Good morning. Glad to see some responsible adults in the audience. You guys did not party hard enough, apparently. But hey, that's great for me. Sunday speakers are always get a little bit worried that nobody's going to show up, or everybody's sleeping or hungover and whatnot. So welcome to Ubiquity Forensics, your iCloud and you. Kind of a little PSA announcement here. So who am I? I am Sarah Edwards. By day, I'm a test engineer at Parsons Corporation. We do some government contracting work for other people. We are hiring. I know the car hacking village has been incredibly popular the last few days, and I know it's closing up soon after this talk, but if you're interested in anything like that, go talk to these people. They're great people, they're fantastic to work with. I've really been enjoying myself there. By night, I'm a Sands instructor and author. I'm a huge Mac fan girl, so I created the Mac analysis course. I do have a bunch of different dates that I've listed here, including September. So if you haven't quite gotten enough Vegas yet, come back next month. It'll be a great time. Latest and greatest version of this presentation will always be at my website. So if I do updates or run into other conferences and do additional research, you'll always have the most up-to-date version of the presentation at mac4n6.com. So a little bit about the scope of what I'm actually presenting here today. So I'm gonna be doing some iCloud basics, getting into some acquisition and storage of the data on particular devices. Some synced preferences. So little configuration files that get synced to the iCloud. And then to wrap it all up, I'm gonna be going over some application data. So let's start off with the basics. So Apple uses the term ubiquity. Obiquity basically means everything everywhere, where so iCloud really does describe best how iCloud works. You can get your Word documents, your email, your contacts, messages, preferences, configurations, all sorts of stuff that you probably don't know about is hidden under a lot of the underbelly of OS X and iOS. So I'm here to at least do a public surface announcement to say, hey, if you use iCloud, and I do, I like it, I find it very convenient to use. You should know what else it's syncing, things that you do not have the choice to opt out of. So I will point that out in a couple of different places. So moving on. The OS X, I have a lot of screenshots in here. So we've got OS X on the left-hand side and iOS on the right-hand side. They tend to look a lot of the very similar GUI-based-wise, and you can deselect various components that you want to sync. But again, there are some things not listed in here that do get synced automatically. So I want you to be aware of that. Just to give you another overview, you can also access it over the web. So this is iCloud.com, so if you're running Linux or something, or another operating system that's not exactly iCloud friendly, this is likely the way that you're gonna be interacting with this data. And then we have Windows.  So this is iCloud for Windows. You can see the options are a slightly less user-based. So you get certain things like your iCloud drive, your photos, and some other bookmarks with Chrome, which is kind of a weird option to have, but it is available. So different account identifiers. So we got the Apple ID, and this is gonna be what you sign into your iTunes account, your Mac App Store account to download various applications, usually an email address of some sort. This email address also has an associated numeric person ID associated with that. So I've redacted mine throughout the slides here, but you can see it starts something like 247 or 274, something like that. There is a numeric ID, which is gonna be important for us once we start looking at these files on disk. So now also with iCloud, you can have associated email addresses, they're called vetted aliases. So different email addresses you might wanna have the same information synced to, or different phone numbers that you might wanna have synced to through iCloud data. So now some credentials. So we're gonna talk a little bit about how do we access this information. So there's a couple of different ways. We can use the Apple ID and password. We can use two factor authentication if it's enabled. It is not enabled by default. In fact, last time I checked there was a three day waiting period to enable it, which I'm not entirely sure that's the best option, because if I see something I'll have to wait for three days, I'm gonna forget about doing this in three days. So hopefully Apple maybe can look into fixing that, making it more available to us. And there's also a token. So a token is basically a little data blob, a little file that's associated. So I log into my OS 10 machine. I have iCloud running in the background. It's not doing authentication each and every time that it's syncing. There is this little token file on there that does the authentication for me. So we can actually take that file off using specialized software and actually use that to our advantage. Now how much data could we possibly have? By default, we're looking at five gigs. You can purchase up to a terabyte. So we're gonna be talking about downloading this information from the iCloud servers. This could take a long time to download. If this person has one terabyte in various photographs, it's gonna take a really long time to download all that information. So some configuration. This is how you check a system real quickly to see if it has iCloud enabled or not. So a couple of different data paths on OS 10 and iOS, as well as a registry key on Windows. So there's a lot of different files, file paths and different locations on the file system you could check. But these are kind of the quick and dirty places. Throughout this presentation, I throw in some incredibly long file names and file paths. This is purely for documentation. I am definitely not gonna be reading out these file paths for you, because I will just trip over my words. But I do tend to like to document my presentations incredibly well.  If you are doing more of the opsec security type things, take a look at these files. See what data is leaking from these files. I think you might be kind of worried about what some of the data might be. That might be leaking from your enterprise environment. So let's actually get to this iCloud data. So on disk. So disk images, forensics related, relatively easy to get. Use DD in case, whatever your favorite imaging tool is. So OS 10 in your Windows, no problem, we can get the data. You might have encryption or whatever, but that's a whole other talk. So iOS is gonna be the interesting one. We can do physical acquisition type analysis now. And it's gonna be most important to get to that physical access. So 64 bit and data protection and all that good stuff has really limited forensics, but it's not impossible. If there is a jailbreak out there, you can get this data. So jailbreak your phone, look at the logical file system, grab the files that you need. I do tend to like Alcomsoft EIFT. It's a piece of Russian software, but it's very highly used in the forensics community to actually do a physical logical, which is a giant tar ball of all the user related files. So not quite a full physical, but enough to get the job done. So iCloud.com, we're gonna go over some various download tools. Some are more sketchy than others. Then I also wanna go over various downloadable storage types. So we have iCloud backups. iCloud backups are very similar to iTunes style backups. So it bundles all these files up, renames them with a hash and then stores them up in the iCloud versus say on your system, on your Windows system, on your OS X system through iTunes. But it has very similar data structures in there. We also have iCloud specific data. So stuff that's not put into the iCloud backups, things like mobile documents, photos, synced preferences. So I'm gonna be pointing these two locations out there. So for instance, iCloud backups, you might have certain backups, snapshots in time. So you might have one from a year ago, but it's definitely gonna be different than one that you've done today. So you could have three, four, five, 10 different backup files. So backup tools. Some are definitely more sketchy than others. If you just do a Google search for iCloud backup or iCloud download or anything like that, you're gonna get a ton of different hits. These cost anywhere from 10 bucks to 50 bucks to 80 bucks and download, it does download your software. But how much do you really trust a lot of these tools? Is it really just taking your credentials and storing them for later on? We don't know. We kind of have to look into that a little bit further. Slightly less sketchy. We have iLoot, which was created in open source that is actually pretty useful. I'll get into that a little bit more later on, as well as the forensic level. This is gonna be Elkumsoft phone breaker, EPBB. So I'll get into these each in a little bit more detail. So iLoot. iLoot, you have to have the Apple ID. It does not have two-factor support. It does not have token support, but it does run on Python. So while I might be a Mac fan girl and I pretty much run everything on a Mac, those Windows users and Linux users can still pull down their iCloud data. Command line only, which is perfect for me.  