This is about … .
Windows
To find the evidence of execution, try the following artefacts:
- Dr Watson
- Installed and uninstalled
- Key 🔑: Microsoft\Windows\CurrentVersion\Uninstall. There can be some data for programs that do not exist on the system anymore. The last write time is when the application was installed.
- Key 🔑 Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore for installed Microsoft applications. Defines between those that were installed for a specific user or system-wide.
- Key 🔑: Wiw6432Node (SYSTEM hive root node) - those that run a 32-bit mode. Separate sub-keys for different versions of a program.
- Key 🔑: Classes\Installer\Products - installed using Miscrosoft installer (those with msi extension).
- Prefetch
- AmCache
- ShimCache
- BAM
- MUICache
- ComDlg32
- Jump List Data
- Recent Apps
- User Assist
macOS
AppStore Downloads
/Library/Receipts/InstallHistory.plist
Search
Spotlight shortcuts
/Users/%username%/Library/Application Support/com.apple.spotlight.Shortcuts
Finder MRU
/Users/%username%/Library/Preferences/com.apple.finder.plist
Linux
- Trash
/home/%username%/.local/share/Trash/ - Recent Files
/home/%username%/.local/share/recently-used.xbel
Android
Obtain and image or physical evidence to work with. For Android, to see installed apps and recent activity:
packages.listpackages.xml- to see permissions for all applications in one place. For example, if this application has a SMS or messaging permission, you’ll know to look. Or, for example, I need all applications with chat permissions or access to the camera.- com.vending.adnroid
- usagestats
- usage history
- battery stats
- recent images
- snapshots
tccb on iOS?
Chromebook - extension preferences file.
Run commercial tools to parse the info. If not, then try to find some specific parser, may be for similar app and try.
Create profiles and you any real data for generation.
Fake data - mockaroo and generatedata.com
- take the snapshot of the system state before populating with data
- Write a script-plan
- take notes
- perform actions 1 min apart
- scrrencap actions
- document them (log with script)
- compare with the the baseline “snapshot” from step 1.
https://blog.d204n6.com/2020/08/setting-up-testing-lab-of-ios-and.html
https://www.mac4n6.com/blog/2020/8/23/step-by-step-iphone-setup-for-ios-research-via-bizzybarney
https://www.mac4n6.com/blog/2020/8/13/step-by-step-macos-setup-for-ios-research-via-bizzybarney
Do not make assumptions before testing! For example, a QuizUp game folder contained some usernames and pictures and the assumption would be that this person was in touch with the suspect. However, testing revealed that when you choose to randomly find you a rival from around the globe 🌎, QuizUp automatically adds them to the player’s contacts.
Jessica advises using appropriate view-managers for specific files, but I would also recommend to check these files in hex as well. There was once a case when I performed vulnerability assessment of a mobile application and I got a SQLite DB, opened it in SQLite Browser DB and couldn’t find the data I was looking for. However grep command showed that this data was in the DB. I opened it in hex and noticed that it might have been damaged because there was an amount of data almoust the same size as the visible one, that was not shown in the viewer. Perhaps that were some deleted rows or the DB was damaged indeed.
Applications of different versions or platforms may have different data structure. For example, iOS QuizUp had a geolocation field, while Android didn’t at that point in time. [1]
iOS
KnowledgeC:
https://www.magnetforensics.com/blog/analysis-of-graykey-images-with-axiom-new-knowledgec-database-artifact-additions/
• /private/var/mobile/Library/CoreDuet/Knowledge/ knowledgeC.db
Screentime:
-
/private/car/mobile/Library/Application
-
Support/com.apple.remotemanagementd/
-
RMAdminStore-Local.sqlite
Snapshots:
• /private/var/mobile/Library/Containers/Data/ Application/[APPGUID]/Library/Splashboard/ Snapshots/