Latest / Parsing the Truth: One Byte at a Time / Karen Read: Special Guest Ian Whiffin

Transcript

Karen Read: Special Guest Ian Whiffin · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the fits and
0:21
bites that filled today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Parsing the Truth One Bite at a
0:53
Time is proud to welcome our first sponsor, ACE Forensics.
0:57
They are based near Chicago and they've been building systems
1:01
since 1983. ACE Forensics delivers high
1:05
performance digital forensics workstations, laptops and
1:08
servers to justice agencies across the United States and
1:12
around the world. They offer unmatched value and
1:15
the industry's only five year digital forensics warranty.
1:20
ACE Forensics build the systems or digital forensics software
1:23
deserves. If you're procuring digital
1:26
forensics equipment, reach out to them for competitive quote.
1:29
Now on to our episode. Welcome back to parsing the
1:33
truth one bite at a time. I'm Stacey Eldridge and with me
1:36
as always is my Co host Becky Passmore.
1:39
We are the true crime podcast that focuses on the digital
1:42
forensics in today's modern crimes.
1:45
Our focus is on the facts and the artifacts that today's
1:49
digital forensic examiners are finding or not finding in
1:52
today's digital evidence. Becky, what are we doing
1:55
tonight? So hello everyone.
1:57
Today we are continuing our coverage of the first Karen Reed
2:01
trial, but with A twist. Tonight we have a special guest
2:04
with us. Very excited.
2:05
If you've been keeping up to date, we just spent the last two
2:09
episodes talking about his testimony and the first Karen
2:12
Reed trial. So tonight, we're going to go a
2:14
little deeper, dig a little deeper as we welcome our guest
2:19
on this podcast and Whiffen from Celebrate.
2:22
Thank you for joining us. Thank you for.
2:24
Inviting me. So, Ian, as we get started, can
2:26
you share a little bit about your current role and a little
2:30
bit about your digital forensics background with our listeners?
2:33
Sure. So I've always been a geek.
2:36
Essentially. I was working in IT back in
2:41
2000, 2001, 2004. I made the move and joined the
2:45
police in the UK, spent five years working patrol before
2:49
moving to Canada and continuing to work in a response role.
2:54
For 2013. I joined the digital forensics
2:56
team and spent the next seven or eight years working in digital
3:00
forensics. Essentially any case, any device
3:04
would come to my team and I was one of the examiners there who
3:07
handled that. And then in 2020 I made the move
3:11
and join self right initially as a subject matter expert.
3:15
I did that for 2 1/2 three years and then moved into decoding
3:20
product manager and then more recently I've been moved over to
3:22
customer experience and one of the customer engagement managers
3:26
very. Nice.
3:27
So if we have a problem when we're using Celebrate and we
3:30
can't at Celebrate, we might come across one of your team
3:33
members. You may well do.
3:34
It's typically my team is more focused on helping understand
3:38
artifacts from the forensic point of view rather than like
3:41
the software crashed or the the license is expired or anything
3:45
like that. We'll tackle forensics issues.
3:48
Awesome. Very good.
3:50
All right, well, we have a round of questions that we're going to
3:53
throw your way, so we'll get started.
3:54
So we know your involvement in this case all began with a
3:59
question about the House Long to Die in Cold Surge.
4:05
Now, from the trial, we know several questions come in to
4:09
celebrate through support channels, like kind of like what
4:12
you were talking about. But during your interview with
4:14
Heather Barnhart, you shared that a podcaster had contacted
4:19
you about this case. So how did all that play out?
4:22
Yes, kind of mid to late 2023 when the host Long to die search
4:28
started to to really make the news and to get, you know, the
4:32
attention on Twitter and things. There was a true crime podcaster
4:35
who reached out to celebrate to our public relations team,
4:38
essentially asking, does celebrate have a comment about
4:41
this, this search which your tool found public relations got
4:46
in touch with me, said do you know anything about this case?
4:49
At the time I didn't. I reached out contacting the
4:52
investigators. They'd actually lodged a ticket
4:55
with our support team, uploaded the data.
4:57
So I was able to access the data, take a look at what was
5:00
causing the confusion, do my own testing with my own devices,
5:03
come to my own conclusion. And then reached out back to the
5:06
investigators with a video with a document explaining this is
5:11
how the timestamp is created. This is what it actually means.
5:15
And of course, as soon as you put pen to paper in a case like
5:17
that, you're almost guaranteed to to get called to testify.
5:20
Yeah. And so that was never really my
5:22
intention going into this. I just wanted to help explain
5:25
this artifact. But it just didn't die.
5:29
It continued to be talked about. So eventually, obviously, I had
5:33
to go and testify at court related to this time stamp.
5:36
And so was it kind of the, the local agency agency that was
5:41
like, we're, we want you to come testify about this, or was it
5:44
the prosecutor or was it kind of everybody meeting together and
5:47
hashing it out, hashing it out to figure out how to handle
5:50
this? So initially my communication
5:52
was with the investigators, then it turned into a conversation
5:56
with the prosecutors. And it was the prosecutors who
5:58
were just like, we need you to come and testify.
6:00
Gotcha. Prosecutors love subject matter
6:03
experts. They show or do.
6:05
Yes they do. So I, I assume you're testing
6:08
and all the work that you had to do with through several stages.
