Home

UFED User Guide_June

image

Contents

1. 58 9 2 1 Bluetooth scan 58 9 2 2 Switch to CDMA offline mode 59 9 2 3 Test Peek Poke functionality 59 9 2 4 Activate TomTom trip log 59 Chapter 10 Services eese 60 10 1 Overview 60 10 2 UFED Services 60 10 2 1 60 10 2 2 Software Versions 60 10 2 3 Counters 61 10 2 4 ted 61 10 2 5 Network Settings 61 10 2 6 Screen 62 10 2 7 Time and 62 10 2 8 User Settings 62 10 2 13 UFED Settings 64 10 2 19 Admin 5 66 Chapter 11 Using Bluetooth Connectivity 67 11 1 Overview ssssssseseeeeeeeen nennen 67 11 2 Phone Settings ssssssssssees 67 11 3 UFED Bluetooth Adapter 67 11 4 Pairing with the Source Device via Bluetooth 68 Chapter 12 Using the Power up Cable 69 User Manual 12 1 Overview 69 12 2 Connecting the Power up cable 69 Chapter 13 Upgrading the UF
2. 4 Inthe list of found devices use the A W keys to scroll to a device then press gt 5 To complete the pairing enter the displayed code in the device 10 2 2 Switch to CDMA offline mode This tool enables you to switch radio on CDMA devices to offline mode 10 2 3 Test Peek Poke functionality This tool enables you to perform a Peek Poke test in order to check if the device is supported by the UFED 10 2 4 Activate TomTom trip log This tool enables you to activate or deactivate the trip log sharing feature of a connected TomTom device which is often disabled by the user 1 Select Activate TomTom trip log and press gt or OK 2 Usethe A WV keys to select the option Enable or Disable then press or OK 3 Connect a TomTom device to the UFED then press gt Cellebrite UFED User Manual 59 Chapter 10 Services Chapter 10 Services 11 1 Overview The Services option on the Main Menu allows you to perform various administrative tasks for the UFED Physical Extraction File System Extraction Extract Passwords Device Tools 11 2 UFED Services 11 2 1 Upgrade The Upgrade process enables you perform software upgrades for the UFED For a detailed description of the Upgrade process see Upgrading the UFED on page 71 11 2 2 Software Versions Selecting this option displays the current version numbers and system information 60 Cellebrite UFED User Manual Chapter 10 Services App T
3. Follow the steps below to perform a file system extraction from a source device 1 Main Menu Select File System Dump from the Main Menu Use the AW keys to move between options Press OK or p gt to continue Source Vendor Select the vendor manufacturer of the source device Use the AW keys to move between options Press OK or to continue Source Model Select the device model Use the A V keys to move between options Press OK or to continue To return to the previous menu press 4 Extract Phone Data Extract SIM USIM Data SIM ID BlackBerry COMA BlackBerry GSM Cellebrite UFED User Manual Chapter 7 Performing File System Extraction 4 Target Selection Select the target location where the content will be copied to USB Flash Drive The content is stored in a separate directory on a USB disk drive connected to the TARGET USB port on the right panel of the UFED SDCard The content is stored in a separate directory on an SD card inserted in the SD card reader slot on the left panel of the UFED PC The content goes directly into the UFED Physical Analyzer application via a mini USB to USB cable connection between the mini USB port on the back panel of the UFED and a the PC Use the A Wkeys to move between options Press OK or gt to continue 5 Extraction Instructions Make sure that the source device and selected target are appropriately connect
4. Extracting Passwords 6 Extraction Instructions Make sure that the source device and selected target are appropriately connected to the UFED Press to start extraction NOTE When connecting the device to the UFED unit some device models will prompt you to select the connection mode on the device s display screen Choose Data Mode PC or PC Sync mode Actual selection choice will vary depending on the device model Completion When the extraction process is completed the password information will be displayed on the screen When the device has more than one password multiple passwords will be shown Cellebrite UFED User Manual Source Connect cable 53 288 Target Display Only User code 12345 57 Chapter 9 Device Tools Chapter 9 Device Tools 10 1 Overview The Device Tools option on the Main Menu allows you to run specific operations Physical Extraction File System Extraction Extract Passwords levice Tools services 10 2 UFED Device Tools 10 2 1 Bluetooth scan This tool will scan for available Bluetooth devices in your proximity and allow you to pair with them 1 Make sure that the Bluetooth feature of the device is enabled 2 Select Bluetooth scan and press or OK 3 Make sure that the Bluetooth dongle is connected to the UFED and press p 58 Cellebrite UFED User Manual Chapter 9 Device Tools The UFED will scan for available devices
5. Press OK or p to continue 6 Advanced Settings optional If you wish to add SPN GID1 and GID2 settings to the SIM card select Yes at the Advanced Settings menu Otherwise select No Use the A V keys to move between options Press OK or p to continue Cellebrite UFED User Manual 35 Chapter 5 Cloning a SIM ID 7 Insert Target Card Insert a blank UFED SIM ID Access Card to the SIM card reader slot at the front panel of the UFED as shown with the SIM card contacts facing down Figure 14 Insert Target SIM card Press to continue Completion Upon completion of the SIM Cloning process a successful cloning message will be displayed detailing the ICCID and IMSI data of the cloned SIM card You can now insert the cloned SIM card into the device and continue evaluating it Insert SIM ID dem Card into the with the SIM card s contacts facing down and the clipped corner ne SIM ID pie Card created cessfull ICCID 83372588888 BABBAGE IMSI 425838888BB8836 Cellebrite UFED User Manual Chapter 5 Cloning a SIM ID 5 5 Creating a GSM Test SIM Card The GSM test SIM card is used to extract phone data when the original SIM is not available a default ICCID and IMSI are programmed into the Cloned SIM ID Card to mimic the original missing card Follow the steps below to create a GSM test SIM card 1 Main Menu Select CI IM ID from the Main M
6. 4 3 Extracting SIM USIM Data to USB Disk Drive or fo DY TEE ER 26 Chapter 5 Cloning a SIM ID 30 5 1 Overview ute dec tp 30 5 2 Flowchart eene 31 5 3 Cloning an Existing SIM 31 5 4 Manually Creating a Clone SIM Card 34 5 5 Creating a GSM Test SIM Card 37 Chapter 6 Performing Physical Extraction 39 6 1 39 6 2 Flowchart eee 39 6 3 Performing a Physical Extraction 40 6 4 Physical Extraction from a Cloned Chinese DEVICES ni iet rettet here 43 6 4 1 Getting 43 6 4 2 Connecting to the Source Device 44 6 4 3 Performing the Physical Extraction 46 Cellebrite UFED User Manual Chapter 7 Performing File System Extraction 50 7 1 OVENI EW aia aaraa aaan ra aa ia tenen 50 Tes PIOWCM AE E 50 7 3 Performing a File System Extraction 51 Chapter 8 Extracting Passwords 54 8 1 Overview ssssssssssseseeeeeeenen nenne 54 8 2 Flo WChart te eee 54 8 3 Performing Passwords Extraction 55 Chapter 9 Device Tools 58 9 1 OVOrVIGW iacet e epe 58 9 2 UFED Device
7. Analyzer Report Manager application via a mini USB to USB cable connection between the mini USB port on the back panel of the UFED and a the PC Use the A Wkeys to move between options Press OK or gt to continue 5 Extraction Instructions Make sure that the source device and selected target are source d CHINE appropriately connected to the UFED adapter Target USB Flash Drive Press to start extraction A beep will sound when a successful connection was established start between the UFED and EPA units Cellebrite UFED User Manual 47 Chapter 6 Performing Physical Extraction 6 Power the Device Press and hold the device s power button Keep holding the power button pressed until the extraction process begins Starting the Process The UFED unit will try to connect with the connected device Press and hold the phone s POWER button until the dump process starts When Connecting is displayed release the power button If the connecting process fails try using a different tip see step 5 of Connecting to the Source Device on page 44 Press to return to step 6 of the process Keep trying different tips until you succeed or have exhausted all available options Completion Upon the completion of the process the UFED will displays the Extraction Summary message To view and analyze the extracted data please open it using the UFED Physical Analyzer application
8. Cellebrite UFED User Manual 81 celebrite delivering mobile expertise 15 2 1 system UFED Universal Forensic Extraction Device User Manual Version 1 1 9 7 March 2012
