#Ufed reader download for mac software#

Phone Exam Properties (Figure 2) are provided in a tabular format and include the typical cell phone specific details that I would expect to be available with a mobile phone forensics product. The file opened quickly and presented the following initial display in the Report Manager GUI. I moved the USB stick over to a forensics workstation running the Cellebrite Report Manager and copied it to sanitized case drive and then opened the analysis file. I selected all available options except audio for my test run and extraction was completed in around 8 minutes.

I chose the 'USB Flash Drive' for a 16 GB FAT 32 formatted USB drive I chose the selection for the 'iPhone 2G/3G/3GS' Several options are available for Apple products:

The Main Menu of the Cellebrite UFED offers several choices for collecting evidence from a mobile device:ДЇor the initial part of my testing I wanted to see just what was available with the standard 'Extract Phone Data' option. Using The Cellebrite UFED 'Extract Phone Data' Option

#Ufed reader download for mac software#

Further Cellebrite has recently released their Physical Analyzer software that works on Windows 7 ењ†4 for both physical dump files and file system dump files. The new/current version 1.8.2 will now operate on a Windows 7 ењ†4 machine. The previous version of the Cellebrite Report Manager was somewhat limited for use in my practice as it only ran on a Windows XP environment and my lab is predominantly Windows 7 ењ†4 based. See highlights on the most current release below (Figure 1). The UFED Physical currently supports 2455 different phones for standard processing and 1462 for physical processing. Let me begin by noting that I am running a Cellebrite UFED with the Physical Analysis Option. However if you want to do a deep dive in to the file structure, Internet usage or look deep in to the applications that are being used on the device and perhaps run some of your 'favorite forensic tools' against it, I highly recommend complimenting your traditional Extract Phone Data analysis by also doing the File System Dump.ДЇor the purposes of my testing for this blog post I am performing a forensic analysis on a 16 GB iPhone 3G Version 4.02. If the subject of your forensic analysis is collecting information regarding the telephone such as call logs, phone book, SMS, pictures, video and audio/music then you will find what you need using the standard Cellebrite processing found under 'Extract Phone Data'. Why would you use the Cellebrite File System Dump instead of the traditional Extract Phone Data ? Rather it is a look at some of the tools I use in my practice and how they can be applied to iPhone forensic analysis.

It is not the intent of this blog post to be an all-encompassing guide to the forensic analysis of an iPhone.