6:12
But do you have any idea in terms of, you know, just for the
6:15
first trial, because we know you had to testify in the second
6:17
trial. And I don't know if you kind of
6:19
kept it separate, but do you have any idea on how many hours
6:22
you spent doing your testing regarding the artifacts involved
6:25
in this case? And like anything else you had
6:28
to get ready to do as you're getting ready to go to trial?
6:31
I never kept a log of it but. That must be nice.
6:35
This was just I sat down and just worked at it.
6:37
Initially, looking at the data to begin with was maybe an hour
6:41
or so actually getting the test data and figuring out what had
6:45
happened. It was probably about another
6:47
hour or so, but then it started to really take time kind of
6:52
writing that report up, getting multiple devices.
6:54
I think I ended up testing 10 different versions of iOS, so
6:58
having to to replicate the same test 10 times and then do the
7:01
same research on all of those. And of course there are
7:05
differences between these. So then that LED down new rabbit
7:08
holes to try and explain the differences between versions and
7:11
then, you know, figure all that out.
7:14
So I'd say probably for the first trial, the ballpark of 10
7:18
or 12 hours just to do the initial like testing, research,
7:22
writing the report. But then there was also in
7:25
preparation for trial, making sure that the software wasn't
7:28
going to crash, making sure that I was 1000% confident in what I
7:34
was about to demonstrate, both in terms of the data and the
7:38
conclusions that I'd come to. But also the steps that I was
7:42
going to take and that it wasn't going to crush any software or
7:45
take too long or you could be explained correctly.
7:48
So yeah. Well, I do think it was good
7:52
that you tested many different versions of iOS with regards to,
7:58
you know, the browser state DB and the artifacts coming from
8:01
there. Because they did ask you on
8:03
cross examination they're, you know, asking the questions about
8:06
the apples to apples comparison and stuff.
8:09
And you were on a slightly different iOS.
8:12
But you were able to come back and say, look, I tested all of
8:15
these different iOS versions and you know, from this one to this
8:18
one, it was consistent. So.
8:19
Yeah, I mean, many examiners have got a cache of devices,
8:24
right, that you can test and play with.
8:26
It's unlikely that everyone's going to have the exact version
8:30
that you need. And trying to find that device
8:32
is a nightmare. So I did the best I could at the
8:35
time, tested several versions of iOS 15 and then, you know, 1617
8:40
and 18 just to show they were all consistent.
8:43
So at the very least, you know, this is the expected behavior
8:46
and try to extrapolate to say this is more than likely what
8:49
happened, not 15 point 2.1. And it did that.
8:53
That was, I think, the the important point that
8:56
contextually it made sense that it was the same result.
9:00
Yeah, for sure. But I think you also had another
9:02
good point about the test devices.
9:04
I mean, depending on your organization, some of them have
9:06
a lot. And I have like a couple and I'm
9:09
always asking my friends, I'm like, can I have your old
9:11
iPhone? Can I have your old Android?
9:13
Can I have that so I can build up my little cash test?
9:19
Some people give you their phones.
9:20
They do and they're like, I'm like, look, if ATT was going to
9:23
give you like $5 for your trade in, I go, I will give you 10.
9:27
How about that? You know, sort of sweeten the
9:30
pot for them as well. But to get it, even if you get
9:34
like the correct physical iPhone to get it back down to the riot
9:37
iOS after the all the updates and like you can go and like,
9:41
you know, kind of do like the hard reset and load something
9:44
on. But even to get those other
9:45
versions, you can only still go back so far as far as I can
9:50
tell. If there's some other trick to
9:51
go back way further, I don't. I don't know what it is.
9:55
No, very limited in the the version she can go back, yeah.
9:58
So we all love trial prep, so tell us what your trial prep was
10:03
like. You know, this one wasn't that
10:06
much different from normal for the first trial really came down
10:12
to again, rereading my report multiple times to make sure I
10:16
kind of knew what was in there and kicking it apart myself to
10:20
see are there any meat points to this that will be questioned.
10:24
Obviously there was some I was pretty confident about
10:27
everything that I thought I had an answer for Again, testing the
10:31
software was the big one on this.
10:33
This was the first time I've done a live demonstration.
10:36
I was. Yeah.
10:38
The. Idea was that that is my big
10:41
question. When first when we saw that that
10:43
live demo go up, I was like jaw-dropping.
10:47
I was like, Oh my God, I can't believe you're going to do this
10:50
because, you know, live demos are, are.
10:53
Notorious are. Risky.
10:54
Yeah, even on a good day. Trying to rely on, you know,
11:00
shake Internet connection through like a hotspot in there
11:04
to a jail broken phone. And then it's the software that
11:07
I've written it. I've got a lot of trust now.
11:08
I've been using it a long time, but it's software.
11:11
It's still crashes sometimes. So yeah, that was the scariest
11:15
part leading up to it and the number of times I run that test
11:18
again and again and again, just hoping that it was going to be
11:22
smooth and trying to iron out and find any little bugs that
11:25
could creep up. I didn't want to spend 10
11:27
minutes at trial in the debug trying to figure out what was
11:30
going on, right? Yeah, yeah, yeah.
11:34
So they'll be like, he can't even figure out how to run his
11:37
computer. How can we trust his testimony?
11:40
I would. Initially I'd done that video
11:42
demonstration for the investigators.
11:44
That was a video that was sent to prosecution.
11:47
It was disclosed to defence so everyone had already seen this
11:51
demonstration. OK, it was not new for the first
11:54
time. It was not new and there was
11:56
questions about whether I'd be allowed to actually do it live
11:59
on the stand or not, but the prosecutors pushed for it and
12:04
everyone eventually allowed it. So Speaking of that live demo,
12:07
you used your tool Artex, and some people may be wondering
12:11
whether it can also be used on Android devices to review data.