9. Perform a physical data extraction from the device See Performing Physical Extraction on page 39 File System Extraction Extracts the file system from the device See Performing File System Extraction on page 50 Cellebrite UFED User Manual Chapter 2 Getting Started Extract Passwords Extracts various device passwords See Extracting Passwords on page 54 Device Tools Enables you to run various operations on devices such as Bluetooth scan switch to CDMA offline mode and activate TomTom Trip log See Device Tools on page 58 Services Enables you to perform various administrative tasks or configure the default parameters within the UFED See Services on page 60 2 2 UFED Menu Navigation The UFED shows the menu options on the display To navigate through the menu Use the A V keys to move between options To select an option press gt or the OK key To return to the previous menu press When additional help is available a help icon will appear in the upper left area of the screen Press F1 to view this help Cellebrite UFED User Manual 11 Chapter 3 Extracting Device Data Chapter 3 Extracting Device Data 3 1 Overview Select Extract Phone Data from the Main Menu in order to copy data from a device the source to a PC USB or SD card the target Use this function to extract phonebook SMS text messages pictures videos etc from mobile device memory to a USB disk drive SD c
10. Source Physical amp Target Extraction Figure 16 The Physical Extraction flowchart Cellebrite UFED User Manual 39 Chapter 6 Performing Physical Extraction 7 3 Performing a Physical Extraction 40 Follow the steps below to perform a physical extraction from a source device 1 Main Menu Select Physical Extraction from the Main Menu Use the A V keys to move between options Press OK or gt to continue Source Vendor Select the vendor manufacturer of the source device Select the Recently Used option to select a device from the list of recently used devices or Use the A W keys to move between options Press OK or to continue Source Model Select the device model Use the A W keys to move between options Press OK or continue To return to the previous menu press Extract Phone Data Extract SIM USIM Data Clone SIM ID xx Recently Used i Rudiavox UTStarcom PCO E181 5200 F1 neoTouch Cellebrite UFED User Manual Chapter 6 Performing Physical Extraction 4 Target Selection Select the target location where the content will be copied to USB Flash Drive The content is stored in a separate directory on a USB disk drive connected to the TARGET USB port on the right panel of the UFED SD Card The content is stored in a separate directory on an SD card inserted in the SD card reader slot on the left panel of the UFED elect
11. connected phone feature When disabled the Auto Detect option will not be available in the list of vendors of the Extract Phone Data process 11 2 10 User interface Language Set the UFED menu language Silent Mode Mutes all UFED sounds Cellebrite UFED User Manual Chapter 10 Services Failure Notification Beeps when a UFED operation fails Connect Device Prompt UFED prompt to connect the target device after the reading process Turning this feature off will save time by eliminating prompts during the extraction process Estimated Transfer Time Turns or off the extraction time estimation which appears during the extraction process Help Instructions Sets how the help information are displayed e F1 only Displayed only when the user presses the F1 key Prompt User Prompt the user to display the help information 11 2 11 Global Settings Create Log file Sets the log files creation mode e Disable Set not to generate log files e Enable Set to generate log files If the transaction is very fast we won t write all the information to the log e Enable blocking the transaction will be slower in order to write to the log Recommended in case of debugging error situation Restore Factory Defaults Reset the UFED to the original factory settings Cellebrite UFED User Manual 63 Chapter 10 Services 64 11 2 12 Phonebook Setting Order
12. directly from a SIM card The extracted data is copied to any standard USB drive SD card or a PC The logical extraction data can be displayed by the UFED Reader application and UFED Logical Analyzer application replacing the legacy Report Manager on your PC while both logical and physical extraction data can be decoded and analyzed and displayed by the UFED Physical Analyzer application on your PC The UFED Logical Analyzer Report Manager and UFED Physical Analyzer applications can also generate detailed reports of the extracted data that can be used as evidence Figure 1 The UFED work flow overview Cellebrite UFED User Manual Chapter 1 Introduction 1 2 Supported Devices A list of supported devices and the data extraction capabilities for each device can be found in the following places In the UFED XXXX Supported Phone List i Microsoft Excel file delivered with each version update of the UFED software The file contains T two worksheets e UFED Logical listing the supported devices for logical extraction e UFED Physical listing the supported devices for the physical file system and password pay P Figure 2 The supported devices list Excel file extraction Using the UFED Phone Detective application logical extraction only In the Cellebrite web site at the following addresses e Logical extraction http www cellebrite com mobile forensics products forensics p
13. gt to continue Source Model Select the source device model NOTE If you do not know the model you can often find the device model on a sticker beneath the battery Use the AW keys to move between options Press OK or gt to continue Cellebrite UFED User Manual Extract SIM USIM Data Clone SIM ID Physical Extraction stem Extraction Motorola COMA Motorola GSM Motorola Nokia COMA 55 Chapter 8 Extracting Passwords 56 4 Target Selection Select the target location where the content will be copied to USB Flash Drive The extracted passwords are stored on a USB disk drive connected to the TARGET USB port on the right panel of the UFED SD Card The extracted passwords are stored on an SD card inserted in the SD card reader slot on the left panel of the UFED PC The extracted passwords are stored on the connected PC Display Only The extracted passwords will be displayed on the UFED screen without storing them Use the A Wkeys to move between options Press OK or gt to continue 5 Connect Target Media If you have not yet plugged the USB drive or SD card into the UFED do it now The UFED is ready to copy the data to the storage device NOTE USB disk drive storage media should be connected to right side Target port SD card storage media should be inserted in the SD card slot on the left side of the UFED unit Cellebrite UFED User Manual Chapter 8
14. press to continue Cellebrite UFED User Manual 67 Chapter 11 Using Bluetooth Connectivity 12 4 Pairing with the Source Device via Bluetooth The UFED searches for visible Bluetooth devices within its proximity and provides a list of all devices that it finds Select the appropriate device from this list Use the AW keys to move between options Press to continue The UFED then instructs you to enter 0000 in the phone to complete the paring between the devices Once doing this all data transfer between the UFED and the phone will be performed using Bluetooth 68 Cellebrite UFED User Manual Chapter 12 Using the Power up Cable Chapter 12 Using the Power up Cable 13 1 Overview while performing an extraction The Power up Cable contains 4 parts The Power up Cable optional powers the device instead of the battery marked as Data Extra power E d 13 2 Connecting the Power up cable 1 Connect the Extra Power connector to the UFED USB Port Extension 2 Connect the Data connector to the UFED SOURCE USB Port Extension 3 Identifying the Device s Battery Contacts Open the device battery cover Locate the positive and negative pole markings of the battery usually found next to the contacts area sure that the battery contacts are marked clearly on the device s body Remove the battery in order to gain access to the de
