Home

UFED Touch User Manual January 2015 ENGLISH

1. and the secondary Black alligator to middle pole in case of three poles or to the one next to the in case of four poles Make sure the alligator clips are not closing a circuit by touching each other Connect the source device to the phone power up cable using the references cable from the cable organizer kit as listed in the UFED Touch menu Chapter 15 Technical specifications 215 Chapter 15 Technical specifications 15 1 General specifications UFED Standard and Ruggedized Display 7 WVGA 800x480 TFT Touch LCD 280 NITS LED Backlight 400 1 Contrast Ratio Operation system Microsoft Window XP embedded Processor Intel ATOM Z510 1 1GHz System memory 1GB DDR2 333MHz 667 DDR2 Data Rate Storage PSSD MLC NAND Flash 64GB capacity Chipset Intel Poulsbo USI5W Premium chipset celebrite 2 16 delivering mobile expertise 15 2 Battery UFED Standard and Ruggidized Lithium Polymer 7 4V 3850mAh Discharge time While being used 5 1 hr Recharge time 15 3 Power supply UFED Standard and Ruggedized Power supply Input AC 100 240V 50 60Hz Output DC 12V 4 16A 50W max Chapter 15 Technical specifications 217 15 4 I O interfaces RJ 45 for device and storage connectivity 15 5 Dimensions and weights Weight amp Dimensions UFED Standard UFED Ruggidized Case dimension cm 44 L x 33 5 W x 16 H 48 7 L x 38 6 W x 18 5 H Weight BK 10K celebrite 218 delivering mobi
2. Chapter 3 Getting started 37 4 Ifthe connected device cannot be recognized by the system a message prompts you to try the following steps or click Find device manually Please try these steps 1 Disconnect the device Android only Turn on USB Debug and enable Media Device mode MTP 3 Wait 5 seconds and reconnect the device Auto detect will start Tried the steps and the device wasn t found Find device manually Chapter 3 Getting started In the event that multiple matches are found the following screen appears Device Detected Successfully To continue please select a device Samsung GSM GT S5570 Samsung GSM GT S5570 Galaxy Mini Tass 5 Select the relevant device Chapter 3 Getting started 39 3 2 4 Search function To search for the mobile device 1 Tap the keyboard ESZ icon in the top toolbar to activate the device keyboard Begin typing the search for device box As you type each letter the list of devices is reduced to meet the criteria In this example sa is the search criteria and the devices that match the criteria are displayed celebrite UFED TOUCH t k P E Keyboard Home Settings Tutonals Bat 97 Identify your device g a Atelier HC ModeLabs AU Versace GD970 LGL22 isai Back Recently Used Manual Selection Chapter 3 Getting started 40 2 Select the device model type from the list Having selected the device UFED Touch will determine what
3. License Version User Permissions Network Enable Users Permissions To import user permissions 1 Run the UFED Touch as an administrator 2 Select Enable Users Permissions and tap Import Chapter 13 Settings 203 The following warning appears Warning Importing Permissions will override all existing data Continue E C 3 Tap Yes and navigate to the directory where the permission management file cp is located For information on creating a permission management file see Using the UFED Permission Manager page 204 4 Tap Open and then tap Save 5 Restart the UFED touch application which will now prompt for login credentials 6 Use one of the login credentials configured in the permission management file For more information seePermission management celebrite 204 delivering mobile expertise 13 6 1 Permission management The administrator can create multiple profiles using the UFED Permission Manager standalone application Each profile contains access permissions including operation rights per extraction type content types etc A single profile can be assigned to multiple users The users and profiles can be exported into an encrypted permission management file which can be imported into multiple UFED Touch applications 13 6 1 1 Using the UFED Permission Manager To create a new profile 1 Download the latest UFED Permission Manager application from your account in MyCellebrite a
4. 2 Connect the source device using the appropriate cable to the Target USB port of the UFED unit Chapter 5 Extracting Data to PC 56 3 On the UFED unit select Extract from Mobile device and identify the device then tap Physical Extraction or File System Extraction 4 On the PC click Start gt UFED Physical Analyzer to open the UFED Physical Analyzer The UFED Physical Analyzer application starts 5 Click the Read Data from UFED icon inthe application toolbar The UFED Downloader window appears go oone t te Press on Start to connect to the UFED Total downloaded files Elapsed time Download path C A Users jonathank Documents My UFED Extractions Q Start D Open target folder Chapter 5 Extracting Data to PC 57 6 In the Download path area click and browse to the desired location for the extraction Tip Click Open Target Folder to display the content of the selected target folder 7 On the UFED Touch unit in the Select Extract Location screen select PC cellebrite UFED TOUCH a a a ee a Keyboard Home Settings Tutonals Bat 97 g Galaxy Mega 6 3 Physical Extractions Select Extraction Location Drive 8 Follow the prompts in the UFED Touch unit until prompted to start the download procedure 9 On the PC in UFED Physical Analyzer click Start in the UFED Downloader window Chapter 5 Extracting Data to PC The data transfer from the device to the PC starts lg UFED Downloader
5. Please Wait Connecting Ga S Extraction to removable drive 9 If prompted select which of the SIM card partitions to read The following screen appears Chapter 11 SIM card functionality 140 When the extraction process is complete the SIM Extraction Summary screen appears displaying a summary of the extraction process SIM Extraction Summary Extraction completed successfully Source SIM Target Local Drive Logical 01 Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data ER Open Preview Additional Extractions Chapter 11 SIM card functionality 141 10 Click the required button To view an HTML preview report that includes information about the device and the extraction To add additional extraction types for the same device To end the process and return to the home screen Finish Chapter 11 SIM card functionality 142 In the event that the Phone Extraction option was selected the Phone Extraction Summary screen appears U Phone Extraction Summary Transin completed succes tilly Source HTC AS7S2 P Cw 10 Ewe 4G Android Target Removable Drive UFED HTC AS PC 100 Evo 46 Androld 2POVUD 7909008 EX ANDOOODSORte4 7017 OF 2 OO Cortect Type ters Sure Prornobigk 212 cortacts B ous l message O Ringtones regione O bytes 11 To end the process and return to the home screen tap OK Chapter 11
6. and then click Retrieve License The License Retrieval widow appears License Retrieval A license will be retrieved for 5908884 7 Click Retrieve License to download your license key The license key will also be sent to your registered MyCellebrite email address 8 Copy the license dat file to the root directory of a USB flash drive Chapter 4 Using UFED Touch 54 9 At the back of the UFED Touch unit flip the cover open to gain access to the back panel 10 Insert the USB drive into the USB EXT 1 or EXT 2 port 11 On the UFED Touch unit in the Cellebrite product license window tap Load from USB and follow the instructions on the unit NOTE UFED Touch is designed to enter sleep mode after being idle for 20 minutes to reduce power consumption You can resume working by pressing any of the navigation buttons on the unit Congratulations your UFED Touch unit is now ready Chapter 5 Extracting Data to PC 55 Chapter 5 Extracting Data to PC NOTE Extraction to a PC with Windows Vista Operating System is not supported 1 Do oneof the following e Connect the UFED unit to your PC using a USB to mini USB cable utilizing the port marked PC located on the top of your UFED unit Your PC may prompt you to install drivers e Connect your UFED unit to your PC using the UFED to PC cable U 441 provided in the UFED Standard and ruggedized kits Your PC may prompt you to install drivers Figure 18 UFED to PC cable
7. celebrite UFED TOUCH amp tf P Keyboard Home Settings Tutonals Bat 97 G1T S9570 Tass File System Extractions Select Extraction Location Removable Drive 3 Select a location 93 Chapter 8 File system extraction 94 The Waiting for Device screen appears celebrite UFED TOUCH a a ee oS Golwaring mobilo exportise Keyboard Home Settings Tutonals Exit 97 GSM GT S5570 Tass File System Extractions Waiting for Device Please connect source device to the left USB port Android 4 2 and Higher 4 1 2 and Lower Tutorial Video 1 Enable Developer options How to 2 Enable Stay awake and USB debugging modes How to 3 Verify screen lock mode How to 4 Connect the device to the unit Samsung GSM GT S5570 Tass using Cable A with Black tip T 100 Enlarge Help Continue 4 Select the correct cable and tip for the mobile device based on the information written in the screen 5 Change the device settings according to the instructions 6 Connect the device to the UFED Touch SOURCE port A red source arrow continues to flash on the left of the screen until the device is connected Chapter 8 File system extraction 95 7 Tap Continue The Extraction in Progress screen appears cellebrite UFED TOUCH a a a oe Keyboard Home Settings Tutonals Bat 97 Extraction in Progress Please Wait Samsung GSM GT S55 0 Tass using Cable A with Black tip T 100 Extraction to re
