The most important part that we are going to cover right
before you start your lab--
keyword searching in Physical Analyzer can be buggy.
If you find a bug, please report it to tech support.
If you're not confident doing that, you can email me.
My Cellebrite email is heather@cellebrite.com.
It's pretty easy.
There are different ways to search,
and you have to know what it means.
So we look at this first one.
Any of these terms versus All of these terms.
Any means marsha or mallow.
So it's not-- if it has a hit with marsha,
it's going to show you.
If it has a hit with mallow, it's going to show you.
If it has a hit with marsha,mallow,
it's going to show you.
You put a comma in between.
All of these terms will be marsha and mallow.
None of these terms is exactly what it says.
This checkbox right here, Search in file contents--
this could add not only several minutes but several hours,
depending on how complex you're trying to make the search.
So be very careful with that.
In this next lab, I want you to try all these searches.
It's a very tiny data set on an older Android device
that if it crashes, it's not the end of the world.
It's very quick to parse.
When you get your search hits, you
will see that it's going to tell you how many hits you have
and then you can start sorting and looking through it.
You should find both parsed information--
I should say more than just both-- parsed information,
files that store that information,
and potentially unparsed data if you
choose Search in file contents.
Search in file contents is supposed
to go through and look at every single file in that file system
and find those artifacts for you.