Access Evidence From 95%+ Of Android Devices Fast

Cellebrite’s ground-breaking technology and new physical extraction solution, Advanced ADB, extends evidence access from thousands of Android devices.

Cellebrite has done it again. On March 15, 2017, Cellebrite was the first in the industry to provide a unique physical extraction solution, Advanced ADB, as part of its UFED 6.1 release, for thousands of Android devices. To be more specific, Cellebrite’s new Advanced ADB method supports more than 95% of the Android devices in the market running any version from 4.3-7.1. Yes 95%! Generally, this capability works on unlocked devices with a security patch level up to November 2016. But, due to the widely fragmented variety of Android devices, a few exceptions may apply.

Several Android devices that this unique physical extraction method supports are:
Samsung Galaxy S7, Samsung Galaxy S7 Edge, Samsung Galaxy Note 5, Samsung Galaxy S6, Samsung Galaxy Note 4, LG G4, LG G5, LG Nexus 5X, LG V20, Sony Xperia Z5, Xiaomi Redmi 3S, Huawei Nexus 6P, HTC Desire 825 and more!

So what does this mean for you? Well, if and when you encounter an Android device in any of your investigations, rest assured that it is more than likely to be supported by Cellebrite’s Advanced ADB physical extraction method.  Doesn’t that solve a lot of problems, worries, backlog?

Here’s how it works:

The Advanced ADB method can be accessed in one of two ways from UFED 6.1:

  1. Via the mobile device – Mobile device -> Browse manually -> Search for Smart Phones -> Android -> Physical Extraction -> Advanced ADB.
  1. From within the specific device profile – Physical Extraction -> Advanced ADB.

And if the device supports a SD card, it’s pretty straight forward.

The extraction can also be performed directly from the phone to any USB storage device, when the device does not have a SD card. To do this, you will need extraction cables OTG 501 and 508. View the UFED 6.1 release notes to understand how you can receive the cables.

Check out the video below to see a step by step tutorial on how to perform the Advanced ADB physical extraction method.

To get Cellebrite UFED 6.1 with Advanced ADB, visit our landing page to learn more.

Solve more cases with access to more applications using unique engines

Applications contain key pieces of information that can provide great insights to an investigation. Most of the databases stored on mobile devices (iOS & Android) are SQLite databases. SQLite is a powerful and relatively simple way to store data. When extracting all SQLite databases from a mobile device, you will note that most of the databases are decoded by UFED Physical Analyzer, (which provides support for more than 200 unique apps and 3,000 app versions). However, there are still some databases that are unfamiliar or are not supported. With 2.4 million apps* available on the market today, there isn’t a single mobile forensics tool that can support all these third-party applications.

Cellebrite’s SQLIte wizard

With the release of UFED Physical Analyzer 6.0, we announced a new capability that enables you to access even more data from apps, including unsupported apps. In short, you can access any information stored on mobile devices, reduce time to evidence and close more cases with the new UFED PA.

As an examiner or an investigator, one of your challenges is to get as much information possible out of a mobile device. In many cases, the potential evidence may reside inside a third-party app that’s installed on the device. When this app is not supported by any mobile forensic solution, the alternative is to manually analyze and investigate the content of the app’s database.

With the new and unique SQLite wizard, you can visually map additional data from different databases, build queries and map database fields to supported models, (such as call logs, instant messages and other generic events).

I’ll take you through a step-by-step tutorial on how to recover data from a database using this tool.

SQLite wizard flow

 

 

 

If you know that a specific application was used on the device, but it was not automatically parsed during the decoding process, you can look into the database’s content and extract the data.

The database in the project tree (under data files), includes a list of all the databases available, with an indication that specifies if it was decoded by Cellebrite. We suggest that you filter out all the decoded databases, and focus on manually decoding the non-decoded databases that you feel may be important for the investigation.

Alternatively, you also have the option to manually decode a database that was already decoded. And why? There are new developments for applications all the time- for example, WhatsApp recently added video chat, and while Cellebrite is on the task to provide support for this new feature in upcoming releases, you may require this specific record immediately, so manually decoding the database will provide you with instant access to potential evidence.

Untitled-1

Let’s assume that you want to extract data from the mmssms.db (database on an Android device), which you suspect may contain critical evidence. First, start the manual decoding process by selecting this database. Within the database viewer pane above, you can see that the selected database has a total number of 362 records, so plenty of information there.

