RELEASE NOTES UFED PHYSICAL ANALYZER, Version 5.0 | March 2016 UFED LOGICAL ANALYZER
Total Page:16
File Type:pdf, Size:1020Kb
NOW SUPPORTING 19,203 DEVICE PROFILES +1,528 APP VERSIONS UFED TOUCH, UFED 4PC, RELEASE NOTES UFED PHYSICAL ANALYZER, Version 5.0 | March 2016 UFED LOGICAL ANALYZER COMMON/KNOWN HIGHLIGHTS System Images IMAGE FILTER ◼ Temporary root (ADB) solution for selected Android Focus on the relevant media files and devices running OS 4.3-5.1.1 – this capability enables file get to the evidence you need fast system and physical extraction methods and decoding from devices running OS 4.3-5.1.1 32-bit with ADB enabled. In addition, this capability enables extraction of apps data for logical extraction. This version EXTRACT DATA FROM BLOCKED APPS adds this capability for 110 devices and many more will First in the Industry – Access blocked application data with file be added in coming releases. system extraction ◼ Enhanced physical extraction while bypassing lock of 27 Samsung Android devices with APQ8084 chipset (Snapdragon 805), including Samsung Galaxy Note 4, Note Edge, and Note 4 Duos. This chipset was previously supported with UFED, but due to operating system EXCLUSIVE: UNIFY MULTIPLE EXTRACTIONS changes, this capability was temporarily unavailable. In the world of devices, operating system changes Merge multiple extractions in single unified report for more frequently, and thus, influence our support abilities. efficient investigations As our ongoing effort to continue to provide our customers with technological breakthroughs, Cellebrite Logical 10K items developed a new method to overcome this barrier. Physical 20K items 22K items ◼ File system and logical extraction and decoding support for iPhone SE Samsung Galaxy S7 and LG G5 devices. File System 15K items ◼ Physical extraction and decoding support for a new family of TomTom devices (including Go 1000 Point Trading, 4CQ01 Go 2505 Mm, 4CT50, 4CR52 Go Live 1015 and 4CS03 Go 2405). Supported content types include contacts, calls and locations, (decryption of trip-logs is NOW SUPPORTING not yet supported). You are required to use cable 303 iPHONE SE, LG G5 & SAMSUNG (TomTom GPS Adapter Cable) to perform this extraction. GALAXY S7 DEVICES File system and logical extractions support for newly released devices FORENSIC DEVICE PROFILES v.5.0 Total Logical extraction 276 8,393 Physical extraction* 377 4,254 NEW VALIDATION CAPABILITY File system extraction 342 4,325 Save time & resources with a new and effective validation process Extract/disable user lock 18 2,231 Total 913 19,203 The number of unique mobile devices with passcode capabilities is 3,417 *Including GPS devices MERGE MULTIPLE MOBILE EXTRACTIONS FOR APPS SUPPORT COLLECTIVE ANALYSIS ◼ New applications for iOS and Android devices: Version 5.0 enables you to merge multiple extractions under Ask.fm, Baidu Maps (iOS), BlackList (Android), Blendr, a single project, and presents a unified view of all the extractions Booking.com, Desk Notes (Android), Dolphin Browser, so you can generate a single unified report. This new feature eBuddy XMS, Endomondo, Expedia, FireFox (iOS), saves you a substantial amount of time that you may have Flipboard (Android), Glide, Google Docs, Google Photos spent reviewing different types of extractions, and reviewing (Android), Google Quick Search (Android), Hide My Text duplicated artifacts. (Android), MeowChat, Mercury Browser, Message Locker – SMS Lock (Android), Momo, OneNote (Android), Puffin THIS FEATURE INCLUDES A THREE-PART PROCESS Web Browser, QQ Browser, Remember The Milk, SKOUT, Merging & Report Generation: Swarm, TunnelBear VPN (Android), Vine, Weibo, Wickr and Yahoo search ◼ Merge any extraction into a single project. All the following ◼ Support for popular Chinese apps, WeChat and extraction types may be combined: Logical, advanced logical, QQ - decoding for voice messages enables investigators file system, physical, SIM card, JTAG, SD Card, Camera to listen to audio recordings, voice messages or push Evidence, and more. to talk is the most popular form of communication on WeChat ◼ Decryption support for WeChat application of secondary users on the same device - Up until now only the main user was decrypted, and now it is enhanced with decoding of all users. ◼ Decryption support for Wickr application for Android devices (iOS is already supported.) ◼ SwiftKey Keyboard Android native app support for Android and iOS devices. SwiftKey learns the words that are frequently used on the device, and enables faster typing, auto correction and prediction. SwiftKey is set as a default keyboard on new Samsung Android devices and can be installed for free on any Android or iOS device. The decoded data can be found under the User Dictionary model. ◼ Decryption of TigerText application for iOS devices. ◼ 205 updated application versions. ◼ Generate a single UFDX file, combining all extraction reports into a single project. Decoding & Analysis: NEW Decode and analyze a single unified project, and avoid analyzing duplicated data. The extracted data is