8. 11 To end the process and return to the home screen tap OK Chapter 11 SIM card functionality 11 2 2 Entering SIM data manually 1 Inthe home screen Tap Clone SIM The Waiting for Device screen appears 2 Insert the UFED SIM ID Access card 3 Tap Continue The Select Source screen appears 152 Chapter 11 SIM card functionality Select Source Clone an Manually Create GSM Test SIM existing SIM enter SIM card data 4 Tap Manually enter SIM data 153 Chapter 11 SIM card functionality 154 Source ICCID 1 20 digits Enter ICCID co cm as a alld OAN H 5 Enter the SIM ICCID number up to 20 digits 6 Tap OK Chapter 11 SIM card functionality 155 The following screen appears Source IMSI 1 15 digits Enter Ms 7 Enter the SIM IMSI number up to 15 digits then tap OK Chapter 11 SIM card functionality 156 The Select Language screen appears r Select Single Value PX ial A IB AR PM Ris Shp English Ai a Hrvatski a English Simplified Traditional Croatian J J Legacy Legacy o e tina Dansk Nederlands Fran ais ti Czech Danish Dutch French Deutsch EAAnvika SE Magyar German Greek eat Hindi Hungarian v N h 8 If required select either a language or tap None Chapter 11 SIM card functionality 157 The Enter advanced settings screen appears Enter advanced settings Me Yes 9 Tap Yes or No to contin
9. Continue 5 Tap Continue and then select Backup my data on the device The following screen appears 100 Chapter 8 File system extraction 101 celebrite UFED TOUCH a ee oe Keyboard Home Settings Tutonals Bat 97 Extraction in Progress Source Reading File File backup backup ab samsung GSM GT i9205 Total read 89 06 MB Samsung Galaxy Mega 6 3 using Cable A with Black tip T 100 Extraction to removable drive The following screen appears Chapter 8 File system extraction 102 Android backup Would you like to try data extraction from a shared location The system will attempt to extract data from the device s internal storage and memory card and will take additional time 6 Tap No if you do not want to try extract data from a shared location Tap Yes if you want to try extract information from a shared location The following screen appears Chapter 8 File system extraction 103 Source Instructions GT i9205 Samsung Galaxy Mega 6 3 Please return the Screen timeout to its original settings Menu Apps Settings My Device Display Screen timeout or Menu Apps Settings Display Screen timeout or Menu Apps Settings Display Sleep 7 Follow the instructions and Tap OK When the extraction is complete the File System Extraction Summary screen appears Chapter 8 File system extraction 104 File System Extraction Summary Extraction comp
10. Operate in covert mode Uninstall reminder Operate in multiple extractions mode Require a password on wakeup Cable and Tip Mode celebrite delivering mobile expertise Chapter 13 Settings 179 The General tab provides access to the following functions and settings e Managing the Custom List page 179 e Changing the application interface language page 183 e Mobile Extraction Client page 187 To swap the first and last name in the phone book e Select Swap first and last name in phonebook 13 1 1 Managing the custom list The Custom List is the list of devices available for use during the Logical Extraction process Device models can be added to or deleted from the list Multiple device models can be defined After a Custom List has been defined a Custom List button is added to the Logical Extraction screen celebrite 180 delivering mobile expertise To add devices to the custom list 1 Tap Edit Custom List Edit custom list The Custom List opens In the event that devices have been previously defined in the custom list the vendor names are selected Custom List sm M p ce GCE Airyme a In this example the Apple device was previously defined for the custom list and is indicated with a blues Chapter 13 Settings 181 NOTE Use i and a to scroll through the lists of manufacturers and devices 2 In the Custom List select the required device vendor For example Alcatel
11. SIM card functionality 143 11 1 2 The extracted SIM data folder At the end of the SIM data extraction process the extracted SIM data is saved in the location you selected previously NOTE The extracted SIM data folder is named UFED SIM card with the extraction date and counter UFED SIM card SIM card lt DATE gt 001 If you selected to extract to the local drive the extracted SIM data folder is located inside the application s Backup folder The extracted SIM data folder contains a detailed report of extracted data in both HTML and XML formats and call log file clog Chapter 11 SIM card functionality 144 11 2 Clone SIM The Clone SIM ID function enables you to copy the SIM ID from one SIM card to a UFED SIM ID Access Card Cloning the SIM ID provides a suitable solution to several problems facing forensic examiners by allowing extraction of the device data e While preventing the cellular device from connecting to the network rendering the device invisible to the network without the ability to send or receive calls or SMS messages and thereby preserving the device s current information No Faraday Bag is required to block RF signals e When the original SIM is not available by manually programming the ICCID or IMSI into the Cloned SIM ID Card to mimic the original missing card e When the SIM card is PIN locked by cloning the identification of the original SIM which allows extraction of the device data withou
12. Subject to the terms and conditions of this Agreement Cellebrite hereby grants to Buyer and Buyer accepts a nonexclusive time limited and nontransferable license effective upon delivery to use only if such use does not violate the prohibitions in Sections 2 F or 2 G a copy of an Update or Upgrade to the Embedded Software in executable form only provided by Cellebrite and the accompanying documentation only for Buyer s internal use in connection with the Forensic Products or for a trial of such Update or Upgrade as the case may be in the country in which the Forensic Product with the Embedded Software was purchased from Cellebrite or an authorized reseller of Cellebrite and only as authorized in the Agreement for a period as specified by Cellebrite but in any case no longer than seven 7 238 celebrite delivering mobile expertise days Any time limited license forthe Embedded Software on a Forensic Product shall be subject to the foregoing license grant and such license may be issued at Cellebrite s sole discretion Buyer agrees to provide to Cellebrite one or more email addresses at which Cellebrite can contact Buyer for communications from Cellebrite including regarding Updates or Upgrades Buyer shall provide Cellebrite with updated email address es each time such email address es change Forensic Products Exclusions Any use or operation of the Cellebrite UFED family of products including without limitation UFED Logic
13. on the back panel e Select PC to extract the information directly to the PC The Select Content Types screen appears Cellebrite UFED TOUCH a a ae bs Keyboard Home Settings Tutonals Exit 96 SIM Card SIM SIM Extractions Select Content Types Target v Phonebook s oe Back SIM to removable drive Select All Next Chapter 11 SIM card functionality 138 In the Select Content Types screen select the content types that you want to extract from the list of options on the center of the screen To select all the available data types tap Select All under the data types list Select All appears after you tap one or more of the options on the screen 6 Tap Next The Waiting for Device screen appears a a ee ae celebrite UFED TOUCH serie be Keyboard Home Settings Tutonals Boat 96 SIM Card SIM SIM Extractions Waiting for Device SIM Insert sim card with the SIM card s contacts facing down and the clipped corner pointing toward you Continue 7 Insert SIM card into the SIM card reader slot located in the middle of the front panel Chapter 11 SIM card functionality 139 NOTE The SIM red arrow prompt at the bottom of the screen continues to flash even after the SIM card has been inserted into the SIM reader slot 8 Tap Continue The Extraction in Progress screen appears celebrite UFED TOUCH eb Keyboard Home Settings Tutonals Bat 96 Extraction in Progress Source
14. Android 3 2 and Lower 1 Enable Developer options How to 2 Enable Stay awake and USB debugging modes How to 3 Verify screen lock mode How to 4 Enable MTP after device is connected How to Samsung GSM GT i9205 Samsung Galaxy Mega 6 3 using Cable A with Black tip T 100 Enlarge Help Continue 1 Follow the instructions to connect the device and tap Continue The Capture Screenshots screen appears Chapter 10 Capture images and screenshots 130 cellebrite UFED TOUCH a a ee oS Se eee Keyboard Home Settings Tutonals Boat 96 ig GSM GT i9205 Samsung Galaxy Mega 6 3 Capture Screenshots TEE MIT AEDI See page 120 for the screenshot options available this screen 2 Tap Next The Capture Screenshots Summary screen appears Chapter 10 Capture images and screenshots 131 3 Tap the required button To view an HTML preview report that includes information about the device and the extraction To add additional extraction types for the same device To end the process and return to the home screen Chapter 10 Capture images and screenshots 132 Chapter 11 SIM card functionality 133 Chapter 11 SIM card functionality The SIM Card functions enable you to perform various SIM card related functions Sim data extraction Clone SIM File system extraction 11 1 SIM data extraction The SIM Data Extraction function enables you to perform logical extraction from a SIM or USIM card to
