Installed applications can be viewed in the Insights view or within the Table View in Physical Analyzer. The Table View is probably what most are used to for those who have used Physical Analyzer in the past. Here, we can tell how the app was parsed (Decoded By) if it was deleted (the pickaxe) and the category it falls under. More importantly, it shows the source, which is the fastest way to hop directly into the file system. The App Genie, as previously mentioned, is a tool that tried to identify databases with artifacts of interest like chats, contacts, and more. Cellebrite recommends using these results for triage and then manually review them to ensure they are legitimate prior to putting them in your forensic report – that concept is the theme behind this class

The Insights view can be used to view the chunks of categorized apps. Under utilities, we see the groups of application categories and the files associated with them. From here, one can launch AppGenie (if not previously run), run the Android Emulator or launch the SQLite Wizard.