Welcome back, everyone. Today, we're talking about how to start a digital forensic investigation with autopsy, and I'm using autopsy4.19.3, but really any version of autopsy4 will be very similar to this. Before we begin, we have to get a couple things ready. First, we need to go to autopsy.com and click the big download button, follow the instructions, it's very straightforward. Next, I recommend you get HxD. It's a freeware hex editor, and it does have integrations with autopsy. A full featured hex editor is much nicer whenever you're trying to dig down into specific data structures. So I recommend getting both of those and installing them, and they do work together. Now, once we have autopsy and HxD installed, the next thing we need to do is set up where our data is going to be located. We don't want to save data to our C drive on our forensic workstation, because we don't want to mix suspect data and our forensic workstation files. So what we want to do is always have a separate drive where you're going to be saving your case data. This could be an external hard drive, it could be a specific internal hard drive set up specifically for your case data, or it could be a network share at your organization. The drive I'm going to be using is the W drive. So again, I'm not saving anything to my forensic workstations C drive, I'm going to be saving everything to my W drive to keep everything separated. In W drive, I have a couple of things already one is a hash set. And we'll talk a little bit about hash sets later. And I have my cases file. So inside the cases file, I'm going to create a new case in most organizations. If we're already in doing an investigation, then a case number has probably already been created for us. So I will create a new folder with a case number. So whatever that case number is, let's just say it was 001. I also like to give it some sort of indicator of what type of investigation I'm doing. That way I can look at the case, I might not recognize the case number, but I can really quickly recognize the tag. So I'll just put like a h here. And for me that will represent hacking, I might also usually include some sort of information like a tag about its location, a tag about the investigator that's starting it, maybe the investigating members initial, I'll just say xx here. So this structure would tell me, for example, case number assigned by our case management system. It's a hacking case. This is the investigator who is looking at it. And then this is the investigating member requesting the case. Come up with your own standard. You want to be able to look at this file and understand really quickly what it's about, even if you don't recognize the case number. And then always use that standard for the rest of your cases, just to keep everything consistent and try to use the same standard through your entire organization. Inside this case folder, I'll create a couple more folders. My basic structure is going to be docs images, temp autopsy reports. While I'm here, I'm going to go ahead and go into docs. And I'm going to create a new text document called case number docs dot text. Now I have my case documentation, open it up and notepad, hit F5 to insert a timestamp and then say case started by. So now we have our documentation notes ready to go. I'm going to go ahead and keep that up for images. The investigating member by this stage has probably already given you images or you're about to create images. So let's say that we have some suspect data. And the suspect data is in exhibit 001. So let's say a computer was brought into you or a thumb drive was brought into you that thumb drive is classified as exhibit 001. So I will just use that exhibit number directly exhibit 001 images, double click on that. And then I already have my suspect data here that's already been collected. So I'm going to move that into this directory. Now all of my image data for all exhibits plus all of my reports plus all of my temporary files and everything like that are in a single place inside this case folder. So if anyone's accessing any of the data, they know that they can just find it directly in that case folder. Everything is constantly kept together and I'm never going to save anything outside of that folder. And I'll have a link to this data below if you want to follow along specifically with my data set suspect data.dd. Next I'm going to do f5 and then say started autopsy four dot 19 dot three, because we need to know which version of autopsy we're using whenever we're processing something to process case data. Now why am I keeping notes like this? This is basically a diary of everything that I'm doing to make sure that I don't forget how I've started everything and to make sure that I'm processing and documenting exactly where all of my data is located. And a lot of this will be relevant to my final report. Go ahead and open up autopsy. And now we have a couple options. First is a new case or open a case. I haven't created a case yet. So I'll do new case, click on new case. And then we're asked for a case name. So I'm going to go ahead and copy and paste the case name in there. And then the base directory I want is w drive cases and then the case name and I'm choosing autopsy as my base directory. That way all of the autopsy case files are stored inside that autopsy folder, click select. So now I have the case number, I have cases and autopsy and then the case type is single user. There's also multi user that's possible. You have to set up a network, including some servers on that network and then multiple people can connect to the same case at the same time and start processing and analyzing different data sources in that case takes a little bit more to set up, but it is very useful in real laboratories. For now, we're just going to do single user, which means everything is going to be processed locally and only you will have access to that data confirm that the case data will be stored in the following directory. I'm going to go ahead and copy this string. And then in my documentation, say f five autopsy case data directory set to this location. So I give the full path consistently. And one reason that I'm using the case number for my paths is because I want whoever's reading these notes to see that it's always in the same directory, I want to be able to very easily show that I'm saving the data in the right location. Next, our case number, we should just put the number instead of the identifiers. And then the examiner, phone number, email, and then any notes about this particular case, we have to include the case number because we want to reference it back to this case number that was assigned by our case management system. The examiner information is necessary because we need to know who to contact if anyone has questions about these cases, plus this will end up on reports. Next is the organization. And this is the organization that you're doing the investigation for. And that way, whenever you're processing data sets across the organization, you can do comparisons of data within that organization. If you need to add an organization, I already have the FBI added here just for fun, but we can just go to manage organizations, click new, we already have FBI, so let's do CIA, point of contact, John Doe, email, phone. All right, so now we have a CIA contact and an FBI contact. So click close, our organizations are set. So now we can select which organization it is that we're processing this case for. Okay, so I'm going to select CIA, click finish. Next thing we want to do is figure out a host name. So a computer can have multiple hard drives in it. So we can specify a host name and then attach multiple data sources to that host. So if you have a network dump, if you have a RAM dump, and you have a hard drive image, you add them under one host. So I'm going to go ahead and specify the host and I'm going to call it exhibit 001. So under exhibit 001, which somebody has obviously already seized and imaged for me, I'm going to add our disk image. So our new host name is exhibit 001. If I had a different computer or another device, it might be exhibit 002 or whoever was making the initial documentation, I would use that exhibit number. Click next. Now we can choose if I want a disk image or VM file. Disk image is what I currently have. It's a raw disk image. So if I go to images, go to our exhibit 001, and I have our suspect data dot DD. DD is almost always a raw disk image. It's an exact copy rather than some type of compressed format like expert witness format. So I have a disk image. This is also a virtual machine file. You can feed it basically a virtual machine disk image directly. Next is a local disk. If I've connected the suspect's disk to my forensic workstation using a hardware right blocker, then I can select local disk. And then I have the ability to pick that suspect disk and read the data directly. This is much, much faster. The problem with this is that that suspect disk, the hardware could go bad while I'm analyzing it. So it's always better to work off of a disk image and specifically a copy of a copy. Next are logical files. If we've only collected files from some suspect device or maybe a cloud service or something like that, we can dump all of those logical files directly into autopsy instead of having an image file. So the way we access these are a little bit different. Unallocated space image file is specifically looking at unallocated space images. And then autopsy, logical imager results. Autopsy does have a logical imager, and you can import the results directly. And there's also X, R, Y, text, export, which is from mobile phone analysis, software, X, R, Y. We're going to do a disk image, click next. And then where is this disk image located? So I'm going to go to browse, and we are in cases, case number, images, exhibit one, and then suspect data dot DD. So that looks okay. The next thing we have is the time zone. I don't necessarily know where this suspect data DD came from, which time zone it was in. Normally it's going to be your local time zone, especially if it's, you know, the suspect was living in your time zone, most likely their system will be set up for your time zone. But if you don't know, I always set it to GMT plus zero, UTC. If you do know, then click on it and then select your time zone from the region. But I'm just going to use UTC here. Anytime I don't know, I always use UTC sector size, keep that at auto detect. Although if you do know it, you can select it specifically hash values. Now hash values are used to do some verification and end up in your final report. So we do want to enter them here. So I'm going to go to the suspect verification report that was given to me, it was created with hash deep, and it has two hash values in it, the MD five hash value and the shot 256 hash value. I'm going to copy the MD five hash value, and you can usually find these in whatever reports was given to you, paste that directly into MD five, the next hash value is shot 256, and copy that and then paste that in. Like I said, this ends up in reports and it can be used to do some image verification later, but it says these values will not be validated when the data source is added. So you have to explicitly verify the source. Okay, click next. Now we have our ingest modules, and this section is how we're going to