NOW SUPPORTING 20,165 DEVICE PROFILES +2,256 APP VERSIONS UFED TOUCH2, UFED TOUCH, UFED 4PC, RELEASE NOTES UFED PHYSICAL ANALYZER, Version 5.2 | August 2016 UFED LOGICAL ANALYZER HIGHLIGHTS INTRODUCING UFED TOUCH2 DEVICE SUPPORT Accelerate Investigations ◼ Partial File System extraction while bypassing screen lock with Digital Insights from for 105 Samsung Android devices. Cellebrite’s Next Generation Note: Requires the device’s MTP to be turned on. Touch Platform This extraction method is recommended for locked devices, in order to unlock the device and gain access to the data. For unlocked devices, use other methods. • For devices running OS up to and including 5.1.1, the Version 5.2 introduces physical following content types may be extracted: SMS, MMS, extraction while bypassing screen lock for 12 Samsung Galaxy S6, S6 Edge and user accounts, passwords, installed applications, user Note 5, now running on Android OS 6 dictionaries, images/videos and data files. In some cases, the device screen lock PIN or Pattern may be recovered by opening the partial extraction in UFED Physical Analyzer. If available, the information Cellebrite introduces is displayed in the Device Info area. You can use partial File System this information to unlock the device and extract extraction while bypassing screen lock additional data by performing other extraction for 105 Samsung methods, such as Logical, File System or Physical. Android devices • For devices running OS 6.x, partial data files (i.e., images and videos) may be recovered. Screen lock information such as PIN or Pattern will SOLVE MORE CRIMES WITH ACCESS not be recovered. ◼ Advanced Logical and File System extraction and TO SUBJECT’S DATA STORED ON decoding support for Apple devices running iOS 10.x beta APPLE iCLOUD PRODUCTION (limited to unencrypted iTunes backup). Decrypt and decode raw data from Apple iCloud production and APPS SUPPORT other tools. Gain access to nearly all data and settings stored ◼ 8 new applications for iOS and Android devices. on the device, including text messages, call logs, application ◼ Now supporting decoding of call logs for Snapchat information, device settings and much more. application – for both iOS and Android devices. ◼ 527 updated application versions. FORENSIC DEVICE PROFILES v.5.2 Total Logical extraction 124 8,663 GAIN INSIGHTS FROM THE Physical extraction* 84 4,528 WORLD’S MOST POPULAR File System extraction 109 4,571 GAME – POKÉMON GO Extract/disable user lock 72 2,403 Cellebrite’s latest release now provides Total 362 20,165 support for the game that has gone The number of unique mobile devices viral – around the globe. with passcode capabilities is 3,781 *Including GPS devices UFED TOUCH2 A Comprehensive, Standalone Mobile Forensics Solution Built on the industry-proven UFED Touch2 platform, our next generation portable digital forensics solution empowers law enforcement, military, intelligence and e-discovery personnel to speed the capture of critical forensic intelligence and evidence from the widest variety of mobile devices and operating systems. No matter the mission requirements, UFED Touch2 reliably and intuitively extends full logical, physical and file system extraction capabilities where they are needed most – in the field or lab. UFED TOUCH2 KEY FEATURES ◼ Standalone reliability ◼ HTML report viewer for onscreen viewing ◼ Closed platform for forensically sound extractions of reports ◼ Unmatched support for the widest range of ◼ Portable – Integrated battery mobile devices ◼ All-inclusive field-ready operational kit – smaller, ◼ Proprietary hardware, software and boot loaders lighter connector tips, external hard drive and more + Field mobility in most environments ◼ Modern capacitive, high-resolution, multi-touch, intuitive display LEARN MORE NOW! UPDATE EXTRACT DATA FROM BLOCKED APPS Using multiple hash mechanism increases the extraction time. (APK DOWNGRADE) It is recommended to use SHA-256, a strong hashing signature Extract data from blocked apps (APK Downgrade) – Following for data integrity protection. We advise you to turn off the MD5 our 5.0 release you now have the ability to access blocked hashing and use the SHA-256 hashing only. application data via the file system extraction. Version 5.2 now provides the following new capabilities: ◼ Android 6 support - you can now extract app data from devices running Android OS 6. ◼ Support for shared data extractions, in addition to “no shared” data, as in previous versions. Cellebrite Release Notes | v5.2 | August 2016 | 2 OUR RECOMMENDATIONS FOR RETRIEVING THE MOST DATA AVAILABLE ON iOS DEVICES Is the device locked? No Yes 1 2 1 Advanced Logical, File System and Logical extractions With Cellebrite’s UFED Touch2, UFED Touch, UFED 4PC and Unlock with UFED Physical Analyzer you can perform Advanced Logical, Extract with Cellebrite File System and Logical extractions to extract and decode UFED Ultimate data from various iOS devices. 