15. Auto Upgrade Settings 2 Enabling With the Enable Automatic Upgrade option selected press OK Use the W key to move to the Enable option then press OK to select it Press to Save and exit back to the Auto Upgrade Settings menu Cellebrite UFED User Manual Chapter 13 Upgrading the UFED 3 Upgrade Method Use the W key to move to the Method option then press OK Use the A W keys to move between the options FTP The UFED will access an FTP site in order to get the upgrade files HTTP The UFED will use HTTP to access the upgrade files Press OK to select highlighted option Press to Save and exit back to the Auto Upgrade Settings menu Next set the following settings according to your preferences and your network requirements as described in the following table Option Description Auto Upgrade Period Choose how often you want the UFED to check for upgrades Daily Weekly or Monthly FTP Settings If you chose FTP for your upgrade method specify the following FTP details as provided by your distributor Cellebrite UFED User Manual 77 Chapter 13 Upgrading the UFED FTP Address Port Number Username Password Press F3 after each screen in order to continue FTP Proxy Settings Direct Connect Choose this if your network security does not require a proxy to access external FTP sites Use Proxy If a proxy is needed choose this option You will then be asked to
16. Change between Last Name First Name and First Name Last Name ordering when copying phonebook data 11 2 13 UFED Settings 11 2 14 Report Information If these options are enabled it allows you to enter free text such as case file number examiner s name department location and notes to be added to each transfer process as part of the report The user will be prompted during the transfer process to enter the values for these fields This data will automatically be added to the Examination Report 11 2 15 Mobile Client Settings Client Covert mode Rename the application client name from Cellebrite sis exe to AAA sis exe Client Uninstall Reminder When enabled the UFED will prompt the user to uninstall the client from the examined smartphone 11 2 16 Report Settings Report Language Sets the generated reports language Report Format Sets the generated reports visual formats Normal The standard report structure suitable to standard display screens Cellebrite UFED User Manual Chapter 10 Services Compact A compact report structure suitable for devices with a small display area Show 5 in report Toggles the display of the MD5 values which are generated for each file in the extracted data Create MD5 list file Generates a Checksums md5 file that contains all the generated MD5 values of the extracted data Show SHA256 in report Toggles the display of the SHA 256 va
17. ED 71 13 1 71 13 2 Upgrading from USB Disk Drive or SD Card 72 13 3 Upgrading from a 73 13 4 Upgrading from the Web 75 13 5 Setting Automatic Upgrade from the Web 76 Appendix A Technical Specifications 79 iv Chapter 1 Introduction 1 1 Overview The Cellebrite Universal Forensic Extraction Device UFED empowers law enforcement anti terror and security organizations to capture critical forensic evidence from mobile phones smartphones PDAs portable GPS devices and other devices Cellebrite s industry expertise provides reliability and ease of use and ensures the broadest support for handset varieties including updates for newly released models UFED extracts vital data such as phonebook images videos audio text messages SMS call logs ESN IMEI ICCID and IMSI information from many handset models including BlackBerry Android iOS Symbian Microsoft Mobile and Palm OS devices The UFED enables you to perform Logical extraction of device data Physical extraction of device memory M Physical extraction of SIM data File system extraction SIM ID Cloning User Manual 1 Chapter 1 Introduction Password extraction The UFED can extract data from a device using a cable Bluetooth or infrared connection or
18. ED s source or target infrared port ri Extraction Instructions Source Connect Cable 73 Target PC Abac Make sure that the UFED is connected to the PC using the mini USB cable to USB Cellebrite UFED User Manual 21 Chapter 3 Extracting Device Data 22 source device is powered on and the data connector is clean NOTE When connected to the UFED some devices will prompt you to choose an operating mode such as PC Suite or Phone Mode Press to continue The UFED now extracts the selected data to its internal memory the following message will appear at the end of the extraction Run the UFED Logical Analyzer Report Manager On your PC run the UFED Logical Analyzer Report Manager application a Click on read icon PC to Select Start gt Programs gt Cellebrite Mobile Synchronization gt start the extraction process UFED Logical Analyzer Click the Read phone button NOTE If the extracted device is a Smartphone or PDA you may be prompted to install a client application on the device Press to continue Extraction The UFED now sends the extracted data from its internal memory to the PC Upon the completion of the process you may disconnect the source device and PC from the UFED Cellebrite UFED User Manual Chapter 3 Extracting Device Data 3 5 Extracting Data from Locked Nokia Devices Cellebrite s cable number 200 enables you to extra
19. M ID Access Card created message will be displayed detailing the ICCID and IMSI data of the successfull cloned SIM card ICCID 83997 IMSI 42583888B8BBBBGb You can now insert the cloned SIM card into the device and continue evaluating it Cellebrite UFED User Manual 33 Chapter 5 Cloning a SIM ID 5 4 Manually Creating a Cloned SIM Card Follow the steps below to create a cloned SIM card by manually entering the SIM card data 34 1 Main Menu Select Clone SIM ID from the Main Menu Use the A V keys to move between options Press OK or gt to continue Select Source Select the Manually enter SIM data option Use the AW keys to move between options Press OK or gt to continue Enter ICCID Enter the ICCID number up to 20 digits Use the A V keys to highlight a digit and press gt to enter the highlighted digit When finished press F3 to continue Extract Phone Data Extract SIMZUSIM Data lone Physical Extraction File System Extraction Clone an existing SIM Card enter SIM Cellebrite UFED User Manual Chapter 5 Cloning a SIM ID 4 Enter IMSI Enter the IMSI number up to 15 digits Use the A V keys to highlight a digit and press to enter the highlighted digit When finished press F3 to continue 5 Language Preferences optional Specify the default language preference for the SIM card Use the AW keys to move between options
20. Manual Chapter 4 Extracting SIM USIM Data Chapter 4 Extracting SIM USIM Data 4 1 Overview Your UFED is equipped an integrated SIM USIM card reader located at the front panel of the UFED as shown below Figure 9 The SIM USIM card reader You can use this SIM reader to extract data directly from the SIM card instead of via the device or when the SIM card is not accessible via the device Besides the physical extraction of the SIM card data the extracted data may include additional SIM data such as the SIM ICCID and IMSI SMS messages deleted SMS messages phonebook records and more Cellebrite UFED User Manual 25 Chapter 4 Extracting SIM USIM Data 4 2 Flowchart Figure 10 The Extract SIM USIM Data flowchart Extract Data View Reports 4 3 Extracting SIM USIM Data to USB Disk Drive or SD Card Follow the steps below to perform a data extraction from a SIM USIM card 1 Insert SIM Insert the SIM USIM card to the SIM card reader slot at the front panel of the UFED as shown with the SIM card contacts facing down cui Figure 11 Insert SIM USIM card 26 Cellebrite UFED User Manual Chapter 4 Extracting SIM USIM Data 2 Main Menu rie Select Extract SIM USIM Data from the Main Menu Extract Phone Data 1 USIM Data Use the AW keys to move between options Press OK or to continue Physical Extraction File System Extraction 3 Source Model Se
21. NOTE Chinese device physical extraction requires special license File 1 HAOHD BxBBBBBBBE BxBd2BBB Progress Sd Extraction completed successfully For more information about license updating see Upgrading the UFED on page 71 Cellebrite UFED User Manual Chapter 6 Performing Physical Extraction For more information about Chinese devices physical extraction see the video tutorials on the Cellebrite website and the Cellebrite YouTube channel Cellebrite UFED User Manual 49 Chapter 7 Performing File System Extraction Chapter 7 Performing File System Extraction 8 1 Overview TheFile System Extraction option extracts all the accessible files on the mobile device using a logical process Extracting the file system is an alternative way to get data from devices including device models that are not currently supported with physical extraction UFED Physical Analyzer provides access and extracts hidden files and databases inaccessible by other file system acquisition tools From the extracted file system you can get many different types of files that can be decoded and then searched for information such as the Contacts or SMS database files 8 2 Flowchart 50 Connect Source File System amp Target Extraction Figure 17 The File System Extraction flowchart Cellebrite UFED User Manual Chapter 7 Performing File System Extraction 8 3 Performing a File System Extraction
