Part 1 – SQLite Joins: How to Create Connections Between Multiple Files in Cellebrite Physical Analyzer
SQLite Joins allow you to create connections between multiple files and see the tables come together in Cellebrite Physical Analyzer.
In order to complete SQLite joins, do the following steps:
- Locate a database of interest, open SQLite Wizard.
- Go through the details of the table and decide what exactly you want to parse from it. To see a larger view of the list, enlarge it with the button on the right-hand side.
- Once you choose the specific files of interest, click on “preview” to ensure they turn out as you wanted.
- For the second column, choose the entries you are interested in and then decide what they have in common with entries in the first column. When you have a connection, click and drag to create the connection.
- Under “preview,” you will be able to see how the two tables come together.
If you want to take it a step further, you can then display timestamps associated with the accounts.