2 Cellebrite’s unique unlocking capabilities With Cellebrite’s UFED and Cellebrite’s CAIS, you can unlock a multitude of Apple devices running various iOS versions. Was the unlock successful? 3 iTunes Backup decoding When the device is locked, you can decode iTunes Backup using UFED Physical Analyzer. Apple users have a couple No Yes of options to back up their devices, using iTunes or using iCloud. iTunes is a local backup of the device, completed when the user connects the device to a trusted PC. 4 Decrypt and decode data produced by Apple and 3 1 other sources You can now decrypt and decode encrypted iCloud search warrant data returned from Apple. iCloud is a remote Extract with iTunes iCloud backup of the device stored on Apple servers. If the user Backup Backup UFED Ultimate decided to back up the information to iCloud, the backup may be initiated when the user is connected to Wi-Fi – anytime and anywhere. The device backup on iCloud contains critical information needed for an investigation. With UFED Physical Analyzer version 5.2, you can decrypt and decode raw data produced by Apple and other tools, Decode with providing you with nearly all the data and settings stored UFED Ultimate on the device, i.e. text messages, call logs, application information and device settings. To decode the iCloud Backup data, use Open (Advanced) function--> Select Device-->Select the Apple vendor or 4 5 search for Apple iCloud (backup) device--> Select the relevant plug-in--> click Next and Finish. Decrypt and Extract and Note: UFED Physical Analyzer supports many different decode data decode with formats of the data produced by Apple (not all formats provided by UFED are supported). Apple with Cloud UFED Ultimate Analyzer 5 Extract and decode iCloud Backup data With UFED Cloud Analyzer 5.2, you can extract a subject’s device content backup stored on iCloud using the iCloud username and password or login information from a PC. Cellebrite Release Notes | v5.2 | August 2016 | 3 UFED PHYSICAL ANALYZER AND UFED LOGICAL ANALYZER FUNCTIONALITY ◼ Disclose cell towers and wireless network connections – ◼ Track list of decoded applications in Trace window – To assist you in tracking a device owner’s connection to cell You can now view logs for each decoded app in the trace log, towers or Wi-Fi networks, you can disclose the duration of such assisting you in tracking the apps decoding progress. connections. These models now include start and end timestamps. ◼ Observe report’s creation time in reports – The report’s creation timestamp is now included in all report formats, allowing you to preserve the exact time you generated a report. ◼ View additional information in the context of device info elements – Each device info element has a tooltip that provides description, additional info or context. REMINDER ◼ Recognize device owner in chats – When analyzing a chat conversation between multiple participants, it may be When merging different extractions in challenging to figure out the device owner. Version 5.2 now UFED Physical Analyzer, you have the indicates the device owner out of the full list of participants in option to configure and include the merged any chat conversation (both in the UI and reports). (duplicate) items within your output report. In the report wizard, there are two settings available: 1) Include merged items (analyzed data). 2) Include merged items (data file). These two settings are unselected by default, meaning ◼ View or hide extraction source information in reports – your report Customize your report and determine whether or not to output will not include the extraction source type in your report. You now include duplicate have the ability to hide this information by selecting the hide items. When extraction source indication when generating a new report. these settings are selected, your report will include all items including duplicate items. The total numbers of items selected for the report may change based on these settings. You may also change the default value of these settings in the general settings. Cellebrite Release Notes | v5.2 | August 2016 | 4 SOLVED ISSUES APP SUPPORT UFED Touch, UFED 4PC 1. Better handling of SIM LTE/4G/NFC extractions. iOS UFED Physical Analyzer, UFED Logical Analyzer 1. Several failure issues when opening the UFED Reader have been resolved. 2. An issue with SMS PDU Search in the Hex windows has been resolved. 3. A decoding issue of SMS messages for Huawei MT7- Application Type Decoding Feature UL00 Ascend Mate 7 device has been resolved. Aliwangwang Social Network User account 4. A decoding issue of SMS messages for LG GB255G Ctrip Chinese Travel User account device has been resolved. 5. A decoding issue of SMS messages for Nokia 108 (RM-944) device has been resolved. ANDROID 6. A decoding issue of deleted SMS messages for Nokia C3-01.5 RM-776 device has been resolved. 7. A decoding issue of BlackBerry Z10 Chip-Off has been resolved. 8. A decoding issue of Nokia Lumia 735 Chip-Off has been resolved.