Why do you need to do this?
I love when students ask questions that challenge me.
I had a student in Vegas a few years ago.
And he said, I'm never going to have to do this.
I work child exploitation cases.
I was like, OK, here's a perfect example.
And we ended up putting a slide together
like this for that student.
You are working a child exploitation case.
You have some random application that's in use
that the tools are not parsing.
However, you see chat messages going back and forth,
and you see pictures and other things.
You're going to have to write a query to parse that.
Now, this is super important.
Every single case you work, SQLite is going to be relevant.
Do you need to parse everything?
Absolutely not.
What you need to do is start with the tool.
So here we can see we have a message between Lloyd
Xmas and Ace Ventura.
We also have those sources.
Remember how I told you, always click on the source.
So here in Physical Analyzer, we would click on the source.
It would tell us these are the databases I'm parsing,
and these are the tables of interests.
The key goal in most of these apps
is going to be to determine the message.
What was the content?
What was the context going back and forth?
Do we know who sent it or received it?
If any attachments are included, what are those file names?
You may want to say file size, hash values.
You can do all the things as long
as the database stores it--
timestamps, and was it incoming or outgoing?