UFED6.3 Releasenotes EN.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
NOW SUPPORTING 22,179 DEVICE PROFILES 4,187 APP VERSIONS RELEASE NOTES UFED PHYSICAL ANALYZER, Version 6.3 | July 2017 UFED LOGICAL ANALYZER, UFED READER CHECK OUT OUR NEW VIDEO ON UFED 6.3! HIGHLIGHTS APPS SUPPORT ◼ 2 new apps for Android and iOS: CM Security Master Antivirus (Android) and Private Zone – AppLock ◼ Decoding support – LinkedIn messages for Android devices ◼ Telegram cloned apps for Android – Telegram is an open source app, and in Google Play there are many apps available for download. We have added a generic parser which can decode information from various cloned apps, including Telegram + app and Telegram Plus. Watch video now! https://vimeo.com/222514207/1d01006bfb ◼ 139 updated application versions FUNCTIONALITY IDENTIFY KNOWN FILES ◼ Quickly identify known media files using Project VIC/CAID USING MULTIPLE HASH SETS ◼ Identify known files using Hash Sets INCLUDING PROJECT VIC/CAID ◼ Carve more locations data from unallocated space and Quickly identify media files by creating databases using Project unsupported databases VIC or CAID hash values, and matching them against existing ◼ View locations by classified origin media files. ◼ Disclose even more web history and search terms from additional sources ◼ New conditions functionality in SQLite Wizard ◼ Tag global search results ◼ Notifications center ◼ Export image files in Griffeye format ◼ Recover the deleted participants list from iMessages ◼ Decode Google Archive files ◼ Recover locations history data (iOS) ◼ Decode modified IMEI (Android) ◼ Search using wild cards in Hex viewer ◼ Decode Bluetooth history (iOS) ◼ Decode the FindMyiPhone state ◼ Decode the Advertising ID NEW! BOOST LOCATIONS ◼ Decode the last backup date DATA USING AN INNOVATIVE CARVING SOLUTION Get the most locations data possible from a digital device by using a unique carving method to obtain more data from unallocated space and unfamiliar databases. FUNCTIONALITY QUICKLY IDENTIFY KNOWN MEDIA FILES USING PROJECT VIC/CAID Cellebrite is proud to provide you with a capability to quickly identify media related to child exploitation, that can incriminate predators. UFED Physical Analyzer 6.3 enables you to create Hash databases by importing Project VIC/CAID files, and matching them against media recovered as part of the extraction, specified with the appropriate VIC/CAID category. Cellebrite’s Analytics solution offers the complete package to fight against child exploitation. In partnership with law enforcement agencies, Cellebrite has developed a unique and innovative method, complementing the Project VIC/CAID solution, that enables users to identify and tag suspected child exploitation related media (images and video) VIEW LOCATIONS BY CLASSIFIED ORIGIN within a new Suspected Child Exploitation Media category. UFED Physical Analyzer classifies each recovered location record Click here for more details. by its origin: Device and External. In this version, 6.3, you can now view and filter for locations that are related and unrelated IDENTIFY KNOWN FILES USING HASH SETS to the device user’s activities (This does not mean the device Identify and upload any csv or text file which contains a list of has been in this location). For example: A picture taken by the known hash values, and match it against any file recovered from camera on a digital device is classified as a ‘Device’ location. the device. To start using this capability, follow these steps: While a picture received on the device is marked as ‘External’ Tools ––> Watch list ––> Hash set manager. You can customize as the location is related to the image sender. Locations are the hash sets results both in UI and reports, using the following highlighted with a different color on the map. options – Show, Hide and Redact. Note: Some locations are classified as unknown DISCLOSE EVEN MORE WEB HISTORY AND SEARCH TERMS CARVE MORE LOCATIONS DATA FROM UNALLOCATED SPACE AND FROM ADDITIONAL SOURCES UNSUPPORTED DATABASES UFED Physical Analyzer can now carve more search history data This unique and innovative solution allows you to decode an from allocated and unallocated memory space, and additional even greater amount of locations data from unallocated space web browsers including Chrome, Samsung browser and Firefox. and unsupported databases. To start using this feature, open the Device Locations and click the carving icon or start the Intact and deleted new records from this carving process can be carving process from: Tools ––> Get more data (carving) ––> Carve found under the Searched Items model. This capability is relevant locations. The carver allows you to either search for additional to iOS, Android and Windows phone devices. locations, up to three of the most visited areas, or any other custom area. Note: The carving results may produce many false positive events. Cellebrite Release Notes | UFED v 6.3 | July 2017 | 2 FUNCTIONALITY (CONT...) NEW CONDITIONS FUNCTIONALITY IN SQLITE WIZARD DECODE GOOGLE ARCHIVE FILES In cases where the