Open source, nobody's ever complained about that. And it's free, which is excellent. So if you are doing research, you do wanna play around with your own data and see what this looks like, go ahead and use it. It's actually, it's very, very useful. But again, it does not have two-factor support. So unless your account is non-two-factor support, you can actually get the data. So what does have two-factor support is the Elkumsoft phone breaker. And this can take anything from your Apple ID and password to authentication tokens. It supports two-factor authentication as well. So depending on what type of data identifiers and passcodes and things like that that you have, you should be good to go. It does cost quite a bit more.  You know, we're looking at $200 to $800. So this runs on Mac or Windows. Each version does have different capabilities to it. They just came out with the Mac version, actually, maybe a few months ago. So the Windows and professional versions have slightly more capability with like, breaking iCloud, excuse me, breaking iTunes backups and encrypted backups and things like that. So take a look at it. But it is one of my favorite tools out there. All right, so that's the basics. Now we're gonna get into the actual nitty gritty of the data. So we're gonna be looking at a lot of P-Lists. So if you have never done Mac analysis before, there's these little files called P-Lists. The only thing I can really compare them to is registry type files. They're key data values, basically describing a lot of the configuration and data saved across the systems. And these are found on OS X and iOS. So synced preferences, these are little data files for configurations, saving various preferences, saving weather configurations, stock configurations. And those are some of the relatively more boring ones. So let's get into a few of these. So email. So iCloud does save your recent email information. So in the data pass, sorry. In the data pass above, you can see a lot of these different P-List files. So I'll have an example of one here. So under the values key, you see this GP or MR underscore and some hash like value. Under each one of these keys holds a lot more different pieces of data. Now this one's really called mail, let me see, comapplemail.reasons.P-Lists. I have the arrow there, showing you how many recent emails I have. It stores a lot of them. It's basically calling through all your mail and breaking out different pieces and storing that information in there. So I don't email a whole lot, or at least I don't consider myself to be emailing a whole lot, but it sure is saving 680 different conversations. Now let me get into this a little bit more in detail. So the MR is data for a single contact. So if I'm talking point to point with one other person, that data's gonna be stored in there. For group emails, it's gonna use GP. So it does mark these things and are relatively easy to figure out what kind of way. So I got two examples up on the screen. Example on the left shows us a point to point contact. So I'm talking with Heather Maholic, but it saves all of this information associated with it. So it saves who I contacted, when I contacted them, best I can tell it's the last five, the most recent five dates associated with that contact. And that's messages going to and from. So not just to a certain person, but both directions. And it also has the client that's been used. In this case, it's comAppleMail, which is the default mail application on OS 10. On the right of the screen, we have very similar data. It looks very close to being the same. That's T value here. I'm gonna try to see that there. This T value here holds the different times and dates for all of those recent contacts. So I've only been contacting this particular group three different times, you know, max of five here. So down here, we also have the key over here. Now this key is what holds the actual contact information. So in this group conversation, who was I having it with? I was talking with Henry Van Gogh them. I was talking with Rob Lee, because I do a lot of sand stuff. I have to communicate with multiple people quite often. So it stores all that information in there. You know, really nice information to head if you're trying to track who's talking with who. You can even set up VIP senders. And this is a default Mac mail type of thing. You basically star a certain contact and they are now your VIP.   So same kind of markup here. T for time, A for address, and some other information associated. So it does have the VIP underscore flag here. So you can tell it is a VIP contact. I haven't seen a whole lot of people use this in reality, but the data is there. So not just with email messages, also text messages, SMS messages, Jabber messages, A messages, ICQ if you're that old school. I think that's still supported. All of those messages also get the same data associated with it. So in the appcom, Apple messages, Recents P list, depending on which operating system you're looking on, stores the same type of data.  So it's storing all that same information. The times and dates of that contact was last messaged. And that, this is not just iMessage. I wanna make a note of that. You can sort of see in here, let me try to highlight it with here, this iMessage here and mobile SMS over here. So different protocols will show you different data within these property list files. But again, the same format, you got the address, you get the times, the protocol, and with messaging you also get phone numbers and email addresses. So I can send a iMessage to somebody else's phone number because that's just how the protocol works. So good data collection there. So next up we have sync devices.  You open up your iPad and it syncs all those tabs down. So you can sort of see in the screenshots to the right there, the different tabs are open on different systems. So if I open one tab on one, I move to a different device, I can open that same tab. All of that is getting synced in real time. So under the sync tabs, again it's another P list. I often say you get sick of P lists really quick, but then you find the value in them. There's some great, great data to be found.  So under each GUID is a different device. So under the value here, we have last modified and device name.  That is the device name that I provided it. You might have so and so's MacBook Air or so and so's Mac mini, something like that. You also had a time and date that that was last synced. So you can do some temporal correlation with this as well. So now we're gonna get into this tabs key down here. So under the tabs key is data for each tab open. It's relatively simple data. It's basically just whatever the title of the webpage was, as well as the URL that it was for. So think about this. If you're being investigated for whatever bad thing you're being investigated for, the cops come by and they get a copy of your iPhone. You still have, say, five different other Mac devices or iDevices that they don't know about. If you're using iCloud and you're syncing all of that data, they can potentially see what Safari tabs you have open at a given period, because it's syncing in real time, assuming it has a data connection. So maybe you open some tabs on your web browser at home that maybe you shouldn't have. Whatever the case may be, that's gonna get synced down. If they have a copy of one, they might as well have a copy of all of them at this point. So this is one of my favorites. Synced access points. So Wi-Fi configurations are also synced across various devices. In OS 10, this is the screenshot to the right. You can see the various hotspots that you have connected to, attempted to connect to. And it basically saves this information for all time until you delete it or do a complete clean reinstall. So in this Wi-Fi panel here, you can see I've connected to Hyatt guest room, H Honors, Logan Wi-Fi, airports and hotels and all sorts of stuff. But there are some other ones that I do not show you here that could potentially be more sensitive. Maybe to