Reason #2 to vote Cellebrite for a 2016 Forensic 4:cast Award

In a previous blog, we mentioned that Cellebrite deserves a Forensic 4:cast Award this year for being consistently first and often unmatched, by bringing critical mobile forensic innovations to your work environment. Just yesterday, we released a solution to decrypt WhatsApp’s new backup database encryption- crypt9, in UFED Physical Analyzer 5.0.2.

We are grateful to the loyal UFED user community and to the digital forensic community for nominating Cellebrite, and would like to ask for your support again by voting for us in the following categories:

  • UFED Touch for phone forensic hardware of the year
  • UFED Physical Analyzer/ UFED4PC for phone forensic software of the year
  • Digital forensic organization of the year

If you haven’t already voted, here is the second reminder why Cellebrite deserves the Forensic 4:cast Awards:

Industry-first support for the most popular brands and models

We get access to more than 100 new handsets per month, which helps us keep pace with device support for the forensic community and capture the next wave of mobile challenges for forensic investigators. UFED 5.0 already supports the new and popular Samsung Galaxy S7 for file system and logical extractions. With approximately 10 releases a year, hundreds of newly supported device profiles are added for each release, including support for new operating system versions, and all supported are tested by Cellebrite’s R & D team. Just recently, with the release of UFED 5.0, we’ve bumped our device profile support up to 19,203.

We continue to innovate the industry, and to expedite your investigation by providing you with unmatched access to case-critical evidence. UFED 5.1, to be released in the coming weeks, is already packed with hot industry-first capabilities, including a new proprietary method to disable user lock for many additional Samsung devices, and lock bypass for popular LG models. Stay tuned!

Does UFED play an important role in your investigations? If you think so, then vote for us today!  

ForensicFocus_728x90_4cast_Vote_30mar2016

 

Reason #1 to vote Cellebrite for a 2016 Forensic 4:cast Award

For the eighth consecutive year Cellebrite has been nominated by our dedicated UFED users and the digital forensic community in recognition of our success in delivering the most innovative and functional mobile forensic tools.

Thanks for your nominations in the following categories:

  • UFED Touch for phone forensic hardware of the year
  • UFED Physical Analyzer and UFED4PC for phone forensic software of the year
  • Digital forensic organization of the year

If you haven’t already voted, here is a good reason why Cellebrite deserves the Forensic 4:cast Awards:

Consistently First, Often Unmatched

Cellebrite’s UFED consistently brings critical mobile forensic capabilities first to the lab and field, and many of these capabilities remain unmatched for months or years. Just in our last two releases (4.5 and 5.0) we included 26 industry-first capabilities, and 22 are still exclusive for Cellebrite. Our recently released UFED 5.0 includes industry-first features and functionality that make your life easier, and your investigation more efficient – this includes a new validation capability, and unifying multiple extractions in a single unified report. We were also quick to include support for file system and logical extractions for the recently launched Samsung Galaxy S7 and iPhone SE.

Our innovation timeline will further demonstrate why we are the undisputed pioneer in breakthrough device specific mobile forensic capabilities. With UFED, chances are you will have these critical capabilities when you need them, when they are essential to your investigation, and well before any other tool currently on the market.

So in a nutshell, you can count on us to continue being the first to provide you with the most innovative, extensive and technologically advanced mobile device support in the industry.

Does UFED play an important role in your investigations? If you think so, then vote for us today!  

ForensicFocus_728x90_4cast_Vote_30mar2016

Exclusive bootloader method support for the latest Samsung devices headline UFED 4.4 release

Bootloader banner

With the release of UFED 4.4, Cellebrite announces support for 17,638 device profiles and 1,092 app versions. UFED 4.4 introduces the exclusive bootloader method designed to solve some of investigators’ most challenging problems for unlocking and extracting data from leading Samsung Android devices. Also including decoding support for new devices and OS updates, including iPhone 6S/6S Plus, iOS 9.1, and Android Marshmallow.

New unlocking & physical extraction support for Androids using the unique bootloader method

In previous version 4.2.6, we announced the release of the enhanced bootloader method, which enables you to obtain additional data when performing a physical extraction while bypassing user lock from Samsung devices.

As part of our ongoing efforts to provide the best physical extraction capabilities for the latest Android devices, version 4.4 introduces an enhanced bootloader to support newer phone firmware versions, and includes 12 additional Samsung devices. You can now obtain additional data by performing a physical extraction using the enhanced bootloader method for 85 popular Samsung Android devices running Android 5.x. This unique solution supports the following Samsung families: Galaxy S3, S4, S5, Note 3 and Note 4.

What is the bootloader method?