12:15
Like during your live demo, do the phones have to be jail,
12:19
broken or rooted in order to use it?
12:22
And where can people download Artex?
12:27
So fundamentally, it was meant to be an iOS forensic tool that
12:31
I started writing back in I think 2018 or 2019.
12:35
The live connection feature I added early 2020 for iOS for
12:40
jailbroken devices. Just recently, like within the
12:43
last 6 to 8 months, I've started looking at Android as well.
12:46
So it will ingest Android or some Android extractions.
12:51
It will at the moment pass very minimal data.
12:54
I'm still working on the parsers, but you can do a live
12:57
connection to a rooted Android device and do the same kind of
13:00
thing where you can use the device and then look at the
13:04
database or the ABX files or whatever the file is that's on
13:07
the device. So yeah, that does work and it's
13:09
available on my website, doubleblack.com.
13:13
ELAK. We'll link that in our show
13:15
notes. But if you are using it, you
13:17
might want to link to it in your case notes.
13:20
That's right. All right.
13:22
Let's get into some more of the technical.
13:25
This is probably what everybody's been waiting for.
13:27
So we're going to dig in to a little bit of the work you did
13:30
regarding that house Long to die in cold search and in regards to
13:34
the browser state dot DB. Now in our community, I don't
13:38
think there's enough education about wall files that go along
13:42
with SQLite databases. And I think there's probably
13:45
some misunderstanding about the artifacts that can be found in
13:49
the wall files themselves. So the first question I wanted
13:53
to ask you is, is everything in a wall file a deleted record?
13:58
It is not no SO. Yeah.
14:00
So it can be, it can be records that are still active or it can
14:05
be deleted. It can contain either one.
14:08
I mean, I think you're right, there's a lot of
14:10
misunderstanding about the wall file in general.
14:13
And it's actually, I think, quite a simple concept.
14:16
But when you start to understand it, it makes a lot of sense.
14:19
But it is like complicated from a technical point of view.
14:23
But the concept behind it is quite simple.
14:25
And essentially every time a record is added, edited, or
14:30
deleted from the database, it goes into the wall file first.
14:33
So we have a collection of records in the wall that haven't
14:36
been applied to the main database yet.
14:39
So for example, I might have a page within the database which
14:43
has 10 records. I add a new record to the
14:46
database and it will copy the page from the database into the
14:50
wall file and append my additional record.
14:53
Now, for a normal database viewing tool that includes the
14:57
wall at the same time, it will take that page from the wall, so
15:01
it'll be the latest version of that page, so you'll have 11
15:03
records. If I exclude the wall and just
15:06
read the database on itself, obviously that additional record
15:10
that's been added to the wall won't be in the database itself.
15:13
And it works both ways. So if I have a page in the
15:16
database with 10 records and then delete a record, that page
15:19
is duplicated into the wall minus the record I deleted.
15:23
So again, when you read it using a normal database viewer, it
15:27
includes the page from the wall as the latest version and you
15:30
are missing a record. And essentially this goes on.
15:33
Over time you end up with multiple duplicate pages within
15:36
the wall. Some of those pages will have
15:40
additional records, some will have less records because
15:44
records have been deleted, and again, from a normal database
15:48
viewers point of view it will take the latest copy of that
15:51
page which may have missing records or deleted records that
15:55
not exist. But forensically speaking, if
15:57
you use something like physical analyzer or R text or any other
16:00
forensic tool, it can go back in time and read all of the
16:04
previous versions of that page within the WOW file and find the
16:08
records that have been deleted. So although WOW files are a
16:11
really good source of deleted data from databases, simply
16:15
being in a WOW file doesn't mean it's a deleted record.
16:18
I think that explains it. Yeah.
16:20
No, I think that's good. Thanks.
16:22
Because it's they're working together and basically you need
16:25
both of them to work and if you just look at one without the
16:29
other, you could potentially be missing.
16:32
Data. Yeah, you'll definitely miss
16:34
data if you're not looking at above, but you could also be
16:36
missing data if you don't look at one like we have right where
16:41
you know the. The wild file essentially
16:44
includes the instructions to delete everything that's in the
16:47
database. And if you read the database
16:49
with the wild, you'll see no live records.
16:51
But if you to exclude the wall, all of those records exist
16:54
because they've not been told to be deleted and so they can't
16:59
work. Both ways to include or exclude
17:02
the wall is useful. Well, and it's important to know
17:04
how your forensic tools specifically work when dealing
17:07
with, you know, the databases and the wall files.
17:11
And I'm old, so generally I just go straight out to a database
17:14
and I work it different ways. And I have Sanderson's forensic
17:19
tool as well that I use. So I can kind of I decide what
17:22
I'm doing and am I looking at the live records of the
17:26
database, am I incorporating the wall?
17:27
What am I doing here? But I just learned last week
17:30
when I was in training that for Axiom, they said that when you
17:34
are looking at the SQLite database in their tool, they
17:38
have like a simple viewer. They said they are incorporating
17:43
the wall file into what you are seeing when you are looking at
17:47
the SQL Lite database. So if you thought it was just
17:50
the library or just the database files and not the wall, but you
17:54
might have to go back in and look at some of that stuff.
17:57
You know know how your tools work if you're relying on them
18:01
for your data and how they are presenting the data to you.