corporate environments to internal Wi-Fi to places that are very specific, that have an access point name that could be considered sensitive information. So naturally, this also gets synced across all the devices. So a couple of other P lists here. On the left, you can see all the things that I've connected to fairly recently. And I like to keep a lot of my data in here purely for science. I do not like to keep this up here, but I do like to have good data to show you all when I do my presentations. So let's take a look at Reagan National Wi-Fi. I'm from the DC area. I hang out at National Airport and I like to connect their free Wi-Fi because why the heck not? So this, of course, gets synced back. So what kind of data is getting synced? The BSS IDs, EAP mode, all that good Wi-Fi stuff. But specifically about the device information, we get the name of the device. In this case, it's my phone 5S, as well as when this was synced. So add it at. So this string right here basically says hey, I was at National Airport on February 9th, 2014 at a very specific time. This is very, very specific. Now if you look at all of your access points, you do data correlation. You can make a beautiful timeline of everywhere this person connected to at a certain point in time. Very scary stuff. So next up, we have map information. So I was always kind of curious why the maps application came down on OS X. I don't find it particularly useful, but I guess they sort of brought it in to sync all the iCloud map data with. Now I use maps on my phone, sometimes better off than others, but I do use Apple Maps. Not exactly known as the most reliable, but I do use it. So that data also gets synced to OS X maps on my system or on my laptop and my desktop systems at home. So favorite, excuse me, favorite locations. Now these are user-created favorite locations. You might have your home address in there, your work address, whatever places you want to just go to very quickly. That's saved in its own list. Again, it's a P-list file and it's called under sync underscore bookmark, some item and again a GUID. A lot of these items are based upon various GUIDs, some sort of good identifying information. So we can search across the drive for these various GUIDs to find certain information as well. So the meat of this is actually under the data key. Now this is kind of a proprietary data blob, I guess you could say. Apple does this every once in a while. I haven't taken the time out to parse it because you can pretty much just see what the data's supposed to be just using the strings on there. So I throw it into a hex editor. You can see I was in Denmark, I was at Copenhagen doing some touristy type stuff. If you've never not been to Nyhaven in Copenhagen, highly recommend it. It's very pretty. Are you from there? That's awesome. Am I lying? It's a beautiful place. Kind of touristy but really pretty. So a lot of the other map data, we have recent addresses and recent location and searches. One note on the recent addresses. This is not user driven. This is being extracted from your email files, extracted from various web addresses, extracted from all sorts of stuff. If you take a look at it, I have a couple of examples in here. I was condo searching. So I was hooked up with Redfin. I was looking at all sorts of different condos in Arlington and Fairfax and wherever. Every time I got a Redfin email and those things, they come in daily. It's scraping the addresses for all of those emails and throwing them into this database. So this is not a choice that the user can disable. So be aware of that. Now recent location and searches, this is definitely something that the user can do. So wherever they search, maybe they're looking for a pharmacy in San Diego, let's say, or they're looking for a burger place, directions to a burger place in Fairfax. All sorts of good tracking information in there. Where has this person been? So that extracted information follows the same structure that we've seen in a lot of other property list files before. It's got the date and times of these emails. So it's extracting that timestamp from them. The core recents under this M key here basically is showing us this information was scraped from a Redfin email on April 26, 2015. There's the URL, there's the information that was scraped, the subject of the email and all sorts of related information. So recent location and searches. Again, this file is the same type of data structure that we're proprietary data blob. But you can just look at it, look at the strings and you can see, oh hey look, this person was searching for a pharmacy in San Diego. You get some timestamps in there as well that you can go back and actually figure out when was this person specifically looking for a pharmacy in San Diego. So moving on to some more application level data. So various applications, things like mail, notes, various documents, all that stuff also gets synced through iCloud. So just to give you a little screenshot of what the documents might look like. On the left here we have the OS 10 screenshot of me saving a document to my iCloud drive. You can save it through the text iCloud drive or just the plain iCloud drive. And I'll get into that a little bit more in a few more screenshots. If you are on the web, on the other side, you see different file folders pre-populated in there for various document formats, numbers, keynotes. But you can also just drag files into that white space. Works very much like Dropbox might work. So all these documents are really under a directory called mobile documents, both on the OS 10 operating systems as well as through the underlying file system. So different document types like pages and keynotes will get their own directory. So that tilde library mobile documents, com, tilde, apple, tilde pages, is specifically for pages and so on and so forth. So you can have some organization there that's been pre-populated by Apple itself. But that other category right at the bottom, that's basically for anything that's not a pages document or a keynote document. If I wanna throw a PDF in there, if I wanna throw a Windows executable in there, if I wanna throw in whatever file in there, it will actually take it. Very Dropbox-like is not Apple specific documents. So looking more on the disk, taking a more forensic look at this, these are all stored in that mobile documents directory under the specific application. Now the one thing about iWork type documents is that they're actually bundled files. So they're actually a directory of other files. So they are presented to the user as a single file, but when you look on disk, or if you look in the terminal, let's say, you'll see a bunch of other files associated with it. So different pictures in the document, different pages, different texts, metadata, all sorts of good stuff, all bundled into one. So that's why you might see multiple files under one document. On iOS, file is the same sort of file structure. Under private bar mobile library, you have that mobile documents directory. And that's gonna look very similar to what we saw on OS 10. Calm till the Apple, till the text editor, or whatever other app you might have. On Windows, same thing. This is one of the few things that Windows does sync down to a Windows device. Again, same similar structure. You get the mobile documents directory under your user directory through Windows. So photos. This application is probably more popular than not. If you have an iPhone, you tend to take a lot of photos. We can get some giant disks now on iOS devices, up to 128 gigs. And people love to fill them up with pictures of their kids, their cats, food, whatever is happening in Vegas last night, I don't even wanna know. All of those are stored and synced up if you have that particular function selected. So there's two different applications right now for photos. So there's the legacy photos application, as well as photos that came out in 10.10.2 or 10.10.3, I can't recall right now. So two different applications. And on the underlying side of them, they look completely different to us. So I'm gonna go over the legacy one first, because people are still using that. It's not exactly that old to begin with. So there is this data structure under applications for iLife Asset Management. Under this particular directory is all the iCloud related information associated with photos. One particular database. This is a SQLite database. It's a ilifeassetmanagement.db. This is where the bulk of the metadata for each photo is stored. And we're gonna get into that a little bit more in depth in one slide or two. But you also have the actual photos located underneath here. So that assets directory, which has