To get started, open the SQLite wizard:

SQLite wizard_home

The SQLite wizard allows you to include deleted data. Selecting this option increases the chances of false positive records, and in many cases, the interesting data or potential evidence may be found as deleted.

Build query:

The list of database tables is available on the left pane. Select the “sms” table with 112 potential records.

Drag the database table to the work area. You have the option to drag several tables and even create relationships between tables (or join in SQLite language). An SQLite query is automatically generated. Alternatively, you can also write your own SQLite query. To see your build queryquery results, click on the preview button.

Map data:
To map the selected data, you need to select one of the existing data models (e.g: call logs, instant messages) or a generic model. For the mmssms.db database, which holds SMS info, you should select the SMS Messages model. Now drag the field types to the correct columns. (See how the screen should look like below before you drag and drop).

Before mapping:

before mapping

 

After mapping:

after mappingSome columns have special formatting options that allow you to convert enum, lookup, XML/plist and timestamp formats to help map the relevant fields and columns, and also make the information readable by selecting the timestamp global format, for example, or customizing your own format.

Run Query:

Now that you completed the mapping process, run the query created in a way that new records are added to the SMS Messages model.

run query

For the the SMS Messages model, there were 207 records as part of the decoding, and after running the manual query there are 319 records available. Therefore, by using the SQLite wizard, I was able to recover a total of 112 new records!

The new records can be treated just like any other decoded record, I can tag, filter, search and include those in my report output. The manual queries can be saved for future use, where you can auto run it as part of the automatic decoding process, and recover huge amount of data that you would otherwise would not be able to access.

new records

Fuzzy methods

In addition to the manual SQLite query tool, we developed another tool to enrich your investigation with valuable data from unsupported database sources, using the Fuzzy model plugin. This innovative solution identifies new data sources, handles and parses unknown databases and endless application databases – some of which are supported by Cellebrite and some are not. Information is being automatically analyzed using a heuristic process and a unique set of rules.

This solution scans and analyzes all the databases and all tables within the databases, and automatically maps the records into a known model ( such as email, IM, call logs etc.).

There are two types of fuzzy models:

  1. Fuzzy objects – View extracted data from any database which has not being decoded by UFED Physical Analyzer’s parsers. This model holds information regarding a certain artefact such as contact, account etc.
  2. Fuzzy events – View extracted events such as messages, call logs etc.

For each one of these models, you can see the list of results presented in a table and the database view pane, which displays the contents of database files that were found in the extraction.

Once the decoding process is complete, you can run the Fuzzy plugin directly from the main menu (Tools àRun Fuzzy model plugin).

The results are presented under Analyzed data in the project tree. Any record in these two tables can indicate a potentially relevant piece of evidence. To find more details, it is recommended to analyze the source database.

Records with a timestamp are also available in the timeline view, which allows you to track and view events in a chronological order to quickly understand the chain of events.

 

*https://www.statista.com/statistics/266210/number-of-available-applications-in-the-google-play-store/

Python Script to Map Cell Tower Locations from an Android Device Report in Cellebrite

Recently Ed Michael showed me that Cellebrite now parses cell tower locations from several models of Android phones. He said that this information has been useful a few times but manually finding and mapping the cell tower locations by hand has been a pain in the butt. I figured that it should be easy enough to automate and Anaximander was born.

Anaximander consists of two python 2.7 scripts. One you only need to run once to dump the cell tower location information into a SQLite database and the second script you run each time to generate a Google Earth KML file with all of the cell tower locations on it. As an added bonus, the KML file also respects the timestamps in the file so modern versions of Google Earth will have a time slider bar across the top to let you create animated movies or only view results between a specific start and end time.

Step one is to acquire the cell tower location. For this we go to http://opencellid.org/ and sign up for a free API. Once we get the API key (instantly) we can download the latest repository of cell phone towers.

mappic

Currently the tower data is around 2.2 GB and contained in a CSV file. Once that file downloads you can unzip it to a directory and run the dbFill.py script from Anaximander. The short and simple script creates a SQLite database named “cellTowers.sqlite” and inserts all of the records into that database. The process should take 3-4 minutes and the resulting database will be around 2.6 GB.

Once the database is populated, the next time you dump an Android device with Cellebrite and it extracts the cell towers from the phone, you’ll be ready to generate a map.

