Now, navigating the file system--
there are so many tricks to find what you're looking for,
and I will show you multiple ways of doing this.
So if you click on the source file,
that's an immediate way to hop right into that file system.
But let me show you some other tricks that you can do as well.
So obviously, you can click on File Systems,
and we can go in and say, OK, in this data partition,
I want to just dig around.
I'm going to find files of interest.
So you can sit here and you can do it this way,
and say OK, there's Chrome.
If you can't find it though, let me show you some tricks.
If you go over to the top right, you could search for--
I'm going to search for the SMS database, so mmssms.db,
and press Enter.
What it's going to do is say, hey, I
know that there are 12 instances of this.
If you click on it, it's going to show you parsed information,
but it's also, as you look through,
going to show you where that file is in the actual file
system.
And we're going to talk about these different artifacts
that you see here and what they actually mean.
But as I look through--
if it lets me scroll--
I'm going to click on mmssms.db.
Do you notice it takes me right into that file system, where
I need to be?
So if I look over here, and saying,
OK, this is in user_de, which stands for device encrypted,
here's the mmssms.db.
And it gives me a glimpse of it.
So that's one way to get to it.
Another way to get to it, if you're an Analyzed Data,
and I'll do the exact same one.
In Analyzed Data under messages, under chats,
let's say you find a chat message of interest.
If you click on the Sources, this
is telling you where it pulled this information from.
So you could click on the file here
and it takes you to that database storing it.
Now notice it currently dumps you into hex view.
This is a gripe I have with Cellebrite.
I want to go to Database View, and not
only do I want to go to Database View,
I want to go to that table that stores
that message of interest.
But these are just different ways that you can navigate.
So you can manually go through and leverage your cheat sheet.
Now this is the first time I'm mentioning this cheat sheet.
You have been provided in your Dropbox
with a unique cheat sheet for Android and one for iOS.
Leverage them.
You have your poster that is accessible.
The cheat sheets are also on smarterforensics.com.
You will find that the cheat sheets may
be in your on-demand portal.
Your SME may provide it to you.
There are so many ways to get it, but the best place to look
is your Dropbox because it will have the latest and greatest.
That is a good way for you to know the actual file path
on what you're looking for.
So you could go that way.
You could search in the top right for your file of interest
or you could go to Parsed Information
and click on the source file and let it take you to it.