I had just demoed these two different view options for you
in Insights and in Table View.
There are so many ways that you can filter.
You can do related to specific types.
You could search.
So you could actually search for Facebook,
and it may show you that it's social media, that it's chat,
that it's many things.
As you search for it, you're going
to find key things of interest.
If you're hunting for malware--
I realize I'm jumping ahead a little bit here--
but look for apps that are no longer in the store.
These are apps where the version is just expired.
Or you may find where it says this app may not
be from the store.
That is extremely important with encryption programs, malware,
and other things that could be threatening
running on that device.
Now as you're going through this,
you may find that some data is not supported or parsed.
You can run the AppGenie.
The AppGenie is a research tool that enables you to go through
and carve for additional artifacts that may be
relevant to your investigation.
The AppGenie and Fuzzy model plugin
should be run together on all of your investigations.
Now you'll notice you can't run AppGenie
across the entire device.
It would cause Physical Analyzer to crash.
It's on applications that are specific to your investigation.
If you look closely here, do you see
that little triangle on Snapchat and the triangle on Facebook?
What that means is Cellebrite parsed something from it.
Do you notice how WhatsApp does not have that?
That is where you want to run AppGenie for sure,
and you also want to run Fuzzy model plugin to see
if you get anything else.
So two different views, many options.
We're going to be leveraging these in the course.
It's totally up to you on what you want to do with them.