15. C Password Profile Teami User is disabled Save Enter the details for the new user including Username Display Name Description and Password Select a profile for the user Click User is disabled to enable the user Click Save 3 4 5 6 Chapter 13 Settings 211 To export an encrypted permission management file 1 In the UFED Permission Manager screen click Export specify a directory for the file and click Save The following screen appears Export complete 2 Click OK NOTE The next time you run the UFED Permission Manager you will be prompted for your user credentials to access the application NOTE Click Import to configure an existing permission management file 212 13 7 Network Local Area Network Wireless Network and Bluetooth connections System License Version User Permissions Network Local Area Connection Wireless Network Connection Bluetooth Network Connection Proxy Server DHCP IP address Subnet mask Default gateway Preferred DNS server Alternate DNS server Static 192 168 255 255 192 168 192 168 192 168 109 51 252 0 111 254 100 20 100 22 celebrite delivering mobile expertise Chapter 14 Special cables 213 Chapter 14 Special cables UFED Touch requires special cables for certain functions These include e The device power up cable e The U 441 Windows Easy Transfer Cable used for
16. Chapter 17 Appendix 245 or outside the Governing State including with respect to any application for injunctive remedies or an equivalent type of urgent legal relief 10 ASSIGNMENT Neither party may assign its rights and obligations hereunder without the prior written consent of the other party Notwithstanding the foregoing either party may assign this EULA to any Affiliate of the other or to an acquirer by purchase merger or otherwise of all or substantially all of such party s business or assets relating to this EULA provided that i the assignee agrees in writing to be bound by the terms and conditions of this EULA ii neither the assignor nor assignee are in default hereunder Any attempted assignment other than as permitted shall be null and void 11 NON WAIVER No course of dealing or failure of either party to strictly enforce any term right or condition of this Agreement shall be construed as a waiver of such term right or condition 12 ENTIRE AGREEMENT The terms and conditions contained in this Agreement supersede all prior Oral or written understandings between the parties and shall constitute the entire agreement between the parties with respect to the subject matter of this Agreement except as provided for in the preamble to this Agreement regarding the order of precedence This Agreement shall not be modified or amended except by a writing signed by Buyer and Cellebrite 13 CONSTRUCTION SEVERABILITY The headings
17. Press on Start to connect to the UFED Total downloaded files 8 Elapsed time 00 02 59 Download path C Users jonathank Documents My UFED Extractions Bion tgee E Downloading file Dump system Tonts DroidIndia ttf Size 1098064 bytes Current file Downloaded 1098064 bytes 100 Downloading file Dump system Tonts DroidSansArabic tt Size 35880 bytes Current file Downloaded 35880 bytes 100 Downloading file Dump system Tonts DroidSansMono ttf Size 119380 bytes Current file Downloaded 119380 bytes 100 58 Chapter 5 Extracting Data to PC 59 During the extraction process the Extraction in Progress screen appears on the UFED unit celebrite UFED TOUCH P EE Keyboard Home Settings Tutorials Bat 97 Extraction in Progress e 5 Reading File File 203 Samsung GSM GT S5570 Tass using Cable A with Black tip T 100 system etc apns conf xml 4 Target Extraction to PC using USB cable On the UFED unit you are prompted to select the types of multimedia to include in the extraction 10 Make sure that the media types that you want to include in the extraction are marked with J To cancel the extraction of a particular multimedia type click onthe multimedia name 11 Click OK Chapter 5 Extracting Data to PC 60 The extraction process continues When complete the Extraction Summary screen appears on the UFED Touch unit File System Extraction Summary Extraction completed su
18. Source Instructions screen appears this depends on the device model Source Instructions Android 4 2 and Higher Android 4 0 4 1 2 Android 3 2 and Lower 1 Disable Stay awake and USB debugging modes How to 2 Verify screen lock mode How to 3 Disconnect the device from the unit 73 Chapter 6 Logical extraction 6 Follow the instructions to return the mobile device settings to the correct settings 7 Tap OK The Phone Extraction Summary screen appears Phone Extraction Summary Extraction completed successfully Source GT i9205 Samsung Galaxy Mega 6 3 Target Removable Drive Logical 01 Content Type Phonebook g SMS Items 4 contacts 0 messages Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data Open Preview Additional Extractions 14 Chapter 6 Logical extraction 75 8 Tap the required button To view an HTML preview report that includes information about the device and the extraction To add additional extraction types for the same device To end the process and return to the home screen Finish Examples of a preview report and the additional extraction type screens are show next Chapter 6 Logical extraction VU y 9 gt m x lt Q 5 bs e 5 A O 2 a v 2 T E r Selected Manufacturer Samsung GSM Selected Model GT i9205 Sams
19. Start gt UFED Touch Tap Start gt All Programs gt Cellebrite Touch gt UFED Touch UFED Touch starts in the selected language Chapter 13 Settings 187 13 1 3 Mobile extraction client To operate in covert mode e Inthe Settings gt General tab select the following e Operate in covert mode Renames the application client name from Cellebrite sis exe to AAA SIS exe e Uninstall reminder When enabled the UFED Touch prompts you to uninstall the client from the examined smartphone celebrite 188 delivering mobile expertise 13 2 Report settings License Version User Permissions Generate reports language English English Notes display mode Embedded Notes Report format Normal Report folder format Model Serial YYYY_MM_DD Show MD5 M Create MD5 list file Show SHA 256 Partial extraction Report custom fields To set the report settings 1 Access the Settings gt Reports tab 2 To set the generated reports language tap next to Generate Reports Language and select the desired language Chapter 13 Settings 189 3 To set how the known issues notes about the extracted device are logged in the generated report tap next to Note display modes and select one of the following e Disable Do not include device specific notes in the report e Separated Notes Add all the device specific notes at the end of the report e Embedded Notes Device specific notes follow the
20. The list of device models opens Custom List Android FS General a app sys files y KPN Hi STARADDICT Messenger II CP 100 One OT 103A v Infinity POP 3 Select one or more device models that you would like to associate with this Device Manufacturer celebrite 182 delivering mobile expertise A blues appears in each selected device model box 4 Tap Back The selected manufacturer is marked with a blue Custom List sm x cara GCE Arme a J AMOI re y AnyDATA ARCHOS oo a 5 Repeat steps 2 4 for each device manufacturer and model s to be added to the Custom List 6 Tap Finish Chapter 13 Settings 183 To remove a device from the Custom List 1 Tap Edit Custom List 2 Inthe displayed Custom List dialog select a device manufacturer marked with a blues that you would like to remove all the associated models or only one 3 Select one or more device models marked with a blues that you would like to remove from the Custom List The markis removed 4 Tap Back 5 Repeat steps 2 4 for each device that needs to be removes from the Custom List NOTE Removing all the marked devices of a manufacturer also removes its blues mark 6 Tap Finish 13 1 2 Changing the application interface language 1 Tap the language field English English Fa 184 celebrite delivering mobile expertise The Select Language screen appears with the current language select
21. a third party by Buyer any Product or Software affected by the cases in a q is referred to hereinafter as an Excluded Item F tis expressly clarified that i the operation of the Software and or Product will not be error free ii not all defects in the Software and or Product will be corrected ili the Software may not operate on hardware or operating systems or in conjunction with other software other than as expressly specified in the Documentation or approved by Cellebrite in writing G Warranty Limitations EXCEPT AS STATED IN THIS WARRANTY CELLEBRITE ITS SUBSIDIARIES AND AFFILIATES SUBCONTRACTORS AND SUPPLIERS MAKE NO WARRANTIES EXPRESS OR IMPLIED AND SPECIFICALLY DISCLAIM ANY WARRANTY OF MERCHANTABILITY FITNESS FORA PARTICULAR PURPOSE OR NONINFRINGEMENT BUYER S SOLE AND EXCLUSIVE REMEDY FOR FAILURE OF AN ITEM TO CONFORM WITH ITS SPECIFICATIONS SHALL BE SELLER S OBLIGATION i TO REPAIR OR ii TO REPLACE OR iii IF NEITHER i NOR ii IS COMMERCIALLY FEASIBLE TO CREDIT OR REFUND AT BUYER S OPTION SUCH ITEM AS SET FORTH ABOVE THIS DISCLAIMER AND EXCLUSION SHALL APPLY EVEN IF THE EXPRESS WARRANTY FAILS OF ITS ESSENTIAL PURPOSE THE ENTIRE RISK ARISING OUT OF THE USE OR PERFORMANCE OF THE SOFTWARE AND PRODUCT REMAINS WITH BUYER H Repaired or Replaced Products Before returning a Product for service Cellebrite recommends that Buyer back up any data contained in such a Product IN NO EVENT WILL CELLEBRITE ITS AFFILIAT