presented under one CABLE! project tree, the Multi Project, and includes various type of extractions from multiple devices. Available viewing options are: ◼ A merged extraction summary and device info of all > GET CABLE NOW extractions, with the ability to drill down to each extraction data. CABLE NO. 170 ◼ View extraction details as part of the Multi Project, including device info, extraction date and time, UFED device used and more. To automatically receive your new cable, update or approve your shipping address in MyCellebrite using the link above. ◼ Every recovered artifact has a source that it was derived from, Now available for all users with an active UFED license, as part which can be used later to validate the data. This source can of your current license. be viewed in the table or in the right pane. Similar and duplicate records are grouped together to enable Cable 170 (for USB Type-C connectors) enables extractions ◼ for quick and efficient analysis. from newer device models that use the new USB standard. Devices include Microsoft Lumia 950 (RM-1105), OnePlus 2 (A2001), LG Nexus 5X (LG-H790) and Huawei Nexus 6P (H1511). Cellebrite Release Notes | v5.0 | March 2016 | 2 ◼ Filter the extracted items, and manage the displayed info to Any record will now include file source information in a table filter out deduplications. The duplicated record can be viewed view or in the right pane, including device information. Each link in the Analyzed data area on the right-hand pane, together points to the offset data and includes the source file name. with the source extraction for the data. The source file information can also be included in the UFED report. REVIEW MEDIA FILES IN LESS TIME As part of the decoding process, hash value of any extracted data file, particularly for media files, is now calculated. UFED Physical Analyzer 5.0 automatically filters out common/known images. This feature saves investigation time that would otherwise be spent reviewing hundreds, if not thousands of common media images that are device files, or images that come as part of app installation. With the automatic filter, you can focus on the relevant media files, and get to the Reporting: evidence you need fast. Note: you have the option to view all ◼ Generate and share a single, comprehensive report with the the images on the device, including common images (either with investigator, prosecutor and other relevant parties. filter reset or in by removing the auto-filter option in ◼ Generate a unified report of all merged extractions, with an the Settings). indication of the original extraction source. UFED Link Analysis will handle the UFDR as well as multiple extractions from different devices as a single source. Learn more about this feature in the UFED Physical Analyzer and UFED Logical Analyzer user manual, available in MyCellebrite. DISCOVER THE MOST EFFICIENT WAY TO VALIDATE YOUR EXTRACTED MOBILE DATA Your usual extraction process may involve using different tools to recover the data, so you can later compare and validate the results. This is a very time consuming process. UFED Physical For all data files, you now have the ability to view the MD5 hash Analyzer 5.0 introduces a new and effective validation process value per file in the UI and in the report output. Also, export to help you save both time and resources. The latest version hash values into Excel, so you can easily compare suspicious or includes file source information that helps you validate the unidentified hash values with your databases. decoded data, and enables you to view its source in the hex viewer by enabling you to open the original source file that the specific record originated from. This is the most effective and most efficient way to perform a real and accurate validation process. This capability reduces the need to perform another extraction of the same device using multiple mobile forensic tools. Cellebrite Release Notes | v5.0 | March 2016 | 3 FIRST IN THE INDUSTRY – FILE SYSTEM ◼ Identify your device using its IMEI – These days, it is challenging to identify the model of a mobile device at first EXTRACTION OF BLOCKED APPLICATION DATA! glance – the exterior of many devices look the same, lacking Note: The Android Backup APK Downgrade method should be used only as a last resort after other extraction methods have been exhausted (including JTAG and chip-off). This method extracts application data using the Android backup service. During the process, the selected application (*.apk file) is temporarily downgraded to an earlier version, so that the data can be extracted. The current version is restored at the end of the extraction process. It is possible that varying non-user data may be deleted during the downgrade. Physical extraction is the most comprehensive extraction method, providing you access to all the data on the device. Unfortunately, not all devices are supported for physical extraction. UFED 5.0 enables you to overcome this limitation by permitting access to data on the device, both intact and a model’s make and/or model.