22. OK or to continue 2 Select Source Select the Clone an Existing SIM Card option Lione an existing gt anuall enter data Use the A V keys to move between options Create SM Test SIM Press OK or gt to continue Cellebrite UFED User Manual 31 Chapter 5 Cloning a SIM ID 32 3 Insert Source SIM Insert the source SIM USIM card you wish to clone to the SIM card reader slot at the front panel of the UFED as shown with the SIM card contacts facing down 18 Figure 13 Insert Source SIM card Press to continue Select Partition to Read If the card is a 3G SIM card you will be prompted to select the partition that will be cloned Use the A Wkeys to move between options Press OK or gt to continue Insert Source SIM into the UFED with the SIM card s contacts facing down and the clipped corner pointing The UFED now reads the data from the source SIM card storing it in its internal memory Cellebrite UFED User Manual Chapter 5 Cloning a SIM ID 5 Insert Target Card Remove the source SIM card from the SIM card reader slot and insert Insert SIM ID vem Card a blank UFED SIM ID Access Card to the SIM card reader slot with into the UFED with the SIM the SIM card contacts facing down card s contacts facing down and the clipped corner Press to continue HL ontinue 6 Completion Upon completion of the SIM Cloning process a successful cloning SI
23. PC as described below Cellebrite UFED User Manual 73 Chapter 13 Upgrading the UFED 74 On the UFED 1 Select Upgrade Type and Source Select Services Upgrade then choose the type of upgrade Application Image Settings or License and select PC as the source for the upgrade Use the A V keys to move between options Press OK or p to continue On the PC 2 Run the Upgrade Program Select Start gt Programs gt Cellebrite gt Upgrade Program e Selecting the Upgrade Type Select the upgrade type according to the type that you chose in step 1 4 Connect the UFED to the PC Use the USB to mini USB cable provided in the kit to connect between any of the USB port on your PC and the PC mini USB port at the back connections panel of the UFED 5 Start the Upgrade Process Follow the steps displayed by the PC application 6 Upgrade The UFED now performs the upgrade Do not interrupt the UFED until the full process is complete Cellebrite UFED User Manual Chapter 13 Upgrading the UFED 7 Finish At the end of the upgrade process a message indicating a successful update is displayed The UFED will then restart automatically and return you to the Main Menu 14 4 Upgrading from the Web 1 Configure HTTP Settings one time only To upgrade from the web first make sure that the FTP HTTP settings are initialized properly For most network environments the UFED comes pre configured properly In some cas
24. UFED User Manual Chapter 6 Performing Physical Extraction 7 4 Physical Extraction from a Cloned Chinese Device Performing a physical extraction of a cloned Chinese device requires a special license see Upgrading the UFED on page 71 and the Cellebrite UFED CHINEX kit to connect the source device to the UFED For more information see the video tutorials on the Cellebrite web site and the Cellebrite YouTube channel 7 4 4 Getting Started 1 Locate the device s power button 2 Check if either of the two adapter cables fit the device s data connector 3 Find all the connecting tips that fit the device s connectors NOTE Some devices use the headphone connector for data although they have other connectors Make sure to find all the possible tips that fit the device s connectors including 3 5 or 2 5 mm headphone jack 4 ldentifying the Device s Battery Contacts CT WEINO 0027 Open the device battery cover LI Locate the positive and negative pole markings of the battery usually found next to the contacts area sure that the battery contacts are marked clearly on the device s body Remove the battery in order to gain access to the device s Cellebrite UFED User Manual 43 Chapter 6 Performing Physical Extraction battery contacts TIP For battery contacts which are not clearly marked on the device s body use the pole markings on the battery
25. apter 1 Introduction ees 1 1215 OVOIVIeW te eet 1 1 2 Supported Devices 3 1 3 UFED Kit Contents 4 1 4 UFED Device 7 1 4 1 General Overview 7 1 5 Ruggedized UFED Rubber Casing 8 1 6 Power and Battery Options 8 1 6 1 The Battery Components 8 1 6 2 Switching to Battery Power 9 1 6 3 Charging the Battery 9 1 6 4 Battery LED 9 Chapter 2 Getting Started 10 User Manual 271 5 om tote tdt 10 2 2 UFED Menu 11 Chapter 3 Extracting Device Data 12 QVOIVIOW cen ease i ids 12 3 2 atta bts 12 3 3 Extracting Device Data to USB Disk Drive or SD Gri EH 13 3 4 Extracting Device Data to a PC 20 3 5 Extracting Data from Locked Nokia Devices 23 3 6 Smart Phones PDA Support 24 3 6 1 Client Application Prompts 24 Chapter 4 Extracting SIM USIM Data 25 4 1 Overview sssssssssseseeeen entente 25 4 2 Flowchart in iet eredi 26
26. ard or directly to a PC There are only slight differences in the procedure when the target is a USB disk drive or a PC Both procedures are described below Refer to the procedure relevant to you 3 2 Flowchart Connect f Source amp Extract Data E Target 12 Figure 8 The Extract Phone Data flowchart NOTE The UFED Phone Detective application can assist you to make a positive identification of the device Cellebrite UFED User Manual Chapter 3 Extracting Device Data 3 3 Extracting Device Data to USB Disk Drive or SD Card Follow the steps below to perform a data extraction from a source device to a USB disk drive or an SD card 1 Main Menu Select Extract Phone Data from the Main Menu Use the AW keys to move between options Press OK or gt to continue 2 Source Vendor Select the vendor manufacturer of the source device Use the A V keys to move between options e Select the Recently Used option to select a device from the list of recently used devices e Select the Auto Detect option to attempt automatic detection of a connected device Press OK or to continue 3 Source Model Select the source device model Cellebrite UFED User Manual Extract Phone Data tract SiM USM Uata Clone SIM ID Physical Extraction File System Extraction SGH BCAT SGH ZY 18 2v38 SGH ZY48 13 Chapter 3 Extracting Device Data NOTE If you do not know the model you can often find the
27. body to identify them To do that simply flip the battery along its contacts edge and place it along the edge of the battery housing then mark the device s contacts according to those on the battery NOTE Use a multimeter to identify the positive and negative poles of an unmarked battery 7 4 2 Connecting to the Source Device 1 Using the supplied USB A to B cable Connect the Enhanced Phone Adapter EPA unit figure A to the SOURCE USB port on the left side of the UFED figure B Connect a target USB drive SD card or computer to the appropriate TARGET USB port on the right side of the UFED 2 Connect the appropriate cable to the cable connector of the EPA unit if not yet connected Use either adapter cable 1 that fits the device s data connector generic cable 2 in order to use the connecting tips that were found to fit any of the device s connectors AA Cellebrite UFED User Manual Chapter 6 Performing Physical Extraction 3 Remove the device battery to expose the battery contacts 4 Connect the RED alligator clip to the device s positive pole and the Black alligator clip to the negative pole Make sure the alligator clips are not closing a circuit by touching each other NOTE A beeping alarm will sound if the exposed sections of the attached alligator clips are touching each other 5 Connect the adapter or generic cable to appropriate device connecto
28. celebrite delivering mobile expertise Cseres LEGAL NOTICES This manual is delivered subject to the following conditions and restrictions This manual contains proprietary information belonging to Cellebrite Mobile Synchronization Ltd Such information is supplied solely for the purpose of assisting explicitly and properly authorized users of the UFED No part of this content may be used for any other purpose disclosed to any person or firm or reproduced by any means electronic or mechanical without the express prior written permission of Cellebrite Ltd The text and graphics are for the purpose of illustration and reference only The specifications on which they are based are subject to change without notice nformation in this document is subject to change without notice Corporate and individual names and data used in examples herein are Fictitious unless otherwise noted Copyright 2012 Cellebrite Mobile Synchronization Ltd All rights reserved WARNING The UFED should be used only with the dedicated AC DC adapter supplied with this device WARNING USB Ethernet and target and source connectors should be connected only to CE ap proved devices according to IEC EN 60065 standard WARNING Make sure that all external connections to other devices except for the power adapter are only indoor and SELV safety extra low voltage not exceed 42 4 V peak or 60 VDC User Manual i Table of Contents Ch