process the data that we just gave it. So the suspect data dot DD, we're going to pick through it and get out any interesting information that we possibly can. So let's take a look at these default modules, you can add additional modules, and you can even write your own modules if you want to. So the recent activity goes through and looks at things like web browsing, activity, recent documents, recently installed programs, any recent activity from a system, especially a Windows computer, it will try to extract that recent activity and then have a special category easily accessible for the investigator. So this is a good module to always run because we're usually interested in user activities whenever we're doing an investigation. Next is hash lookup. And what this does, we can set hash databases of known good files and known bad files. And with known good files, we can use that hash database to filter files that we know are good, so we don't necessarily want to see them in autopsy. We can also add known bad hash databases, where if any file matches a known bad hash, then it's automatically flagged for us for review. So it makes investigation really easy if we can share these hash values and then it'll help us to reduce the amount of data we have to look at and also flag things that we know are definitely going to be suspicious. I don't have any hash databases set right now, but what I do always check is calculate MD5 even if no hash set is selected. So the MD5 hash value of the files that are being processed, we do want to create a hash value. So whenever we're talking about those files or extracting them, we can give that hash value as well. So make sure that calculate MD5 is checked, it will take a little bit longer to calculate those hash values, but in most cases, it is worth it. If we want to add a hash database, we can go to the global settings button, and then I can either create a new hash set or import hash set. If it's a new hash set, then I need to add hashes manually, otherwise, it'll be empty. And then import hash sets is what we normally use, and I'll talk about hash sets in a different video. The next file type identification, so matches file types based on binary signatures, we can set file types that we want to match in the global settings. So custom mime types, let's go ahead and create a new file type identifier. So the mime type that we want, and in Linux, you can use a command file dash I to get the mime type of a particular file. So I'm going to do file type dash I and then I have a hash database here, I'm going to find its mime type, its mime type is application CSV, I'm going to copy that. And then I'm going to add a signature. And the signature in this case is bytes in hex. I'm going to use xxd with the hash database, and then pipe that into head. So we can get the first bytes here. And actually, this is just a header. So it's not going to be that interesting. But let's say that I know that this signature 2253 is going to be interesting for multiple files. And what I can do is say signature 2253 in hex. And the byte offset here is zero. So I'm essentially looking for a header. And then relative to the start or the end, I'm going to say start. Okay, so now I have application CSV mime type with a signature 2253. And if I find that, I can flag it automatically. So for example, we can check alert as an interesting file when found, click okay, and then I have application CSV and my signature. So you can make custom signatures based on any data structure. If you give a hex or binary value, find the data structure that's interesting, and then flag where that data structure is. It is interesting if you want to do advanced file structure analysis and then automatic detection. Next, we go into extension mismatch director. This one's a little bit more easy, I think to understand. Basically, we have a file signature. And then we also have a file extension. So next I have test dot hwp and hwp file is a hungle word processor file. It's basically a doc file for Korean characters. If we do file dash I test the hwp, I can see it's an application slash xhwp file type. And then we have the hwp extension. So that's actually what we would expect to see. But if I find the xhwp file type and the extension is not hwp, then I know something is suspicious. That's essentially what this extension mismatch detector is doing. So here I can select what types of files I want to check check only multimedia and executable files will make things run much faster. But if somebody is trying to hide a file, you might want to check all file types, they might be naming like a doc file to a jpeg. And then whenever you double click on the jpeg, it doesn't open because it's actually a doc file. macOS and Linux use the file header to understand how to open the file, but Windows uses the file extension. Next go to global settings. And then we can see the file types. This is the file header type. And if we click on PDF, for example, then we can see the extension that we will accept. I know that hungle word processor is not usually in the extension mismatch identification setting. So I'm going to add hungle word processor, I'm going to click new type. And then the mime type that I want is application xhwp, and then paste that in. Okay, application xhwp. And then I want to add a new extension that's acceptable. And it's hwp. So now, if it finds an application xhwp, and it doesn't have a hwp file extension, it will flag it as a suspicious file extension. Click okay. Now we have our extension mismatch detector. Next embedded file extractor. This is fairly straightforward. There's a lot of files that are actually compressed, like zip files, essentially. And what this will do is go in and decompress everything, take everything out of the file, and then index all of the files that were inside the compressed file. So we want to keep that checked pretty much all the time. Picture analyzer, same thing. We're looking at images and extracting things like XF information from JPEGs. XF information is really useful because it might have locations, it could have timestamps, it could have, you know, editing programs that were used to modify the picture, the camera settings. So we definitely want to keep picture analyzer. In most cases, it's very relevant. Next is keyword searches. And you can do quite a few things with keyword searches. By default, they have phone numbers, IP addresses, email addresses, URLs, credit card numbers, and credit card numbers, URLs, email addresses, and IP addresses are all fairly universal. Phone numbers by default are set up for the US style phone numbers. So you might want to modify that if you're looking for other phone numbers. By default, it's also only looking for Latin basic. So we will need to modify that if we want to support other character sets. Okay, then we have the option to enable optical character recognition. And this looks at images and attempts to extract text from those images. Really, most of the time, we want to turn on optical character recognition. The problem is that optical character recognition takes quite a bit longer. So if you enable it, it will take longer to process all of this. But you will be able to search for images with text in them, which is extremely useful in most cases. If you know you're looking for certain types of keywords, make sure you select these boxes. I usually turn on optical character recognition because I found it so useful. And then now we need to go into global settings and configure some settings for this. What we can do is set up first our keyword lists. So I might create a new list. And it might be called, for example, drugs. So I want to search for any keywords related to drugs. And I can add as many keywords as I want here. And I can do, for example, a new keyword. So I added two keywords here. And then I can do exact match, substring match or regular expression to make sure I don't get too many false positives. I'm going to do exact match. You'll get a lot fewer results, but also fewer false positives.  Regular expressions are an advanced form of pattern matching across keywords and extremely powerful tool in digital investigations. We'll just do exact match in this case, click okay. And then we can see the keywords that we have associated with our keywords list. As you do more investigations, you'll find there are patterns and keywords that you get for certain case types. Whenever you detect those patterns, create a new keyword list for that type, and then add those keywords to it, and then reuse it in all of your cases. It will save you a lot of time. If you're just looking for English keywords, just click okay. But before we leave, we can go to string extraction. And this is where we can select other character types that we want to include. So for example, I sometimes search in Hangul, Korean characters. So I'm going to enable Hangul Korean character sets. And you can also enable a lot of other character sets. So if you're trying to search for any other character sets using keyword searching, make sure you enable this first. And this is a global setting, it will be there for the rest of your cases. So make sure string extraction, you're selecting the alphabets you want to use, and then lists, make sure that you create lists for any keywords that you know tend to show up for certain case types, click okay. Next is email parser, and this just parses out PST or OST files and any other email types that it can try to find. So we usually want to keep that enabled encryption detection. This tries to find encrypted container files using entropy testing. This takes a very long time. If you have a good reason to suspect that encryption is being used, you might want to keep it on. Otherwise, if you uncheck it, it will save you a lot of time. Interesting files finder, you can set up what you think are interesting files by default. We have cloud storage, cryptocurrency wallets, encryption programs, and privacy programs only for Windows hosts. So this is by default set up for interesting files on Windows. If we want to change that, we can either select which categories we actually want to include or go to global settings, and then we can see each category and add or remove programs to it. And we can also create a new set of what we think are interesting files. If there's a program or set of programs that you're looking for, and they're always involved in the cases that you're investigating, you definitely want to make a filter to automatically scan for them using these interesting items settings. Click okay. Central repository. This is a really interesting feature in autopsy. What this does is creates a local database that keeps track of some of the files and activities that you've seen in past cases. If there's a file that you flag in one case, there's another case that you don't think is related to the first case. Central repository can pop up and say, hey, you've already seen this file and you flagged it in another case. Do you want to take a look at it now? So it can really help you to find patterns over cases. So I highly recommend using the central repository because it can show you when there's connections to other cases that you might not have known were there. Now, none of the original suspect data is saved. It's all going to be via hash value. So a hash value of file is going to be created stored in the central repository and logged which case it was involved in, but you won't be saving original suspect data. Now we have central repository. We can save items in the central repository. I highly recommend you do it. And then we can do things like flag items previously tagged as notable. So if we've seen them in a past case and tagged them as notable, then flag them. And I would definitely check that flag devices and users previously seen in other cases. If you've set up and you're managing devices and users across cases, then I would select that just so you know if they're related to this new case and then flags, apps and domains not seen in other cases. So what this can help you do is find applications that you've never seen before, which basically helps you to focus in on things that are unique to this case. So I would also select that. This is such a useful feature here. Next is photo rec carver. And this carver is used to find additional data that has been deleted or unallocated, removed, whatever, it will try to carve out any of that data and then basically present it back. So we have a couple options here, keep corrupted files or focus on certain file types. A lot of people just want to focus on, for example, JPEG PNG or zip.  