22. consent before Buyer exercises any such rights Buyer shall notify Cellebrite of such desire and no later than sixty 60 days following receipt of such request Cellebrite may decide either a to perform the work to achieve such interoperability and charge Its then standard rates for such work to Buyer or b to permit Buyer to reverse engineer parts of the Software only to the extent necessary to achieve such interoperability Only if and after Cellebrite at its sole discretion partly or completely denies Buyer s request shall Buyer exercise its statutory rights Network Usage Buyer understands and agrees that Cellebrite may use Buyer s internal network and Internet connection for the limited purpose of transmitting license related data at the time of installation registration use or update of Software to a Cellebrite operated license server At such time Cellebrite may validate the license related data in order to protect Cellebrite against unlicensed or illegal use of the Software Cellebrite may at its option only permit activation of the Software upon exchange of license related data between Buyer s computer and the Cellebrite license server Chapter 17 Appendix 241 3 OWNERSHIP Cellebrite or its licensors retains ownership of all right title and interest in and to the Software and Documentation and any derivative works thereof and all copies of the Software Nothing in this EULA constitutes a sale transfer or conveyance of a
23. content type they refer to in the report 4 To set the generated reports visual formats tap next to Report format and select one of the following e Normal The standard report structure suitable to standard display screens e Compact A compact report structure suitable for devices with a small display area 5 To set the generated reports folder name formats select next to Report folder format and select one of the following e Model Serial YYYY_MM_DD The folder name is constructed from lt the model name gt lt the model serial gt lt the year in 4 digits gt _ lt the month in 2 digits gt _ lt the day in 2 digits gt e YYYYMMDD Model Serial The folder name is constructed from lt the year in 4 digits gt lt the month in 2 digits gt lt the day in 2 digits gt lt the model name gt lt the model serial gt 6 Select or clear Show MD5 to toggle the display of the MD5 values which are generated for each file in the extracted data 7 Select Create MD5 list file to generate a Checksums md5 file that contains all the generated MD5 values of the extracted data 8 Select or clear Show SHA256 to toggle the display of the SHA 256 values which are generated for each file in the extracted data celebrite 190 delivering mobile expertise 9 Select or clear Partial Extraction to set in the event of an extraction error whether or not to include the partially extracted data up to the error point in the generated report 10 Tap Re
24. executable form only provided by Cellebrite and the accompanying documentation only for Buyer s internal use in connection with the Products in the country in which the Product with the Embedded Software was purchased from Cellebrite or an authorized reseller of Cellebrite and only as authorized in the Agreement General Limitations Buyer shall use Embedded Software solely for execution on the unit of Product originally delivered to Buyer with such Embedded Software installed or any replacement unit provided under a warranty from Cellebrite Any Update or Upgrade of such Embedded Software that Cellebrite has licensed to Buyer may be loaded and executed only on the Product on which the originally licensed Embedded Software is authorized to execute License Exclusion Notwithstanding any other provision of this EULA except as may otherwise be required by applicable law no license is granted for installation or use of any Embedded Software or associated Update or Upgrade on any Product resold by anyone who is not an authorized reseller of Cellebrite for such Product 236 celebrite delivering mobile expertise Single Product Buyer s license to the Embedded Software is limited to a license to use the Embedded Software on one 1 Product for each Product purchased from Cellebrite or Cellebrite s authorized reseller Standalone Software Subject to the terms and conditions of this EULA Cellebrite hereby grants to Buyer and Buyer accept
25. page 115 Capture images and screenshots using the UFED camera to take pictures or videos of a device or capture internal screenshots directly from the connected device All types of extractions can be performed to a removable storage device or PC The Device tools page 165 menu tab is also located in the Select Extraction Type screen and includes e Bluetooth scan e Switch to CDMA offline mode e Odin mode e Test Peek Poke functionality e Activate TomTom trip log e Uninstall Windows Mobile Client e Uninstall Android Client Chapter 1 Introduction 15 1 3 UFED Touch accessories The UFED Touch kit includes connection cables and tips These are used in order to connect mobile devices to UFED Touch Figure 2 UFED Touch Cables and tips The UFED Touch Ultimate kit contains tips and cables for logical file system and physical extractions The UFED Logical kit contains tips and cables for Logical Extraction only 16 celebrite 1 3 1 Using cables and tips The cables and tips set includes up to various adapter cables the number of cables depends on the UFED product and kit purchased Each cable has a letter and name for example A Adapter USB Figure 3 Single cable Chapter 1 Introduction 17 For easy recognition the tips are color coded and numbered the color represents the vendor Figure 4 UFED Touch tip example Before each extraction the required cable and tio number and color is specifi
26. ports you can use a USB hub 10 1 1 Contents uantity Anti glare pad Camera case Camera pad Camera stand 10 2 Capturing images When taking pictures or videos of a device you have two options Capture images as an additional extraction type for a selected device or without specifying a device To capture images or videos for a specific device 1 Tap Extract from Mobile Device and identify the device tap Capture Images Fora Capture Images The Select Extraction Location screen appears Chapter 10 Capture images and screenshots 117 UFED Touch C E celiebrite UFED TOUCH PP EE Sea aca Keyboard Home Settings Tutorials Exit 100 ung Galaxy Mega 6 3 Capture Images Select Extraction Location _ 2 Select Removable Drive to extract the device data to a USB Flash drive connected to the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader on the back panel Select PC to extract the information directly to the PC The following screen appears if no camera Is detected Chapter 10 Capture images and screenshots 118 UFED Touch xX celebrite UFED TOUCH a TE Keyboard Home Settings Tutorials Ext 100 sung GSM GT i9205 Samsung Galaxy Mega 6 3 Capture Images Please connect the UFED camera to the rear USB port 3 Connect the UFED camera to a USB port on the back of the unit The Capture Images screen is displayed C
27. the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader on the back panel e Select PC to save the extracted passwords to the PC Chapter 7 Password extraction 81 The Waiting for Device screens appears cellebrite UFED TOUCH fk P EL eq wre eer Keyboard Home Settings Tutorials Exit 96 LG CDMA UN 610 Lotus 2 Password Extractions Waiting for Device Please connect source device to the left USB port LG UN 610 Lotus 2 using Cable A with Black tip T 100 Continue 4 Connect the source device 5 Tap Continue Chapter 7 Password extraction 82 The Extraction in Progress screen appears cellebrite UFED TOUCH amp ff PE perth beac tien pars Keyboard Home Settings Tutorials Exit 96 Extraction in Progress Source Please Wait Connecting LG UN 610 Lotus 2 using Cable A with Black tip T 100 g Extraction to removable drive At the end of the extraction process the extracted passwords are displayed in the Passwords screen Chapter 7 Password extraction Passwords User Code 0000 ESN MEID 268435459304781538 Own Number 0123450000 MIN 0123450000 6 Tap Continue to display a summary of the passwords extraction process 83 Chapter 7 Password extraction 84 Extract Passwords Summary Extraction completed successfully Source LG UN 610 Lotus 2 Target Removable Drive assword 01 Need additional extractions for thi
