options, turned on USB debugging and then the first, the first man you want to do Before you go on, can you give the folks that don't know what a quick primer what platform tools is?
Speaker 2:Oh, so the platform tools is where I'm going to run the ADB commands to pull out the the Android settings files. Yeah, and pretty much that's a collection of, of, of, of.
Speaker 1:you know pretty much binaries or executables, programs that Google puts out for you to interact with the device, right? So if you have your phone, you can enter to your computer. How do you talk to your computer? These platform tools? A collection of them. Some of them are to send commands, some of them are to pull stuff from the device and, like Heather said, you can download that for free and and work it on your phone Again, when we can. Heather cannot explain that in detail right now. We don't, we're short, we're running super short, but Google that, so you understand. How can you interact with your Android devices using this? Google provided tooling, yeah.
Speaker 2:So to verify that the device is attached, use ADB devices as the command and it will show a list of attached devices. So attached you can see my Google pixel and to run or to pull the settings from that device. It's ADB shell settings list global, which you can find right in Matias blog, and then I'm going to just put it out as a as a text file. Let me share what that looks like. Let me open it up here.
Speaker 1:Yeah, and for the folks that are listening, it's all. If you command line instructions or terminal instructions, they're in Matias blog so they're really easy to follow. So it's not. It's not a big lift, but you can get a lot of value in a really short amount of time by doing what, what Heather's been showing you here.
Speaker 2:All right, let me share this. I'll tell you the type of things you can get here, so it will put it out into a text file that you can easily read and it'll get you just a few of the different types of settings. You can get the name of the device. You can find out whether the device's time was set automatically to automatically update, whether the time zone was set to automatically update if mobile data switched on or off, plus a ton of other settings for the Android device are in these settings files that you can pull.
Speaker 2:I only just did one, the global settings, but there's three that Matia mentions in the blog and there's tons of great triage data that you can find inside of these. And then the other. The other part to this is you can pull it right from your full file system. So pull the XML, the ABX files, right out from your full file system and CCL solutions, which we've talked about many times on this podcast. But if you go to their GitHub, there's a script to convert those ABX files to XML and I'm just going to pull up the XML and show you what that looks like once it's converted.
Speaker 1:Yeah, and for those are not familiar Android devices. Now some XML files which are plain text. You can read them. They've been turned binary, which means you need an extra step that Heather just mentioned to convert them back to a human readable XML.
Speaker 2:And let me zoom in. So this is what the converted file will look like. You wouldn't be able to just double click on the file when you export it and view it. But once you use that script to convert the file, you have all of the same settings that you were available in those text files. So either way would work. But if you haven't gotten your full file system yet, those ADB commands are awesome. Oh absolutely, and the blog is awesome.
Speaker 1:Oh, absolutely, and obviously I tried to get my full file system first. But you want to validate, you want to validate. This is how you do it. The tool might give you some of this, but if it's a report, how do we know? It's not missing something that I need and you pull it and you convert it yourself and you see what you have. Yeah, Matt has been putting a lot of good content lately. He put another blog post. What today?
Speaker 2:Yes, I know I'm like, oh, we can't add another thing to the show. We're going to be like four hours long. So it seems like a lot of good stuff has been coming out from a lot of people lately. There's a ton of stuff popping up, so keep on those blogs.
Speaker 1:Oh, absolutely, and I appreciate everybody listening or joining us. We're trying to highlight some of those because there's a lot of content and hopefully we're one way of putting it out there and if you come across content that you think is worthwhile, let us know. Go to Slobby, the LinkedIn, and look for Detail Forensics Now podcast there and leave a comment and send us a message and we'll be happy to look into any of that.
Speaker 2:Yeah, I think we'll skip over to the location data, since we're running a little long on time here.
Speaker 1:Let's go. Let's go to the location first let's let's do this because honestly we're really sure on time. Let's do the location data and then close it with the meal, the meme of the week. Okay, keep it a really close to an hour.
Speaker 2:All right. So I'm sure everybody has seen in the news and if you haven't, we're gonna talk about it right now the Google location data News. So Google announced that they are gonna change the way that they store and access users, opt-in low location history and Google Maps, so they're gonna make the Data retention period shorter and they're gonna make it impossible for the company to access it. So what does that mean for us? No longer, they're not no longer gonna respond to geofence warrants. The change will prevent the government from getting information on a specific user with their full account Details without their full account details, sorry. And then investigators can no longer just hand over Coordinates and a time frame and request that Google gives them identifying data or metadata on all the users that were within the parameters of those coordinates.
Speaker 1:Yeah, look, opinion time right.
Speaker 1:I mean is it bad? Yeah, it is bad. We're losing a capability, there's no doubt about it. It is a bad thing.
Speaker 1:But there's this habit of some folks in our space that they get mad at the companies. Right, and my thought is is my thought, is this right? We can make the companies give us as information? There's a process, right, it's a, you know, constitutional process. We we got, you know, representatives and senators and a president, and we have laws that we can write To address some of these things. The question is, you know, as a community and as individuals, are we letting them know what we want of things to be right? And that's a tough one. I Like we, we expect, sometimes private entities to have certain level of action that we don't require from ourselves. Okay, so that's kind of my two cents. And again, I do, I do recognize it. It's a loss of capability that could be addressed, you know, with proper legal process. But the companies also are more than legally allowed Keep that data if they're not mandated or required to keep it right. So the animosity against the companies, I don't think it's warranted.