Physical extraction using the boot loader method is the recommended method to recover data from Android devices. When the device is in boot loader mode during extraction, the operating system does not run, and therefore, the device cannot connect to the mobile network. It bypasses any user lock is forensically sound.

New tutorial video is available below.

Cellebrite now supports new iPhone 6S/6S Plus and Android v6.0 Marshmallow

Recent device launches and updated operating system are also supported with UFED 4.4.  Users can now perform file system, logical (including applications data), advanced logical extraction, and decoding from,iPhone 6S and 6S Plus devices and iOS 9.1. UFED 4.4 also provides file system and extraction support for the latest Android v6.0 Marshmallow with limitations. Following recent changes made in Android 3rd party apps, including Facebook, WhatsApp and Snapchat, data from these apps can no longer be extracted when performing file system and logical extractions when using Android backup method. We recommend two options in order to overcome this limitation: Perform a physical extraction (when available), or root the device to extract data.

iPhone6 banner for blog

Extend your investigation capabilities with enhanced support for new apps for iOS and Android

UFED 4.4 keeps pace with investigator demand for more app support, and greater visibility into app data. This version introduces newly added support for some of the most popular apps installed on both Android and iOS, including: Google Drive, Google Tasks, Google Translate, Inbox, One Drive ,Pinterest, Runtastic, Yandex Browser, Yandex Maps; One Note and VIPole are available for Android.

With 300 million active users using Dropbox, 250 million using Microsoft’s OneDrive, 240 million using Google Drive*, and 100 million users on Pinterest, (the third most popular social network in the US)**. We are bound to believe that high number of people using these apps on their devices, may also hold the evidence you need for your investigation.

Updated support is also available for 53 Android and 61 iOS app versions.

New decoding method process for WhatsApp data 

App_whatsappIn UFED 4.2.6, we introduced a new capability to decrypt WhatsApp data. Using a third-party script, you can manually extract the WhatsApp key (on non-rooted Android devices), and use it in UFED Physical Analyzer to decode and decrypt the data. During the process, the WhatsApp version will be temporary downgraded to an earlier version, so that the key can be .extracted and used to decode the WhatsApp database. The current WhatsApp version will be restored at the end .of the extraction process.

A new step-by-step process is now available in MyCellebrite.

Learn more about UFED 4.4– download the release notes here!

* http://expandedramblings.com/index.php/google-app-statistics/

**http://marketingland.com/pinterest-says-it-has-100-million-monthly-active-users-143077

New time saving workflow capabilities in UFED 4.0: Translation, automated data carving, and more

UFED Release 4.0Efforts to obtain evidence and intelligence from mobile devices can be stymied by inefficiencies such as extra layers of work process, lack of access to a full range of tools, and other challenges both small and large.

UFED 4.0 continues Cellebrite’s track record of developing features that improve investigative workflows and save you time both in the lab environment and the field. Among the most significant time savers we’ve added to UFED Touch, UFED 4PC, and UFED Physical/Logical Analyzer: better Android data carving, language translation, a UFED Touch data preview capability, and better workflows overall.

Simple, efficient language translation

Reduce challenges associated with foreign language translation, including the need to rely on another person, or to copy/paste into an online tool. Either one takes time you may not have, and errors—especially with short words—can alter the meaning of content.

UFED Physical/Logical Analyzer 4.0 contains an offline translation solution that accurately translates both short and long words. Use it to translate selected content on demand, and to use filters in your language of choice. The translation engine keeps the source language, which you can see in the user interface, and you can include both the translation and the original source text in your report.

The UFED translation engine currently supports 13 languages, including English. Choose five free of charge when you access all the language packs from your my.cellebrite.com account. If you need more than five languages, you can purchase them directly from Cellebrite. Be sure to let us know if you need access to languages apart from what we offer!

Faster, more powerful data carving from Android unallocated space

Enhanced automated carving from Android devices’ unallocated space gives you access to much more—in some cases, double or triple the amount—of deleted data than previous data carving features allowed. Owing to a new algorithm, the carving process is now also faster.

While manual data carving is still an important part of forensic validation processes, Cellebrite redesigned the automatic data carving functionality to achieve more deleted data with greater precision, by dramatically reducing false positive and duplicate results.

Learn more about data carving when you take the Cellebrite Certified Physical Analyst course.

Save time in the field: Preview logical extraction data in UFED Touch

UFED Touch users may find themselves needing to preview evidence to decide whether a mobile device is worthy of deeper examination, or they need intelligence to decide an immediate course of action. UFED Touch now offers the option to view an HTML report that includes general device Information and the logical extraction data on the touch screen—without requiring a laptop.