18:04
Definitely in that kind of thing.
18:07
Physical analyzer will show you the database with the wall
18:11
applied, but then with a button that will carve out additional
18:15
records from the wall. That X will have a tab for both
18:20
with the wall or without the wall, so you can see both ways
18:22
at the same time. Yeah, it was.
18:24
I mean, the entire tool is every time I, as an examiner have come
18:28
against a new challenge, the feature that addresses it.
18:31
And that was a feature that I came up with a while ago.
18:34
So I thought this would be really useful for doing database
18:36
work. Wow, yeah, that's great cuz then
18:38
you could just easily flip back and forth.
18:40
That would be so amazing to just have it right there in the tool
18:45
instead of having different, because sometimes you just want
18:47
to look at a quick thing here and there instead of all the
18:50
different things open. Like you can write your own
18:52
query and it will apply it to both versions of the table to
18:56
the with not while at the same time and a combined view and an
19:00
advanced view. And yeah, it does quite a few
19:03
things. That's awesome.
19:04
Great. Yeah, I like.
19:06
It. Now obviously I don't use
19:07
Celebrite, but you do. So when Celebrite is parsing or
19:12
recovering artifacts from the wall files, what do users need
19:18
to be aware of when reviewing those artifacts in Celebrite?
19:23
And on to this, from what I've heard, there's some confusion
19:27
about like there can be a red X icon associated with the
19:32
artifacts that recovered from a wall file.
19:34
And so some people think it always means deleted, but maybe
19:37
it doesn't. If you want to kind of give us
19:40
some tips regarding that, I think that would be great.
19:44
So we have a flag within the table, but not within the
19:48
database table within the past data view.
19:51
And that flag will tell you whether it's an intact record.
19:53
So it's a live record. It will tell you if it's
19:56
deleted. I always say it's deleted and
19:58
recovered because if you don't recover it, then there's no
20:00
record there at all. So this is where the red X comes
20:03
in and you'll see a red X say this is a deleted record, but
20:06
we've recovered it. There's a trash can icon
20:09
essentially to say this record has been deleted but is not
20:12
deleted. Something like.
20:14
Photographs when you you send it to the recycle bin for 30 days.
20:18
So technically it's deleted record, but it's not actually a
20:21
deleted record in terms of database and database recovery.
20:24
And then yeah, there's an unknown state as well.
20:27
Just in case, you know, we're not sure for whatever reason.
20:29
So is there anything, so we've kind of got some of those icons
20:32
down, is there anything that the examiners need to be
20:36
specifically aware of when they're looking at those wall
20:39
files, when they're using Celebrate?
20:41
No, we already covered that, yeah.
20:46
Again, if you see that it comes from a wild file, it doesn't
20:49
necessarily mean it's deleted. You can go in and check the
20:52
database and see whether it's actually deleted record by
20:55
viewing the live data and searching for the record you
20:58
want. Yeah, makes it.
20:59
Sounds like you can do that easy peasy in Ardex.
21:01
Exactly. That's right.
21:04
All right. So tell us more about your
21:06
research and findings regarding the browser state dot DB and its
21:10
purpose. If you could just walk us
21:13
through a scenario where people could understand what's
21:16
happening as a user is browsing in Safari and what and when they
21:23
might see artifacts actually written into that browser state
21:28
dot DB as a live record versus what they may be seeing in a
21:32
wall file. OK, how browser state works in
21:35
iOS 14 first and then move on to 15.
21:38
There was a big change between 14 and 15 and I think that
21:41
caused some of the confusion in this case with how this database
21:45
functioned. So in iOS 14 you open Safari,
21:49
create a new tab, and at that point in time a record is
21:53
created in the browser state database in the tabs table that
21:56
says this tab is open and there's a time stamp that shows
21:59
the time the tab was opened. There's also a field called URL
22:03
and that gets populated with the web address that's being
22:07
visited. As I continue to use Safari and
22:09
visit different web pages and navigate around, the URL in the
22:14
database is updated constantly, but the time stamp remains when
22:18
the tab was was opened. If I close Safari completely and
22:23
reopen it, or if I change between different tabs, that's
22:27
when the time stamp gets updated.
22:28
But navigation itself doesn't 'cause that time stamp to
22:31
change. If I minimize Safari and reopen
22:34
it, that doesn't cause the time stamp to change either.
22:37
So essentially in iOS 14 every time you navigate to a different
22:41
web page, the database is being updated and I think that is
22:45
quite a lot of IO of the device to to handle really writing to
22:49
the database that is filling up the wireless causing checkpoints
22:53
every 10 minutes. So in iOS 15 this changed and
22:56
instead of writing that record to the database when the when
23:01
the tab was opened, it waited until the tab was closed.
23:03
So now in iOS 15 and above, you create a tab and everything's
23:08
held in RAM, right? So the the time stamp and the
23:11
URL that you're visiting is purely held in RAM.
23:14
You navigate around as much as you want, nothing gets written
23:17
to the database. When you eventually close that
23:19
tab, that's when the record with the original time stamp when the
23:24
tab took focus and the most recent URL that was visited
23:28
getting written to the database in one in one go essentially.
23:32
Whereas in iOS 14 you can do record recovery and see every
23:38
page that was visited within this session or within this tab,
23:42
in iOS 15 you can no longer do that because it's only a single
23:46
record that shows the most recent web address that was
23:48
visited. And it sounds like in iOS 14 it
23:52
would have basically been a very close mirror to what you might
23:56
have seen in the history dot DB for Safari.