The photo rec carver is basically for deleted data recovery. It's a really interesting program. Next is the virtual machine extractor. If the image that you're analyzing has a virtual machine inside of it, the virtual machine extractor will extract that virtual machine and then treat that virtual machine as a separate disk. So it's very similar to the embedded file extractor, except it's specific for virtual machine files. Next is data source integrity. And this is calculating the source hashes verify existing data hashes verify data source integrity is just verifying that the hashes that we're dealing with are okay. Remember, we already copied in the MD five and shot 256 hashes. So it will try to verify against that. Next is Android analyzer. Our disk image does not have anything to do with Android. So I'm going to uncheck that. But if you are analyzing an Android device, make sure it's selected. A leap is a great tool for parsing out Android data structures. DJI drone analyzer. We're not looking at drones today.  I usually keep it unchecked because it does take a long time to run and they do say that it duplicates autopsy modules. If you want to be very thorough, you can enable it but it will take much longer to run your processing. Yara analyzer. Yara is a really interesting pattern matching tool. We can write Yara scripts to try to analyze a file structure and then flag those files. It's really similar to file type identification. We use it a lot for malware analysis. So if you're doing any type of malware analysis, people share Yara scripts or Yara patterns. You can just add those Yara patterns to autopsy and then detect new malware in a system. It's really interesting. Next iOS analyzer using iLeap. We're also not looking at iOS devices like iPhones. So we're going to leave that unchecked. And then GPX parser. If we do find any GPX files, then we can get some potential location information. I know there's not any in our image, but it won't take that long to analyze. We also have another Android analyzer. So again, if you have a Android suspect image, then you want to select those are all the default modules. You notice that I kept most of them on, but I try to remove anything that I know that I don't need or that's going to take much too long. So the more modules you enable, the longer processing is going to take. Usually we want to find a good balance between processing everything and taking a very, very long time. So if you don't suspect encryption, remove encryption detection. If you're not analyzing Android devices, remove Android device analyzer, things like that. Just be conservative with how you're running your modules. So now we've selected everything we want to select. We can click next. And now it starts to add the data source and starts processing. You can see in the back, we have some messages popping up and we have this progress bar. If I click finish, the progress is going to be really quick because this image is very small, but now it's processing and now it's done. A normal disk image will take a very long time. So you can expect like a one terabyte hard drive of a normal Windows computer to take at least several hours to process and sometimes up to 24 or maybe even more. We have our data sources. If I expand that, we have exhibit 001 and that is the device name that I gave it. And then I have one hard drive under exhibit 001 called SuspectData.DD. If I select SuspectData.DD, I can also expand it and see the file structure, or I can see the files in this main view. In the main view, I can see things like the file name, special attributes, modified time, change time, access time, size, any flags, MD5 hash, SHA256 hash, MIME type extension and the location relative to the disk image. If I click on any of these files, then I get the main view in the bottom, we're in the application view where it tries to show what the data actually looks like. We also have the hex view where I can see the raw data of the image plus the ASCII view next to it. You notice whenever I'm selecting this, I can launch an HXD if I have HXD installed. So if we click that, then HXD pops up and I get a lot more flexibility in searching with a hex editor like this. So next I have the text view and we have the indexed text. So this is information about the indexing and the file itself. If I go to strings, then these are the raw strings that I find in the text that are also indexed and I can do keyword searches over. We can also go to file metadata and see everything like modified time. Again, it's in UTC because that's the time zone that I set other occurrences. So if we've ever seen this file before, if I have correlation set up, we can know when this file was seen. So in case X that I had previously, I had source name, suspect data dot DD, it's the same suspect image, we have the same file name and hash value. So I have seen this before in a prior case. So once I see this, I can say that maybe our current case and case X are related, especially if this file was a suspicious file. Okay, so other occurrences can be interesting whenever we're looking at suspect files. Most of the time you're going to be looking at things in application view or hex view. At least that's where I spend a lot of my time. So we have our data sources tree, we have exhibit one, and we have one image under exhibit one and suspect DD. We have all of the files available in the file view. And then whenever I click on them, I have the detailed view in the bottom. And most forensic tools are set up in this kind of workflow. If I was processing a bigger case, we'd also have a lot more things showing up over here. So let's go ahead and look at these views first. So under file views, we have some filters that are automatically created, we can filter for example by extension. So images based on their extension, we can also do documents if there's any documents in the folder. So many times in investigations, we want to see all of the images in the system or all of the documents in the system. We don't really care where they're located, but we need to scan through them to see for example PDFs and see if anything suspicious. So using these filters is a really quick way to focus in on just the file types you want. We also have executable file types as well, like maybe we want to know all of the .exe files that are in the system and then just look for anything suspicious there. After that, we can also do it by MIME type. We've talked a little bit about MIME type so far, so we can either do applications, images or text. So same principle as by extension, except this is using the file header instead of the extension. So next is by deleted files. So we can have files deleted from the file system that were able to be recovered or at least partially recovered. And we have all data that was recovered, whether it was in a file system or not. But under file system, we have four items. Under all, we have six items. And you'll notice that those four items are also in the all items, but we have these two extra carved files that are available that were probably carved out of unallocated space. If you have carving enabled, you might see more in all. Make sure you check what data has been carved. Next, we can also filter by file size. So by default, we can do 50 to 200 meg, one gig and one gig plus. So sometimes it's interesting to filter and say, hey, only show me the devices that are over one gig, because maybe they're encrypted containers containing a lot of interesting information. Or, you know, if you have an Excel file that's like 16 gigabytes, that's very suspicious. So you might just want to take a quick look at anything over one gig. And sometimes it can lead you in a direction. All these are meant to give you a quick view into odd situations and odd data that might stick out at you. Next is data artifacts. I didn't have very much data inside this disk image. So we don't really have any data artifacts that were carved out, but every all of the ingest modules that we selected, if any of them got a hit, it will show up in data artifacts or analysis results or OS accounts. So since we don't have an operating system on this disk image, they don't show up here, but this is essentially the filters that will show all of that information. So one workflow that I normally do, once an exhibit's been added, we have our suspect image and it's been indexed, processing has mostly been done. Then what I tend to do first is keyword searches. We might have already had our keyword lists, but now I'm going to do keyword searches specific to this case. Keyword lists have general keywords that might be relevant to a similar case type. Keyword searches will be specific to my individual case. So I know, for example, that this disk image has something related to cats. So I'm going to do cat. I'm going to do an exact match. And then I want to search suspect data dot DD, and I'm going to save the results. So I'm going to click search. And then what happens is we have our analysis results. We have our keyword hits for cat show up. So the string literal keyword search, we can expand that. And then we have our search for cat, and it's a string literal. So now I have a filter set up for that particular keyword. And now I can go through and look for anything that I think, you know, might be interesting. So let's say that I think this image is interesting. The next thing that I would do, if it's related to our case, is right click on it, and go to add file tag. If I know it's related to the case, I would probably do either bookmark or notable depending on what type of file it was, depending on how it was related to the case. So let's just go ahead and bookmark it. And then we find another picture. Let's say that I know that this image is definitely related to the case, and it is notable. So I'm going to add file tag, and then go to notable. What we tend to do is tag items that are related. That way we can filter out the related things and then build our story around those tagged items. So your report will refer to those tagged items, and then say why they're relevant to your case. All right, next. So keyword search cat, it gave us eight results.  