Now let's talk about keyword searching.
Different than Physical Analyzer in the aspect that you cannot
do a hex search.
So if you want to hex search at that file system level,
you have to go into Physical Analyzer.
But we can do logical searching and then
we can do advanced searches.
So I'm going to show you what this looks like.
We go up at the top right, and you're
going to see this Advanced button.
Click on that.
And then in here we have some options.
So you can do regular expressions.
To do regular expressions in Cellebrite,
you would do that in the hex search.
So let's say I want to search for "hank"
and I say I want to include it.
You can say whatever you want here.
I'm leaving it generic.
Now do you notice this?
It says AND or OR.
You get one option.
So if I do "hank" AND "livingston"--
I could add another keyword, but do you
notice there's no option of AND/OR?
You choose it one time, and it stays true for all of those.
And I'm going to say Search.
Whoops, I don't want this one.
I have to clear that.
And I have no hits.
Let me see.
We delete this one.
No, it's because it's Hank Fresh.
My personas are getting messed up.
But do you also see how it says fuzzy search,
"Thanksgiving" hit on "hank?"
And it narrowed it down.
You want to clear it-- clear filters.
So that's really simplified.
Now this is where it gets complex.
We go in to File system.
I want to show you some examples here of where things go wrong.
So let's say I am in this maps.
OK, so I'm going to zoom in here.
If I search for DirectionsData, let's see what happens.
But what I'm going to do is I'm going to just choose
a different directory.
So I'm searching for DirectionsData.
Now we'll zoom in, and press Enter, and I get no hits.
But you can see it literally right here.
What you have to do, you must be on the top directory.
You must change this to All subfolders from Selected only.
And then you will get your hit.
So let's try a different one.
If I do-- let me show you this again.
So if I'm in Kik--
and I got to clear my hit so it actually shows me--
and I want to find this kik.chat directory that's right here
on the left, if I'm one below it,
and I search for com.kik.chat--
oh, and I spelled it wrong.
Typo.
Com.kik.chat-- you notice I have nothing, no hits.
You move up one, you have hits.
So that's why I recommend you're always at the top
and then look how many more you have.
So a reminder, top directory.
If it's iOS, it should say decrypted.
Change this to All subfolders.
And that's something I requested as the option
to do a universal change so it always does that.
You will see when I review labs with you during this course,
I will forget that as well.
That is the most overlooked item, I think, in the tool,
where people think they don't have hits because of that.