23:59
Essentially, yes, You'd be able to to look at them both and
24:02
correlate between them, yeah. This is why it's so important
24:05
for people to understand what version of iOS they're looking
24:08
at. Absolutely.
24:09
The fact that research can be done one day and it can be
24:12
completely different a few days later.
24:14
Yeah, and we're always, I mean, it's not very often, well, at
24:17
least for me, by the time it comes to the defense side, it's
24:20
not like I'm getting a brand spanking new case.
24:22
I'm going back many, many iOS versions on many old devices.
24:27
So, you know, you've got to stay up to date, but you have to have
24:30
the ability to look backwards in time and see what was happening
24:34
when it was on this iOS versus this iOS that is, is, you know,
24:38
current today. And so with regards to, you
24:43
know, obviously it's, so you're saying that it's basically
24:46
tracking where you're going and what's happening with your tabs
24:50
in RAM now instead of writing every single record to the
24:54
browser state. There's also a session tab as
24:57
well which will track each of the pages that's visited within
25:01
the session. I believe that's written at the
25:03
same time as the the tab record. Didn't actually check that,
25:07
thinking about it now. That's right.
25:10
The session would give you a little bit more information
25:13
about the pages that were visited since that tab was
25:15
opened. Now, unfortunately in this
25:17
particular case, because it was a deleted record and the BLOB
25:20
that held that session data was so huge, it couldn't be
25:23
reconstructed. So there was a lot of data that
25:26
was overwritten. We weren't able to pull the
25:28
entire session data out from that.
25:32
Yeah, and that session data, that's when you keep that tab
25:35
open that whole entire time. And so depending on how people
25:40
use their phones, right, some people might just use one tab
25:43
over and over and over again, never closing the tab, never
25:47
closing Safari, versus other people like me who have like 50
25:51
tabs open with other phone on their computers and switching
25:56
between them all constantly. Yeah, exactly.
25:58
And it's probably important to know as well, when I say that
26:01
the session was huge, I mean in terms of number of pages of the
26:06
database they took. And the pages are only a few K
26:09
each, so it doesn't take that long before it starts to spill
26:12
over into multiple pages. And it only takes one of those
26:15
pages that's deleted now to be overwritten, and you can't
26:18
recover essentially any of them. That's a good point regarding
26:22
the size. Yeah, it's I can't think of the
26:25
word. I was going to use relative.
26:28
Yeah, it's relative. Yeah, yeah, yeah.
26:30
And then so Speaking of the changes that was kind of
26:33
happening before between 14 and 15.
26:36
And I know you mentioned the session table that was in the
26:39
browser state DB contains more data.
26:42
But what where are all of the open tabs that allows the
26:47
tracking like, you know, the seamless experience before your
26:50
devices? Where would people go and look
26:52
for that sort of information? So there's two of the databases
26:56
that's in the same folder as browser state.
26:58
There's Safari Tabs and Cloud Tabs, and Cloud Tabs is the one
27:01
that will synchronize across all devices, but it doesn't
27:04
necessarily have that much history in there and.
27:07
That's probably because it's just serving a purpose of I'm
27:09
gonna get all of this stuff synchronized across all the
27:12
different devices. And I think that's one thing to
27:14
keep in mind is like, what is the purpose of this thing?
27:18
Based on its purpose, what can we expect to see?
27:21
Yeah, I try to tell people this all the time.
27:23
If you understand why that data is being recorded, it's not
27:26
being recorded for us. It's being recorded for for
27:29
Apple's purposes, right? So yeah, if you why it's
27:32
recorded, you'll have a good grasp of how reliable it is,
27:35
what it actually means actually, and how important it actually is
27:38
to the case. Sometimes I kind of worry as we
27:40
talk about stuff and it comes up in big trials, like it's Apple
27:44
tracking all of this and they're like, we're going to see what we
27:46
can do to get rid of these artifacts so the digital
27:48
forensic examiners can't look at them anymore.
27:51
Absolutely. We're going to change it in the
27:54
next iOS version. That's exactly what they're
27:56
thinking, right? Yeah.
27:58
So during the first trial, you mentioned that House Long to Die
28:04
in Cold didn't actually appear on the screen until 10:33 AM You
28:09
mentioned that it took a little bit more work to figure it out.
28:13
So can you tell us a little bit more about how this time stamp
28:17
came about and and where it came from?
28:20
Yeah, so I mean, I'll ignore all the 227 time stamp all together
28:24
now because that one's been, in my opinion, thoroughly debunked.
28:28
So there was the mobile safari dot P list that had the recent
28:33
searches and that had the record of how long to die in Kikdi,
28:39
followed by Hast long sky in the cold.
28:41
That was at 62352 and then 624 and change.
28:47
I can't remember the exact times.
28:48
Neither of those records was present in the history database
28:51
where we obviously normally expect to see any visitor page.
28:55
So it took some time to figure out, well, why is it not in
28:58
there? I knew it hadn't been deleted
29:01
because there was number missing records in terms of the row IDs.
29:04
I knew it wasn't done within a private browsing mode because if
29:08
private browsing was on then we'd have no record of it in the
29:11
Mobile Safari P list. So I was trying to understand
29:14
first of all why is is it not in the history database and
29:17
determined that that was because the page never loaded.
29:19
If you try to access a page and then close it before it
29:24
completely loads it will not show up in your history in the
29:27
database or within the the screens list of history actions.