So I'm not going to save the results search, and a new tab is created. So in this search, we got 10 results in cat, we got eight results. And the difference is when keyword searching doing exact match, cat must be by itself. So you can have dash cat, and it can be capital or locate or lowercase, but it must be essentially on its own. There can't be other characters around it except things like dashes or something like that. But with a sub string match, we can have things like cats. So cat is a sub string of cats. So we actually returned two additional results by using a sub string match. So let's say that this one might be relevant to our case, but I'm not really sure if it is. So I need to come back to it. I'm going to add file tag to follow up. So I tend to go through everything and tag everything as follow up, unless I absolutely know it's relevant to our case. And then I'll mark it as notable, but I use follow up a lot. And then I go back again, once I've done my preliminary examination, and then we'll follow up. Now you might be thinking, why am I tagging things? Well, now I can close these searches and we can go into this tags folder. And in the tags folder, I'm going to expand it under bookmarks. I have one picture bookmarked, and then I have the picture view. So I can access that picture directly along with all of its data for follow up. Same thing. So I can go back to follow up and say, oh, all of these could have been related. Now I need to do a little bit more analysis on each of them. And I have access to them directly. I can right click on a file, I can do, for example, extract a file and then work with it in other tools if I need to, or I can just start to do some analysis on it directly. I can also see a text view and everything just like before. And then the same for notable items. I already have notable items. And then I can start to use this to build up my report. I can say that these are related and also how they're related, how the suspect was using this data. When did the suspect access this file? When did the suspect download this file? Things like this are what I'm going to need to answer in my report. So I would start to use tags for images and then probably go into like Windows registry artifacts and things like that to try to get user activities to say what this user was doing with this file. So we did a keyword search, we started tagging things based on the keyword search, we found one bookmark, one follow-up, and then one notable item. So the next thing I might want to do is go to generate report. And what this will do, there's a couple different report types, but the most basic is going to be our HTML report, click next. I'm going to process the suspect data dot dd, click next. And then I want to do which data to report on, we can either do all results, all tagged results, or specific tagged results. So I'm going to do specific tagged results and I want to make a report that includes books, marks, and notable items. So I'm going to uncheck that, click finish. This will generate a report about our data that we've already tagged. If I click on this link here, I can see the report file and it has some of our metadata from one of we started the autopsy forensic case, all of our locations that should match our documentation. And then on the left hand side, we can see tagged files. And we have our bookmark, which is one of the cat pictures with its metadata. And then the notable item also bookmarked with its metadata. And if I click on any of those links, then I can see the file directly. So it's been exported with our report, I can get this kind of overview. So I would have all of my notable images, for example. And if I click on them, I can access them. I can now copy this report out and give this to anyone who I'm reporting to and say, here's the things that we found that are notable. This fits along with the report that I'm writing. So my final investigation report, I can refer back to these images in this exported report file and say, here are the images that I'm referring back to, please see them in this report. Now if we open up our directory structure again, I am going back to our case folder, go into autopsy. And then we have our case file for inside autopsy. And I have our reports folder. And our report that we generated are in this file directly. So the report plus all of the content, which are all of the bookmarks images, everything like that thumbnails that were created. So all we have to do is make a copy of this folder. And I'm going to take it out of the autopsy folder and then put it into my reports folder. And then I'm going to name this supporting evidence. So supporting evidence. So I would have some sort of like word document or PDF for my main report article, like the write up of my report. And then I would be referring back to this supporting evidence inside these HTML reports. With the HTML report, it's very easy for people to see exactly what you're talking about. And then I would also potentially include these images in my report while referring to this case. Okay, so once you're done with your report, go ahead and click close. And then under reports, you can see the report that you generated and when you generated it. And then if you right click on it, you can also open report and then get the report back. So so far, we've added a data source. Once it was done processing, we did a keyword search for cat and found some responsive files to cat. We also looked at our file views, our analysis results for search terms, we tagged a few items, and then we generated a report based on those tagged items. And that's really a workflow that will work in most investigations. There's also quite a few other tools that are useful here for this data set. The one that's probably going to be the most interesting are images and videos. If you click on that, we open up a new utility. And this will give us a gallery view of all of the images and also let us flag things really quickly. So if you deal with a lot of images and video, this image video gallery editor view really helps. So really, if you can add a data source, do some keyword searching, sort by images and videos, and then do some filtering. If you understand about tagging items, and then if you can generate reports based on things that you tagged, then you can do at least a basic investigation. That's really all it is is loading up the data, searching through it, usually using keyword searching first, and then finding anything interesting, flagging it and then building a story around those things that are interesting. Usually the story is about why a user was doing a specific thing. So that's it for today. Thank you very much.


Have you ever heard the saying, the person who cares the least has all the power in relationship?  The reality is, is there are plenty of men and women out there who are playing games. And I wanna lean into this conversation of game playing because I want everyone to avoid this before it ever happens. So we're gonna talk about the different types of games men play. And then we'll give you a suggestion of how to avoid this in the future or at least get them to stop. And it looks like my phone is still on so I wanna turn off the volume on this. So the first one starts with a man who says, I want a relationship. And then later he starts being very inconsistent in his pursuit of a relationship. Now, I think ladies, what you have to recognize in the very early stage of dating is to determine what is a relationship? In other words, decide what a relationship looks like for you and then try to assess what a relationship looks like for him. What I mean to say is if a relationship looks like this to you and a relationship looks like this to him, do you know what that space in between is called? That's called drama because you're wanting to have him step up to the plate. So it's critically important in the very early stages to determine what does a relationship look like for you? Now that might be a confusing question to a man. So you have to answer this question for yourself. Now I've always said in my videos if you watch my content, I say a healthy, happy relationship looks like this. We do social activities, we do hobbies, we do mutual interest, we have these things together. We spend time with family and friends. We travel together. We have teamwork building skills both in our personal and our professional life. We have intimacy, both physical and emotional intimacy that is leading towards moving in together or getting married. That's a form of a relationship. Oh, I forgot to mention the beginning, spending three or four days and nights a week together, okay? Now that outlines a blueprint of what a relationship looks like. Now of course that's not gonna happen on the first date, second date or third date, but if two people decide they wanna explore a relationship together, then having a blueprint and outline some understanding of what that looks like very early on avoids the confusion and it stops him right in the tracks of not pursuing you if what you want in relationship is different than his. Now here's something critically important. I wanna invite you all to do in the very beginning. Never share your relationship desires without hearing his desires first. Okay, why do you wanna do this?  Then it's flat or you both agree, wow, he wants a relationship. So then you follow up with the question, what does that look like for you? Again, he might be in the deer and the headlights, but I invite you all to probe a little bit deeper. I might invite you to probe the question, what does commitment look like for you?  That's the real follow up to a question is, what does a relationship look like for you? And then you outline yours. Now here's the thing.  Now, you might be going, well, I don't wanna scare a man away. Yeah, actually you do. You wanna scare the wrong person away as soon as possible. Here's the thing. When you're interacting with a quality man and what I mean by quality man, I simply mean a man who's got his act together and he desires a commitment, committed relationship. He's got his act together. He desires a committed relationship. Those are two of the most important qualities or desires, well, let's again, those aren't qualities. Well, he's got his act together. I get that's a quality of responsibility. He desires commitment that demonstrates intentionality. Okay, let's go with that for a second. What I mean to say is most of you are hyper focused on the stats. Does he check the boxes? Instead of simply, does he have his act together and does he desire a fully committed relationship?  So we talked about the guys who say they want a relationship and then their actions don't say otherwise. And the sad part of that, why that's game playing is it's playing with your emotions. See, I wish I could be there for you on a first date.  