From The “Cell Towers” section of your Cellebrite results, export the results in “XML”. Place that xml file and the Anaximander.py file in the same directory as your cellTowers.sqlite database and then run Anaximander.py –t <YourCellebriteExport.xml> . The script will start parsing through the XML file to extract cell towers and query the SQLite database for the location of the tower. Due to the size of the database the queries can take a second or two each so the script can take a while to run if the report contains a large number of towers.

output

Ed was kind enough to provide two reports from different Android devices and both parsed with no issues. Once the script is finished it will let you know how many records it parsed and that it generated a KML file.

done

This is what the end results look like.

mapresults

The script can be downloaded from: https://github.com/azmatt/Anaximander

This is the first version and there are several improvements to make but I wanted to get a working script out to the community to alleviate the need for examiners to map the towers one at a time. Special thanks again to Ed Michael for the idea for this (and one other) script as well as for providing test data to validate the script.

Follow my blog for up to date digital forensics news and tips: http://digitalforensicstips.com/

About Matt:

Matt performs technical duties for the U.S. government and is a Principal at Argelius Labs, where he performs security assessments and consulting work. Matt’s extensive experience with digital forensics includes conducting numerous examinations and testifying as an expert witness on multiple occasions.

A recognized expert in his field with a knack for communicating complicated technical issues to non-technical personnel, Matt routinely provides cyber security instruction to individuals from the Department of Defense, Department of Justice, Department of Homeland Security, Department of Interior, as well as other agencies, and has spoken frequently at information security conferences and meetings. Matt is a member of the SANS Advisory Board and holds 11 GIAC certifications. Among them: GREM, GCFA, GPEN, GCIH, GWAPT, GMOB and GCIA.

 

 

Access Historical WhatApp Conversations with UFED Cloud Analyzer

With UFED Cloud Analyzer 5.2, you can unfold suspect’s daily conversations by extracting WhatsApp backup from Android devices. While conversations are stored locally on the device, a WhatsApp user may backup their content to the cloud and later restore it on new devices, or when downloading the app again. Android device users can store the backup on Google Drive- the backup frequency (daily, weekly or monthly) is configured by the user.

You can access the information whatsappstored on Google Drive by utilizing login information from the Android mobile device. The login information contains two elements: the Google login information required to access Google Drive and a device key required to access the WhatsApp messages. If the Google login information has expired, you can use the credentials for the Google account, but to obtain the message you will also need the device key which is available in the account package generated by UFED Physical Analyzer. Without the device key, you can access the WhatsApp backup, however you
will only have access to media files (photos and videos) attached to the message, without the message itself.

whatsappeg

When can this become useful in your case?

  • When WhatsApp content isn’t available on the device- – a suspect or victim may be using a new device, and did not restore the data.
  • When WhatsApp data was deleted from the device.
  • When you don’t have access to the device.
  • Cloud backup may contain more info than in the device information.
  • When the user switches from an iPhone to Android, not all the content is smoothly transferred, since backups act different in iOS and in Android.

Register for a 30-day UFED Cloud Analyzer free trial, and explore how you can extract case-critical information that is only available in the cloud. forensicfocus_ufedcloudtrial_sept2016

Cellebrite Spotlight: Interview with Director of the Research Group, Shahar Tal, Cellebrite

180020_502158187216_7446504_n

Shahar Tal – Director of the Research Group at Cellebrite –  has built an extensive and impressive career within the realm of R&D. Hailing from an elite military background, Shahar in his current role oversees Cellebrite’s research efforts to provide extraction-enabling solutions – for all devices of interest, including the most complex and challenging.

Read up on his career highlights, opinions on Cellebrite’s future in digital forensics as well as advice to newbies entering this technological sphere.

Have a question for Shahar? Leave us a comment below!

Shahar, you are the Director of the Research Group at Cellebrite. Tell us a bit about your role. What does a day in your life look like? 

In my role, I am responsible for Cellebrite’s research efforts to provide extraction-enabling solutions for all devices of interest. This core role within the company helps define what our products and services can do. Our unmatched research is one of our strongest differentiators, creating high expectations among our customers and colleagues. My job is to ensure that we continue developing unique capabilities to match these expectations. Luckily, I have several research teams made up of top talent that are dedicated to the task in each different research domain. They deserve a lot of the credit for the technical breakthroughs achieved at Cellebrite.

What does a typical day at the office look like?

Hectic – with dozens of ongoing research projects in various stages! One moment, you may hear cheers and excitement from one of the rooms, where researchers successfully discovered a new extraction method for a previously unsolved device; the next moment, you take part in a critical design review for the next UFED version, while simultaneously reviewing open issues and feature requests for five other projects. After lunch, I usually interview several candidates to join the research team, and then round-up the team for a weekly follow-up of progress and status.