pub, sub, subshared, holds a lot of the actual photo information. And this is gonna be very different than what we see on the new photos application. So this ilifeassetmanagement database holds a ton of different pieces of metadata, height, width, iCloud person ID, so we can actually associate it to a particular iCloud user. The photo UUID, the device UDID. This one's gonna be particularly interesting because we can tie it back to a certain device. File name, file size, timestamps, all sorts of great metadata associated with each particular photo. You also have photo stream photos. So photo stream photos or your photo stream photos are stored in slash sub. If you have a shared album, those are gonna be in sub-shared. And each one is stored under this hash. And this is that UUID for each particular photo. So if you're looking for a particular one, you find some interesting metadata in that database. You can go find it by that UDID. Search for that file name, for that directory, and you get the photo that's particularly interesting to you. The new photos application, this one's stored again in a bundle, has photos with lots of other stuff underneath it. So the photos library again is one of those bundled files. So underneath here we have all sorts of stuff. Stuff I haven't even had time to take a look at. Attachments, masters, plugins, previews, whatever. So the new photos application actually stores information for all the photo stuff on that OS 10 disk. All the previous one stored information just for the iCloud photos. iCloud is now being more integrated into the OS 10 subsystem. So now it's containing everything associated with it. So the actual photos are stored under the masters directory. They might be stored under other directories if they had some edits made to them, if they were modified in some way, maybe they added text to it or something like that. But the general photo themselves are under the masters directory. And we have timestamp file paths, which just makes it pretty easy to find photos that were taken for a certain time period. But how do we actually tell, because this is all the photos, how do we actually tell which are iCloud specific photos? So I could have a camera, I could have a nice digital SLR, hook it up here, and those photos would also be in those directories. If we look at the extended attributes, we can tell if it's an iCloud photo or not. So one of my favorite commands is X-A-T-T-R. I like the flags X and L, just to show me the data in a hex format. We can actually see what this quarantine value is. So the comApple quarantine, these metadata values get populated every time you download a file, every time an attachment comes in. You download a file through a web browser. This comApple quarantine information gets tagged with specific files. Forensically speaking, this stuff is gold. This tells you when that file is downloaded. That hex value in there is a timestamp. It tells you what process downloaded this photo. So in this particular instance, we see Cloud Photos D, but say we downloaded something from Safari or Chrome or Firefox, it's actually gonna show you that it came from Safari, Chrome or Firefox. So on a side note, forensically speaking, take a look at this information. It is one of my favorite pieces. So metadata. On the legacy photos application, we had the iLife photo, iLife Asset Management Database, and that stored all the metadata associated with each iCloud photo. And this one, we have a library APDB file. This is also a SQLite database. If you see anything on Mac, it's either a PLIST file or a SQLite database. Generally speaking, I would say 95% of everything is one of those two file types. So the photos metadata. We get a lot more metadata on the new photos application. Various timestamps, height, width, whatever. But we also get locational information. So it's pulling this data outside of the XF data. We're getting kind of like a reverse DNS lookup of this particular data. So we don't have to pull that information from XF data and have to throw it into Google or whatever GPS core in that thing we like. It's actually showing this. Oh, hey, this thing. This photo came from Denmark on a certain date and time or wherever. So really good information in there. So we can actually just scroll through the database, find a picture from a certain location that's of particular interest to us and go looking for that without having to do a lot of the background work for it. So the new photos application. All that photo stream data is also stored in these particular files. So I got an example of here of iOS. A lot of the data is stored in here as well. So you get the height with a lot of the other metadata associated with it. A lot of the stuff that we've already seen in that database on iOS 10, but as well as on iOS. Shared albums on iOS. We have there are certain file path for them. It does contain a lot of the same information. So I can see who shared this photo album with me and other related information. So my email address or their email address when they shared it. Various identifying information associated with it. As well as the title of the shared album. Now on Windows. Again, one of the few things that is synced down to the Windows. You still have my photo stream and shared directory. And these are all located under the photos application on Windows. Or in the photos directory on Windows. Again, another screenshot of my photo stream. These files are stored in just a straight up JPEG or paying format depending on the type of, if it's a photo or screenshot. Pretty easy to get to. If it's a shared album, you're gonna find that's in again, another hash type thing. We can correlate this back to other databases as well. So passbook passes. This one is particularly interesting. I like to use passbook a lot. I do a lot of travel. I like, I don't like United. I use United to basically get my passbook, my pass to get onto certain flights. So each flight I take has a ticket associated with that. All of those get stored in the ubiquitous cards directory. In this directory, we have these PK pass directories. So in these directories stores all the information associated with each card. Now these could be airline cards, they could be Starbucks gift cards, Target cards, what have you. What you won't see here is Apple Pay related information. So you're not gonna see your Mastercard, your AmEx card or anything like that. This is not Apple Pay specific information. So in these files, we have pass.json. This is just a JSON file, not an XML or anything, not a PLIST file for some reason, but a past JSON file. So Apple's gotta switch it up every once in a while. So this stores all the metadata associated with each pass. So in this one, it shows me what flight I was on, what seat I was on, my United Mileage Plus number, what gate I was at, all sorts of interesting metadata. The notes application. So each note that you take, whether on iOS or Android or Android, OS 10, you see a lot of the same information getting synced up. Now you can choose to make it an iCloud note or not, but many people do because it's almost like an automatic backup of that data. So all that data is stored in these particular directories in a SQLite database. So iOS or OS 10, the SQLite database is very, very similar. I've done one little query here just to show you some general information. Each note has associated timestamps when the note was created, when it was last modified and just an HTML rendering of the note contents. So very easy to get to that data. Calendar and reminders. Calendar and reminders, while two separate applications on OS 10 and iOS, they're actually integrated as one in the backend. Just a calendar view there. And again, I've done the same thing. So again, they are SQLite database. You could pull out very quick information out of them. So when was the calendar item created? What was the reminder for? Alarm information, all sorts of metadata. These databases are incredibly large databases. Really makes for awful screenshots. Thus I made a tiny little query just to show you the general information. Contact information. So all your Apple contacts, all the phone contacts, your messaging contacts, those are all synced up back up to the iCloud. So every time you add a new contact, maybe you've added a lot of contacts at this conference. It's likely. Those are getting pushed up to the iCloud and maybe saved on your OS 10 systems back at home. And those are again stored in a SQLite database. So I pulled out one of the records, a lot of information associated with it. So while here I have a creation date, modification date, first, last name for Andrew, and thankfully I blocked out his number, otherwise I'm sure