Hello,
I am curious as to what Cellebrite is looking for when the hash set "Known files database (Cellebrite)" is automatically ran in Physical analyzer; do any of you know? Also, I cannot figure out how to filter for just the known files so that I can answer my own question. I have consulted the manual and was only able to find the following
You cannot edit or delete the default hash set "Known files database (Cellebrite)". This hash set it used to categorize images that appear under the Data Files tree item.
Any assistance anyone can offer would be greatly appreciated.
If you are using physical analyzer or reader you can use insights tabs, then under watch lists > hash sets > image > known files will allow you to view those known files in isolation. hope this sheds light for you or anyone with the similar intrigue.
Â
