foreign
you to our talk missing pieces tips and
tricks on how to ensure your
Acquisitions aren't missing critical
data I'm Cesar kezata and this is
Jessica Hyde
[Music]
first starters and
and he has got
geises that otherwise wouldn't have been
gotten into and found data that was
missing regularly so so excited to
partner with him on this talk he's
currently in three roles he does r d for
arcpoint he does he's a senior technical
exploitation officer at mantec working
in a lab he's been working in for a very
long time killing it there doing really
great work and he's a commander of an
Army National Guard unit uh in the 133rd
cyber security groups though true expert
here uh we worked together when we were
both with the basis uh and he's worked a
wonderful amount of other places George
Mason a graduate of their Ms and
computer forensics program and a cool
reviewer for dfr review if anybody wants
to help out with that project and peer
review for the community we'd love it
yes
and this is Jessica I'm sure most of you
if not all of you know who Jessica is
right she's everywhere
um she's founder and owner of hexordia
she's also an Adjunct professor at
George Mason University so she's helping
grow the future uh fire indicators out
there and helping grow the field he's
been at Magnet at basis at Ernst Young
American systems and like I said she's
everywhere she's even on Tick Tock now
so I'd recommend you go follow her
foreign
all right here's today's agenda do you
want to touch on you know why do we care
why should you care about this talk and
then we're going to go into some real
world examples of how data could be
missing from hard drives and mobile
devices we're going to touch briefly on
how to test it to determine if you're
missing data and then we'll wrap it up
with some questions
so why do we care we care because if
your collection is missing some of the
critical elements of data you're not
going to be able to find all of the cool
artifacts that were being discussed like
in Heather and Jared's talk earlier
today a lot of those artifacts can be
missing if you don't have a fully
inclusive acquisition and a lot of times
we are unaware that our Acquisitions
aren't complete and so today we're going
to bring you some tips and tricks to
take care of that
so we could say we don't know what you
don't know right we can often say that
something exists right if you have a
picture you have the picture you have
the metadata you know it exists but you
really can't say that you know perhaps
it doesn't exist in other places it
wasn't sent somewhere if you don't have
that data to look at right so that's why
it's important to keep an eye out and
always do proper investigations and when
you don't have that complete picture you
can wind up making incorrect assumptions
it's also important as we recognize that
there are times where a triage or a very
specific targeted acquisition is
necessary so when we're talking about
these times when we're talking about
missing data we're talking about
unintentional data that you're not
acquiring not when you're doing an
intentionally targeted acquisition there
are definitely times when you don't want
to wait to get the whole physical if
you're doing an Enterprise collection
you're not going to collect every single
computer or full disk image and look at
them all uh to figure out what's going
on there's definitely a need for it
however when you are working a case
where you need to be able to provide to
the other side data of possibly somebody
being exonerated if you don't have the
full picture you may be missing
exonerable evidence and I think that's
really critical in investigations
when we're talking about scope you know
oftentimes we are limited on what we can
look at if you are doing an
investigation you can look at from time
a to time b
um that that's your limitation okay so
we accept that but if you go and acquire
that device from time a to time B and
that's all the data you get
you're going to be missing data when you
go back to your lab and perhaps you're
doing that further investigation and you
need to put pieces together that are
outside that scope so we often say to
limit your collection on the analysis
side right get as much data as you can
and then limit yourself on the outside
analysis aside from time a to time B and
then
once you're doing your investigation you
still have the additional data to go
after I'm going to tell you why this
really scares me because a lot of times
there's tools out
and limit your scope
in terms of meeting data within a pair
of time frames but if we go back to that
you don't know what you don't know if
you're limiting in time frames there's a
possibility that you're not getting the
data the third party applications that
are not supported about your tools that
they don't know to collect if you're
able to collect that data and then limit
on analysis you're going to be much
better off but even more importantly in
some instances there are databases that
correlate to other databases that'll be
with outside of your time date range
maybe a contacts database that's older
for an application that needs to be
correlated with the messages database
so now let's look into some examples of
computers and hard drives and some data
that we could be missing
so let's take for example the Samsung T
drives right I'm sure everyone's used
them every they're everywhere right the
little Samsung T drives
um nowadays they're coming out with
newer technology now they have a
fingerprint reader on there that can
lock the drive to encrypt it and you
know some claims are that it doesn't
