In the example above, Shared.data is an SQLite database, and the Contacts table is undergoing analysis.

The table stores a contact ID, phone number, display name, and an icon, among other attributes. Within the Contacts table, the “icon” column contains an embedded PNG image, which in this case is storing the contact’s avatar associated with this application.

Applications that embed image data within the tables make the process of correlating images to contacts (like in this example) relatively simple. This same scenario can apply to audio, video, or image files that are sent as message attachments, posts made to social media pages, etc.