28. used in this Agreement are for reference purposes only and will not be deemed to limit expand or in any way affect the interpretation of any term or provision hereof If any provision or part hereof shall be held to be invalid or unenforceable for any reason then the meaning of such provision or part hereof shall be construed so as to render it enforceable to the extent feasible If no feasible interpretation would save such provision or part hereof it shall be severed herefrom but without in any way affecting the remainder of such provision or any other provision contained herein all of which shall celebrite 246 delivering mobile expertise continue in full force and effect unless such severance effects such a material change as to render the Agreement unreasonable In case of any inconsistency between this Agreement and any other agreement document and or instrument entered into by Buyer and Cellebrite the terms of this Agreement shall prevail 14 WARRANTY A Hardware Warranty Cellebrite warrants that each Product including all firmware and excluding Software for which the warranty is only as provided under Section D below but not related services or prototypes of any such Product shall be materially in conformance with the written specification furnished or agreed to by Cellebrite for twelve 12 months after acceptance the Warranty Period If any failure to materially conform to such specification Defect is suspected in an
29. 22 e Bootloader extraction extraction that takes place before the Android operating system starts running several variations of this method are available This method can be performed on locked devices For more information see Bootloader extraction page 225 celebrite 222 delivering mobile expertise 16 1 1 Android debugging bridge method Q How does ADB work A ADB is a built in protocol within the Android operating system Every Android based device has this protocol which enables developers to connect to an Android based device and perform low level commands used for development Cellebrite utilizes this protocol to extract data from Android devices Q Can ADB be used to extract any Android device A In theory data can be extracted from every Android device using ADB However there are some limitations e The USB debugging option must be enabled on the device e Access to the device must be with administrator permissions Q How do turn on the USB debugging option A On most Android devices go to Menu gt Settings gt Applications gt Development and then tap USB debugging Chapter 16 Extracting Android devices 223 Q Does this method bypass the unlock password or pattern Will be able to retrieve the code A The device USB debugging option must be turned on before it s possible to attempt an extraction For locked devices you can perform an extraction if the user enabled USB debugging befor
30. 6F8C725C04E6 Calculate hashes Data Files Databases 3 41 0 7 12 0 Text lt 1 229 0 Chapter 6 Logical extraction 63 Chapter 6 Logical extraction The Logical Extraction function enables you to extract various types of data such as call logs phonebook records SMS text messages calendar events and multimedia files images videos etc from a source device and saved to your PC or to a removable storage device as desired In addition data can be extracted from many Android and iOS apps For an updated list of supported apps and versions for each platform refer to the Decoding Android Apps and Decoding iOS Apps documents in MyCellebrite or from the Help gt Supported Apps menu in UFED Physical Logical Analyzer Data extracted from these apps can be analyzed using UFED Physical Logical Analyzer although the data is not included in UFED HTML and XML reports NOTE The available types of extracted data may vary depending on the source device manufacturer and model The supported data types are listed in the UFED Phone Detective or within the UFED Supported Phone List Microsoft Excel file Chapter 6 Logical extraction 6 1 Performing logical extraction To perform a logical extraction from a mobile device e Tap Extract from Mobile Device and identify the device then tap Logical Extraction ES H Logical Extraction 64 Chapter 6 Logical extraction 65 6 1 1 Connect mo
31. ES OR SUPPLIERS BE LIABLE TO BUYER OR ANY THIRD PARTY FOR ANY DAMAGES OF ANY KIND WHATSOEVER RELATING TO OR ARISING OUT OF DAMAGE TO OR LOSS OR CORRUPTION OF ANY RECORDS PROGRAMS OR OTHER DATA RESULTING FROM CELLEBRITE S REPAIR OR REPLACEMENT SERVICES UNDER THIS WARRANTY ORAS A RESULT OF A FAILURE OR MALFUNCTION OF A PRODUCT celebrite 250 delivering mobile expertise A Activate TomTom Trip log 165 174 Activating the license 199 Android backup 98 Android Debugging Bridge method 221 222 Android extraction methods 221 Appendix 231 Application taskbar 44 B Back panel 25 Battery 216 Bluetooth Scan 165 167 Bootloader extraction 221 225 Bottom Panel 28 Index C Capture images 14 Capture images and screenshots 43 Cellebrite YouTube channel 19 Changing the application interface language 179 183 Charging the battery 48 Clone SIM 13 43 144 Cloning an existing SIM card ID 145 Connect mobile device 65 Cover Page gt 1 Creating GSM test SIM 161 D Detect automatically 36 Device power up cable 213 252 Device tools 14 43 165 Dimensions and weights 217 Disabling the password 86 E Enabling wireless and Bluetooth communication 49 Entering SIM data manually 152 Exit Odin Mode 175 Extracting Android devices 221 Extracting Data to PC 55 68 136 Extraction in Progress 72 F File system extraction 13 43 91 Front pan
32. FED Touch 51 Chapter 4 Using UFED Touch Before you can use the UFED Touch unit you need to activate the license from your MyCellebrite account To use UFED Touch 1 Power on the UFED Touch unit The Cellebrite product license window appears Cellebrite product license Already have a license file Load from USB Need to download your software license Go to MyCellebrite Serial 5908884 UFEDID 0805 sales cellebrite com Close Chapter 4 Using UFED Touch 52 2 On a computer log in to your account at my cellebrite com If you don t have an account click Register now create a user and then log in to your account The following window appears celebrite Welcome to the new MyCellebrite Portal Please add your device 3 Click Add Device The Add Device window appears Add Device Serial Number 590884 Device ID 0805 Name Precinct 8 Add Device Cancel Chapter 4 Using UFED Touch 53 4 Enter the UFED Touch Serial Number Serial and Device ID UFED ID as they appear in the Cellebrite product license window 5 Click Add Device The UFED Touch unit is now displayed in the Active Products area v Active Products A ae UFED Touch 5908884 UFED Physical Expires on Mar 31 2015 UFED Logical Expires on Mar 31 2015 NOTE You can use the filter devices search box to search for the UFED Touch unit 6 Select the UFED Touch unit and click Retrieve License or click
33. OS e Clone the SIM ID which allows you to extract phone data while preventing the mobile device from connecting to the network It can also help ifthe SIM card is missing celebrite 10 delivering mobile expertise e Extract the data from a mobile device either by a cable based connection serial or USB or a Bluetooth wireless connection The tips and cable kit consists of four master cables and various tips The extracted data can be saved to any standard USB mass storage drive SD card or PC and then generated in the form of clear and concise reports Chapter 1 Introduction 11 Cellebrite s industry expertise provides reliability and ease of use and ensures the broadest support for mobile devices including updates for newly released models before they are available to the market Figure 1 UFED Touch unit celebrite 12 delivering mobile expertise 1 2 UFED Touch extraction types and device tools UFED Touch includes a range of data extraction types that can be accessed through the Select Extraction Type screen NOTE The available extraction functionalities may vary based on the type of product purchased the UFED Touch Logical or the UFED Touch Ultimate product Table 1 1 Functionalities of the UFED Touch products Functionality UFED Touch Logical UFED Touch Ultimate Logical Extraction Ys dG SIM Data Extraction File System Extraction Not available Physical Extraction Not available Capture Images Screen
34. Select the link type USB Cable or Serial Cable Chapter 12 Device tools 173 The Device Tool in Progress screen appears UFED Touch CI oe celebrite UFED TOUCH Ss tf k Gaivaring astia enparan Excellent Keyboard Home Settings Enat 95 Device Tool in Progress Source Please Wait Connecting Test Peek Poke functionality The Peek check reply prompt appears 3 Tap Continue The Device Tool in Progress screen appears The Reporting prompt appears celebrite 174 delivering mobile expertise 12 4 Activate TomTom trip log This tool enables you to activate or deactivate the trip log sharing feature of a connected TomTom device which is often disabled by the user To Activate TomTom trip log 1 In the Device Tools gt Select Tool screen tap Activate TomTom trip log The Select Mode prompt appears 2 Select the desired mode A prompt labeled Attention appears requesting to connect the device to the PC 3 Connect the device to the PC 4 Tap Continue 12 5 Uninstall Windows Mobile Client In order to perform Logical Extraction the client is installed on the device In some cases due to device failure or if the mobile device was improperly disconnected from the UFED Touch the client remains installed on the mobile device This option enables the client to be manually uninstalled Chapter 12 Device tools 175 12 6 Uninstall Android client In order to perform Logical Extraction the clie
