In the example above, physical searches for a unique search term were conducted over two different mobile device image files (*.bin). In the example on the left, the unique term appeared multiple times throughout the physical device but only existed two times within logical files on the file system, as evidenced by the “Source” category within Cellebrite Physical Analyzer’s interface. Like we learned in Section 1, this is an example of wear leveling, where the operating system efficiently moved that entire database to various physical pages on the NAND flash to prevent wearing out the chip.

In the example on the right, another keyword search was conducted for a unique term over the entire physical memory. Each of the search hits were tied to a logical file on the file system, which in this case was a database file or the temporary file (WAL) for that database. If this same search was conducted on just the database in question, mailstore.kimmiecheers1998@gmail.com.db, it would appear that there is no “source” for the search hits. This is NOT an example of wear leveling due to the fact that the search was conducted on a single database file and not the physical memory.