It is important to understand whether a location was carved within Cellebrite Physical Analyzer or automatically parsed in the data collection process.

To check this, go to “Maps” and then “Locations.” When you hover over the pickax symbol for an item, you can see if it is listed as carved. From here, it is important to verify the timestamps and to verify that the device was actually in that location.

Zoom into the areas of interest and dig through the timeline to check if they make sense contextually. The most important thing is to verify the source file and to verify the data within the source file to ensure that the latitudes and longitudes grabbed by the tool are legitimate and correct.

When collecting data in Physical Analyzer, under the “Carve Locations” option in the toolbar, you can carve for additional locations in the processing phase.

Under the “Decoding” section of “Settings,” make sure the appropriate items are selected. “Deep Carving” for SQLite is very helpful to find hidden latitudes, longitudes, and deleted artifacts that may impact your investigations.

Share this post