35. Source and then the Target is active 6 Follow any on screen instructions The following screen appears Chapter 9 Physical extraction 110 NOTE Forsome devices an estimation of the time the extraction will take is displayed For example Blackberry Nokia BB5 QCP SamM 550 LgEmergency LgP0 Android generic and SPF SoreadTrum Samsung GSM MTK LGInfinion and BCM 2133 and Palm Source Instructions GT i9205 Samsung Galaxy Mega 6 3 Extraction completed successfully please remove and reinsert the battery Tf the battery is not removable please shut down the device Press continue to finish 7 Tap OK When extraction is complete the Physical Extraction Summary screen appears Chapter 9 Physical extraction 111 Physical Extraction Summary Extraction completed successfully Source GT 535 0 Tass Target Local Drive Physical 01 Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data Additional Extractions Finish 8 Click the required button To add additional extraction types for the same device e To end the process and return to the home screen Finish Chapter 9 Physical extraction 112 In the event that the system cannot connect to the device the Extraction Summary screen appears with an error message celebrite u Extraction Summary Caini conme to phone GT 19000 Galaxy S Android To allow phone connection Ba
36. TALL OR USE THE SOFTWARE OR AS APPLICABLE 232 celebrite delivering mobile expertise THE CELLEBRITE PRODUCT IN WHICH THE SOFTWARE IS EM BEDDED AND B WITHIN THIRTY 30 DAYS AFTER RECEIPT OF THE SOFTWARE OR IF AN AGREEMENT BETWEEN YOU AND CELLEBRITE PROVIDES A SHORTER TIME PERIOD FOR ACCEPTANCE SUCH SHORTER TIME PERIOD FOR ACCEPTANCE EITHER RETURN THE SOFTWARE TO CELLEBRITE OR THE APPLICABLE AUTHORIZED RESELLER FOR FULL REFUND OF THE SOFTWARE LICENSE FEE OR IF THE SOFTWARE IS EMBEDDED IN A CELLEBRITE PRODUCT FOR WHICH NO SEPARATE SOFTWARE LICENSE FEE WAS CHARGED RETURN THE EQUIPMENT AND EMBEDDED SOFTWARE UNUSED TO CELLEBRITE OR THE APPLICABLE RESELLER FOR A FULL REFUND OF THE PURCHASE PRICE YOUR RIGHT TO RETURN AND REFUND ONLY APPLIES IF YOU ARE THE ORIGINAL END USER PURCHASER This EULA governs Buyer s access to and use of the Software as defined below first placed in use by Buyer on or after the release date of this EULA the Release Date 1 DEFINITIONS In this Agreement the following capitalized terms shall have the meaning set forth below Affiliate of a party means such party s parent corporation an entity under the control of such party s parent corporation at any tier or an entity controlled by such party at any tier Forthese purposes control shall mean the power to direct or cause the direction of the management and policies of the entity whether through the ownership of more than 50 of the outstand
37. To view an HTML preview report that includes information about the device and the extraction To add additional extraction types for the same device To end the process and return to the home screen Chapter 10 Capture images and screenshots 124 To capture images without a device 1 Click Capture Images The Select Extraction Location screen appears celebrite UFED TOUCH a Galivaring mobilo expertise Exit 96 Keyboard Home Settings Tutorials Capture Images Select Extraction Location Drive a 2 Select Removable Drive to extract the device data to a USB Flash drive connected to the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader on the back panel Select PC to extract the information directly to the PC The Capture Images screen appears Chapter 10 Capture images and screenshots 125 celebrite UFED TOUCH me a a a oe a en aanl a Keyboard Home Settings Tutorials Bat 96 Capture Images See page 720 for information on available options in this screen 3 Tap Next to continue The Capture Images Summary appears Chapter 10 Capture images and screenshots 126 Capture Images Summary Transfer completed successfully Source USB Camera Target Removable Drive 01 Content Type Items Pictures 1 picture Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data BR Open Preview Addition
38. a removable storage device or PC 11 1 1 Performing SIM data extraction The following example is performed using a SIM Card To perform the SIM Data Extraction 1 Select Extract from SIM Card The following screen appears Chapter 11 SIM card functionality 134 celebrite UFED TOUCH tt P EL Keyboard Home Settings Tutonals Boat 96 Standard Micro Nano CU T w SIM Card SIM Card SIM Iden SIM 2 Tap either Iden SIM or SIM Card Chapter 11 SIM card functionality 135 3 The Select Extraction Type screen appears celebrite UFED TOUCH Se k P E serch bel Keyboard Home Settings Tutonals Boat 96 SIM Card SIM Select Extraction Type a ap SIM Data Extraction Clone SIM i ep File System Extraction S Capture Images Chapter 11 SIM card functionality 136 4 Select an option The Select Extraction Location screen appears cellebrite UFED TOUCH a a en ee ee Keyboard Home Settings Tutonals Bat 96 SIM Card SIM SIM Extractions Select Extraction Location Q Drive NOTE The UFED Physical Analyzer Application must be installed on the PC before the PC option can be selected See Extracting Data to PC page 55 Chapter 11 SIM card functionality 137 5 Select the desired location e Select Removable Drive to extract the device data to a USB Flash drive connected to the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader
39. action information used by the UFED Physical Analyzer application e PM file The File System extraction can be viewed using the UFED Physical Analyzer Chapter 8 File system extraction 98 8 3 Android backup The Android Backup feature communicates with a connected Android device and enables you to extract data from the device The data that is extracted is dependent on the device s specific characteristics Android backup supports Android devices with version 4 1 and later Android Backup may provide less data then other methods therefore you should use this feature when other file system methods such as ADB are not successful or when other file system methods are not available for the device for example if the android version is not supported There are two extraction methods e No Shared Extracts all the applications native and non native that reside on the device e With Shared Extracts all the applications native and non native that reside on the device plus data from the device s internal storage and memory card included images videos etc This method takes additional time for the extraction If this method is not successful you should try the No Shared method To extract data using Android backup 1 Tap Extract from Mobile Device and identify the device then click File System Extraction H B File System Extraction The following screen appears Chapter 8 File system extraction 99 celebri
40. al UFED Ultimate UFED Physical Analyzer in connection with any product and or cellular device developed manufactured produced programmed assembled or otherwise maintained by any corporation shall be permitted only after the User of the Cellebrite UFED family of products has obtained any consents or approvals required to the extent required pursuant to applicable law in the jurisdiction in which such use ismade UNDERNO CIRCUMSTANCES SHALL CELLEBRITE ITS OFFICERS EMPLOYEES OR REPRESENTATIVES BE LIABLE TO USER OR ANY OTHER THIRD PARTY UNDER ANY CAUSE OF ACTION WHETHER IN CONTRACT TORT OR OTHERWISE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL CONSEQUENTIAL PUNITIVE OR EXEMPLARY DAMAGES UNDER ANY LEGAL THEORY WHATSOEVER ARISING OUT OF OR RELATING TO THE USE OF THE CELLEBRITE UFED FAMILY OF PRODUCTS IN CONNECTION WITH ANY PRODUCT AND OR CELLULAR DEVICE DEVELOPED MANUFACTURED PRODUCED PROGRAM MED ASSEMBLED OR OTHERWISE MAINTAINED BY ANY CORPORATION WITHOUT OBTAINING THE APPLICABLE CONSENTS AND APPROVALS User agrees to indemnify and hold harmless Cellebrite its directors shareholders and employees from and against any damages claims liabilities and expenses including legal fees arising as a result of the use of the Cellebrite UFED family of products in connection with any product and or Chapter 17 Appendix 239 cellular device developed manufactured produced programmed assembled or otherwise maintained by any corporation with
41. al Extractions Chapter 10 Capture images and screenshots 127 4 Tap the required button To view an HTML preview report that includes information about the device and the extraction To add additional extraction types for the same device To end the process and return to the home screen Finish 10 3 Capturing screenshots The Screenshot feature captures internal screenshots directly from a Blackberry Android or iOS device To capture screenshots from the devices 1 Tap Extract from Mobile Device and identify the device then tap Capture Screenshots i Ha Capture Screenshots The Select Extraction Location screen appears Chapter 10 Capture images and screenshots 128 celebrite UFED TOUCH e P Keyboard Home Settings Tutonals Galaxy Mega 6 3 Capture Screenshots Select Extraction Location Drive 2 Select Removable Drive to extract the device data to a USB Flash drive connected to the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader on the back panel Select PC to extract the information directly to the PC The Waiting for Device screen appears Chapter 10 Capture images and screenshots 129 celebrite UFED TOUCH Ss t k C p Keyboard Home Settings Tutonals Exit 56 samsung Galaxy Mega 6 3 Capture Screenshots Waiting for Device Please connect source device to the left USB port Android 4 2 and Higher Android 4 0 4 1 2