work on Linux even in Samsung's own
documentation but here you can see the
where it says it's only supported on
Windows and Mac OS right so
um once you bring that drive into Linux
it's not a problem during our testing
because we found that even though
Samsung's own documentation says it
doesn't work on Linux
um it does it does right right so if
you're working on a Linux workstation
and perhaps it's not working for you you
know
it doesn't work
um so here's a view of that uh drive
when it's locked
and now unlocked right sorry I I went
too fast for you sorry a lot right it's
a bunch of unallocated space and it's
not going to give you any data however
when you apply your fingerprint
is unlocked and all the partitions
appear there's not a problem
here's another view of the Samsung Drive
locked
and now it's unlocked you can see it it
has a FS events at some point this this
particular Drive was connected to a Mac
but
and here ftk imager again locked
and it's important because if you're not
aware of new technologies coming out you
could be plugging this drive into your
computer you could see that it's much of
an unallocated space you might think
there's nothing on here or something's
wrong with the drive when in fact it's
just you need a fingerprint or some
other security measure needs to be
unlocked for you to take a look at it
and something key here is that even in
the lock there appears to be data so you
could be misguided and think that it was
just a less used dry drive if it's
unlocked I want to get into something
that's going to be mismatched of
compatibility of things where you make
it missing Acquisitions so how many
people out here have really upped their
speed and are using USB 3.2 gen 2x2s
getting that 20 gpps all right I see a
couple hands fast adopters of Technology
right
so if you run into one of these in a
while these are going to give you 20
gpbs 20 Gigabytes per second versus the
10 gigabytes per second you're going to
get with regular USB 3.2 which is really
confusing because USB 3.0 was renamed
anywhere so many times so many times
3031 oh now we're three two and we don't
care if you're backwards because it's
three two gen two anyway
if you have in evidence a 3.2 drive it
is backwards compatible 3.2 gen 2x2 it
is backwards compatible and you'll be
able to image completely and normally
with a USB 3.2 Gen 2
receiver however
however if you are those fancy labs and
you are like woohoo I got the speed
and you really only get that speed when
you're matched guess what happens when
you're matched with this new technology
it drops bits without your knowledge
you're not going to get consistent
hashing Imaging the same drive over and
over and you're actually going to need
to plug that in instead to your 10 gbps
port to do your collections or you can
be losing data and that's really crazy
and scary and I don't think people are
aware sometimes when they adapt
technology and go oh I'm getting the
fastest they don't realize that that
speed is dropping bits
right and here's another example uh
where we have
um the same hard drive so that's the
same hard drive in both those pictures
right we have a star tech adapter that
you can buy anywhere it's just an
adapter to read the hard drive and on
the right side you have the hard drive
in its enclosure that it came in we just
took the case off uh for the purposes of
the picture
so we image the drive
first with the start Tech adapter this
is the hash that ftk provided us for the
Imaging of the entire Drive
and then we plugged it into with its
adapter uh hard drive enclosure adapter
that it came with and it gives us a
completely different hash
so that is clearly not something's wrong
here so here it is in Linux uh we're
looking at the different partitions here
uh with the star tech adapter not a
problem
however with its original hard drive
enclosure we have a warning that the
backup GPT cable is corrupt and there's
one less sector in this acquisition so
you're actually missing a sector by
using the native adapter instead of
putting on an acquisition adapter
right and so here's the look in ftk
imager the last sector is in red this is
the start Tech adapter
and here it is with its native Drive
native adapter that is the end of disk
of the uh adapter right there there is
no additional sector so that adapter is
cutting it off logically
um and it's discarding that last last
sector for itself where it's metadata
and what have you so that's just
something to be aware of whenever you're
Imaging in a drive with its own adapter
in it okay this is the one that scares
me so in 2017 on the stage Courtney Webb
came and did a fantastic talk that I
encourage you all to watch
um called implications of firmware
trickery and hard drives and the tldr on
that is that a drive can come labeled as
a one terabyte drive but beyond a two
terabyte disk this is to save money and
there are utilities out there that will
allow you to go ahead and store in that
additional space but then when you plug
in the drive for Recovery it'll still
look like that original one terabyte
drive there's also tools like HDD hacker
that allow you to alter the drives at
the firmware so most acquisition
Hardware utilities a lot of them will
not catch this and get the second
utilities but there are some that will
go ahead
um and look at the firmware and allow
you to think it so basically you can be
fooled into thinking that the drive is a
different size or people it's two
different scenarios you can take a drive
that's a known size and alter it or you
can take a drive that the manufacturer
has shortened because they're using the