29:31
The these records also appeared in the Knowledge C database
29:35
under Web usage artifacts. So we had two time stamps for
29:39
how long to die in the Kitty which were both at 620-3624 and
29:43
then how long to that. Sorry, how long to die in cold
29:47
had a timestamp for 10:33. Knowledge C isn't showing you
29:53
navigation history. It's not telling you.
29:55
This is when the page loaded. It's not telling you, you know
29:59
the user went here at this time. All it's telling you is this is
30:02
what Safari is currently trying to show.
30:05
So at 10:33 Safari was reopened by the user and it showed the
30:09
previously loaded screen which was trying to load Hostel on
30:13
time the cold. So that was that to the first
30:16
record of web usage recording that particular web address.
30:20
What was also good in this case, the title field in browser state
30:24
was blank. Oh, OK.
30:25
It was a Google search and when you do a Google search, the
30:28
title is Google and then the contents that you searched for.
30:33
So that's populated when the page downloads and processes.
30:37
The fact that it was blank in the database was additional
30:41
evidence that the page never loaded.
30:43
Yeah, that's a great point. You walked us through a lot of
30:46
things, like you're thinking of connecting the dots and that's
30:50
what we have to do with so much of our evidence, so many of the
30:53
artifacts. We can't just be like, you know,
30:55
I mean, depending on what you need to demonstrate in your case
30:58
or disprove in your case, you can't just be like time stamp
31:02
URL case closed. You did a lot of the correlating
31:06
of the artifacts across a lot of different databases.
31:10
You got AP list involved and then you're examining all of the
31:14
different fields that were present kind of in your initial
31:19
approach to everything. I mean, is this kind of how you
31:21
were working it from the beginning or were you just kind
31:23
of more focused on like, what is the significance of, you know,
31:28
this timestamp of 2:27 AM being in the browser state DB and then
31:34
you kind of had to connect all the dots?
31:36
Or did you have to do a lot more digging once you knew you were
31:39
gonna be in the hot seat and having to write that report?
31:41
Darling, I was taking that approach all along.
31:44
Yeah, I've been doing forensics from Safari for years.
31:48
I know that the mobile Safari dot P list is a reliable source.
31:51
I know that history usually is, but I've never seen it do this
31:55
before where a record was completely missing at the same
31:58
time as being obviously should have been there.
32:02
So in this case, there was artifacts that just didn't make
32:05
sense. The 227 time stamp didn't make
32:07
sense. And to me it was actually quite
32:09
a new artifact. We'd only added it to physical
32:12
analyzer in late 2022, I believe, or early 22.
32:18
The relatively new aspect, it's not one that I've really used
32:22
before. So suddenly now I've got several
32:25
data sources on the phone that I've used for years that I trust
32:29
that I can easily test and validate.
32:31
It's still good. And I've got this new one which
32:33
is untested and that shows untested by myself and it shows
32:37
something at odds with what I know to be true.
32:41
So I really wanted to focus on why is this 227 time stamp
32:45
there? What does it mean?
32:46
How does it get populated and how relevant is it?
32:49
Well, it was probably compounded by the fact that there was at
32:52
least 2 cases where people had came to celebrate and been like,
32:55
hey, what's up with this, this time stamp?
32:57
So you knew other people were questioning it too.
33:00
It wasn't just you. So the there was another case
33:02
that I was made aware of, but it was after I'd already done this.
33:07
Oh, it was OK. Yeah, so I I did the analysis
33:09
for this case sent that away. I was in the process of
33:13
discussing or discussing it with the forensic research group to
33:17
to get into coding in physical analyzer updated and then and
33:20
then another examiner came forward saying, hey, have you
33:22
ever seen this before? This doesn't make sense.
33:24
The time stamp like can't be right.
33:27
So I walked through it with an explained.
33:30
This is very similar to another case I've just worked.
33:32
This is the conclusion I came to there and it all makes sense for
33:36
him to wow. That's great.
33:37
OK. Yeah.
33:38
Well and you said in that one, wasn't it in Austria and you
33:41
said I don't know who came first.
33:42
I think the the law enforcement agency came to you first and
33:46
then the defense expert came to you a little bit afterwards, but
33:49
basically the same question. Yes, it was just within the
33:52
Karen Reed case. Yeah, the prosecution came in I
33:55
think March, sorry, September. And then it was a few months
33:58
later that defense came with the same question.
34:02
Oh, I guess I misunderstood. I was.
34:05
I got the wrong way around. Defense came first, Yeah.
34:08
So defense contracts and support first.
34:10
In the Karen retrial. Karen Retrial OK Defence
34:14
contacted support asking what does this time stamp mean?
34:17
You know this is my understanding.
34:18
Can you confirm it? As I said earlier, we have our
34:22
team which are responsible for helping with the forensic
34:25
artifacts and another team that helped with software problems.
34:29
He contacted the software problem team and they told him
34:33
to contact my team and that never happened.
34:36
OK. So I wasn't aware of this
34:39
particular ticket that had been opened in support until much
34:43
later when I was actually trying to find the the prosecutor's
34:49
request. Gotcha.
34:50
Gotcha. That makes sense.
34:54
Yeah. Then I'm curious, just, you
34:56
know, I know my support experience with other tools and
35:00
stuff like when people are coming to you with these
35:02
questions like is there an average turn around like a day
35:06
or two or we're talking like weeks and months?
35:09
So the the the technicals. Depends.
35:12
Have it does depend the Technical Support you have like
35:17
a full turn around expectation chart etcetera.