interpretation of a field is based on another Open and decode Google Archive files using UFED Physical field’s value, you can map that data using the new conditions Analyzer (via Advanced Search, or by running the Google function. For example: SMS participants table in an SQLite Archive Databases chain). This archive file contains important database contains SMS information. In several cases, the same information including: Chrome history and bookmarks, contacts column will contain both From and To values of an SMS message. from Google account and Google+, emails from Gmail, search You can now create a new condition to distinguish between the history from Google Play, chats, calls and contacts from two different field values. Hangout, and played/search history from YouTube. RECOVER LOCATIONS HISTORY DATA (iOS) We have enhanced the locations data from iOS devices. You can now decode additional location history records from the maps data plist file. This file is used to sync location history from the iOS device to the cloud service. DECODE MODIFIED IMEI (ANDROID) It is possible to change the device IMEI number using flash boxes or other methods. UFED Physical Analyzer version 6.3 can now decode the modified IMEI number (when available) in addition to the previous IMEI number. TAG GLOBAL SEARCH RESULTS Note: There is no indication in UFED Physical Analyzer if the Create tags for all Global Search results items in a touch of a IMEI is original. button. We have also enhanced the Global Search UI to provide SEARCH USING WILD CARDS IN HEX VIEWER you with a familiar user experience. Within the Find tab in Hex viewer, you can now search using wild cards - ? and * (? replaces an octet - 4 bit and * replaces an entire byte). NOTIFICATIONS CENTRE Never miss a thing with the new automatic notifications that will keep you up to date with new feature and capabilities in DECODE BLUETOOTH HISTORY (iOS) UFED Physical Analyzer. In the Notification Centre, you can now view the latest alerts, news, warnings, completed actions and Under the Bluetooth Devices model, you could previously view much more. To view Notifications, click on the Bell icon–– > View a list of Bluetooth devices that were connected to the device. all notifications. We have enhanced the results presented with additional Bluetooth history records for iOS devices (using full File System EXPORT IMAGE FILES IN GRIFFEYE FORMAT extraction which is available via Cellebrite Advanced Investigative Easily export selected images in Griffeye format (* C4P Index. Services (CAIS)). xml). You can import the exported file into Griffeye using a C4All DECODE FINDMYIPHONE STATE XML data source. Under Device Info, for iOS devices, you can now view if the RECOVER THE DELETED PARTICIPANTS LIST FROM IMESSAGES “’FindMyiPhone” setting is enabled. We have added support for iOS devices, recovering deleted participants’ information from iMessages. Cellebrite Release Notes | UFED v 6.3 | July 2017 | 3 FUNCTIONALITY (CONT...) APP SUPPORT DECODE ADVERTISING ID Under Device Info, for both iOS and Android devices, you can now view the “Advertising ID” of the device. Using Mobile iOS advertising, mobile app developers can identify who is using their mobile applications. DECODE LAST BACKUP DATE Under Device Info, for iOS devices, you can now view the “Last Backup Date” of the device. Application Type Decoding Feature LEO Privacy / Decryption of private pictures, Private Zone - Files private videos and private files AppLock DID YOU KNOW UFED Physical Analyzer allows you to convert the BSSID ANDROID values (wireless networks) into location positions/ specific addresses, so that you can easily reveal and track connections to wireless networks, within a specific timeframe. You can also download an offline database or use Cellebrite’s enrichment service from My.Cellebrite (~60 GB). To ease the download of this large database, you can now download split database files (6 files, 10 GB file size) and Application Type Decoding Feature CM Security load the files into UFED Physical Analyzer. Tools User account Master Antivirus Note: From this version, 6.3, onwards, UFED Physical LEO Privacy / Private bookmarks, decryption Analyzer will merge all database files. Private Zone - of passcode, accounts, VIP cards, Files AppLock bank cards and private albums (file system) SOLVED ISSUES The following issues have been resolved: iOS: NEW AND UPDATED APPS A decoding issue of iCloud backup (Apple ◼ 1 NEW App production data). 166 UPDATED Apps ◼ A localization issue of SIM information under device info in Japanese. Any.DO 4.9.0 ◼ A decoding issue of locations from the Endomondo Aliwangwang 4.1.6 app for Android devices. Badoo 5.4.0 ◼ A decoding issue of call logs from a public pay phone, BeeTalk 2.5.54 the from participant appears as -3. Blendr 5.6.0 ◼ A decoding failure of the WeChat app version 6.5.4 (Android). Booking.com 14.2 ◼ A decoding failure of Samsung GSM GT-E1200i Chatous 3.8.7 Keystone 2. Ctrip 5.0.0 ◼ A decoding issue with missing POI of a TomTom Dropbox 46.2 GPS device model Start 25, type no. 4EN52.