same physical disk uh to share but
they're changing the sizes
so in an example of
a device perhaps that's new technology
right we'll we'll look at the Microsoft
Surface
we get a piece of evidence a new
technology back in you know a few years
ago when Microsoft Surface first came
out
you couldn't know how to image it we had
no idea how to image this device it was
brand new we had one USB port
um
you know it was a problem but thanks to
the community and this is a very
sharing Community with all the parcels
and tips in methodology
um someone out there posted a
walkthrough of how to image this device
so now
we pretty much use this walkthrough
um today right we needed a powered USB
hub changing some settings in in the
security settings like
um external drive keyboard and mouse so
relying on other examiners who are more
knowledgeable and who have you know been
around the block a bit more is is very
helpful for acquiring new devices that
perhaps maybe you wouldn't be able to
get if you were working by yourself
not all of these methods are going to
work like you think they're going to
work so I've had the luxury of spending
a lot of time digging into Chromebooks
over the last several years and Daniel
dickerman came out with this incredible
method of acquiring Chromebooks that's
based on a custom recovery it's great
peer-reviewed work I've used this method
multiple times fantastic except
when you're doing this method the
Chromebook writes out the data to what's
left on the drive before writing it out
to your external media that you're
copying to so if let's say you have a 64
gig hard drive okay on on your
Chromebook and by the way if you think
all the Chromebook data is in the cloud
it's not pldr I've got lots of stuff on
that so you're acquiring the Chrome back
you get the 64. you've got 64 gigs 50 of
it is used that means you've got 14 gigs
your acquisition is only going to be 14
gigs and your tools are not going to
notify you so if you're not logging in
and checking that disk size you're going
to be short data in the opposite if you
only had 14 gigs of use it's going to
write you out that 14 gig image you're
going to have everything and there is
your tools your methodology you're not
going to get a warning that you're not
getting all the data and that's really
the key to what we're talking about
all right so now let's take a look at
mobile devices something we all love and
hate right we love them because they
give us a lot of information but
we hate them because it's information
overload and sometimes they're hard to
get
so when we're talking about mobile
devices we're going to talk about the
difference between the different
Acquisitions and the problem is is the
terminology is a little different than
you may see in typical computer
forensics so I'm going to share
um the terminology that I personally
know and teach because I think it's
the most applicable to understanding
these differences so that we can talk
about then the differences between the
data you're going to get in these
Acquisitions and when you need to get
them so for mobile images you've got the
physical The Logical and the file system
and physical and logical and file system
do not mean the same thing here as they
do in traditional dead box computer
forensics so the definition we're going
to use here is that if physical means
that the data is pulled directly from a
connection to the devices storage area
it is reading the data from the storage
area directly a logical mobile forensic
image means we're pulling the data via
the operating system and that's data as
interpreted by the operating system this
is also controlled by what the operating
system is trying to let you get back
included in this area would also be if
you're doing iTunes backups if you're
doing any kind of backup if you're
putting an agent on a device anytime
you're communicating via Android or iOS
to get the data you're getting that data
as interpreted by the operating system
there's several methodologies here be it
on an old school at command to uh you
know doing APK downgrades there's a lot
of different ways to collect data
logically but that logical data in this
terminology is going to be has collected
by the operating system very different
than the term logical in computer
forensics which is actually more
synonymous with the term file system
image in Mobile forensics the file
system image is going to be the
collection of all the active files and
folders that exist on the drive now if
you're used to the computer forensics
world and not really to mobile you may
be thinking well that's going to mislead
it not really because on mobile phones a
lot of our data is happening in
databases uh and those records still
exist within the file so there's going
to be lots of remnants of data and
non-user data as well you can get that
complete picture so for us really today
the full file system image is really the
gold standard because we don't get a lot
of physicals anymore because of
encryption
or they're useless
yes
so an example that Jessica and I always
like to talk about is we had a case once
where we had an Android phone and this
was a very hot case and talking they
wanted the data yesterday right it was
in the news hot so uh we took a look at
it we took a look at our tool the tool
said yes we can get you a full physical
of that device no problem you know so we
plug it up we start the acquisition and
in the meantime we're going through all
the typical websites you go to for
mobile devices like GSM Arena or Phone
Scoop to look up the specs and to verify
you know what we have exactly going on