I'd have the shotgun at hand and pointed at his face and saying, what's your intentions with my little sister? See, asking someone's intentions, especially if it's someone he's accountable to. See, that shotgun in his face is there's a consequence for messing with someone's emotions. There's a consequence. See, today there's no consequence for using someone or playing games. There's no retribution. There's no way to make him pay for his crime, so to speak, because, and by the way, there is no crime, except the crime of maybe being uncertain of what they want. See, it used to be if two people wanted to have sex, they had to get married and there was a consequence if you ended this relationship usually. So coming back to game playing, first, how do you avoid game playing? By being more intentional from the very beginning and watch out for these clues, the person who says he wants a relationship and just remember, a lot of people can say they want a relationship, but do their actions demonstrate this over time? Now, there's another class of men out there. These are the men that lead with I'm a broken person. I'm a broken person. See, what a broken person does is they're playing games. They want all the goodies of a relationship. They want that occasional companionship. They want that occasional connection. They want that occasional sex, okay? But without any real desire for commitment. See, when a person says they're broken, they've literally said, I have an exit clause. I've got a way to escape from this because I've already set up my exit route with you by telling you I'm broken. What do these men do eventually when they want to end a relationship? They say, look, it's not you, it's me, I'm broken. Pay attention to the broken guy. These are men who typically, the ground underneath them doesn't feel solid. They have a contentious relationship with an ex-spouse or they have challenges raising their children. That's one thing. Number two, they've got professional issues going on in their life, okay? Maybe they've got a chaotic boss at work. Maybe they're going through some financial struggles. Remember I said earlier, got their act together?  See, for the age demographic that I talked to which is midlife, which is after baby making years and before retirement, a significant percentage of the population has health issues. And so it's important to recognize that this will affect your long-term relationship with someone, okay? So coming back to I'm a broken man, well, a lot of times they use that as their escape clause because something, as I said earlier, the ground underneath them doesn't feel solid. So pay attention to the men who do have their act together. Now there's another type of game playing which is always I'm busy, I'm busy, I'm busy. I have a busy life. I'm always busy, I'm busy, busy, busy. I'm busy with work. I'm busy with my children. So you have to ask yourself, remember I said earlier the type of relationship you're looking for and what they're looking for? Well, certainly if people have a busy life, do they have a capacity to build a relationship with someone? Now, did you hear the critical words I just said? Build a relationship with someone. Build a relationship with someone. Build a relationship with someone. Why am I repeating myself? As many of you are experiencing a relationship where it's just surface, you're just experiencing life, you're not actually building something in those very early stages. See, we almost have it backwards here. We spend a significant amount of time together, could be years, before we actually engage in building something together, developing roots together. Now some of those roots might be like what in my situation with my sweetheart, Marie and I, we chose to move in together, we signed the lease together. There are some roots when you do that. What types of roots are you building with another person other than just spending time with them? Many of you know my narrative between the users, the spenders and the growers. The users, the spenders and the growers. And then roughly 20% of the population of men and women alike are users. They're using somebody for their own benefit, okay? And these people oftentimes are completely unaware that they're doing it. They're just very self-centric human beings, okay? Now the growers and the builders, that's another 20% of the population. Those are people who want to build a relationship with someone. And the vast majority of men and women are in the middle. They're the spenders. And women tend to be, they desire commitment more, but they still fall in this category of spender because they're accepting a spender instead of accepting a grower and builder. Now a spender is a person who spends time with you. They just spend time with you. They want that occasional companionship, occasional connection, occasional sex without any real commitment. Women do this, men do this. Doesn't make them bad people, it just makes them human beings. What really is incumbent upon you is do a better job choosing. And if you need some support with that, right here is a link, the schedule of discovery call with me to see if working with a coach is right for you and there's a link below as well. My area of expertise is to help you design the questions based on your personality to ferret out the users and the spender so quickly because they represent 80% of the population. These are the people that will unintentionally play games.  And yet to some degree, if you're complicit in this relationship without doing your due diligence and doing your job of not just pre-qualifying your prospect, but remember, this person's your intern in the beginning of the relationship. He's got to earn the right to be in this relationship with you. And yet many of you are happy being a friend with benefit and you just don't know about it. See, it's incumbent upon you to do what I'm about to share in a moment to change the narrative. And remember, there are plenty of men who go hot and cold. That's another way of playing games with someone. So I made a note here, I just wanna share with everyone, games happen for a few reasons. Now the first one, he's just simply a player. Players oftentimes are very swabbed, they're very charming, they have financial resources, they have many options. These are the people that can swipe, swipe right all the time and get plenty of women in their funnel, okay? I'm not saying all men are this way, but certainly those that are swabbed, charming, have the financial resources and have lots of options could be game players, that's why they're called players, okay? Here's the tricky part. See the vast majority of men play games because they like you, but not enough. That's right, they like you but not enough, not enough. In other words, they haven't feel in their heart of hearts that you are someone special in the very early stages that they want to have a long-term relationship but they like the idea of your companionship, they like the idea of the connection with you and they certainly like the idea of being physically intimate with you. See, I don't think men intentionally use women, I don't think they even intentionally play games, I think there's a real confusion for a significant percentage of men in midlife is because we are swim, listen, roughly 75% and this is anecdotal of people over 45 years old that are in the dating marketplace are divorced and men in particular are gun shy to fully committed relationships. They're gun shy and because of that gun shy they're one foot in, one foot out and this is why they play games, this is why they're hot and cold, this is why their actions don't consistently match their words or as I said earlier, maybe they've got the ground underneath them doesn't feel solid and as Lisa just said so many guys are clueless as well. So what did I make notes? So if a man's been burnt in the past, he could have trust issues, he could have commitment issues. Certainly that's his past relationship. What about his childhood? He might have had abandonment in his childhood. He might have had a contentious relationship with his parents that can make them also gun shy. See men in their 20s and 30s have a different type of gun shy going for them.  So I wanna offer you an antidote in a moment but before I do, I wanna read a line from the movie Vanilla Sky, Vanilla Sky. This is for all the men to listen to this right now. The movie Vanilla Sky, this is with Tom Cruise, Vanilla Fee Cruise and Cameron Diaz. And there's a scene where Cameron Diaz is driving in a car with Tom Cruise. This is someone they've been physically intimate with each other and she's driving erratic cause she's angry at him. And there's a line she says the following.  Your body makes a promise whether you do or not. When you sleep with someone before trust has been built you're gambling, he's an honorable man. Men can seem so charming and decent but the only way to stop being played is to avoid players and wounded men by making them jump through more hoops. That's right, when we're swimming in a sea of players, of users, of those spenders I've talked about, those dysfunctional men, you have to make them jump through more hoops before you become physically intimate with them. So I wanna lay out something I talk about in my private coaching and that is radical honesty, laying your cards on the table and the rules of engagement. That's right, radical honesty. This requires being vulnerable, authentic and transparent. In other words, it's cutting through the BS right from the very beginning by establishing deeper conversations before you become physically intimate with someone. In addition, laying your cards on the table is talking about your past relationships. Each one of you talking about your past relationships. So it's like going on a job interview and the interviewer asks for your resume and you've worked at this company, you've worked at this company, you've worked at this company. Now, keep in mind they're only gonna hear a one-sided version but you have to say why did you leave this company? Why did you leave this company? Why did you leave this company? Ideally, you'd like to be able to talk to the company owners, each one of those companies to find out about those past relationships. So you have to remember that they're gonna give you their own version of events. However, through that version of those versions of events, you can actually determine what was the real reason. This is something I talk about in my private coaching as well. Ladies, you have to become more of a detective. You can't rely on what the person says on face value. Why is it important to lay your cards on the table? The best predictor of future events is usually past behavior. That's right, that's usually a good predictor of future events. What's the definition of insanity? Doing the same thing over and over again, expecting different results. So it's imperative to ask questions about the past relationship and then rules of engagement. Rules of engagement is simply laying out the standard you're looking for in a relationship and setting boundaries. So for example, the standard I said earlier, we spend three or four days a night a week together, doing shared activities, hobbies, mutual interests, spending time with family and friends, traveling together, teamwork, building skills, both in our personal and our professional life. That's a standard. See, that's laying your cards on the table right from the get go. But Jonathan, I'm just supposed to sit my feminine energy and let him lead because men are the provider and protectors and they're supposed to lead, they're gonna wanna take care of us. What bizarro planet do we live on? This whole narrative about men or provider protectors, how many men after divorce saying that's the last thing I wanna