Newly included in logical extractions, and therefore viewable with UFED Touch, are web history and web bookmarks. From iOS devices, the new UFED 4.0 feature extends logical extraction and preview capabilities to app data.

Balance time savings with process: capture images and snapshots with UFED Camera

Sometimes, taking screenshots of a mobile device is the only way to capture its evidence. This could be because you have no UFED with you in the field, or the device or certain data on the device isn’t supported for extraction with the equipment you have.

With UFED Camera, our new manual evidence collection feature, collect evidence by taking pictures or videos of a device. A single report contains any extracted information together with screenshots or video.

The ability to take screenshots can be important in the field, helping to substantiate a police officer’s, border patrol agent’s, or corporate internal investigator’s documentation of what s/he saw on the device during an initial scroll-through. (Remember to get consent or have another form of legal authority to show for it.)

In the lab, taking screenshots can help you to validate device extraction results – to show that the evidence in an extraction file existed on the evidence device.

For more details on these and other new and enhanced decoding and app support capabilities—including support for iPhone 6, 6Plus, & other Apple devices running iOS 8—download our release notes!

Does Windows XP’s end of life affect the UFED Touch?

UFED Touch continues to be Cellebrite's flagship hardware.In recent weeks we’ve gotten quite a few questions regarding the impending April 8, 2014 end-of-life date for the Microsoft® Windows® XP operating system. Specifically, customers are wondering whether the Windows XP life span affects the Windows-based UFED Touch platform.

We are happy to report that it does not. The UFED Touch runs the Windows Embedded Standard 2009 version, released on October 7, 2008. According to Microsoft, the end of life for Windows Embedded Standard 2009 doesn’t happen until January 8, 2024.

So, if you are in the process of procuring or evaluating the UFED Touch for your mobile forensics needs, please be assured that it will continue to be fully supported.

Now available: UFED Touch User Guide App

Cellebrite UFED Touch tutorial appA new interactive support guide app is now available to all UFED Touch users! This Flash app covers all of the basic functions available in the UFED Touch device, including extractions, settings, updates and much more.

All functions are detailed in Flash animation with easy-to-follow narrated instructions in English.

If you’re a UFED Touch user, download the “UFED Touch User Guide” app by following these simple steps:

1. Go to my.cellebrite.com and sign in

2. Locate the “Downloads Software Updates and Utilities” window

3. Click the “Downloads” drop-down menu and select “UFED Touch User Guide App.” The app will download to your computer

4. Unzip the downloaded file and double-click the “UFED Touch User Guide Installer.exe”

5. The installer will install the app and create a shortcut icon on your desktop

6. Click the “UFED Touch User Guide” shortcut icon to open the app

Download the UFED Touch User Guide app today!

New Device Support with UFED 1.9.0.0; New Language Support with UFED Link Analysis 1.8

Following on our release of UFED Physical Analyzer 3.7 just a couple of weeks ago, we’re pleased to release a new firmware version for both UFED Touch and UFED Classic, as well as a new UFED Link Analysis version.

New UFED firmware means new device support

UFED Touch and UFED Classic 1.9.0.0 now offer logical extraction from Samsung Galaxy S4 devices, and from the HTC One, logical along with file system extraction and decoding with user lock bypass. (Watch our video below for details on the HTC One extraction.)

Physical extraction and decoding with user lock bypass is now available for HUAWEI and ZTE devices running any Android OS version. This is possible with proprietary client software. To perform this type of extraction with your UFED Classic, update the EPR file before proceeding.

UFED CHINEX now enables physical extraction with decoding and user lock bypass from additional selected Alcatel devices. Using the UFED Ultimate interface, you can either select the specific model you’re working with, or one of two generic options offered.

Because these options cover different families of devices which are not included in the device list, but can be extracted using the same methods as already-supported devices, you should use the two options in sequential order.

Physical extraction with user lock bypass is now available for selected LG devices; decoding will be added in the future. To perform this extraction, the device boot partition is replaced without affecting the user partition.

UFED Classic Logical extraction enhancement

Cellebrite has improved UFED Classic Logical’s performance by enabling email extraction as part of the logical extraction process. This increases the amount of data available via logical extraction and is therefore beneficial in examinations where time is critical.

Customers who have recently purchased UFED Classic systems, but have not yet budgeted for UFED Touch upgrades, may find this improvement valuable as the number of smartphones they encounter increases.

Multilingual support for UFED Link Analysis

Released May 29, the UFED Link Analysis user interface is now available in 10 different languages besides English: Chinese, Dutch, French, German, Hebrew, Italian, Japanese, Portuguese, Russian and Spanish.

You can select the display language you prefer from the application settings. The language selection will be saved for future sessions as well.

Find our full UFED release notes here.