he'd be receiving some calls. I don't think he'd appreciate that, but there could be also a ton more information associated. Things like social media accounts, physical addresses, digital addresses, all sorts of great contact information depending on what the person put in there. Now we're down to third-party applications. So if you've looked in some of these screenshots here, you've seen things like iCloud, com, get Dropbox, Microsoft Office PowerPoint, OneNote, SkyDrive. It looks like these could be reserved for future use. I took a look at mine, I tried playing with the application to populate that data, but they all seem to be empty. So even the absence of data can still tell us a little bit of something. So you can see what applications I actually use just by looking at this. So maybe you don't have my iPhone, but you can tell some of the applications that I do use. So I'm assuming this is kind of a reserved for future use type of thing. And last but not least, iCloud Keychain. iCloud Keychain can be extremely useful. People do not like typing in passwords to their iOS devices. I can barely type on these things. I have small hands and I don't like doing it. So maybe I wanna save all my passwords to Amazon or social media accounts into this database. So this keychain2.db is just a SQLite database. You can look in there, you might be able to find some strings of interest. If you get access to the user's OS X system, along with their password, you can actually dump their iCloud Keychain, which is incredibly useful to do. Have not yet found a tool or a way to do it on an iOS specific device, but if you do get access to the user's desktop or laptop system, it does make it a lot easier. It's only protected by the user's login password. And this can contain anything from email accounts, certificates, keys, credit card information, saved form data, addresses. There's really no limit to what could be saved in the iCloud Keychain. It works just like the Keychain on OS X.  Just a screenshot of the Keychain access program. So if you do have the user's password, you can go ahead and click this lockup at the top, input that password, and you can now unlock that Keychain, and you can go ahead and browse the data at your leisure. So that's it for the presentation. Hopefully the goons are not gonna kick me off stage. I do thank you for coming to the presentation. If you have any questions for me, I will be here for maybe a couple minutes in the outside of the hall. Feel free to email me any questions you might have. I'm also on Twitter, I am EVL Twin. I do a lot of the Twittering, if you will. It's probably the only social thing that I probably do. So feel free to hit me up on that as well. So thank you for coming. I hope this was informative, and I hope you have a great rest of the conference.


All right, so we get up on Friday going to, I think we'll finish today with our last of the 2D planer motion Portrait systems we're looking at. We did the Cartesian system. That's very useful in, well, if nothing else, you're used to it. You're familiar with it. You've been using it since she's probably fifth grade or something, some of you. Also works particularly well for any problem that just happens to line up with that system as projectile motion does because the gravity is all in the y direction. Most of the motion is from buildings that are in the y direction and downrange targets, which are in the x direction. So that works pretty well for those type of things. Then we look at normal tangential coordinate system. Remember what kind of problems that works particularly well for? If the path is no, it works real well for those type of things. However, as we saw, we did a projectile motion problem in the normal tangential coordinate system. So the problems can be done in any of these. It's just sometimes they turn out to be a little bit easier than others. And we'll look today at the polar coordinate system in 2D motion. We'll talk about that one just real briefly about what it means in three dimensions. The Cartesian system in three dimensions is no great change. You just add on the third dimension the z direction and deal with it like that. The normal tangential is kind of also the same. Just add a z component to it in and out of the plane just like you would with the Cartesian. Polar is a little bit different, but we'll just briefly address it without any great explanation. So the polar coordinate system, oh, and remember of course, because these are 2D planar motion coordinate systems, each one of them has two variables to describe the location and then from which changing location we get the velocity and then the acceleration. And of course the unit vectors was i, j for that. I think we used e n and e t for this one. And now for the polar coordinate system, it's only slightly different than the normal. Same kind of idea. So here's some path upon which our object is traveling and it happens to be at some point on that path. The location of that is described as being some distance from some origin. And so we'll call that r. That being some origin, oh, and then that that just tells us the distance it was away from the origin, but that in what direction is described by some angle theta measured from some reference direction. And so it looks very much like you might imagine if you were stuck at the north pole and you were trying to find out where anything else in the world was, you'd say it's so far away and it's in that direction. So the polar coordinate system then would have unit vectors for the direction in the r direction there and then the theta direction, as I drew it with this, would be something like that and again these are all orthogonal coordinate systems that we're talking about. So it's the actual position vector itself then r would be the magnitude r in the r direction. So it sounds kind of simplistic and redundant, but that's all the more it is. And then if we give this thing some kind of velocity, remember that's always tangential to the path. So that velocity put the position vector right back up here again because then the velocity is the time rate of change of that vector, which will take into account both distance from the origin and direction because it's any change in the position vector, more simplistic notation, of course r dot, and then that will be the time rate of change of the vector we just put up there. And that's going to take a little bit of new work on our part. We're going to have to come up with a few new concepts we haven't had to mess with before. All right, so we have two things here that are changing with time. It could be changing with time, both the distance from the origin, but also the unit vector itself is changing with time because if this object's moving along the path, er, one time is pointing, it's always pointing straight out from the origin, but its direction changes as well because the direction from the origin can change. So this actually has two components to it that we get by the chain rule. r, er, dot, the time rate of change of the unit vector itself, plus the other half of the chain rule, r dot, er, so that would be a velocity in the radial direction, purely a factor of whether it's getting closer to or farther away from the origin as it moves along that path. If we had purely circular motion, r would be constant and then that term would be zero automatically. All right, so we have to evaluate, we have to evaluate this time rate of change of the unit vector in the r direction first. So I'm going to blow it up a little bit so we can see it. There's er sort of in that same direction I had there and some little instant time later, actually let me get that out of the way and put it on top, some little instant time later, the unit vector in the r direction is now that way and there's been some change in the r unit vector. Now that in itself we can look at, let's see, that's a vector, so the magnitude of it, the magnitude of that unit vector, well it's just, since this is very small difference, it's really just the arc length that the tip of the unit vector sweeps out, would be plenty close enough for us, so that's a distance out there times some change in the angle that occurred during that same time, so the arc length, the magnitude of this change is going to be r, not r, the distance delta theta is the arc length, the distance is one, that's the unit vector. So this will be one del theta, that's the arc length, and so we've got that, we've got that piece in the direction of however, I already took it down, in the direction of e theta, so delta er is delta theta e theta, the arc length, and it's in a direction perpendicular to the direction of the unit vector itself. Alright, so