do for a woman? See, that might be somewhat instinctual in the very beginning, but we're talking about a demographic of human beings. As I said earlier that are gun shy. They might be going through contentious problems in their financial area of their life. So you gotta let go of the old paradigm and recognize what we're dealing with today as an example. In addition, you've gotta determine the virtuous men, the decent men versus those broken men. And as I said earlier, roughly about 80% of the population is broken to some degree. Some people are worth working on, but just remember, you might be investing in a money pit as an example. Is this making sense? Is this resonating with you? Please let me know. So it's imperative upon you to lay your cards on the table. It's imperative to ask better questions. I recognize you would all like to have first aid is, just go have fun. It's all about having fun. Just have a good time. Most dating coaches will tell you it's all about having a good time. I'm suggesting something different. Do you ever watch the Indian matchmaker or the Jewish matchmaker on Netflix? Do you know their job is to vet the person before they ever match two people together? So during this vetting process, if the matchmaker has done their job, they've actually asked those important questions. So when they get together, they can have a good time. But do you know what also happens in these cases? Part of the dating process is to sit with the parents or sit with the family members because it's their job to vet as well. You see, if we're not doing that, you're gonna have to do that for yourself because I wish like I said earlier, I could be there for you. I have that shotgun at hand pointed at that guy's face. You have to do that for yourself. Now it might be a turn off, however, let me just say this. The men who have their act together and the men who sincerely want a fully committed relationship, they actually appreciate these deeper questions. They appreciate that you've actually thought this through and you can actually have a deeper dialogue because intellect is critically important in relationship. Certainly emotional connection is important in a relationship as well as sexual connection. But intellectual connection, when you're actually asking deeper questions, it allows the man to connect with you at that intellectual level. I know you've heard it before, men are logical and they're the thinkers and women are the emotional. That's why you ask questions. It does trigger their brain, but it also requires them to at least be honest with themselves and if they are a decent guy, they might pull back because they know they're gonna hurt you. And that's how you get them to stop playing you right from the get go. Is this sinking in? Is this resonating? Please let me know. Hey, I'd like to hear your thoughts on this. Post a comment below. If it did resonate, please hit that like button. Please share this video. Please subscribe to my channel and hit that notification bell so you can be notified of future videos. All right. I think this will be a good place to start our Q&A. If you're familiar with my format and you have a question, write the word question and post the question there after. Or you can purchase a super sticker super chat with the dollar sign in the chat box. All of the monies from the super sticker super chat goes to a scholarship fund in the name of my son Connor Asley. That's him right there. It's my son who passed away almost five years ago in his honor. We donate to causes like the Hoffman process, Insight Institute and Seeds of Love which supports children who are terminally ill and they've been abandoned by their parents in Columbia where my sweetheart is from Cartagena, Colombia. Has anyone ever been there? All right, it's time to take questions. By the way, for everyone that sent me those sweet well wishes yesterday, I wasn't feeling well. I got vaccinated for the shingles vaccine and boy, did it wipe me out for two days. So I'm about 80% today but I wanna thank you all for those kind messages. So thanks so much. All right, I see Camille has written a question. Any idea about older men and what they do expect in relationship when they reach 70 years old, especially after a divorce with a toxic wife, loss of income, are men manipulative still? Well, all right, let's be real about this.  The average age expectancy is 79 years old. So he's roughly only got nine years of life expectancy or less at that age demographic. So does that person really want a fully committed relationship? Probably not. I mean, some do, but probably not. Or maybe it's the opposite. They want to, I'm saying there's one version of males that just say, look, I don't wanna make a full commitment. Someone I've got assets, I've got inheritance that I wanna leave for my children. That's a group that does not. There's another group that, look, I'd like to be with someone my last days. They want that companionship. They want that connection. So there's that group of men as well. So, but you have to recognize that when the days in front of you are shorter, the decision making is completely different than the decision making when you're in your 20s and 30s as an example. When someone in their 20s and 30s, they might want to have children and raise a family with someone. When they're in midlife, they may want some, you know, when someone's in their 40s and 50s, they may, they've still got a good 30, 40 years in them possibly.  But when you get to 70, it's a whole different ball game. Now, are men still, men manipulative still? I don't like to start with that perception of men. I've certainly, if someone who went through a toxic divorce, he's probably gun shy. He's probably hurt. He probably doesn't know what he wants. Okay. I wouldn't characterize that as intentional manipulation. It might feel like manipulation because he doesn't know what he wants. So he says one thing and acts a different way. Is he intentionally playing games with you? Probably not. But I want to recommend something to you. Is to be radically honest with someone. One of the chapters in my book, what the heck has self-love any way of journey of personal development, self-help and spiritual work. There's a link below to get a copy of my book. Speak your truth, do it with kindness. Why not be upfront? Just like what the woman said in vanilla sky.  Why not just simply say, you know what? I'm catching feelings for you. Are you genuinely and sincerely have my best interest at heart? Remember what I said earlier? When you sleep with someone before trust is built. See trust isn't just about fidelity. Trust is, do you have my best interest at heart? Do you have my best interest at heart? Now, of course we have to have our own best interest but it's equally important to determine if someone has your best interest at heart before you physically are intimate with them. Now at age 70, people aren't having as much sex as they did in their 20s, 30s, 40s, 50s and even 60s, okay? But I wouldn't characterize them as manipulative. And I hope that gives you some context or at least some perceptions of what I think about men in their 70s. Thank you so much for asking your question. All right, Lisa's in the house. We haven't seen you in a while, Lisa. How soon should I tell someone I'm a cancer survivor? I've been doing it early but maybe I'm cheating myself. What would you say? Well, I've always believed is knowing that you have cancer material to the relationship. How material is it to the relationship, okay? Now, when you're beginning to date someone, I don't think it's very material to the relationship.  I'm gonna say, if someone told me they had cancer and they beat it, I'd probably find out how likely are you to get it back again and just recognize that there is a risk that you take with someone that could have a reoccurrence. So whether it's, you know, I mean, and I'm not trying to put you at a disadvantage here. I'm simply saying that is part of the decision-making process. Most of you all know, I've shared this before, my sweetheart, Marie, on our first date, I noticed her hands shake a little bit. And she has what's known as benign tremors or familiar tremors. And I was speaking to one of my dear female friends about this before, I think it was before Marie came to visit me, or it was maybe after our first visit. I don't recall, it might have been after. And I was talking to my dear friend about this and says, hey, Jonathan, before you get involved with someone, you should know how serious that is because that might be a significant ailment that could be worse. And do you want to invest in someone who could turn into Parkinson's the next day as an example? Now I'll be candid with you all. I thought about for a moment, I Googled it, but I liked this person so much that it didn't bother me. I thought, if even if all I have is a year with this person, that's what I thought, or with her, that would still bring me a lot of joy. So before you cheat yourself, ask yourself how material is it to the relationship? And certainly explain it in such a way to give them some reassurance that you beat this. At least that's the way I would approach it, okay? Hope that helps, thanks so much. Oh, one of our Facebook group members says, Cartagena is beautiful. Yes, I agree, I've been there. By the way, if you're not familiar with my group called Midlife Love Mastery, there's a link below to join my private group where you can have access to me on a regular basis. I shoot videos for the members of the group based on the questions. We have a Facebook page and we have a once a month webinar where you can talk to me directly on the phone. So check out the link below. And Gigi says, the shingles vaccine nearly did me in. I agree, it did the same for me. All right, Gigi goes on to ask, what are the signs that he is worth working with? That's a great question. I think, coming back to what I said earlier, does he have his act together and does he seem genuinely committed to the idea of a fully committed relationship?  And asking the deeper question, what does commitment look like for you? What does a relationship look like for you? I think those are really two important questions to ascertain from someone. See, the problem is when we're meeting total strangers these days, we know nothing about them. We don't know their family, we don't know their friends, we don't know their backstory. So it requires us to be a bit of a detective. Like I was sharing before about interviewing someone for a job. Keep in mind, you're only getting one side, one version when you're doing that. So what can we do? What about looking up there? Do they have a Google footprint? Do they have a social media footprint? Try to dig a little bit further into their life beyond the surface. Because the reality is, is when you're meeting a stranger, you've got to take on face value, everything that they say to you is actually valid. You see, think about this for a second.  