This is hard to show on the slides.
So when you find analyzed data of interest
and you want to know where in the actual file system
the data exists, this is different than following
the source.
And this is going to lead some of you
in your lab to get the wrong answer.
So I'm not going to spoil it for you right now.
But when we look at this, we found health data of interest.
We want to know, on that iPhone extraction,
where that data exists.
This does not mean that we want to know
in healthdb_secure.sqlite where that data exists.
No, we don't want the database, we want on the entire device.
I'm going to show you how to do this.