we need to figure out just what that is, or just what the time of change that is now, which will be the limit, delta t goes to zero of this vector over delta t, but that's the same limit of this new part we've got here now, delta theta delta t in the theta direction. So I've figured out what the change in the radial unit vector represents, I need the time rate of change of that, so I divided it by delta t, drive delta t to zero, and then I made my substitution of what the change in the unit vector in the ironsion is, which is delta theta in the theta direction. Because now we're all done, the limit as delta t goes to zero of delta theta over delta t is theta dot. So the time rate of change of the radial vector is equal to the angular velocity in the theta direction. We can then put that together, r theta dot e theta, that's just making the substitution. I already have r making the substitution for the time rate of change of the radial unit vector, and then the second part I don't have to touch. Let's see if this makes any sense by comparing it to the type of thing when we look at circular motion back in physics one. In circular motion, in physics one we probably wouldn't use theta dot, would we use for angular velocity? Omega. So this would be r omega, and if it's circular then the theta direction is the tangential component, so this would be, we can just write down that as its direction. You remember that v equals r omega from circular motion when we are looking at physics one. And r dot is zero, meaning there's no normal component of the velocity, no radial component of the velocity. In circular motion it's all the same distance from the center of motion at all times, and its velocity in any time is r omega. So that looks very much the same as what we've seen before with circular motion. Okay, so no tricks there really, but we did have to look at things in a different way than we have before, because we have this time changing unit vector. Alright, so just capturing these things again, theta dot e theta, all I'm doing is rewriting it so I can kind of build a summary for ourselves as we go. And this last component is only if it's getting nearer or farther from the origin, and this is essentially as it's passing across the origin, across its angle of view. So maybe I'll write down the change in the unit vector because we're going to need that important. The time range change of the radial vector is theta dot theta. Alright, just using that piece. Okay, so we have the position, we have the velocity which is the time range of the position in the two component directions. Now we need to do the acceleration as well. Acceleration is theta dot, so it's d dt of the velocity vector, which I've got here, r theta dot theta half plus r dot e r.  So here we go. First part of this has three parts to it itself. Each of them might have a time variant quality to them. So we're going to do the chain rule on that. r dot on the first one leads the next two alone. The first one alone do the second one. So it's theta double dot. We'll leave the third one alone. Leave the first two alone do the time range change on the last of the three. That looked right for the chain rule on that first part. r theta dot e theta. I didn't miss anything. Looks okay. I have the second part. So it becomes r double dot. Leave the second part alone. Leave the first part alone. We get er dot. I think everything's okay. Look alright everybody? Okay. We can collect a couple light turns. Well one thing we can do is this very last term here, this time rate of change of the radial vector. We've already got that. We know what that is. This piece is that theta dot e theta. What? Is it okay? Yep. One thing we do have that's new is this little piece here, this e e theta dot. So we're going to analyze that in just the same way we did with the other one. So imagine we've got some object, there's r so that establishes for us er theta. And what we want to see is the time rate of change of the theta direction unit vector. So I'll do just what I did last time. Draw a nice big picture so we can see it. There might be an original position. A little bit in time later. It's moving around the path some so now e theta might look something like that with a change between the two. Now e theta right there because of some change in angle. Del theta just like that. I think we're okay. Yep. And so that has magnitude. That has magnitude of one. Del theta just like we did before. It's the arc length. But this happens to be in that direction back towards the origin. So it's as a vector is del theta in the opposite direction of the radio vector minus er half. So that's its magnitude and then its direction is the minus er because that's pointing in towards the origin where the unit or the radio direction is away from the origin. And then let's see we're over there. We're trying to find the time rate of change of that. So we want the time rate of change of this with the limit as delta t goes to zero of minus delta theta delta t er. And that's theta dot again. This is minus theta dot er half. So that goes where is that? That goes right here. Minus theta dot e. Don't worry I'm not going to expect you to develop this just just use it once we've got it. So let's collect like terms which means group them by unit vector. So that's r dot theta dot e theta plus r theta double dot e theta plus the last one r dot theta dot e theta dot. Oh but I already have one of those. So I'll just put a 2 in front of it. So I took care of this e theta e theta e theta but comfortable so far. And then the 2 in the radial direction. Two components in the radial direction. Oh wait this is in the theta direction plus the 2 components in the radial direction. r double dot minus theta dot er in the r direction. That's beautiful. That's a big jump work there already. Let's let's see let's see what it looks like if it looks at all familiar for us. If we're doing circular motion. So r is a constant. This term drops out. We have just r theta double dot. Theta double dot in the theta direction. What did we call theta double dot in circular motion? Called it alpha. Right so this is just r alpha perpendicular to the radial direction which is the path. The path is always perpendicular to the radial direction. So that's r alpha. And if r is a constant we've got r double dot. We have minus theta dot. I lost an r didn't I? Let's see where was it. This is oh and I have the er in there twice. So let's fix this one. Let's fix this is the r direction. Not that one not that one. That is a minus sign so we'll take it second.  That's in the r direction. That's better. We would have caught it because it didn't work at all right here. And that's it. Alright so if r is constant r double dot is zero. We have minus r theta dot squared minus r theta dot squared. But we didn't use our theta dot. We used omega. So this is minus r omega squared in the radial direction. Opposite the radial direction is in towards the center. This is the centripetal acceleration that we always had in circular motion anyway. Alright so I just have a second while I reset the taper. And the minus sign means it's towards the center as centripetal acceleration is because our radial direction is away from the center in our positive radial direction. Increasing r if that happens. Wow that's a beautiful piece of work. You guys should be proud of yourselves. So let's write it down up here. Then we can clear the board and use all of these pieces in a couple of problems. I'm just rewriting the acceleration part here so I have all three of them together. Okay all three starts with our time rate of change of the theta vector, unit vector as minus theta dot. Now I'm mixing up parentheses. You can note some chalk. Makes it easier. Okay looks a little better. Okay let's do a couple problems. Looks a lot worse than it really is mostly just because it's new. We have never looked at a time varying unit vector before. That's all a new concept for us. But it was pretty straightforward I hope to figure it out. The book presents this very same thing only a slightly different way so either one is fine. Alright so let's do a problem here. Imagine we have some tracking radar on the ground which makes very good use of the polar coordinate system because that origin is fixed and whatever object is being tracked will be very much tracked by a change in the angular position. So here's a plane perhaps we're tracking. It's got some velocity v. It's in level flight. Being tracked by radar, I don't know if you know this or not it's blue. So being tracked by radar such that it's changing components as it's tracking. Well it knows that it's 6400 feet away. That's just simply the same kind of thing that radar does. Send out the signal in time how long it takes to return. R dot and this it would get from Doppler shift is 312 feet per second. Theta at this instant happens to be about 40 degrees. Theta dot is minus 0.0309 gradients per second. Watch your units here because for angles we need those kind of things. R double dot. So the rate at which that velocity signal is changing is 751 feet per second squared. 