The reality is, is for most people in midlife, they're fudging in some way, shape, or form because they don't want to be rejected, okay? How else do we fudge in our lives so we don't want to be rejected? I know some people don't disclose STDs until sometimes after being physically intimate with someone. Listen, it doesn't make them bad human beings. It just happens to be that people are hiding in all different ways, shapes, or forms or they have masks put on, have masks that they're wearing because the fear of rejection, the fear of not being loved is very prevalent. Plus we're swimming in a sea of dysfunctional human beings who have childhood wounds and traumas and adult traumas that cause them to have negative patterns, limiting beliefs, and peculiar actions in the way they operate in the world. So what's the signs he's worth it? It's not a, it's really your job to investigate. Do you share the same values? Are your lifestyles blendable? And more importantly, is he emotionally mature enough? And if you need some help and support with that, schedule a discovery call with me. That's my area of expertise, Gina. Thank you so, Gigi, thank you so much. Oh, Elena says my arm was hurting after shingles and pneumonia. I've got a big bruise right here on my arm.  Okay, Callie Blue writes, can we hire somebody to do the vetting? That sounds like a total career opportunity for someone. Yeah, it's called a matchmaker except matchmakers don't do it the way I see. Most matchmakers, that's their job to do the vetting for you. The problem is most matchmakers do not have a large enough pool of people or you're not attracted to 99% of the people in their pool. See, we're a country that hyper focuses on looks. Then we do genuine compatibility. And I'm guilty of that, you know? I'm guilty of that as well. But we tend to hyper focus more on looks and chemistry. We overweight chemistry and under appreciate the importance of compatibility and more importantly, vetting. So to answer your question Callie Blue, that's a matchmaker's job. But now here's the thing. Maybe I should offer this as a service. You're just beginning to date a guy. My job is to get on the phone to do the vetting for you. Now I'd be ridiculously expensive to hire me but I can certainly do that for you on your behalf. So thank you so much Callie Blue. Jonathan Asley, the vetter. All right, Rosie Sheik says, what if we only do things he likes doing when we're together? It seems like we never do the things I like doing. It's mostly all about him.  If a man isn't willing to engage in the activities you like to do, what does that say about him? See, one of the things about men leading the relationship process, it puts them in the control position. Control, if you add an ER to it is controlling. Oh no, excuse me, an ING is controlling. He becomes a controller. See, when it's all about one person, what they can be end up being is controlling. It's always sold on, well, I'm the provider protector, I'm the leader of the relationship. No, I get to control the outcome the way I wish. If a man is unwilling to do the things you like to do, what does that say about him genuinely caring about you? That doesn't say much. Gosh, I'm constantly asking my sweetheart what to do. But my point is, is I'm inviting that conversation and sometimes we do the things she likes to do and a lot of times we do the things I like to do. Fortunately, we're both kind of on the same page. We always seem to do the same thing together. But I'm always inviting that from her and if there's something she'd like to do that's like we're talking about going to the Ronald Reagan Museum in a few weeks, that's something she wanted to do. I'm like, I'm all for it. See, when you're with somebody who's genuinely commitment oriented, partnership oriented, they want to do the things you like to do. Does that help Rosie? I hope it does. All right, let's keep going. Lisa says, Bravo, thank you so much. I appreciate that. Linda writes, with a long distance new relationship one month, what questions do you ask on the phone? We met at a wedding and had four dates. He wants a relationship. I'd like some substantial questions. Linda, that's something we do in my private coaching. Right here is there's a link and there's a link below. You can click on that link, schedule a discovery call with me. Part of my coaching, that requires you filling out a very long assessment about you. And what we do is we carve that we design the questions based on your personality. It's not like you can look at, you can read the 36 questions that's in the New York times or something like that. But if you don't understand the deeper importance based on your personality, it's not gonna matter. So Linda, schedule a discovery call with me. There's a link in the show notes and there's the link right there, Johnathanasley.com forward slash coaching, okay? And Linda to make it simpler, we're just gonna show it to you right here. All right, that's where you get it in the link below. All right, let's keep going here. I saw another question, Camille writes, how do you acquire such knowledge about relationship? Do you have a degree in psychology or some life coach training? I'm impressed on how much clarity you have. Well, thank you so much for that question. So let me give you my backstory. After turning 40 and going through a divorce, got a decade and a half ago, I found myself out in the dating marketplace. And I'll never forget. My first date, really nice woman, nice date, something wasn't right. A few days later, another woman, nice date, nice woman, something wasn't right. A few days later, another one.  In one year, I had over a hundred inner first dates. And I realized that something wasn't right was me. So I began doing therapy, I began reading books. Now, all along my drug of choice was talking to women on the phone, sometimes hours at a time, sometimes all across the country because I got addicted to feminine energy.  You really want to help people out. So in a way, I found myself talking to women as my therapist. All the while, I was really learning about human behavior in these first couple years. Now, what happened is a lot of women would reach out to me and say, hey, Jonathan, you're a great guy. Can you help me improve my online dating profile? So at first, my first part of my job was helping women improve their online dating profile. And I get calls, literally, we'd be on the phone one night, we'd change their whole dating profile. And then three weeks later, I get a call, Jonathan, I met this really great guy. And I can tell the difference because they were attracting what seems like to them a better quality man. Then during that time and about, I've amassed over 20,000 hours of coaching, over 3,000 hours of personal development, workshops, trainings, books, videos, that sort of thing. I've studied human behavior. And then I was in a relationship with a therapist for on and off for six years. And I got a PhD in therapy being with her, at least human behavior. And then I share my perspective on things.  See, the old paradigm doesn't work. The stereotypical paradigm, men are the leaders. See, I invite everyone to read the book.  I invite everyone to read this book, Camille, you as well, because this is where and all the books behind me is where I got a significant amount of my knowledge. So thank you so much. All right, let's keep going. Linda writes, in other words, how deep of questions do you ask on the phone or wait for deep questions when you see each other? No, no, no, no, no, no, no. Let me just tell you something. Okay, Marie, there she is right there. She lived in Chicago when we first communicated with each other. On our second phone call, I gave her my top 16 questions because I had nothing to lose. She lived far away. And we spent, on that first phone, the second phone call, we spent four hours unpacking the critical questions I want answered. Now, after that phone call, we became Facebook friends. And for the next year, we just communicated a little bit here, a little bit there. We didn't have incessant communication. Every once in a while, it was a text message. We go, how's dating going for you? Or we'd see a Facebook post and we would like something. These were some of the things we would do before we actually met. So by the time we met, we'd built up some friendship. We saw pictures of one another's families and friends and that sort of thing. We saw trips. A matter of fact, I remember seeing she posted a trip she had gone on. By the way, a previous trip she went on. So I asked her about it, but I did the critically important questions well before I met her. And that's my invitation for you, Linda. So thank you so much. Hey, Leafs in the house. Hey, glad to see you, Leafs. Where is your pyramid diagram? I think what you're thinking is my relationship iceberg, folks. I don't have my, well, actually, everyone hold on for one second. Bear with me, I'll bring it out. Since someone brought it up, I'll bring it out. I didn't bring out my diagrams today, but I think what you're talking about is my relationship iceberg. Okay, it's a little bit shiny here. Above the waterline is attraction. You can see the word chemistry below the waterline is compatibility of shared values, blendable lifestyles and emotional maturity. We can only see the tip of the iceberg. At first, what we have to concentrate is what's below the iceberg. And that's what I think Leafs is talking about. So thanks for reminding me to bring that up for everybody. So thanks so much. Elena says, Jonathan Asley's big brother vetting, exactly. Cat says, best book ever. Why men love bitches? Well, I don't love some of the aspects of the book. There is an aspect of the book that I do love. And that's the empowerment aspect of the book. Cat, so I do appreciate that one as well. All right, let's keep going. Let's keep going. Cache man says, please talk about why they say things like, I want to only date you. And on the second date when you say you want to see how it goes and then they quit talking to you. Okay, this is great. I think what she's referring to or he is referring to is how a man will come on strong on a very first date. Oh my God, you're the most amazing person I ever saw.  You're so wonderful. I mean, I see a future with us. I mean, we should travel together, blah, blah, blah, blah, blah, blah, blah, blah, blah. Okay. What that man is experiencing on that very first date is lust or limerence, lust or limerence. Limerence means extreme infatuation. Now what's happening is he's receiving a chemical, there's a chemical being released from his brain known as dopamine. Dopamine is like crack cocaine in that very moment he wants something. So he's gonna say all the right words to get what he wants. Believing that's true for him. It's like an anti-truth serum, anti-truth serum. In other words, it's not truth serum because he doesn't know that he wants it with you because he doesn't know you.   