29. ct data from locked Nokia devices To use cable 200 1 Remove the device battery 2 Connect one side of the Nokia JAF adapter to battery contacts of the device 3 Connect the other side of the Nokia JAF adapter to Cellebrite Cable 200 4 Continue the data extraction process as described in Extracting Device Data to USB Disk Drive or SD Card on page 13 and Cellebrite UFED User Manual 23 Chapter 3 Extracting Device Data 5 Extracting Device Data to a PC on page 20 3 6 Smartphones PDA Support 24 When extracting data from Smartphones or PDA s you will be prompted to upload a client application from the UFED to the phone This application enables access to the phone memory NOTE Client application upload is not necessary for BlackBerry and Symbian 3rd edition phones 3 6 1 Client Application Prompts Client Upload When necessary the UFED will inform you to upload the client application as follows Install Client Prompt The UFED instructs you to run the installation on the device Install and Run the client If the device prompts you to install the client application follow the installation steps and then run the application You can identify the client application by the ze icon NOTE Pressing F1 on the UFED to get the exact path to the client application on the device After completing the entire extraction process you can uninstall the client application from the device Cellebrite UFED User
30. device model on a sticker beneath the battery Use the A V keys to move between options Press OK or to continue To return to the previous menu press 4 Source Memory Select the source memory locations you wish to extract Use the A VW keys to move between options e Press OK to select the currently highlighted option or press F2 to select all Press to continue NOTE Some devices do not allow access to the SIM card data via the data cable In these cases you will be prompted during the process to remove the SIM card and insert it into the SIM Card Slot Source Link This step determines how the device will connect to the UFED This message appears only if the device supports more than one IrDA infrared connection method Cable Bluetooth or IrDA Infrared Use the A V keys to move between options Press OK or gt to continue Cellebrite UFED User Manual Chapter 3 Extracting Device Data NOTE For best performance we recommend using a cable connection whenever possible The appropriate cable number will be displayed in the Extraction Instructions see step 9 or can be found in the UFED Phone Detective application or at the UFED supported device excel In addition the information extraction from the device can vary based on the link used 6 Target Selection Select the target location where the content will be copied to e PC The content goes directly into the UFED Logical Analy
31. e Connect SIM Card Press to start extraction Target USB Flash Drive NOTE If the SIM card is protected with a PIN you will be prompted to enter the PIN during the extraction process To enter the PIN code tart use the AW keys to move the cursor to the required digit and press OK to select that digit Repeat this for each digit of the PIN To delete a digit press the key When complete press F3 Cellebrite UFED User Manual Chapter 4 Extracting SIM USIM Data 7 Completion Upon the completion of the process the UFED will displays the Extraction Summary message Source Connect SIM Card The transfer process is complete and you may now disconnect the Target USB Flash Drive Source device and the Target media from the UFED device To view the extracted data connect the target media to a PC via a USB port or an SD card reader The target media should include a bac start new folder named in the following format UFED SIM CARD 2G 3G SIM and date of extraction The folder contains the following files 001 CAL 001 001 CLOG 001 SMS Backup_ExtractionDate Backup ExtractionDate _ 001 _ 001 Backup ExtractionDate 001 Backup ExtractionDate 001 Report xml 3 HTML files that can be accessed from a web browser named Report html PhoneBook Extraction date 001 html and SMSMasseges Extraction date 001 html Cellebrite UFED User Manual 29 Chapter 5 Cloning a SIM ID Chap
32. ected according to the source link selection see Source Link on page 14 e For Cable connect the source device to the SOURCE port on the left panel of the UFED using the references cable from the cable organizer kit e For Bluetooth see Using Bluetooth Connectivity page 67 e For IrDA Infrared place the device with its infrared port directly in front of the UFED s source or target infrared port The selected target is appropriately connected to the UFED see Target Selection on page 15 source device is powered on and the data connector is clean NOTE When connected to the UFED some devices will prompt you to choose an operating mode such as PC Suite or Phone Mode Press to start extraction NOTE If the device is a Smartphone or PDA you may be prompted to install a client application on the device Press to continue Cellebrite UFED User Manual 17 Chapter 3 Extracting Device Data CAUTION Do not disconnect the device or the power adaptor during the process Once started the process should not be interrupted 10 Completion Upon the completion of the process the UFED will displays the Extraction Summary message Extraction NOTE Besides the standard user device data the UFED also provides successu H metadata about the device Among this data is the ESN for CDMA phones or IMEI for GSM phones The ESN or IMEA is a unique identifier or serial number uniqu
33. ed to the UFED PEE i Source Connect Cable 118 Press to start the file system extraction process Follow the Target USB Flash Drive instructions displayed on the UFED screen to complete the extraction process mbac 52 Cellebrite UFED User Manual Chapter 7 Performing File System Extraction 6 Completion Upon the completion of the process the UFED will displays the Extraction Summary message To view and analyze the extracted file system please open it using the UFED Physical Analyzer application Cellebrite UFED User Manual Extraction completed successfully 53 Chapter 8 Extracting Passwords Chapter 8 Extracting Passwords 9 1 Overview The Extract Passwords feature provides quick access to the device s user passwords without the need to analyze an extraction using the UFED Physical Analyzer application 9 2 Flowchart Connect Source Extract amp Target Passwords Figure 18 The Extract Passwords flowchart 54 Cellebrite UFED User Manual Chapter 8 Extracting Passwords 9 3 Performing Passwords Extraction Follow the steps below to extract the device passwords 1 To return to the previous menu press Main Menu Select Extract Passwords from the Main Menu Use the A V keys to move between options Press OK or gt to continue Source Vendor Select the vendor manufacturer of the source device Use the A V keys to move between options Press OK or
34. ely associated with each single handset device IHLontinue The extracted data is stored on the USB drive along with an HTML and XML report of the extraction You can open the HTML report on any PC with any installed web browser Use the UFED Logical Analyzer Report Manager PC application to open and analyze the generated XML report To view the extracted data connect the target media to a PC via a USB port or an SD card reader The target media should include a new folder named UFED Vendor Name Model number and OS a 15 digit extraction number and date of extraction The folder contains the following files Backup ExtractionDate 001 CAL Backup ExtractionDate 001 PBB Backup ExtractionDate 001 CLOG Cellebrite UFED User Manual Chapter 3 Extracting Device Data Backup ExtractionDate 001 5MS 3 HTML files that can be accessed from a web browser named Report html PhoneBook Extraction date 001 html and SMSMasseges Extraction date 001 html XML Report The transfer process is complete and you may now disconnect the device and the PC from the UFED device Cellebrite UFED User Manual 19 Chapter 3 Extracting Device Data 3 4 Extracting Device Data to a PC The UFED system includes the UFED Logical Analyzer Report Manager application which you can use to upload the extracted device data from the UFED to your PC 1 Main Menu and Device Definitions Select Extract Phone Data from the Mai