9.751 and theta double dot. The angular acceleration as that plane is being tracked 0.003807 radians per second squared. Alright all the type of things that you can read right off the screen of a radar tracking system. Alright so we want to find velocity and acceleration of the plane which we get by filling in the velocity and acceleration vectors with all the parts that we know. Quick word is that. So the velocity of the plane is R theta dot. 400 feet theta dot is minus, what's the minus sign here mean? The minus sign on this theta dot number. The angle is coming towards the ground. Yeah this, if that's theta as I gave you then that's decreasing. That's what the minus sign means. Nothing more than that. 0.030, no not 79, second squared. That's in the theta direction plus the R dot component 312 feet per second. Sorry that's not second squared that's second. And so you work out those numbers we already, we know what the vector looks like because I said it was in level flight but just to get the numbers to it I believe the minus 250 in the theta direction plus 312 in the radial direction and that's feet per second. This velocity vector broken into that component and that component. So that's 250 feet per second this is 312. Notice because of the way theta was drawn which was a little bit different than the original layout for this problem it's in actually in the opposite direction of what we had before. This is 60, that's R theta dot which is the first component here R theta dot. Is that an equal 250? 198. Mine was down one line. Oh I see it, no, no. I think I misread it. Yeah I did, I'm sorry. It's not 309, it's 39 at least for the numbers I have but remember just a problem. See everybody's taking notes on pencil anyway so I don't feel guilty. That's 250 then? Yeah. Okay good. Alright you do the acceleration vector in R theta direction and then we'll also sketch that on the little pictures you would have looked like. And again it's a matter of simply taking the acceleration vector and putting the pieces that we know to R dot which is 312. We've already checked the units on everything so we can be a little more cavalier with it because we've got a lot to write R theta double dot theta double dot the angular acceleration that's the angular component and then the the radial component. The radial acceleration 9751 the percentage squared so our chain is working on times theta dot squared which we need to make sure the units work out. They do the right one. R double dot minus oh not quite which would be obvious because the units aren't working out. There's R double dot now I need minus R theta dot squared theta dot squared. Okay that's better and that's in the radial direction. R double dot minus R theta dot squared gives us the two acceleration components in the R and the theta direction. Alright we got them. Got the first one there John for a chance. Yeah that's what I got. That's feet per second squared and that's in the theta direction. Yeah that's what I got. .0166 and that's in the radial direction and this is all feet per second squared. So the acceleration those are both about the same magnitude so a quick sketch should be pretty easy for us. It's got a little bit in the plus theta direction which is increasing theta so maybe something like that. That's A in the theta direction and about the same component in the R direction. Alright this acceleration component in that direction comes because as it's getting further and farther out it doesn't have to track an angle as fast. It's angle decreases by somewhat but it's a matter of taking the parts where we're going and these are very easily read right off the screen for the tracking station. I'll leave those we'll meet them. Have I got it all? Oh are you okay? Yeah. Okay so we can look at a second problem but leave that up there because that's the whole basis for this whole important system. Alright leave this one for you a little bit. Imagine a robot arm that has something right at the tip of it and maybe it's moving apart from one place to another maybe it's making a weld in some way but it follows a path that is something like this. R is 1 plus 0.5 cosine theta so a distance from the origin which we'll put right at its own pivot spot as a basis for the pull accordance system and theta is measured from the vertical in this case. So as the angle changes the distance from the center changes a little bit so it's certainly not a circular path because it's certainly not constant radius. Alright given these little pieces here when theta equals 45 degrees we know that theta dot is 0.6 radius per second and theta double dot is 0.25 radius per second squared. At that point where it's 45 degrees so about like drawn find the velocity and the acceleration vectors in the pull important system we're using. So we've got theta dot we've got theta double dot what we don't and we have R what we don't have is R dot and R double dot. So where will those come from? We've got R if we deliver it once and then twice we've got R dot and theta dot R double dot just the time derivative of each of those. Don't forget to use the the chain rule because theta dot as a part of that also changes the time. First derivative that's constant minus 0.5 sine theta. Does that look right? Does that look okay? And you can take the derivative of that again to get R double dot. And then all of those we know at a particular theta so those can all be evaluated. I'll set the table. Thanks Tom. So R double dot I'm going to add a couple parts to it and look at the same thing. We're going to have minus 0.5 out in front as a constant double dot sine theta plus cosine theta theta dot squared. Is that right? And yeah we won't have a minus sign there so that'll look okay. Yeah not theta dot. And so those are going to be evaluated because we know what theta dot theta double dot R, we know what theta is. So like the problem we had before we now know all of the components of each of those two pieces. So find those real quick and then we can make a quick sketch of what it looks like actually on the on the path. I'm not sure just how the path looks with that piece but we can at least get an idea what to make sure that the component directions we've got indicate the kind of thing we've got before. Theta dot is positive so this angle is growing. We know that it's moving down along the path. Should have a path. No that's okay. The path is getting a little bit closer to R as theta grows. It's the cosine decreasing as theta grows up to 90. Alright so we've got V and R all, A all, identify all the component parts. Make some sense? See once we get V and A established after that first half of the class it's a little bit more straight forward. Filled and okay. Alan alright with this? Yep. Good. See any tears? I don't hear any whining. Some of the numbers as we're going. So at this point, oh by the way I'm sorry this is meters. If you put it in feet that's okay. It's just a unit change. It's not going to affect the values of the numbers at all. 3, 5, 4 meters. R dot though are rated which it's coming to or away from the center, the origin. I have that as a minus so yeah it's actually getting closer to the origin and the acceleration. Those are the same numbers you guys got in those ones? The bill was okay. And that's just putting the known angle in and the theta dot and the double dot are just plugging those in. And that gives us everything we need. The six components we need to write out the entire velocity and acceleration vectors. Then put it with the drawing see if it makes sense. You do know that the velocity must be tangential. That does not mean it doesn't have an R component to the velocity because the center of curvature and the origin are not the same points. No it should be positive because it's moving in the direction of increasing theta because we have a positive theta dot. Radial unit vector perpendicular to that and not necessarily parallel to the velocity itself is the theta unit vector. Remember tangential components, normal tangential components are to the center of curvature. This is to some of the established origin in there. Not necessarily the same. They would be in circular motion the same but not in ours. Alan okay? Some matter doing it. Watching your minus signs? Watching your decimal signs. I