Deep carving within SQLite is essential to find deleted data in databases.

Every time Physical Analyzer is updated, it is necessary to go under tools and settings to double-check the settings. You must ensure that the box for “Use Deep Carving for SQLite” is checked and only then should you parse the collected data.

From here, Physical Analyzer will go in and deeply carve for deleted artifacts that may be extremely relevant to your investigation. Although you will also receive false positives, you can check each artifact individually by examining the source file to find the deleted artifacts that were carved from the database.

Share this post