However, when you go to the database
and you look at that database in hex,
look at what we have here--
a date/time stamp.
Location.
We can see it's also called "first tomatoes
from my garden."
We can see latitude, longitude, Dunn Loring, the place name,
8521 Minerva Court, Vienna, Virginia.
That is my old home address.
It is exactly where I was when I took
a picture of those tomatoes.
What's even crazier-- look down at the bottom.
It was 29 degrees Celsius.
It was 84 degrees Fahrenheit, partly cloudy
in America, New York.
All of that information is stored
in the hex of these databases.
Now, what I recommend you do.
If location really, really matters in your investigation,
I'm going to show you a trick.
I'm going to go into Physical Analyzer.
And first thing I would do is go into Tools
and see under enrichment--
or, sorry, data carving--
if you can carve for locations.
That's the first thing I would do.
I would say, I want to carve for locations, and Carve.
The next thing I would do is scroll all the way to the top
in your file system.
Under your file dumps, click on the magnifying glass.
And I would search for the word "location"
and then do another search for "position."
I just did two searches.
How this data is going to look-- you'll
see different tabs at the bottom.
So I have 1,122 for location, 93 for position.
And you may find that they don't make sense.
Photostat SQLite may not be as helpful
as some of these other ones.
But I just search in hex to see if I
find anything that could be hiding
in the background like that.
You will find a lot of these applications will say things
like current position, current location, last position.
And you may have good information, or a good way
of finding some of those location artifacts
that are otherwise hiding in the background.
So look through your hits.
You would dig through and see if you find anything relevant.