Some key features-- and again, I'm
not going to demo every single one of these for you
right now because they will not become relevant
until we hit Section 2 labs, Section 3 labs, and so on.
But there is something built into Physical Analyzer called
the SQLite Wizard and DB Viewer.
I work at Cellebrite, and I'm going to tell you
it's not my favorite thing.
I prefer the DB Browser for SQLite, which is
a free tool that's brilliant.
However, some people prefer AXIOM.
Some people prefer Physical Analyzer for this.
I will show you in Lab 1.3 where this feature within Physical
Analyzer could be really valuable to you
if you're new to SQLite examination.
I'm going to skip it for now.
We will get to that shortly.
You're going to find different Plist viewers, XML viewers,
Protobuf viewers--
these are terms you have not heard before.
Just be patient.
I will review those with you as they are relevant.
Same thing with plugins and chains--
that's a strange terminology.
Now I am going to show you Timeline.
I'm going to review Data Carving again if it's possible.
I'm also going to show you the "Go to" option.
I already showed you the multiple tabs,
and then there's also the media categorization.
Do not run media categorization on Lab 1.1.
For some reason, it struggles and may not finish and could
cause your VM to crash.
It's not going to add value.
So don't do that for Lab 1.1.
Some people don't listen and try anyway.
You have been warned.
So please don't do that one.
But let's take a look at some of these other features
that I want to mention here.
So Timeline-- if you click on the Timeline icon,
your entire timeline for Physical Analyzer
is going to come up.
Now what's super-important here are these Timeline settings.
If you look at the default, it is saying in the timestamp
field, it is only going to show you anything that
was captured for that time.
So what happens if you're working an investigation that
involves guns and the user deleted photos on that date?
You may want to have that.
Because of that, I do Show all.
Now, when you choose Show all, you could have duplicates.
I would rather have more information
and then pare it down versus miss something
because I didn't check the box.
Make sure for Data type, you show all.
Now this is where you have a choice.
Show activities.
This is going to be health.
If you are looking at an iPhone and you choose Show activities,
the person could have millions of health activities.
It will really slow down your process.
If you aren't sure if health matters,
stay tuned for Section 3.
For Android, we're going to talk about health, too.
That is a nightmare, so I would definitely check it.
Show device events-- do you want to know
every time the phone was powered off and powered on, placed
in airplane mode?
If that's not relevant to your investigation,
then you don't have to do it.
But choose wisely because once you check this,
it's going to say, OK, you have to re-click on Timeline
in order to update it.
So if you had things already going on in Timeline,
it wouldn't take place until you click out and click back in.
Do you notice, I also have Fuzzy events in here?
Remember, Fuzzy events and anything from AppGenie
should be verified.
You want to make sure.
If you want to specify your time range,
you would do that right here.
So you could go in and click on this and say, you know what?
In 2020, from January 1 to present-day or whatever,
this is where you would filter.
You can also filter on most of the categories.
So if you know you're only looking for call logs,
you could say I want to clear all and just show me call logs.
You can filter as much as you want.
Just make sure you're not over-filtering.
If you ever leave work for the day and you come back,
and you're looking at your data set, one thing I do recommend
is that you always look and see if any filters are applied
and clear them if you're not sure what you filtered on.
Because you don't want to over-filter something and then
miss relevant information.
One more thing I wanted to show you.
So let's say-- let me go into--
hm, I'm going to choose--
I'm trying to choose things you're not
going to do in your lab.
Over here on the right, you're going to see this Go to button.
If you click on Go to, it gives you things you could hop to.
So you can see we can hop right to the Timeline.
We could hop to that Installed Application.
We could hop to the Searched Item or to the Journey.
So journey means location.
So for this, this is Google Maps.
It looks like some kind of restaurant.
It's going to show you the journey
that the person searched for.
So there are many things.
You may find on some of these things you can only hop to one.
It may just be Installed Application or Timeline.
Depending on the artifact, it's going
to depend what you can hop to.
But if you're not sure-- let's say you find something.
You're like, now what?
This is a good cheat sheet go to and look there.
Something else I want to show you-- if you get lucky enough
and you see this little icon right here,
this is where you can rebuild the cache
to see what the user was looking at on that page
at a certain point in time.
So if you click rebuild cache, you may have success with this.
You may not.
We'll see what happens here.
I clicked rebuild cache, and it doesn't look
like anything is happening.
So for some of these, you may not have luck.
For some, you may.
But it's worth a shot if you have to rebuild cache.
This is where AXIOM is really strong, at rebuilding
those cache files.
I figure since I see that icon I would just
show you what it means.