here
uh the websites tell us we have about 16
gigabytes of data that we should be
expecting for a
image of this device
and then our tool finishes and it says
great we got all the data all one gigs
one gigabyte of data so there's a little
bit of a discrepancy there between the
16 gigs and the uh one gigabyte of data
so uh in the end we ended up having to
terminal use a Mac and terminal into
that phone to DD the 16 gigabytes of
emmc that were on there
and plus the one gig that the tool gave
us which was an additional we actually
ended up with 17 gigabytes of data
versus that even the 16 gigabytes that
the websites told us so it's just
something to be aware of that you
shouldn't always trust the tool even
though it tells you you know I can get
all of it
sure it got all of it but we're still
missing yeah I'm missing a whole nother
storage area and and here's the deal
right if the if you're noticing a
pattern it's we got the data but then we
realized we were missing some and we
looked and we researched and found out
there's actually more data to get there
how do we now get this right and and we
were actually able to just see that uh
emmc uh via the terminal and just DD it
was actually relatively simple once we
figured out that that data was there uh
I want to see it really quickly before
we oh this before we dig into this yeah
yeah there's there's there is value to
doing a triage extraction there is value
to doing a quick logical and not getting
all the data at first because it's easy
to manage you can look at it you can
inform your
interviews I always try to pause myself
and stop myself from saying
interrogation
difference in the world is that you work
in different times in your life uh so
you know that information can inform
but when we get to Android let's talk
about how the differences are between
these so we're going to talk about all
the differences between different
artifacts and what you're going to get
in that logical versus that full file
system
oh my gosh my data is not showing up on
the screen
oh that's bad okay so let's see what
Jessica can do from memory because my
slides which looked fine yesterday are
actually missing the blocks below that
are going to tell you what's going on so
luckily hopefully I know what the heck
I'm talking about so
so when we're talking about uh Goods so
your MSI sen your imeis those are all
going to be present in both your logical
and full file system extractions as well
as your Pim data except for call logs
and notes uh all of your call logs are
going to be impressed in both your SMS
messages are going to be good you're
going to be good on m s messages where
you're going to start to see a
difference as your Standalone files
you're going to get partial recovery in
your logical versus your full file
system images when we talk about
application data you are going to have
wide discrepancies this is because some
applications are going to share that
information and backups and others will
not and even when you have that shared
data and backups it's a difference
between if they're exporting the entire
full file system or not very similar to
what we're going to see in social media
so in social media application data
these are both areas where you're really
going to need the full file system if
you want data from your additional apps
so for example WhatsApp data does appear
in backups but you won't get signal data
for example
communication app data kind of what I
was just talking about that's going to
differ internet data is going to differ
and this is really interesting because
you may think that you're going to get
all of your browser history and a
logical you won't there's going to be
much more enriched in a full file system
on Android you need a full file system
for email OS and app activity if you
want the really cool stuff like usage
stacks and recent paths usage Stacks is
going to show up in full file system
recent tasks is going to be partial and
logical deleted files if you really want
to pull those archives like I said those
are going to be at in those files that
you're going to recover and you're going
to scrape through so you're not going to
see that data in your logical you need
your full file system
so we're going to move into iOS now
right so
um
so with iOS we have a couple additional
calls to look at so we're going to look
at still The Logical and the file system
but now we're going to look at AFU and
vfu which is after person lock and
before first unlock and just real quick
overview after first unlock is when the
phone has been rebooted and uh the the
passcode has been entered at least one
time and before first unlock is after
the phone's been rebooted and it has not
been unlocked and depending on those
dates is how much data you'll get now
this I'm going to admit my memory is not
going to be as clear as what's between
BSU logical AFU and ffs uh without it on
my slides so this will be fun equipment
user data you do get them all uh Pim
data
I know you get both an AFU and full file
system
uh so I believe that you get notified
some of your notifications in bfu but
you don't get full it's a partial uh
call odds you're good off your partial
and bfu SMS your logical yeah AFU and
your full file system will be complete I
am going to have a link at the end of
this slide deck there's a QR code and
you'll be able to see these tables
incomplete uh not incomplete completely
I speak so quickly there was no space
between the word in and complete you
will completely see all of these tables
populated uh in that uh PDF that's
available there so you'll be able to see