42. are without regard to this sentence had it been delivered installed on the Cellebrite equipment Forensic Product means a Product used for the purposes of conducting forensic analysis including without limitation Products sold under the trade name UFED License Authorization Software means Software that is provided together with hardware on which it is embedded that is used to validate the authorized use of Standalone Software License Term means the term of a paid subscription to the Standalone Software 234 celebrite delivering mobile expertise Product means a product sold by Cellebrite or an authorized reseller of Cellebrite with Embedded Software Software means an instance of a program module feature function service application operation or capability of the Cellebrite supplied software Software includes Embedded Software and Standalone Software Standalone Software means Software that is not Embedded Software or License Authorization Software Third Party means an individual or entity other than Buyer Buyer s Affiliates Cellebrite and Cellebrite s Affiliates Update means an update to the Software or the Standalone Software that is provided by Cellebrite and that may incorporate i corrections of any substantial defects li fixes of any minor bugs iii at the sole discretion of Cellebrite allowing additional compatibility of the Software with cellular phones provided by third parties and o
43. bile device NOTE The following screen appears only when more than one connection option is available NOTE For Apple devices use the generic option that is available in the Model selection screen UFED Touch ey ae celebrite UFED TOUCH s y EE NAE Very Good Keyboard Home Settings Exit 96 Motorola GSM EX122 Logical Extractions Connection Type Cable A with Black tip T Bluetooth 100 e Select the connection type from the options shown Chapter 6 Logical extraction 66 6 1 2 Select phone memory Data can be extracted from the device memory memory cards and SIM memory of the device All memories can be selected or only one The types of memories can vary between devices Where only a single memory Is available this screen is not displayed celebrite UFED TOUCH St amp P E ee ee eee Keyboard Home Settings Tutonals Bot 97 msung Galaxy Mega 6 3 Logical Extractions Select Phone Memory Phone SIM Phone Memory Card Phonebook Phonebook Content Content Chapter 6 Logical extraction 67 To select the phone memory 1 The Phone memory selection box is selected by default It can be deselected if desired 2 Select any other memories as desired 3 Tap Next to continue The Select extraction location screen appears 6 1 3 Select extraction location celebrite UFED TOUCH S ee ee Keyboard Home Settings Tutonals Exit 97 ng Galaxy Mega 6 3 Logical Extractions Select E
44. ccessfully source G1T 555 0 Tass Target PC Chapter 5 Extracting Data to PC On the PC in UFED Physical Analyzer the following message appears Extraction Completed Extraction completed ae Would you like to open the extraction o 12 Click Yes 61 Chapter 5 Extracting Data to PC 62 The extraction opens in UFED Physical Analyzer and the Extraction Summary screen is displayed f uen Physical Anayzr 410 178 I ee File View Tools Extract Python Plug ins Report Help GE Samsung GSM_GT S5570 Tass B Extraction Summary E Device Info 4 B Images FileDump Samsung GSM_GT S5570 T b Memory Ranges b amp File Systems Configurations f Databases 41 B Documents E Images 12 E Text 229 E Videos a fi Carving Images b Tags Timeline Watch Lists Malware Scanner OO Project Analytics Hex Bookmarks sir Entity Bookmarks m r b Same SEP BH S al A All Projects Q 3 amp _ L Welcome x Extraction Summary x Samsung GSM_GT S5570 Tass Extraction start date time Extraction end date time Unit Identifier Extraction Type Extraction ID 1 12 2015 4 26 16 PM 1 12 2015 4 31 17 PM UFED S N 5908884 Analyzed Data Unit Version 4 1 0 324 4 U Data Files Selected Manufacturer Samsung GSM f Applications Selected aie Name p Tass J Audio Connection Type Cable No 100 File system 7F78F624 3340 49AC A1CB
45. celebrite delivering mobile expertise UFED Touch User Manual January 2015 Legal Notices Copyright 2015 Cellebrite Mobile Synchronization Ltd All rights reserved This manual is delivered subject to the following conditions and restrictions This manual contains proprietary information belonging to Cellebrite Ltd Such information Is supplied solely for the purpose of assisting explicitly and properly authorized users of the UFED Touch e No part of this content may be used for any other purpose disclosed to any person or firm or reproduced by any means electronic or mechanical without the express prior written permission of Cellebrite Ltd e The text and graphics are for the purpose of illustration and reference only The specifications on which they are based are subject to change without notice e Information in this document is subject to change without notice Corporate and individual names and data used in examples herein are Fictitious unless otherwise noted WARNING UFED Touch should be used only with the dedicated AC DC adapter supplied with this device WARNING USB Ethernet target and source connectors should be connected only to CE approved devices according to IEC EN 60065 standard WARNING Make sure that all external connections to other devices except for the power adapter are only indoor and SELV safety extra low voltage and do not exceed 42 4 V peak or 60 V DC FCC WARNING This device
46. complies with part 15 of the FCC rules Operation is subject to the following two conditions 1 This device may not cause harmful interference 2 This device must accept any interference received including interference that may cause undesired operation Contents Chapter 1 Introduction ssssssssssssssssssssssnnsssssssssssssss 9 TV OV CIV IGW schscccsssscecccccccccccccccceesecsssssssesueccecccccecccecccccceececcceeeeee 9 1 2 UFED Touch extraction types and device MO aanne E E A A 12 1 3 UFED Touch ACCESSOTICS sssssssssssssssssssesssssesssssssesssen 15 1 3 1 Using cables and tipS s ssessrerssrsrsersrrersrrersersrserserns 16 1 4 Supported devices eeesssssssssssssssssssssssssssssssesssesssessssssssset 19 1 5 Cellebrite YouTube CHANNE L scssssssssssssssssssseeesses 19 Chapter 2 Orientation to the UFED Touch UNIE aa 21 2 1 TOP VIQW acessssssssssssssssssssssssssesssssssssssssssssssssssssssssssssssssseseeseeeeeees 21 2 2 Front panel sesssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssseeeeeeeeeees 24 Pipe a o lt 6 A ONO a 25 PRAE E E eee 26 DP FIC ih cll Ve e 27 DG BORON P AN ed orssriaississssisisssssisisinannnnnn 28 Chapter 3 Getting started ssssssssssesssessens 31 3 1 Turning the UFED Touch Unit On or Off 31 3 2 Working with UFED TOUCH 33 3 2 1 Starting the UFED Touch application ANETA D E AA EAA AA 33 3 2 2 HOME SC IC I sssssssssssrssnssnonnonsersnnoanonnorsnnsan
47. dalone Software was licensed from Cellebrite or an authorized reseller of Cellebrite and only as authorized in the Agreement Buyer s license to the License Authorization Software is limited to a license to use the License Authorization Software on one 1 Authorization Product for each license to the Standalone Chapter 17 Appendix 237 Software the authorized use of which is validated by such License Authorization Software and where such license is purchased from Cellebrite or Cellebrite s authorized reseller D Updates and Upgrades i Updates Updates or Upgrades to the Software may be made available to Buyer pursuant to a separate agreement between Cellebrite and Buyer Any particular Update or Upgrade shall be licensed under the terms of the Software that is being updated by such Update or Upgrade as the case may be li Limitation Except as expressly provided in the Agreement Buyer shall have no rights in any Update or Upgrade to Software nor any rights to support services associated with such Software iii No Obligation Nothing in this EULA requires Cellebrite to provide Updates or Upgrades to Buyer or Buyer to accept such Updates or Upgrades The provision of any Updates or Upgrades shall be governed by a separate agreement between Cellebrite and Buyer or by a purchase order issued by Buyer and accepted by Cellebrite in Cellebrite s sole discretion E Specific License Terms for Particular Products Forensic Products
48. e locking the device For selected Android devices you can perform a physical extraction where there is greater support for extraction from locked devices pattern lock PIN password Following a successful physical extraction you can view the numeric password or pattern lock protecting the device in UFED Physical Analyzer and use it to unlock the device Q How do I get Administrator root permissions on the device A When USB debugging enabled UFED Touch automatically detects the Android OS version and whether or not access is at administrator level If it is not UFED Touch automatically gains root permissions NOTE It is possible to gain access at administrator level manually using third party tools but gaining access this way may harm the integrity of the data on the device or has the potential to render the device useless Q turned on USB debugging What extraction types can perform A Once USB debugging is enabled you can perform either a physical extraction which extracts all the data on the device or a File System Extraction which extracts only relevant files celebrite 224 delivering mobile expertise The advantage of a physical extraction is that it retrieves more data from the device making it possible to recover deleted files such as photos that were saved on the device The disadvantage is that it takes more time and that file system reconstruction is not supported for all devices The advantage of a