35. enu Extract Phone Data M Extract SIM USIM Data Use the A W keys to move between options Press OK or to continue 2 Select Source Select the Create GSM Test SIM option Clone an existing SIM Card Manuall enter SIM data Use the A keys to move between options teate GSM lest SIM Press OK or p to continue 3 Insert Target Card Insert a blank UFED SIM ID Access Card to the SIM card reader slot at the front panel of the UFED as shown with the SIM card contacts facing down Cellebrite UFED User Manual 37 Chapter 5 Cloning a SIM ID 38 Figure 15 Insert SIM card Press to continue Completion Upon completion of the SIM Cloning process a successful cloning message will be displayed detailing the ICCID and IMSI data of the cloned SIM card You can now insert the cloned SIM card into the device and continue evaluating it Cellebrite UFED User Manual Chapter 6 Performing Physical Extraction Chapter 6 Performing Physical Extraction T 1 Overview The Physical Extraction function enables you to perform a physical extraction of the source device memory to a removable drive USB drive or SD card or to a connected PC NOTE Physical extraction of iOS and portable GPS devices is performed by the UFED Physical Analyzer application version 2 4 or higher For more information see the video tutorials on the Cellebrite web site and the Cellebrite YouTube channel 7 2 Flowchart Connect
36. es where network environments require proxies and user id passwords set these settings as described in Section 11 5 2 Connect the UFED to the network Connect the UFED device to your network via the Ethernet port on the top of the UFED Use a standard Ethernet cable for this connection 3 Select Update Type and Source Select Services Upgrade then choose the type of upgrade Application Image Settings or License and select PC as the source for the upgrade Use the A V keys to move between options Press OK or to continue 4 Upgrading The UFED now performs the upgrade by fetching the upgrade files from the HTTP server Do not interrupt Cellebrite UFED User Manual 75 Chapter 13 Upgrading the UFED the UFED until the full process is complete 5 Finish At the end of the upgrade process a message indicating a successful update is displayed The UFED will then restart automatically and return you to the Main Menu 14 5 Setting Automatic Upgrade from the Web 76 If your UFED is connected to the network via the Ethernet port you can configure it to perform automatic upgrades This enables you to keep your UFED up to date without requiring any ongoing interaction We recommend using this method as it eliminates the manual process for each upgrade and guarantees that your UFED remains up to date To set automatic upgrade 1 Accessing From the Main Menu select Services gt Upgrade gt Upgrade Settings gt
37. from a USB Disk Drive or SD Card Main Menu Select Services gt Upgrade Press OK or to continue Upgrade Menu Use the A VW keys to move between the following options Upgrade Application Now The application refers to the UFED application data which includes the support information for any new phones Upgrade Image Now The image refers to the core software that is running on the UFED Press OK or p to continue Selecting the Upgrade Source Cellebrite UFED User Manual Chapter 13 Upgrading the UFED Use the A V keys to move between options choose USB Disk Drive or SD Card according to where you have copied the upgrade files Press OK or to continue 4 Upgrading The UFED will display a list of the available upgrade files Use the A V keys to select the correct file then press OK or to continue The UFED now performs the upgrade Do not interrupt the UFED until the full process is complete 5 Finish At the end of the upgrade process a message indicating a successful update is displayed The UFED will then restart automatically and return you to the Main Menu 14 3 Upgrading from a PC In order to upgrade from PC the Upgrade Utility is required on your PC If it is not already installed run the installation located in the UFED Kit CD The process of upgrading from a PC is similar to upgrading from a removable media USB Disk Drive or SD Card with a few additional steps on your
38. g Case Rugged case Soft case UFED Device y UFED Device Casing Rugged rubber casing Standard UFED Protective Cover Y Cable Organizer d Data Cables Full Set Full Set Bluetooth Dongle for wireless phone connection USB Flash Drive for saving examination data Power Supply UFED Charging kit 12V In vehicle Power adapter Y Y SIM ID Cloning Cards V Micro SIM adapter Mobile Phone Battery Charger set s Faraday Bag Cellebrite UFED User Manual Chapter 1 Introduction UFED Logical Analyzer Report Manager viewing and Logical Logical printing application UFED Physical Analyzer application Ultimate Ultimate UFED Phone Detective application Phone Connection Cleansing Brush User Manual and Support CD Cellebrite UFED User Manual Chapter 1 Introduction 1 4 UFED Device Overview 1 4 1 General Overview Power Supply Connect to power adapter LCD Display Function Keys F1 for help F2 for select deselect all F3 to continue ON OFF Power Button Target connectors for extraction to USB disk drive SIM Smart Card Slots for reading SIM cards and smart cards Navigation Keys For navigating the UFED menu Source connectors Connect device via USB serial or IR gt Q 2 Cancel Button 0 SD Card Slot for extraction to SD card 1 USB Port Extension for Bluetooth dongle o
39. he application version Full and Tiny The software image versions S N The UFED Serial Number 1 The unique identifier used during the activation process 11 2 3 Counters Show counters Shows the number of transactions performed by the UFED device Reset counters Resets all counters to zero Set counters Allows you to set the counters to a specific value 11 2 4 Help Phone Specific Help Allows you to view various help information about specific phones Generate File Allows you to generate and export the full help info to a USB disk drive 11 2 5 Network Settings The network settings option allows you to configure various network settings for the UFED device when connected to a network via the Ethernet port Press F1 to configure the following settings Dynamic IP Set to Dynamic DNS or Static DNS Cellebrite UFED User Manual 61 Chapter 10 Services 62 Static IP Enter a static IP address 11 2 6 Screen Settings Contrast Set the contrast level of the LCD screen Backlight Toggle the display backlight on or off 11 2 7 Time and Date Show Time and Date Display the current time and date Set Time Set the time zone daylight saving time mode the time and the time format Set Date Set the date and the date format 11 2 8 User Settings 11 2 9 Connectivity Auto Detect Phones Enable or disable the automatic detection of a
40. icator provides a visual indication regarding the UFED power mode LED Status Indication Red Battery charge in process Green Battery fully charged No light e Sleep mode no input power source e Battery not connected e Charging suspended timer fault or thermal shutdown e Over voltage fault Flashing Red Battery problem Verify that the battery is connected properly Cellebrite UFED User Manual Chapter 2 Getting Started Chapter 2 Getting Started 2 1 Initial Setup 10 Unpack the UFED device from the kit see UFED Kit Contents on page 4 Connect the power supply adapter to the UFED Please Wait appears briefly on the screen followed by a screen showing the version numbers NOTE When starting the UFED for the first time you need to set the date time and GMT When the UFED is set and ready for use the Main Menu will display enabling you to access the following options Extract Phone Extract Phone Data Logical extraction from a device Extract USIM Uata Clone SIM ID See Extracting Device Data on page 12 Physical Extraction Extract SIM USIM Data Logical extraction from a SIM USIM card File System Extraction See Extracting SIM USIM Data on page 25 Figure 7 The Main Menu Clone SIM ID Clones a SIM card enabling you to analyze the phone without it being open for incoming calls See Cloning a SIM ID on page 30 Physical Extraction