35:20
Yeah. My team, not so much.
35:23
Some of the answers we can get back to you within a few
35:25
minutes. Some will take a lot longer,
35:28
like some of them do require like getting test devices,
35:31
getting test software set up, doing multiple tests across long
35:35
periods of time. So that can take weeks sometimes
35:38
together to get answers to somebody.
35:40
Well, you've got to test and validate it enough to have an
35:44
accurate answer. Yeah, you have to figure it out.
35:47
Test a, validate it communicated back and then eventually, like
35:51
we do, seek to incorporate that information we've learned into
35:56
either, you know, a webinar that will run a blog that we can
36:01
write. Change the tool if it requires,
36:04
you know, something adding up, changing like you did in this
36:06
case. So there's lots of kind of
36:09
wheels that start turning when we start to look at one of those
36:12
types of questions. It's always kind of interesting
36:15
to see like how is it working behind the scenes?
36:17
What are they doing to incorporate like these questions
36:21
and new things that they that we find out that they find out and
36:24
get it into the tools. I'm just.
36:25
Curious, do you find more challenging questions coming
36:30
your way when it comes to Apple devices or Android devices?
36:34
Historically, it's been Apple. I think we're starting to see a
36:38
lot more Android devices down, but I think a lot of that comes
36:41
from the type of data that people are really starting to
36:44
question. Like location data is always a
36:46
common question and for a long time, like we've got very little
36:50
location data from Android devices compared to to iOS.
36:53
Now we're much better on Android.
36:55
We get more questions about Android location data.
36:58
Health data is another big one that we constantly get
37:00
questioned about. Of course, it's in every iOS
37:03
device. It's somewhat rare in Android
37:06
compared to compared to iOS devices.
37:09
So again, we'll still get more questions about iOS with that
37:12
regard to. Yeah.
37:14
Well, and I think that's the difference between Apple and iOS
37:17
because on that Android stuff, a lot of that that, you know, the
37:20
equivalent of the health that's not on by default, you got to
37:23
take extra steps to turn it on and you can keep it off.
37:26
So that's yeah. That's the difference.
37:29
Just the very splintered nature of of Android means that we
37:32
don't get that many questions because that's so different.
37:36
The questions are so varied. Well, and I don't know what your
37:38
customer base is, but I mean, in general, iOS devices, iPhones,
37:43
iPads are much more popular in the United States versus once
37:46
you leave, sort of like North America.
37:49
Android devices are a lot more popular across the globe.
37:53
And you're right, that could probably part of it too.
37:56
As a team, we're a lot more probably present within North
38:01
America, but we're a global team.
38:03
We do assist other areas too. But I think, yeah, a lot of our
38:06
content is predominantly consumed by American users.
38:11
So we probably do kind of skew the figures that way too.
38:16
Well, you got to do what the what the people want, what the
38:19
people need, you know? And so, so in, if you wanted to
38:25
educate new examiners, old examiners like myself, who you
38:30
know, I, you know, I, I don't look at cell phones as much as
38:34
Stacey does. If you wanted to educate your
38:38
our listeners, the the community on things to be you know to
38:42
watch out for things to look into, things to keep educated on
38:49
what what are some tips that you would provide?
38:53
It's, I think really get to grips with the file systems
38:56
behind what the tools show. Understand the database,
38:59
understand the files. I always try and preach the
39:02
tools are great at surfacing data, but they are going to give
39:06
you anything they don't support first of all, but also anything
39:09
that it can't find. And sometimes the evidence is
39:12
what doesn't exist on the device.
39:13
So there might be a whole conversation that's being
39:17
deleted or a bunch of messages that are deleted and the tool's
39:20
not going to show you the 20 messages are missing.
39:24
It's just going to show you what it finds.
39:26
So it'll just show you the the ones that exist.
39:29
And if you don't recognize that there's a lot more data to be
39:31
had just by going into the files and starting to look at the the
39:35
file structure in the database, etcetera, then you're only going
39:39
to be doing half a job essentially the.
39:40
Tool is not forensics. The tool is there to help parse
39:45
and prepare the data, but if the tool doesn't know how to parse
39:49
and prepare the data, then it's the data's still there.
39:52
Exactly. And the tools are great at doing
39:55
stuff that either you can't do yourself or don't want to do
39:59
yourself. Decrypting databases is never a
40:01
fun task. If the tool do it for me,
40:03
fantastic, I'll take yeah. Yeah.
40:08
So the tools are great at doing that kind of leg work, at making
40:11
your job easier. But yeah, you still need to
40:15
understand the background to it and know how to do the work if
40:18
you don't have that tool. I think we're getting close to
40:20
the end, but I know the Karen Reed trial was crazy #1 and #2
40:27
Karen retrial was probably a little bit crazier.
40:30
I don't know if there's anything that maybe you didn't get to
40:35
stay on the stand about the evidence that you felt should
40:40
have come out and it and it didn't come out and we're just
40:42
talking about the first trial. Like, was there something you
40:44
really wish the lawyers would have asked you on the stand and
40:47
maybe they were supposed to, but they skipped a question and you
40:50
didn't get to say it. I know that's happened to me
40:53
sometimes. Nothing that the biggest thing
40:55
came out the first trial is when I heard some of the other
41:00
evidence that was being presented outside of the house
41:03
lung and thinking, you know, that that needs a little bit of
41:10
help one way or another. That's not being presented, you
41:13
know, correctly understood or misrepresented or whatever,
41:17
which is why I was more heavily involved in the second trial.