The most gratifying moments are when we receive customer feedback – that praise both our technology and efforts, which enable them to solve a critical case, that may happen to appear all over the news that week. This feedback is significantly rewarding, and contributes to the drive and motivation behind our work every day.

Can you tell us a little bit about what first sparked your interest in digital forensics? 

I am still a newcomer to the digital forensics field, and I learn from the experts and my peers at Cellebrite every day. Coming from a research background, my introduction and continued involvement in the digital forensics arena are incredibly interesting. I think it is crucial for a researcher to understand the needs and concerns of the end user, and that is why I personally follow and often respond in community forums and mailing lists.

Shahar, you hail from a military background. I can imagine that this is quite different from work in the private sector. Can tell us how working in the private sector compares with the military life? 

I have a history in elite army R&D units, and in many ways these years have provided the best training possible – by shaping the nature of my work and sharpening my skill sets. Working under tight schedules in an environment where product performance and reliability are absolutely critical, helps you sharpen your instincts and prioritize tasks accordingly. I am also delighted to have had the opportunity to work with some of the best talents in the world on extremely challenging projects.

When comparing, I find that the private sector brings many new aspects into play – where cooperation and outbound communication are legitimate and important facets of your role. I enjoy taking part in and interacting with the research community; I regularly attend and sometimes speak at conferences around the world. I welcome potential collaboration opportunities and keep an eye out for new developments in the field.

This year has been a big year for Cellebrite’s technologies. Which current trends in forensic computing particularly interests you, and what new challenges do you foresee in the future? 

I believe the challenges of encryption are strongly influencing the forensic landscape already, and will continue to do so in the coming years. Full Disk Encryption has easily been the most significant mobile forensics game-changer since last year, in effect rendering chip-off/JTAG/ISP methods useless in all new devices. This landscape shift leaves on-device unlocking capabilities as the only alternative. Fortunately, this is where Cellebrite, as the forensics research leaders, have excelled throughout the years.

I also expect that we will continue to see device manufacturers implementing more layers, mechanisms and obstacles, further challenging evidence extraction. We see this today and witness the difficulty and resources invested per solution – which is increasing steadily.

And, moving forward – what does the future hold for Cellebrite? What can we expect to see over the next year or so? 

Cellebrite is making great strides in providing a complete digital intelligence portfolio. Our dominant extraction capabilities are only where it begins, and I think many law-enforcement and intelligence investigative practitioners will be excited about what’s coming next.

I expect to see us maintain our leadership in device unlocking services – being the first to provide the technology to unlock a newly released device, while simultaneously seeing our analytics platforms integrate into many agencies’ processes and infrastructure.

I think that we definitely have the ability to change people’s perspectives when it comes to mobile forensics. That is, to make people realize that a locked device is not a dead-end road, and that they can turn to Cellebrite – who can help them recover the most available data possible from locked as well as encrypted iOS and Android devices.

As you stated, you are a newbie of sorts to digital forensics. Do you have any advice for individuals who are just starting out in their digital forensics career? 

Be prepared for a rapid rate of change, and understand extraction challenges. Digital forensics is no longer restricted to decoding and analysis of data – examiners and responders from the lab to the field should have a deep understanding of what is possible to extract and under what conditions. Stay involved, read about technology and security research news, be prepared to learn something every day – this will give you an edge in a field where you can never learn enough.

Finally, when you’re not working, what do you like to do in your spare time? 

I enjoy spending time with my family, reading books and playing puzzle games with my young daughter. I am a serious basketball fan and a less-serious, mediocre player – on good days. My favorite team since childhood is Hapoel Jerusalem… and occasionally you may find me waking up at 03:00 AM to watch NBA matches.

Click here to learn how Cellebrite’s mobile forensic solutions meet your investigation needs.

Follow Shahar on Twitter: @jifa

TomTom Triplog Decryption: Provided by Cellebrite Advanced Investigative Services

Global Positioning Systems (GPS) fall into the category of wireless communications that hold a considerable amount of evidence that can be used in an investigation. People’s whereabouts are recorded in “second-by-second” detail on their TomTom navigation system and retrieving this type of information can provide powerful digital evidence for your case.

In recent years, the law enforcement community has seen a dramatic increase in the use of GPS devices as an instrument of a crime or as a “witness device” collecting and logging positional data while the crime is being carried out. TomTom and Garmin units are by far the most popular devices law enforcement have been encountering. The sales of portable navigation devices are at an all-time high.