the difference between MMS where each
one of these files are for each of these
categories the tobr on each of these uh
with there there are some interesting
ones uh so like when we talk about
communication app data
um
my gosh a Snapchat for example you can
get some of the data in bfu and not in
logical but you'll get it in AFU and
full file system so between dfu and
logical what you get is going to vary
um the tlvr on this is your strongest
extraction is going to be your full file
system every single time but you can get
so much data from ASU and
proceeds are just went through the
difference between bfu and AFU and what
that really means at the end of the day
is that you cannot have that device die
so sometimes folks will be like oh I
recovered the data I recovered the phone
sees it from the scene I put it in a
Saturday bag I've isolated from the
network no one can send a white command
yes
but they didn't put it on a charger
and if you don't put it on a charger and
that phone sits in a faraday bag that
battery is going to drain and once that
battery drains and that device is now in
that bfu mode even if it's locked a lot
of your forensics tools or at least two
of them will be able to get you an
extraction even though the device is
locked that extraction if it is before
the device reboots so you keep the power
on it it was unlocked by the user before
you seize it and had not had a power up
you are going to get great data
even without cracking up password so
before you even brute force it so you
can start looking at that data but
if you let that battery drain out
you're gonna get next to nothing and and
that's what's on all these slides that
aren't there
this is my passion to talk about it
especially uh GPS data the tldr on this
is if you want all of the incredible
artifacts that um Heather maholic and
Jerry Barnhart were just showing in
their last presentation
you need to have that full file system
yeah let's talk about retention
all right so in an example of you know
did the user change a setting we're
gonna take a look at this uh mobile smsp
list which denotes the iOS message
retention
so by default iOS will ship you the
um keep messages for days as forever
that's how it comes to you as without
the user ever changing them
so we wanted to see if we could
determine if the user ever changed it so
we image of the device and the keep
messages for days keys in that P list
was nowhere to be found it doesn't exist
there
so we change the option to one year and
then all of a sudden that keep messages
for days key appears with the value of
365 obviously for 365 days in a year
we image did again change the option to
30 and now it has a value of 30. and
finally we changed it back to Forever
and now the keep messages for days key
appears it's still there but now it has
a value of zero so now we know that the
user did change it at some point we just
don't know any additional data after
that well this is important because now
you know that your collection there's
data that doesn't contain and you need
to find other ways to validate the data
the problem is you don't know what
period that was on or off for
so here's the big issue You've Got That
device and you kept the charger on it
you kept that device AFU yes we're gonna
get all the data so because you've got
that battery on it right you can just
leave it on the Shelf
no
these databases the rich database
sources that you heard about in the last
talk they drop data every single day you
are losing data from a period before
Safari history retains 30 days now can
you carve additional data potentially
from the database yes but the active
records Right Live records versus not
live those are going to be a 30-day
history so every day you go you're going
to drop a day past there is a weird
thing if the same website's been visited
way past before the 30 days and it was
continually visited never dropped out of
30 days it will maintain time stamps
from before so if you see that don't
necessarily think that you didn't lose
that data you did it doesn't mean your
database goes back that to far deleted
photos they're on the device for 30 days
so that the user can put them back up
after that they're going to be gone
knowledge see all the incredible work
that Sarah Edwards has done on the HC
database and shared with the community
that Apollo parses fantastic Rich
artifacts
they all kind of range between 7 and 28
days uh depending on how long the shelf
life they have
Cash locations every single day you're
losing Cash locations the call logs are
some variance by carrier but they are
dropping day by day so tldr and this is
when are you going to acquire that
device
as soon as freaking possible it should
be asfp
sorry
because you need them right so now we're
going to touch on how do we determine
you know if our devices uh if we need to
do additional steps to get devices or
possibly missing uh data
so the first thing and Caesar touched on
this when he was talking about the
surface is you need to listen to the
community there's no way to really know
about the fact that your Chromebook
Acquisitions are going to only go as far
back as the period that you have written
on the disk because the methodology
right said this before it writes out if
you're not following what's going on in
the community and looking things up uh
if you are not on Twitter please get on
Twitter follow hashtag dfir it's the
best way to keep up on what's going on
that's where people share it this week
in forensics is a Blog ran by stillmore
that talks about oh what doesn't talk
about it lists everything that comes out
