There are many different ways to handle databases within Cellebrite Physical Analyzer.

If you want to verify a note that is marked as deleted, you can click on the source or go straight to the file system and the database of interest.

Once arriving at the database, it is essential to understand which tables are relevant. You can determine this by going to the parsed data where it lists which tables are included. From here you can recover the deleted files.

To take it a step further and write queries or see items that have hints or passwords associated with them, you can use the SQLite Wizard and query builder. This allows you to go through and check the items of interest by selecting the desired items.

You may find your answer in the preview, or you can go further by mapping out the models and diving deeper into the date/time stamps.

Share this post