When we talked about data moving around
on the solid state drive of the actual device,
wear leveling can occur.
What you're seeing here in this slide is,
we searched for a term-- "is that not awesome?"
And you could see here that it provided 478 results.
So I'm going to zoom in just in case you cannot see that.
And we could see 478 right here.
Let me magnify.
Where this is so important-- if you simply exported or created
a forensic report from this point, saying,
I searched for "is that not awesome?"
And the user typed that 478 times, that is false.
When we look at the source, you see where
it says message 7, message 1.
"Is that not awesome?" was actually typed--
received one time incoming message, one time outgoing.
So two messages on that entire phone resulting in 478 times.
The reason we see all of these results
is, that file was moved around that phone,
because the person also texted with other people.
This is the perfect example of what
wear leveling can look like.
And again, this is in Physical Analyzer.
I'm going to keep telling you this.
Wear leveling is often cleaned up on these devices.
So if you're working an older Android,
chances are good you will see it.
If you're working an older iPhone,
chances are extremely good you're going to see it.
But if you have an Android 10, 11, 12 device,
even a little bit older than that,
chances are good that the Android will clean up
after itself, and you're not going to get access
to this information.