think it should be the way it looks. No ER is not negative. ER is always away from the origin. The velocity? R dot yeah. R dot is negative. Yeah we already have that. R dot is negative. So it's distance from the origin is decreasing and so it does kind of fit the picture I've got there of it. And it looks like theta dot should be positive which yeah that's what I have. Question Alan? Okay. Looking my faces back to where I wrote those down. So I can't look at the board. You can't see the board? Do I not write big enough? That's not what I said. I've got all of those formulas written on a couple of pages back here. So if I put them up there I know we're going to need them. Do we have a disagreement on the numbers? Don't we agree with Chris? No? You guys are talking. This is something a professor would become a divorce lawyer. Yeah the velocity that's the right acceleration. Yeah I think so. Yeah negatives as always have been are very important. Negative is negatives and units. Watch them carefully. Chris and Phil are you guys okay? Let's see what we've got for the velocity vector. About 812 in the theta direction. Minus, well we have just that r dot up there. Minus the whole point direction. And that's meters per second. The velocity, then that's pretty much what it looks like with my sketch here. So there's theta component, v theta, radial component, not very big and in the negative direction. So v r. So if we break the sketch of the path coming closer as it comes down, it looked pretty good. So nice big drawing is how it plays well. Not working for the post office. And if that is that we come up also with the acceleration vector. 0838 for the theta direction. 0841. 0841. 08. Okay so maybe a little bit around. We'll call it 0848. Theta direction. That's meters per second squared. And then the r direction. 703. Something like that. Give or take a little bit. Meters per second squared. And that, yeah that's negative. So we have an acceleration component. A little bit in the r direction. Very little bit in the theta direction. Oh, it's just getting messy from sketching over there.  I told you this was just advanced physics one. This should be called substitution 101. Yeah. Well this one, it's kind of messy. It started up. Get it going because we had to do those time changing unit vectors. But once you've got it established, then it's pretty straightforward. You just have to watch your minus signs and your decimals for the most part. Alright, so I think you're crying for a problem here of your own. Your very own. Actually I'll save the problem a little bit. Just to get out of class one. And talk a little bit about three dimensional coordinate systems. Just so you can see them. Just so you got a bit of a picture of them. The, of course the Cartesian coordinate system is just like it was before. Where any point we might locate as a z component, a y component, and an x component to it. And then the velocity and acceleration vectors are just time rates of change of any of those components. We did some of those in physics one, so that's no very great departure from what we had before. The normal tangential coordinate system doesn't lend itself quite as well to three dimensions, but the polar coordinate system most certainly does. And I'll tie it to our familiar Cartesian coordinate system just so you can get an eye on it. The polar coordinate system we just established has to do with a point being at some place away from the origin and at some angle as measured from some reference line. So we had coordinates r, theta. Then to add a third component to it we just add a z component. So we have to have a three dimensional space. Then we can use the same r theta and then add a z component to it. And then we can do this very same thing in three dimensional space. And things don't really change other than the fact that we have on each of these for the position we'll have as well on a z component possibly. For the velocity we'll have z dot and for the acceleration we'll have z double dot. So there's not very much more that needs to be done. The polar system once done this way is called cylindrical coordinates because we take the circle that we had in the base plane, extend it up in the z direction and we essentially get a cylinder that way. So it's not known. In three dimensional space it's not known as the polar coordinate system. It's known as the cylindrical coordinate. And then there's a third one that doesn't lend itself very well at all to two dimensions and that's spherical coordinates. Again referring it in some way to the x, y, z plane which is which. But now the location of some arbitrary point in three dimensional space is described with three vectors, the distance from the origin. So we have r as the same as the original component we had before. But then two other angular components. We drop its shadow down to the x, y, z plane somewhere. We see the shadow makes a line something like that. So that's our first angle theta. The angle the shadow would make in the base plane. So we're trying to locate the point A. And then the third coordinate is this angle down from the vertical direction. I guess that would usually be z then. Some third angle phi. And so the three coordinates are r theta and the angle phi. So it doesn't lend. Well if it's in two dimensions just r theta then we just have the polar coordinate system that we started with. Alright we're not going to do much with that one. It's very, very useful in astronomy where the observatory itself is at the very center or if we're talking on greater scale than the Earth center which we all know this Earth is the center of the universe anyway. Specifically the United States for all my foreign listeners. Okay so one last problem. Get out of class question for you. Looks something like this. Alright then we have an arm that barely sticks out of maybe a table top or something and then the main bulk of the arm is parallel to that. And it can rotate around this part of the arm that's perpendicular to the table. So as the arm rotates it rotates in a plane perpendicular to that direction z is drawn. Now there's a sliding error on the arm whose distance to the base of the arm can change with r and that makes some angle with a third dimension theta such that that angle is thinking with time at t cubed radians. Also its distance from the origin is 100 t squared meters. So find v with one second. So back to polar coordinates because this little collar whatever it may be rotates only in a plane and you can find all the pieces you need. You can find it r, r dot, r theta dot, theta, theta dot, theta double dot all at one second. And then you can put them all together get the velocity and acceleration. Just show me the velocity and you can get out of class early. You've got seven minutes to cash in on that exciting offer. Anthony, you can do it.  That's fair game. So you've got theta and r and you can find theta dot, r dot, theta double dot, r double dot and then put it into the velocity acceleration equation because it's at 13.2 seconds. Of course then you notice the r gets really big real quick since it's where it's pretty big two big t cubed velocity. I don't think we've had a favorite student or a million dollar award on camera yet. Nope. Yeah, that looks right. That one's not right. That number up there is not quite right. We'll double check it. Anybody else? Catch your trouble, Alan? I don't know. We'll find out in a second. Are there still a chance to cash in early? Any statement? Any statement? All right. Excellent. Really? Promise? Promise. All right. Nobody has a lot of statements from the year. Got something, Tom? Nope. They are on just one part of it. Who else? No. You and it. I want to see it the other way around. Alan, did you find it yet? 32. Yep. Different. That one's not. Did you get it, Phil? Minus is right, 1800 right, that number is right. What's your misunderstanding? Huh? I don't know. Come on, I don't even give you one second. It couldn't be easier. You'll be able to do it in your head. Yeah. Got one minute, Alan. One minute to fix it. David, you got something? I don't have acceleration for a month, sure. I found this correct. That's a spirit. No, someone's wrong. Yeah. That one's good. Nope, that's worse. Let's see here. Just so you have them. V is 200 in the R direction. Plus 300 in the theta direction. Is that what you got, Alan? Yes. Yeah, what's wrong with it? Billion of time. I'm having unit time. Same thing here. You did not know me well enough, Alan? I had a funny feeling that's what you were doing with me. You made me do it twice anyway. I had it wrong the second time. Theta minus 700 in the R direction. Meter per second squared. Okay. That's a wrap.