Let's look at, where is the user data?
So we don't want to pull the application file itself.
That's not going to contain user data.
What we want to do is find the databases.
Where are they going to exist?
Remember, it could contain deleted data.
So as we look here, we are seeing an application.
We clicked on that little pickaxe in Physical Analyzer,
and we could see that it has 27 deleted items.
And that's just from selecting the pickaxe.
Not all of the tools and viewers are
going to be created equally.
In one of your labs in this section,
you're going to click on that pickaxe.
You're going to see deleted items
and then realize they're actually not relevant.
They are just traces of wear leveling in that database that
hasn't been vacuumed yet.
We will use a free script that then
uncovers additional things that will aid you
in your investigation.
So don't stop with one.
What I would say is, if you're at that point where you're
like, OK, I click the pickaxe, I don't have any deleted hits,
go into hex.
Use the magnifying glass.
Search that way.
Or export, and use Mari DeGrazia's script
that we're going to leverage in this section.