from the communities like 200 some odd
things the community puts out each week
I do read it weekly but that's not how I
use it if I'm looking at a device and
something doesn't seem right in my
acquisition I use that as a search query
to find the blogs that people
practitioners other people have put out
for the things they've seen
uh the digital forensic Discord server
has over 10 000 forensicators on there
talking actively about the problems and
solutions they're seeing
search that read it become familiar with
it if you have a specific it's very
broken down into category so you can
actually have the conversations where
you are but the big thing is if you
don't see the data you expect if your
driver your collection size of the
lesson you want and it's actually one of
the advantages of not doing a Target
collection is you should be able to
determine what the total size should be
and even if that means yeah you've got
to log into that Chromebook live right
yeah you need to research what size the
manufacturer actually uses for that
drive and if they partition down in the
firmware
so that you can ask those questions when
you see what you don't expect we are
talking about a lot of scenarios I know
we didn't give case examples that's more
due to the cases we work that we can
really discuss them but
these are things that we've ran into
time and time again on actual cases and
the answer is is when something doesn't
look right you need to get that Exemplar
and tests
you don't want to be testing on your
device so I'd say one of the most
critical things
to being able to discover and get
through this is really ensuring that
your exemplars
have a little flexibility and you think
about what other ways can I look at this
if you are running into a prom because
you're doing a Linux collection and
you're seeing a GPT table that's not
working and is corrupted what other way
can I try to do this collection to see
if I can get that space
you need to really think outside and say
well let me try this and do it with an
Exemplar that you've populated you know
what's there
when you populate data document document
document and more importantly if you can
please share those data sets back out
with the community so they can use them
as testing and reference test sets thank
you Joshua Hickman for all of the data
sets you've contributed to the community
and then once you're done populating
your device you need to go ahead and
validate your assumptions
one of the biggest problems that I see
with testing for this particular
scenario
is unintentional inserted bias
it is very difficult to sometimes think
like how somebody would misuse the
device
but it's really what you need to do to
see that and then try to misuse the
device to validate your assumptions
so in summary uh just to wrap it all up
Triage images are valuable but they
won't have all the data so try to get
that
you know full file system if you can
once you have the image make sure to
take another look at it make sure it's
not encrypted make sure it opens up in
your forensic tools I mean I think about
all those old blackberries right there
were all these old blackberries that
would you would get a full physical
um tools were good at giving me full
physical the blackberries but there was
nothing out there that would parse them
um so I needed the logical The Logical
was more appropriate for all of those
freaking BlackBerry World devices right
tools may not be self-aware uh that a
collection is incomplete an example of
the Android right the tool thought it
did its job it got the full physical but
yeah
that's the one chip right but we were
missing 16 gigs of data so that that's a
lot for phone
uh an example of surface these
examiner's knowledge is critical right
we didn't know how to image that device
so if we would have just relied on
ourselves that piece of evidence would
have sat there for a long time but we
you know we looked in the community
looked exactly you know how can we get
this device Acquired and we're able to
figure that out right at the end of the
day our job is not just to follow
instructions as to how to acquire
devices and to look at the data from the
tools our data is our job is to question
what the tools are doing for us and see
what might be missing
that is our role
otherwise we could all be automated out
of our jobs right let's be real our role
is to figure out what else
isn't there what is new what is missing
right right
and the state of the device is uh
important at time acquisition just so
you know what to expect you know AFU bfu
logical physical you need to know that
so you know what to expect when you're
getting that data and if you really want
to know what to expect please pull the
slides where the data actually is
instead of the like 20 blank slides I
had in there of that we promise it's
there
and then uh from time to seizure to
acquisition is important right you as
soon as you get that device you want to
try to acquire it immediately even if
you have it in a faraday bag airplane
mode even if it's powered on
uh with a battery it's going to lose
data day by day so you want to try to
get an acquisition as soon as possible
okay and with that yeah
um so first off please scan that QR code
if you want the slides or just CS
um I'll give you my card and email me
and I'll give it to you
um I actually have a TAP card you could
just fill in your email address and and
I can send it to you so apologies for
those slides being blank uh but if you
have any questions we're happy to take
them now and also 100 the best place to
reach us is on Twitter so there are
handles
[Applause]
[Music]