41. larget i ast Drive Ll C The content goes directly into the UFED Physical Analyzer application via a mini USB to USB cable connection between the mini USB port on the back panel of the UFED and a the PC Use the A Wkeys to move between options Press OK or gt to continue 5 Extraction Instructions Make sure that the source device and selected target are appropriately connected to the UFED Press to start the physical extraction process 6 Completion Cellebrite UFED User Manual ri Extraction Instructions Source Connect Cable 88 Target USB Flash Drive Follow the instructions displayed on the UFED screen to complete the extraction process 41 Chapter 6 Performing Physical Extraction Upon the completion of the process the UFED will display the Extraction Summary message Extraction completed successfully The transfer process is complete and you may now disconnect the source device and the Target media from the UFED device Connect the target media to a PC via a USB port or an SD card HLontinue reader The target media should include a new folder named in the following format Physical Vendor Model and date of extraction The folder contains the following files e UFD UFED Extraction file accessed by the UFED Physical Analyzer e Image file To view and analyze the extracted data please open it using the UFED Physical Analyzer application 42 Cellebrite
42. lect the source device model Use the A W keys to move between options Press OK or to continue To return to the previous menu press 4 4 Target Selection Select the target location where the content will be copied to elect Target PC The content goes directly into the UFED Logical ash Uwe Analyzer Report Manager application via a mini USB to USB cable connection between the mini USB port on the back panel of the UFED and a the PC USB Disk Drive The content is stored in a separate directory on a USB disk drive connected to the TARGET USB port on the right panel of the UFED SD Card The content is stored in a separate directory on an SD card inserted in the SD card reader slot Cellebrite UFED User Manual 27 Chapter 4 Extracting SIM USIM Data 28 on the left panel of the UFED Use the A Wkeys to move between options Press OK or gt to continue Content Types Select content types to be extracted The UFED displays the options according to the capabilities available in the device ex If the device does not support video the Videos option will not appear Use the A W keys to move between options Press OK to select an option Pressing on F2 will select deselect all options Press y to continue Extraction Instructions Make sure that the selected target is appropriately connected to the r1Extraction Instructions UFED see Target Selection on page 15 Sourc
43. lues which are generated for each file in the extracted data Report Folder Format Sets the generated reports folder name formats e Model Serial YYYY MM DD The folder name will constructed from the model name gt the model serial the year in 4 digits the month in 2 digits the day in 2 digits gt YYYYMMDD Model Serial The folder name will be constructed from the year in 4 digits the month in 2 digits gt lt the day in 2 digits the model name gt the model serial Generate XML Report Toggles the generation of XML report Partial Data Extraction In case of an extraction error sets whether or not to include the partially extracted data up to the error point in the generated report Extraction Notes Sets how the known issues notes about the extracted device are logged in the generated report e Embedded Notes Each of the device specific notes will follow the content type they refer to in the report Cellebrite UFED User Manual 65 Chapter 10 Services 66 Separated Notes All the device specific notes will be added at the end of the report e Disable Device specific notes are not included in the report Report Thumbnails Sets how image are linked to the generated report When disabled the full size original images will be linked to the report When selected a low resolution thumbnail will be created for high resolution JPG images to optimize the browse
44. n Menu and then select the device vendor model memory location and link method This part of the process is identical to the USB Extraction process See steps 1 5 of Extracting Device Data to USB Disk Drive or SD Card on page 19 Use the AW keys to move between options Press OK or p to continue 2 Target Selection Select PC from the target menu Use the A Wkeys to move between options Press OK or to continue 20 Cellebrite UFED User Manual Chapter 3 Extracting Device Data 3 Content Types Select content types to be extracted The UFED displays the options according to the capabilities available in the source device ex If the device does not support video the Videos option will not appear Use the A keys to move between options Press OK to select an option Press gt to continue NOTE Transfer time varies according to the data types selected Selecting all options will increase the transfer time 4 Transfer Instructions Make sure that source device is appropriately connected to the UFED according to the source link selection see Source Link on page 14 e For Cable connect the source device to the SOURCE port on the left panel of the UFED using the references cable from the cable organizer kit e For Bluetooth refer to Chapter 6 for details e For IrDA Infrared place the device with its infrared port directly in front of the UF
45. provide the address and port of the proxy HTTP Settings Similar to the FTP settings when the upgrade method is HTTP HTTP Proxy Settings Similar to FTP Proxy settings when the upgrade method is HTTP App The application version Full and Tiny The software image versions S N The UFED Serial Number ID The unique identifier 78 Cellebrite UFED User Manual Appendix A Technical Specifications Appendix A Technical Specifications Power Supply Input AC 100 240V 50 60Hz Output DC 12V 2A Interfaces RJ 45 source phone RJ 45 target side USB source phone USB target phone Mini DIN to PC COM Port SIM reader IrDA source and target IRDA 2 Infrared transceiver modules Supports STD IrDA speeds up to 115kbps Ethernet controller LAN91C111 10 100MBPS Ethernet controller and an 8KB packet buffer SDRAM CPU Intel XScale micro architecture Cellebrite UFED User Manual 79 Appendix A Technical Specifications CPU frequency 520MHz Bus frequency 104 MHz Memory Capacity SD RAM 128 MB RAM Flash memory Intel StrataFlash embedded memory 64 MB density Operating System Microsoft Windows CE Operating Temperature 0 C to 70 32 F to 158 F Storage Temperature 40 to 80 41 F to 176 F Maximum relative humidity 95 80 Cellebrite UFED User Manual Appendix A Technical Specifications
46. r When using the generic cable connect a tip to the connector at the end of the adapter cable and then connect the tip to the appropriate connector of the device NOTE A tip can be connected to the adapter cable in both directions Cellebrite UFED User Manual 45 Chapter 6 Performing Physical Extraction 46 7 4 3 Main Menu Select Physical Extraction from the Main Menu Use the A W keys to move between options Press OK or p gt to continue Source Vendor Select the Chinese phones option Use the A V keys to move between options Press OK or p gt to continue Source Model Select the source device model For an unknown device select Generic Chinese phone Use the AW keys to move between options Press OK or to continue Performing a Physical Extraction Extract Phone Data Extract SIM USIM Data Clone SIM ID Hc UH AceMobil iene Ferarri Ti Lake Tahoe Cellebrite UFED User Manual Chapter 6 Performing Physical Extraction 4 Target Selection Select the target location where the content will be copied to USB Flash Drive The content is stored in a separate directory on a USB disk drive connected to the TARGET USB port on the right panel of the UFED SD The content is stored a separate directory on an SD card inserted in the SD card reader slot on the left panel of the UFED PC The content goes directly into the UFED Logical
47. r memory usage 11 2 17 Global Settings Extract SIM after Phone Toggles the extraction order of the phone and SIM card data When enable the SIM data will be extracted before the phone data Compressed Volume Size volume size for zip files the flash disk 11 2 18 Extraction Settings Deleted SMS Extraction Enable or disable extraction of deleted SMS messages 11 2 19 Admin Settings NOTE Please contact Cellebrite s support to receive your Admin password Change Password Enables you to change the admin and service passwords of the UFED Change Admin Password Sets a new administrator password to the UFED e Change Service Password Sets a new password to the Service menu Cellebrite UFED User Manual Chapter 11 Using Bluetooth Connectivity Chapter 11 Using Bluetooth Connectivity 12 1 Overview On some phones the UFED enables you to use Bluetooth instead of data cables for the extraction process When you choose Bluetooth for the connectivity type follow these instructions 12 2 Phone Settings On the mobile phone you must enable the phone to connect via Bluetooth by turning Bluetooth capabilities on In addition you must set the Bluetooth services to Visible on the phone 12 3 UFED Bluetooth Adapter The UFED kit comes with a Bluetooth USB adapter as shown Connect the Bluetooth adapter in either of the two USB ports at the back panel of the UFED then