Speaker 2:That's usually my first reaction you can't do that. But yeah, then I'm talked off the ledge.
Speaker 1:So Well, and there's always I mean there's always other ways we can do our work. Is it gonna be harder? Of course gonna be harder. It's not as convenient or as easy, and I don't know down the line we might you know if, again, laws can be written to address that in a way that's that's lawfully accessed while Preserving the privacy of necessary privacy of individuals. That is not overly broad, right that there's. There's a whole bunch of issues that we don't have the time to discuss, and even if we did, I don't think we should. Anyways, we're not experts in this area. Where you said we're, we're what we're live nerds Like says you're in the back my new sign in the background if anybody didn't see it.
Speaker 2:If you can't see what it says, I got to move closer to it. But live nerds live nerds.
Speaker 1:I love it. I'm so, I'm so envious and jealous of your sign, of your neon sign. I want one of those.
Speaker 2:So Google also had other news, so they rolled out protections, additional protections for users on location data as well. They're gonna begin and they may have already, because this is a like a couple week old news but they're gonna begin changing where it stores the timeline data. Currently it's on the device in the Google servers, and they're gonna be shifting solely to the device and then less data is going to Be stored over time. So they were holding about 18 months of stored data and it's gonna drop down to three months. So if you don't know what I'm talking about with that, with that type of data, and you have a Google account, go to your Google dashboard. I'm sure a lot of people in here know exactly what I'm talking about. But go to your own Google dashboard and look at the amount of data that's being stored, so that timeline data is what they're gonna start protecting for users.
Speaker 1:Yeah, and and that, that. What does that tell us? That tells us that we need to get to the stuff quick.
Speaker 2:Yeah.
Speaker 1:Don't, don't, don't say, don't sit on the evidence, don't sit on the process. You gotta get to it, because now we're getting less than whatever we get is gonna be even more valuable. So just keep that in mind right. All right. So with that we come to the landing portion of the program, which is the meme of the week, and head is gonna show us what the week of the meme, I mean what the meme of the week is Let me share.
Speaker 2:Okay, let's get it up there there we go and take that off and take that off. So I love this meme of the week. We have Legos that represent extracting, parsing, tagging, reporting and presenting and they they End up as a built house at the end. When you get to that presentation starts off as Extraction which kind of a mess of Legos and the parsing gets a little more organized. The tagging starts to build them up, the reporting builds it up even further and at the end you have a full Lego house for your presentation. It explains that process beautifully. I love this meme. It's one of my favorite ones.
Speaker 1:Yeah, I put a lot of thought process into it and you know I knew what I wanted to say, but I need to make sure that that it makes sense right, and I Like it. I liked it because, if you notice, in the extracting, not only there is a lot of bunch of Legos of all colors mixed together Right, there's a lot of them. Right. And as you put them in order, that's what your tool does, right, and then you, as a user, you put them in piles Okay, I care about these ones. And then your report puts them all in categories.
Speaker 1:Right, you got all your chats, you got all your pictures and most of us stop there. Right, but we got to take all those pieces and build that story. Right, make it 3d, because usually it's just in a piece of paper. Right, it's like two-dimensional right, you up and down, left to right, but we need to make it a 3d, like a real Object in time and space and your narrative and your understanding of the artifacts and how those correlate from 2d to 3d. It's what actually will make the case either because you will put the bad criminal in jail or you're gonna free their only accused innocent person. So we just keep that in mind, we need to move away from the 2d To the 3d in the type of work that we do. At least I believe so.
Speaker 2:I 100% agree with that. The presentation is the most important part, absolutely.
Speaker 1:And then with that we thank everybody for, you know, sticking up with us for this hour and, you know, for sticking up with some a little bit of Technical hang-ups, but we made it to the end.
Speaker 2:Thank you.
Speaker 1:I just came out. We came out with a Calendar for the show so people are not confused when the show is on or not. It's gonna be an I'm gonna put the link shortly in our data forensics now podcast LinkedIn page. You can add that calendar To to your. I will mention that in a second. We're gonna add that calendar to your own Google Calendar and that way you can easily see when the episodes are gonna come out and you can put on the occasion to know that it's coming out. You can come and chat with us and add to it.
Speaker 1:Jesse's saying don't stop at 3d, go VR. I might need, I might need one of those new the the Apple ones I forgot what the name is that you can kind of they can see your eyes through it or something. That's what I need. Right, go go go VR. I like it, I love it. Let's go VR, full virtual reality baby, alrighty, well, we're gonna be back. Look, get, get the calendar. We're gonna be back and not did not next Thursday, the first day after, with another episode of the podcast and we hope to see you then.
Speaker 1:Yeah, thank you very much and have a good night everybody.
Speaker 2:Have a good night.
Speaker 1:And let's hit it and.