Last year, more than forty million portable GPS devices like TomTom’s GO series or Garmin’s Nuvi series were sold worldwide.* In Europe, TomTom is the most widely used navigation system; and the big market share (47%) could be attributed to the TomTom built-in installation in vehicles. Forensic analysis of vehicle movements records can provide evidence of considerable value in crime detection. (While Cellebrite does not provide data extraction from built-in systems, we support decoding of chip-off data extractions from them, and then decryption of the triplogs).

Cellebrite supports a select list of TomTom devices, which can be found here. Aside from extracting timestamped GPS locations from the trip log files using unique decryption technology, Cellebrite also provides decoding support for contacts, calls and locations. Forensic analysis of such records can provide evidence of considerable value in crime detection.

Upon setting up a TomTom device for the first time, it prompts the user for permission to collect information from the navigation device. The information or triplogs shared is used to improve maps and other services offered by TomTom, such as traffic information related to where the user is. (These services are disabled if a user chooses not to share the information).

If the user accepts, his or her TomTom device is set to log all trips in dedicated binary files known as triplogs. These files are saved in the device file system under a directory named STATDATA. The triplogs collected illustrate a breadcrumb trail of where the person travelled to with the navigation system in very high resolution. TomTom triplogs are encrypted in order to protect user privacy, but also accumulate additional encryption obstacles to the ones that already exist.

Cellebrite offers a unique decryption service to our customers, as part of Cellebrite Advanced Investigative Services, that enables the extraction of timestamps and locations from the triplog files that reside in the STATDATA folder. The triplog files hold complete trip GPS information (including latitude and longitude), and thousands of locations, in a resolution of 1 to 5 seconds.

TomTom Triplogs

How can I send Cellebrite these triplogs?

Using UFED Physical Analyzer, open the extraction and then select Tools,TomTom menu, select Export to save the XML file generated from the triplogs, and submit to Cellebrite via CAIS. The decrypted data will be sent back to you within a few days, and ready to be imported into UFED Physical Analyzer- where the triplogs can be viewed in detail (3 second log when device was active). A kml-file can then be generated and viewed in Google Earth and other similar applications.

UFED Physical Analyzer enables TomTom extraction and decoding of the following information: home, favorites, recent, user entered, locations, last journey, location, date & time, routes, GPS fixes (also deleted), deleted locations (of all categories), as well as recovery of geotag visualization of location based data on Google Earth/Maps.

UFED Physical Analyzer has also been equipped with a covert feature that enables silent activation of triplog files, which means that you can connect a TomTom device to the UFED system and activate the logging feature. As soon as this is carried out, the device will start saving triplogs, once TomTom is in use again.

Send us an email to learn how Cellebrite Advanced Investigative Services can help with your encrypted triplog files, along with Google Earth KML files.

Watch the webinar below to learn how you can use UFED Physical Analyzer to extract TomTom files:

References

*http://www.forensicfocus.com/tomtom-gps-device-forensics

Cellebrite launches actionable forensics data in the field

Police work is mostly about solving cases, and this is not a trivial task. Gathering clues and hints is important to achieve the desired outcome. Everyone today has a mobile device on them wherever they go, and these devices are storing a lot of information (calls, chats, locations, pictures, contacts), leveraging this data for investigation is just common logic.

Researchers conducted on investigation process proved that evidence or clues that are gathered within the first 48 hours are imperative to solving cases, and the statistics shows that when there is no real direction the chances to ever solve the case decreases by 50 percent.

So the need for speed is clear, and providing actionable data extracted from mobile devices is a necessity. How can this be done? A mobile forensic examiner would require years of experience to develop the right skill sets to overcome different technical challenges of obtaining forensically sound evidence. How can we speed the process and move mobile data recovery from the forensic labs, where we have the experts, to the field where we have excellent investigators whom ar not experts in mobile forensics?

This is the exact challenge we faced at Cellebrite when we started planning and designing our UFED InField solution. We have consulted with many of our customers (both digital forensic experts and police investigators), and together we defined the criteria and needs of users for field mobile extraction. There were three main obstacles we needed to address:

  1. Extraction duration – it must be quick and effective, as in the field there is no time for long process.
  2. Simplicity – The users are not technical nor forensic experts, and therefore the flow should be as simple as possible.
  3. Deployment management – When you have a wide deployment of devices across the country to enable investigative teams to perform mobile extraction quickly, you must have a tool to manage the deployment and set flows per the need on the agency.

