So in the slide that shows you we're on health.
We're in the FileDump.
And you can go back and forth.
What we're going to do here is let's
find something of interest.
So let's say Social Media, Facebook.
We have this wall post here.
If I asked you where in the database this existed,
you would click on this source file.
But if I ask you where in the entire file
system does this exist, what's the offset, what you need to do
is something completely different.
You have to go into File Systems.
You have to scroll all the way to the top
and click on that FileDump.
So what you want to see is that raw hex.
You want to see this green that we just searched.
And then when you go back to Facebook and you click on this,
if you switch to FileDump it should take you to it,
and it did.
Sometimes it doesn't work and you
have to make sure you're not over-clicking.
But what this did was it took us to that
offset in the entire extraction on where that artifact exists.
This is different than the database,
and it's so important.
Because there are so many times that if you find something
that the user thinks they deleted
or they think that doesn't exist or you're
trying to prove wear leveling, this
is how you're going to do it.
So again, you find-- let me find something else, a call log,
maybe.
I could click on calllog.db, but that's
going to tell me in that database where it exists.
That's not what I want.
For this call to Cafe, I click on the FileDump
and it takes me out to the call logs now.
And then we can see that information.
If you hover above it and you can click on it,
it's because it's parsed by the tool.
You're going to do this in your lab
as well because it's very important.
And if you get it wrong, wait for the review.