Basic terminology that is so important to you--
you're going to have a database.
That database is going to be comprised of tables.
It could be one table.
It could be so many tables.
There are some tables or databases on iOS devices
that could have hundreds of tables.
Look for the one that stores the conversations, whether it's
chats, messages--
that's typically where you want to start in a lot of the chat
applications.
You can also sort by row count and look accordingly.
Then you're going to have the different columns.
And then those columns will have data stored in rows.
So I want to show you something really quick.
And this is a nice trick that I had learned.
In Physical Analyzer, I don't care
if it's an iPhone or an Android, under Data Files,
you're going to have databases.
And in that cold case that I mentioned previously
in this course, there was a person that was murdered.
None of the data was really speaking
on anything that could prove the innocence or guilt
of the person of interest.
But what my friend had done who was working this with me is,
he went into databases just out of desperation,
and he sorted by row count.
So sort by row count descending, go up to the top,
and look at the ones that have the most information.
And this is where this gets interesting.
Within here, he was able to identify applications that were
used for transferring money.
There were very large transfers of money
to a person of interest that maybe
shouldn't have had that type of money sent to them.
So as we start looking through this, here we can see--
I'm going to choose worldcity.db.
This one only has three tables.
But as you look, you can get a quick glimpse
of what you're looking for.
Here, we have internal.db.
And you could go over and say, is
any of this stuff of interest to me?
Is this relevant or not?
So it's just a good clue to you.
And what I like to do is, I want to say, OK,
show me the ones that are not decoded by my tool,
and then that's my good cheat sheet on where
I'm going to start.
So row count, it's difficult. Even
malware, anything that has a database involved,
you can't hide from the row count--
very, very helpful, just if you get
lost, and you're trying to keyword search
and you can't find things.