When you're trying to determine if your tool is actually
supporting the application of interest,
where should you start?
There are so many things that we have to consider at this point.
One of the best starting points is looking under Analyzed Data
and then understanding, what did the tool actually decode?
Which files are accessed there?
So let's look at Cellebrite right here for Facebook.
Facebook is this orca2.db.
We can see that it parsed Facebook Messenger.
What you should do is open orca2.db and see,
how many messages did it parse?
Did it parse three messages, and that's all there is?
Great.
But then, look at the other tables.
Are there tables that have not been parsed by the tool?
Even if the tool parses the data,
is there anything left in there that's not properly decoded?
Maybe there's base64 chats.
Maybe there's protobuf information or something
that just has to be decoded in a certain way
that you can review it.
The best way to know what is available
is to actually look at the App Store or download the app
and see, what is the functionality of that app?
Can it send messages, receive messages?
Are you able to take photos within it,
or only attach photos?
Can you set time limits on it so it's self-destructs?
Can you do private mode versus regular mode?
All of these things need to be tested by you.
What you can also do is if you look at Physical Analyzer
and you go to the Help menu, you will
see applications that are supported for decoding.
If we switch to the VM quickly, I will show you how to do this.
You click on Help, Supported Apps, Android, and iOS.
And what you can do is you can click on these,
and it will open a spreadsheet.
And it will tell you the application version
that's supported, if it's partial support, full support.
So you know when you need to go and dive deeper.