48. r other external devices such as keyboard ao WON 12 Serial connection not in use 13 Ethernet port connect to network for automatic updates and for uploading data to a network hosted PC Figure 5 The UFED device general overview 14 Mini USB Port for extraction to PC via mini USB cable Cellebrite UFED User Manual Chapter 1 Introduction 1 5 Ruggedized UFED Rubber Casing The Ruggedized UFED device is encased in a rubber casing to hold the battery house and to protect the UFED from dirt dust sand or other contaminants 1 6 Power and Battery Options The UFED device can be powered by power supply Acar power supply Ruggedized Kit only internal battery power Ruggedized Kit only 1 6 1 The Battery Components RE gt gt 1 Figure 6 The UFED device battery components Battery kit and battery housing protective covering Charging switch Battery s state of charge test and LED indicators Cellebrite UFED User Manual Chapter 1 Introduction 1 6 2 Switching to Battery Power To run the UFED on battery power flip the power switch to the right BAT position Battery power will take Over 1 6 3 Charging the Battery To re charge the battery connect the device to an AC adapter supplied with the kit and then flip the power switch to the left CHG position 1 6 4 Battery LED Indicator The Battery LED ind
49. roducts ufed logical ufed logical supported phones html e Physical extraction http www cellebrite com mobile forensics products forensics products ufed ultimate ufed physical supported phones html Cellebrite UFED User Manual Chapter 1 Introduction 1 3 UFED Kit Contents Portable and easy to operate the UFED can be used in the forensic lab as well as the field The UFED is a handheld device without the need for a PC in the field The Ruggedized version of the UFED comes with hard sided case and battery power for even greater mobility and flexibility and fully loaded with all needed accessories The UFED comes equipped with all you need for mobile device analysis The UFED Ruggedized carrying case is designed specifically for field use conditions To open the case flip the two latches open NOTE The case is air tight sealed When the case undergoes changes in atmospheric pressure ex mountain areas after airplane flights the latches may be hard to open To release them unscrew the vacuum release valve located in the center of the case next to the handle Figure 3 UFED Standard Kit Figure 4 UFED Ruggedized Kit The following table lists the features and accessories that come with each kit Some of the accessories can be purchased separately 4 Cellebrite UFED User Manual Chapter 1 Introduction Kit Features Ruggedized Kit Standard Kit Kit Carryin
50. selected procedure instructions on the UFED screen 70 Cellebrite UFED User Manual Chapter 13 Upgrading the UFED Chapter 13 Upgrading the UFED 14 1 Overview Cellebrite continuously updates its UFED software providing support for new devices as they are released by the various vendors The Upgrade process installs these various updates on your UFED The UFED application is constructed of three main files Tiny Image Core system software Full Image Additional core system software Application The UFED application and data including support for the various phone models NOTE When upgrading choose either Application Upgrade or Images Upgrade The Images Upgrade option updates both the Full and Tiny images The UFED Upgrade menu also allows you to perform Settings upgrade UFED Auto Upgrade FTP FTP Proxy HTTP and HTTP Proxy settings License upgrade Installed license information and License activation You can upgrade your UFED in one of three ways Locally via USB Disk Drive or via SD card Cellebrite UFED User Manual 71 Chapter 13 Upgrading the UFED 14 2 1 3 72 Locally via PC Remotely via the Internet Automatic upgrade can be done when the UFED is connected to the internet via the Ethernet connection NOTE When performing an upgrade the UFED will reset itself Do not interrupt the process at any stage The full upgrade process takes approximately four minutes Upgrading
51. ter 5 Cloning a SIM ID 5 1 Overview 30 Cellebrite s UFED enables you to clone a SIM ID by utilizing the built in SIM Card Reader providing your organization with valuable new functionality NOTE The SIM ID cloning process clones only the SIM IDs and not the SIM contents The SIM ID cloning capabilities resolves many key problems facing forensic examiners today Extract Phone data while preventing the cellular device from connecting to the network The handset will be invisible to the network with no calls or SMS messages to or from the handset preserving the current call and SMS messages history in the device No Faraday Bag required to block RF signals Extract Phone data when the original SIM is not available ICCID or IMSI can be manually programmed into the Cloned SIM ID Card to mimic the original missing card Extract Phone data when the SIM card is PIN locked Cloning the identification of the original SIM card allows the phone data to be extracted without losing critical data including call history and SMS messages Cellebrite UFED User Manual Chapter 5 Cloning a SIM ID 5 2 Flowchart Clone SIM Figure 12 The Clone SIM ID flowchart 5 3 Cloning an Existing SIM Card Follow the steps below to clone an existing SIM card 1 Main Menu Extract Phone Data Extract Lm Data Select Clone SIM ID from the Main Menu one Use the A W keys to move between options Tent Press
52. vice s battery contacts Cellebrite UFED User Manual 69 Chapter 12 Using the Power up Cable TIP For battery contacts which are not clearly marked on the device s body use the pole markings on the battery body to identify them To do that simply flip the battery along its contacts edge and place it along the edge of the battery housing then mark the device s contacts according to those on the battery NOTE Use a multimeter to identify the positive and negative poles of an unmarked battery 4 Connect the RED alligator clip to the device s positive pole the Primary Black alligator clip to the negative pole and the secondary Black alligator to middle pole in case of 3 poles or to the one next to the in case of 4 poles Make sure the alligator clips are not closing a circuit by touching each other NOTE A beeping alarm will sound if the exposed sections of the attached alligator clips are touching each other 5 Make sure that source device is appropriately connected according to the source link selection see Source Link on page 14 e For Cable connect the source device to the Phone power up cable using the references cable from the cable organizer kit e For Bluetooth see Using Bluetooth Connectivity on page 67 e For IrDA Infrared place the device with its infrared port directly in front of the UFED s source or target infrared port 6 Power up the device and follow the
53. zer Report Manager application via a mini USB to USB cable connection between the mini USB port on the back panel of the UFED and a the PC See Cellebrite UFED User Manual 15 Chapter 3 Extracting Device Data 16 e Extracting Device Data to a PC on page 20 USB Flash Drive The content is stored in a separate directory on a USB disk drive connected to the TARGET USB port on the right panel of the UFED e SDCard The content is stored in a separate directory on an SD card inserted in the SD card reader slot on the left panel of the UFED Use the A Wkeys to move between options Press OK or gt to continue Connect Target Media If you have not yet plugged the USB drive or SD card into the UFED do it now The UFED is ready to copy the data to the storage device NOTE USB disk drive storage media should be connected to right side TARGET USB port SD card storage media should be inserted in the SD card slot on the left side of the UFED unit Content Types From the list of content types supported by the device select content types to be extracted Use the A V keys to move between options e Press to select an option Press F2 to select deselect all options Gr1Extraction Instructions Press p to continue Source Connect Cable 73 Target USB Flash Drive abac Chapter 3 Extracting Device Data 9 Extraction Instructions Make sure that source device is appropriately conn

Download Pdf Manuals

image

Related Search

Related Contents

Télécharger - Zero Rupture  LG Electronics 5270 Flat Panel Television User Manual  Wayne-Dalton 44 User's Manual  

Copyright © All rights reserved.
Failed to retrieve file