A dopamine hit is just temporary. It makes you want something but it doesn't make you feel fulfilled and it's only in that moment. So why does that, that's the why it happens. So as my mother used to say in the beginning, she said, I took what your father said in the beginning with a grain of salt. So you have to remember trust is built over time. It's not built by making a lot of false promises and guys will do this and I am guilty of this as well. When I've been apt up on lust and limerence is we do what's called trying it on for size. I think Alison Armstrong calls it the cut and paste. In other words, we go, wow, wouldn't it be great to go on a trip with you? I can see us going here. I want a introduction to my family. I want to introduce you to my friends. We're trying it on for size to see if you'd fit in our life because men bond through experiences. I want everyone to listen to what I just said. Men bond through experiences. We don't bond through the telephone. All of you that are addicted to the cyber version of relationships you're experiencing right now, those men are not bonded with you. We bond through experiences and the adversity within experiences, the challenges within experiences. So that's the why it happens, Keshe Min. And thank you so much for being a member of our group. We really appreciate it. Christine says, Kristen says, do you give an issue if we lean back in our feminine energy of boundaries? I believe it works well in dating and relationships. Okay. I want everyone to understand why I'm not a fan of the idea of leaning back in your feminine energy. I'd rather lean into your empowerment, okay?  But it might be a temporary chase because you pulled away. Ladies, what does it feel like when a guy pulls away? Okay, you're feeling a disconnect. So what happens is you want to go chase them. Well, when you've done the same, it makes them chase you.  All right, what benefit is that? What benefit is that? Now I'm all in favor of being in your empowerment to be in your sovereignty, to be in your self love. I'm all in favor of that, but lean into it is what I'm saying. And I know this might sound semantics, but leaning back might just know this. If a woman played the game of leaning back with me, bye-bye, I'm just not attracted to that. I'm a person that, I'm attracted to a person who leans into healthy dialogue when there's a disconnect going on. Is this sinking in? Is this resonating? Please let me know. Gallia says, what are the 16 questions you asked? That's something I teach in my private group, but I will say this, we did talk about vaccines, we talked about mass, we talked about politics, we talked about religion, but I go into, we went into deeper nooks and crannies on those things and keep in mind when we met, our first conversation was at the height of COVID. So that was one of the 16 things we talked about. By the way, it wasn't 16 questions. Now that I think about, there was 16 bullet points, but within several of the bullet points, there was multiple questions within it. So there was probably 30 questions. I should have stated that in the beginning. So Gallia, thank you so much. Questions, is it a bad sign when a man does not want to see you, see, wait, want you to see his house? He says he is ashamed of it. He's taken me out several times. We have a lot in common, he's very nice. Okay, couple of things. I can relate only because there was a period of time after my divorce where I was living in a one bedroom apartment. Now I happen to have an ocean view, but I invited several women over and for whatever reason I didn't get a second or I didn't get a date after that. And I thought maybe they thought I was poor or something like that.  So I understand how they might feel. Now there's another possible reason. He's married, okay? He is married, that's a possible strong reason or he's ashamed, but here's the bottom line is, before that penis ever goes inside the vagina ladies, you might want to see his place to determine if he's legit and if he's avoiding sharing that with you, you got to ask yourself, is he legit? Is he legit? Is he not married? And maybe he might be ashamed of his house, but you can tell him also I'm a very compassionate human being and that won't dissuade me unless you live like a hoarder and if you live like a hoarder, why would I want to engage in a, as a possible reason, okay? If he's a hoarder as an example, yeah, I might not want to engage with a hoarder. I would want to see their place. I think that's a fair thing to ask of someone to see how they live. If we're going to engage in developing a relationship to get, look it, you can do anything you want before you have sex. It's as I said earlier in this broadcast, don't you know when you sleep with someone, your body makes promises whether you do or not? Everyone, write, someone write that down. I'm going to read that again.  JC, I hope that answers your question. That's at least my perception on that one. Hey, Leafs wants to remind everyone, please hit that like button so we can get more action going right now. Thank you so much. Hey, one of our Facebook members posts on dating sites, I've gotten so many catfish, I'm skeptical of everyone who likes me. How can I get past this, that? I get back to optimistic mindset. First and foremost, probably only 20% of less of the population are true catfishers, okay? What I want to invite you all to begin reciting the following. It's raining good men, it's raining good men, it's raining good men, it's raining good men, it's raining good men, it's raining good men. I invite you all to start adopting that. Start this narrative, say it over and over and over and over and over and over and over and over and over and over and over and over and over and over again. God, Jonathan, that's a lots of over again. Yeah, start changing the story in your head. It's raining good men. You'd be surprised what happens, like many of my clients who call me. I love the fact that women make investment in this coaching program and I get calls every week. Jonathan, I met a great guy. Jonathan, I met a great guy. Jonathan, I met a great guy and I know the difference. I just got an email yesterday from someone who worked with me last year. I met a great guy and I know the difference. That's what I want to impart my wisdom on everyone who works with me and my private coaching. So thank you so much. All right, Jackie says, I agree with leaning in however when he can't show up because he's got so much of his own stuff going on and can't talk or doesn't want to talk about anything deep. How do I handle it? Sounds like he's just not your person. See, how do you handle it? If he's incapable of exploring a relationship then you just say, thank you next. Thank you next. Why invest in someone who's incapable investing in you? I like what Matthew Hussie once said in one of his videos. Invest and test, invest and test. See if he invests and then test. In other words, what he means is you make a little bit of effort. Does he meet you at the 50 yard line? See, if he's always at the 10 yard line and you're at the 50 yard line, he's not your person, Jackie.  Yeah, again, an unconscious guy might temporarily come towards you, but if he's incapable of leaning into the beginning stages of a relationship with some sense of common decency by making himself available, how serious is he about a relationship? Anyways, that's my two cents on that one, Jackie. Thank you so much. Kristen says, is that true with men and women the body promise thing? You know, okay, so what that point is trying to make and Leafs was, oops, Leafs was kind enough to say this.  See what happens is through the experience of intercourse for women in particular, chemical is released from the brain known as oxytocin. Okay, oxytocin is a bonding agent. For men, we don't bond with women. We bond through a vasineparin, I believe, is the chemical. We bond through experiences with a person. And again, with social activities, hobbies, mutual interest, spending time with family and friends, we bond more as in a friendship capacity as how we bond with a woman. See, when a woman becomes our really good friend whom we're sleeping with, that's how we bond with them, okay? For a woman, they bond typically through that physical experience. So the fact is, the minute you sleep with someone, the minute you sleep, his body is making a promise to her that it's going to continue. That's how a woman feels it. This is why it's imperative to have deeper conversations early in the mating process. So you avoid, so you can build that friendship piece as I talked about that men need before you ever dive into the physical piece. Is this sinking in? Is this resonating? Please let me know. Hashayman says, amen, Jonathan, they make time for people they wanna be around. Exactly. Jackie says, yes, borderline. It's possible it's a borderline personality. All right. Hey, listen, I hope you appreciated the conversation we had today. Is he playing games? How to get him to stop? Again, I'm here to encourage radical honesty, laying your cards on the table, and oh my God, the rules of engagement. I went blank on my own content. I hope you found value in this. If you did, please hit that like button. Please share this video. Please subscribe to my channel if you have something to add or share. Please hit that super thanks button. Please post a comment below. I'd like to hear your thoughts. I always do my best to respond to them. And I'm gonna wrap up this video as I always do.  Ooh, hurting my arm from that shot that I got vaccination shot. I'm gonna reach into the gamma and give you a hug of love if that's okay. I'm gonna ask you to turn to someone, a pet, a teddy bear pillow, and give Iter them a hug of love because hugs are a great source of love. And let's face it, we could all use more love in our lives. I wanna thank Wejoin and Jackie and Leafs and Cashamann and Kat and Kristen and JC and Brock. Jackie, one of our Facebook group members, JC, Gallia, Rosie Chic. Let's see, Lisa's in the house and Hillary and Leslie. Thank you so much everyone. You have a fab evening. Be well. Thanks, bye now. Thanks, Linda, I appreciate it.


So I think now we have a huge moment of opportunity for UBI in the UK, in many ways we're a perfect society to introduce it because we are a society in a very bad place. In the UK, we are a society in many ways crying out more than most even for a universal basic income. 16 million people in the UK have less than 100 pounds of savings. People have gig economy type jobs, zero hours contracts, low minimum wages, no chance to save. And so this it's a deeply insecure society. And we've been starting to see with the medical impact of COVID-19 acknowledgement of what a risk that is in terms of if you're asking people to self isolate because they've been exposed or because they've got symptoms. And we have statutory sick pay of essentially 100 pounds a week. So, you know, it's very difficult for people to do that yet that's what they should do for the public health of all of us. But what became very obvious was that how people were falling through the gaps in those schemes. So for example, if you were had a small business and wanted to get support, you had to have three years of accounts. And people who were just between jobs when the lockdown started, there's no one is the new starter furlough people. They got left with no money through absolutely no fault of their own. One of the things that COVID-19 has demonstrated is very much that change can happen very quickly. And in fact, that's my theory of political change is that it happens in big jumps. It doesn't happen slowly and gradually. So the last change certainly UK or US perspective was the rise of Margaret Thatcher and Ronald Reagan. We've had 40 years of neoliberalism. We're going to, we're now in the middle of creating whatever comes next. And I think it's crucial for us to say that universal basic income doesn't solve all the problems by any means, but is a necessary precondition for a society that lives within the physical limits of this fragile planet, while also ensuring that everybody has a decent secure life.