With new release of UFED InField 5.2, we kept the above three challenges as part of our product design guidelines, and indeed, based on the feedback from our beta customers, we gained a lot of progress.

Meeting all the needs for field forensics is a journey, and together with our customers will continue to research and develop new capabilities to make the experience simplified and efficient as possible.

Join the journey and discussion share your ideas and feedback by posting a comment below. Perhaps together we can help build a safer society.

I am hosting a webinar next week, Wed. June 22nd, on how you can simplify mobile data access in the field to speed investigations. Click here to register.

_ARS6348_NewKiosk_22may2016

 

Reason #3 to vote for Cellebrite for a 2016 Forensic 4:cast Award

There is just less than a week left to cast in your votes for the Forensic 4:cast Awards. In our previous blog posts, we mentioned that Cellebrite deserves an award this year for being consistently first, and often unmatched, bringing critical mobile forensic innovations to your work environment, and for also being the first to provide support for the most popular brands and models.

Here is the third reminder why Cellebrite deserves an award:

Forensically Sound Evidence Every Time

Unlike competitors’ “black box” third-party bootloaders, UFED remains the only mobile forensics solution with custom-designed, read-only bootloaders. By controlling every part of the process, Cellebrite ensures that the bootloading is non-intrusive and that nothing is altered on the device, keeping the data forensically sound. This capability is delivered in proprietary bootloaders that support physical extraction while bypassing locks for mobile devices, which have no alternative solutions. Our custom-designed bootloaders contain a code that is specifically designed to only read the memory chips, not write them, and are thus more flexible, generic, and work with a wider variety of devices. Altogether, they make for a solution that lets you overcome barriers and ovoid data loss or overwrite.

In version 4.2.6, released August 2015, we have enhanced the bootloader method to provide physical extraction support for the latest Samsung Android devices, (including firmware SM-G900V, SM-G900A, SM-N900V, SM-N910V, SM-G860P). With the coming release of UFED 5.1, we will be providing lock bypass and physical extraction support using the enhanced bootloader method for 200 Samsung devices.

If you benefit from our unique capability to perform a physical extraction while bypassing lock, then vote for us today!

Cellebrite’s nominations include:

  • UFED Touch for phone forensic hardware of the year
  • UFED Physical Analyzer/ UFED4PC for phone forensic software of the year
  • Digital forensic organization of the year

ForensicFocus_728x90_4cast_Vote_30mar2016

Introducing Cellebrite’s Advanced Digital Analytics Platform

Today we are excited to announce our new UFED Analytics solutions, a cornerstone of the Cellebrite Unified Digital Forensics Platform. Designed in collaboration with our customers, the new UFED Analytics Platform simplifies the complex by automating the manual, time-intensive tasks associated with analyzing and managing data collected from mobile devices, applications, cloud services and CDRs.

Comprised of three offerings, the solutions act as a force multiplier, empowering examiners, analysts, investigators and prosecutors to simultaneously organize, search, map, visualize and manage large sets of digital data to identify patterns and reveal connections between one or more subjects – or cases – quickly and efficiently. Advanced text, image, video, geolocation and link analysis capabilities deliver the deepest, most accurate insights possible, helping to accelerate investigations.

Cellebrite’s Analytics Product Family components include:

UFED Analytics Desktop: Designed to meet the needs of a single forensic practitioner or investigator, this application simplifies and automates analytical tasks, allowing a user to easily identify the critical relationships that can focus investigations.

UFED Analytics Workgroup: Designed for 50 users or less, UFED Analytics Workgroup delivers a client-server solution that efficiently and effectively manages hundreds of digital data sources.

UFED Analytics Enterprise: This scalable platform supports a complete, end-to-end digital forensics workflow, allowing anywhere from tens to hundreds of users to collaborate on a case or perform cross-case analysis simultaneously.

Expanding beyond the mobile landscape

The time has come for our customers to consider a more efficient approach in order to work cases faster. Sifting through data to search for evidence in PDF reports is like going fishing, and the more mobile devices, the more data, the bigger the report. Investigators can no longer waste their time with manual analytical processes. We now enable investigators to move beyond disparate data repositories and manual analytical processes to a unified investigative platform. With intuitive and streamlined digital forensic data management, case stakeholders can collaborate and act on digital data in real-time.

Read our case study to discover how the McLennan County District Attorney’s investigative process is already benefiting from this new approach.

Banner for Interactive tool