41:21
Looking at a wider range of data now for the first trial, can't
41:25
think of anything that right now that I.
41:28
Yeah. Sorry it wasn't on the list of
41:30
questions in advance, I was just kind of thinking.
41:33
Maybe the hash value was one that caught me out.
41:36
Defence made a big deal about the fact that I didn't hash the
41:39
extraction. I still don't believe in that
41:41
particular case that it was necessary because a everybody
41:44
else had already hashed it and they were seeing the same data
41:47
that I was seeing in the same issues.
41:49
I was validating within the database itself, but nothing of
41:51
being modified like date. Every page of the database and
41:56
every frame of the wall has its own checksums, right?
41:59
If you change something, the entire database will break
42:02
essentially. So I was looking, I got all of
42:04
these kind of pointers to make sure that these databases and
42:07
these files hadn't been modified.
42:09
And fundamentally my purpose in that trial was to explain this
42:14
time stamp. So I I didn't, it was necessary
42:17
to to do the entire, you know, hash extraction.
42:20
I can explain on a completely separate device that I don't
42:24
need to hash this. This is how this time stamp is
42:27
populated and what it means. Yeah.
42:31
So I still don't think it was necessary to hash got some some
42:36
heat, but I'll stand by that decision.
42:38
You know, again, defense has their strategies involved in
42:42
what they're going, especially if you're a good witness,
42:45
especially if you are very confident in your statements,
42:49
they're going to look for something to go after that.
42:52
Maybe they don't even understand what the value and meaning of
42:55
all this is, but they're just trying to stir you up to see if
42:59
you'll change your mind. So for sure, talk about those
43:02
strategies a lot. So yeah, whether it's from the
43:05
prosecution or the defense, they're looking for things that
43:09
will, you know, get you to change your opinion.
43:12
Yeah, that's not. Well, and I forget now, Becky,
43:16
remind me and you maybe, you know, I don't know if you after
43:19
the fact watch Jessica Hyde's testimony, but I know, and I
43:23
can't remember if it was the first trial or second trial, but
43:25
she talked about and I'm, and I'm inclined to think it was the
43:28
first one where she was verifying the hashes from the
43:32
gay, the Gray key report. And you know, she mentioned it's
43:36
not digitally signed versus celebrite extractions are
43:40
digitally signed and that she took the extra step of like
43:43
looking for any evidence of tampering with that great key
43:47
report that contained the hash. So I mean, was it wasn't that
43:51
the first one that she talked about that?
43:52
And she might have said it again in the second one for all I
43:54
know. I can't remember.
43:56
I'm living in 2024 right now. I don't recall it, Jessica said.
44:00
I know I said something along those lines in the second trial.
44:03
Maybe we see you, I don't know. The PDF essentially isn't
44:07
signed, so you're trusting APDF file that has the the hash of
44:12
the extraction. If you can go to the trouble of
44:14
going into that the extraction and changing the data, changing
44:17
the hash in an unsigned PDF, child's play.
44:20
So I didn't necessarily think that was any strong sign that
44:23
had not been validated versus actually looking at the files.
44:27
And you know, I've got all of this data that all works
44:31
correctly and validates independently on its own, Don't
44:33
need to validate the the entire extraction.
44:35
So Ian, where can people connect with you and follow your
44:39
research online? So I say earlier my my own
44:42
website at doubleblack.com occasionally post research on
44:44
there. I post the the software that I
44:46
occasionally write and release. It's it's all on there for free.
44:50
Awesome. They can just go out there and
44:52
download it and use it and follow you and watch your
44:57
updates and your research that you post.
45:00
Yeah, he's got. Obviously there are a few blog
45:03
posts related to the artifacts you examine related to the Karen
45:06
Reed trial. So our listeners want to know
45:09
more about what you were looking at and some explanations about
45:14
it. They should definitely visit
45:15
your website and check out those blog posts.
45:18
I tried most of those posts as well to write it in a way that
45:22
anybody would be able to follow along and do it.
45:25
Certainly the the browser to stay research.
45:28
Anybody in the world with an iPhone and a computer would be
45:30
able to do that research on their own and replicate the
45:32
results that I had. Some of the other data sources
45:36
on there is obviously much harder than our forensic
45:38
extraction, but the browser stays easy enough.
45:42
Yeah, for sure. Awesome.
45:44
That's great. Well, Ian, thank you so much for
45:46
taking time out of your busy schedule to share your knowledge
45:49
with us and our listeners tonight.
45:51
There was a lot of good tidbits in there for us.
45:53
I appreciate it. Thank you.
45:55
We really appreciate it. So join us every week on
45:58
Thursday as we continue to dive into the Karen Reed's first
46:01
trial, where next week we will be discussing more testimony.
46:05
So make sure you subscribe, follow or like wherever you
46:08
listen to get notified when a new episode drops.
46:11
Until next time, stay safe, stay sharp, and as always, keep
46:14
parsing the truth one bite at a time.
46:18
If you enjoyed this episode, make sure to follow us to get
46:21
notified the next time a new episode drops.
46:24
If you can do Morehead on over to parsingthetruth.com and
46:29
donate by clicking on the donate button.
46:31
Parsing the Truth is a nonprofit organization and we are raising
46:35
money to send a new digital forensic examiner to I Asus
46:38
training next year in Orlando. Thanks.
46:46
Yeah, yeah, yeah, yeah. Yeah, yeah, yeah, yeah, yeah.