49. ed In this case English Select Language English English VY Dutch Nederlands Hungarian magyar Chinese Simpl fied Legacy Croatian HIZ iE hrvatski He French German fran ais Deutsch Indonesian Indonesia tallaa Kid italiano Indonesia Czech Danish e tina dansk Greek EAANVIKQ Japanese Korean AAS et O01 v NOTE Use the arrows to scroll through the list of available interface languages Chapter 13 Settings 2 Tap the required language Select Language Chinese English G a x ed Croatian English CGIE hrvatski IBR Dutch French Nederlands fran ais German Deutsch Indonesian Hungarian Ce Italian magyar Indore italiano Indonesia Czech Danish e tina dansk Greek EAAnVIKG Japanese B48 185 celebrite 186 delivering mobile expertise The following message appears You must restart the application for the language change to take effect 3 Tap OK The General tab appears with the language of choice in the Interface language field 4 Tap Save to close the Settings panel 5 To restart the application a To close the application Tap x in the application taskbar b To re launch the application do one of the following Tap the application shortcut icon located in the UFED shortcuts panel at the right of the screen Double tap the UFED Touch Icon located on the Desktop Tap
50. ed by the selected device are enabled for selection Unsupported content types appear with a cross 3 Tap Next to continue The Waiting for Device screen appears celebrite UFED TOUCH a a a oe Keyboard Home Settings Tutonals bat 97 Samsung Galaxy Mega 6 3 Logical Extractions Waiting for Device Please connect source device to the left USB port Android 4 2 and Higher Android 4 0 4 1 2 Android 3 2 and Lower 1 Enable Developer options How to 2 Enable Stay awake and USB debugging modes How to 3 Verify screen lock mode How to 4 Enable MTP after device is connected How to Samsung GSM GT i9205 Samsung Galaxy Mega 6 3 using Cable A with Black tip T 100 Enlarge Help Continue Chapter 6 Logical extraction 4 Connect the source device to the USB port on the unit If the device Is already connected disconnect and then reconnect the device 5 Tap Continue 71 Chapter 6 Logical extraction 72 6 1 5 Extraction in progress Q UFED Touch celebrite UFED TOUCH a ft Gr delivering mobile expertise Very Good Keyboard Home Settings Extraction in Progress Source Samsung GT i9205 a Samsung Galaxy Mega Initializing 6 3 Please Wait using Cable A with Black tip T 100 Extraction to removable drive During the extraction process the progress bar for the Source and then the Target is active Chapter 6 Logical extraction When the extraction is complete and if required the
51. ed in the Source area of the Select Content Types screen 18 Source BB 8700f using Cable A with Black tip T 80 Figure 5 Enlargement of notification celebrite delivering mobile expertise Chapter 1 Introduction 19 1 4 Supported devices To find out which mobile devices are supported in UFED Touch and which data extraction capabilities are available for every mobile device use one of the following 1 The UFED lt version no gt Supported Phone List file is delivered with every UFED software version update The Microsoft Excel file contains two worksheets The UFED Logical sheet lists the mobile devices supported for logical extraction The UFED Physical sheet lists the mobile devices supported for physical file system and password extractions 2 UFED Phone Detective devices supported for logical extraction only 3 On Cellebrite s website http www cellebrite com mobile forensics support ufed supported devices 1 5 Cellebrite YouTube channel For your convenience a selection of useful videos demonstrating typical workflows and common procedures are available at youtube com cellebriteufed 20 celebrite delivering mobile expertise Chapter 2 Orientation to the UFED Touch unit 21 Chapter 2 Orientation to the UFED Touch unit This section describes the layout and components of the UFED Touch unit 2 1 Top view Access the UFED Touch application through the UFED Touch screen Navigate the ap
52. el 24 celebrite delivering mobile expertise G General settings 178 General specifications 215 Getting started 31 H Home screen 33 I I O interfaces 217 Image capture 115 Introduction 9 L Left panel 26 Legal notices 3 License settings 196 Licensing 51 Locked HTC Huawei and ZTE devices 227 Locked Motorola devices 226 Logical extraction 13 43 63 M Managing report fields 190 191 Managing the Custom List 179 Mobile Extraction Client 179 187 N Network 212 O Orientation to the UFED Touch unit 21 Other locked devices 228 Overview 9 P Password extraction 13 43 79 Index Performing a file system extraction 91 Performing a physical extraction 105 Performing File System extraction for an Android device 226 Performing logical extraction 64 Performing password extraction 79 Performing SIM data extraction 133 Permission management 204 Physical extraction 14 43 105 Power supply 216 R Regulatory compliance 219 Report settings 188 Right panel 27 254 S screenshots 115 Search function 39 41 Select Content Types 68 Select extraction location 67 Select phone memory 66 Settings 45 177 SIM Card Functionality 133 SIM data extraction 13 43 133 Special cables 213 Starting the UFED Touch application manually 33 Supported devices 19 Switch to CDMA Offline Mode 165 170 Sys
53. ely caused by Cellebrite Buyer s direct damages and celebrite 242 delivering mobile expertise ll For claims other than as set forth above Cellebrite s liability shall be limited to direct damages that are proven in an amount not to exceed the total amount paid by Buyer to Cellebrite during the twelve 12 month period that immediately preceded the event that gave rise to the applicable claim C Limitation of Liability Notwithstanding any other provision of this EULA CELLEBRITE shall NOT be liable for incidental indirect special exemplary or consequential damages including but not limited to lost profits savings or revenues of any kind whether or not CELLEBRITE has been advised of the possibility of such damages This provision shall APPLY EVEN IN THE EVENT OF THE failure of an exclusive remedy D No Liability to any Third Party TO THE MAXIMUM PERMITTED EXTENT CELLEBRITE DISCLAIMS ANY AND ALL LIABILITIES OR OBLIGATIONS WHATSOEVER RELATED TO THE SOFTWARE ORITS LICENSING TO OR USE BY ANYONE OTHER THAN BUYER 6 BUYER INDEMNITY Buyer will at its expense i indemnify and hold Cellebrite and its affiliates officers and directors harmless from any claim whether brought by a Third Party or an employee consultant or agent of Buyer s alleging that any Product or Software furnished under this Agreement was used in a manner other than as authorized under this EULA including but not limited to using the Product or Software in a
54. er the Waiting for Device or Waiting for Device Adapter screen appears Cellebrite UFED TOUCH se ft P EE Keyboard Home Settings Tutonals Boat samsung Galaxy Mega 6 3 Physical Extractions Waiting for Device Please connect source device to the left USB port Tutorial Video 1 Before starting the phone battery should be fully charged 2 Put the device in download mode How to 3 Connect the device to UFED TOUCH How to Note If the battery is not sufficiently charged use the power up cable if applicable Samsung GSM GT i9205 Samsung Galaxy Mega 6 3 using Cable A with Yellow tip T 133 Enlarge Help Continue 4 Do one of the following e Select the correct cable and tip for the mobile device based on the instruction on the screen e Change the device settings according to the instructions e Connect the device to the UFED Touch SOURCE port A red source arrow A continues to flash on the left of the screen until the device is connected Chapter 9 Physical extraction 109 5 Tap Continue The Extraction in Progress screen appears UFED Touch Ccellebrite UFED TOUCH Be ft Hy Golwaring mobilo expertise Very Good Keyboard Home Settings Exit Extraction in Progress a Source Samsung GT i9205 l Samsung Galaxy Mega f Reading Phone Info 6 3 Please Wait using Cable A with Yellow tip T 133 Extraction to removable drive During the extraction process the progress bar for the
55. ertise S ANATOLA PACKUP iiics 98 Chapter 9 Physical extraction sss 105 9 1 Performing a physical extraction ssr 105 9 2 The Physical Extraction fold Ef 113 Chapter 10 Capture images and Screen SNO tS usisna 115 10 1 The UFED CAMO ecssssssssssssssssssssssssssssssssssssssssssssesse 115 10 1 1 Contents siscsscccsssscsssssssssssssnssssnnnsssssssssssssesssssssssssssesseet 116 10 2 Capturing iIMaJ6eS ssssrssssrsrrersrrerserorserorrersnrernrorrernrns 116 10 3 Capturing Screenshots s s serssrsrsersrsersrrersrrersererrerenrns 127 Chapter 11 SIM card functionality sss 133 11 1 SIM data extraction ceessssssssssssssssssuessssssssssssessssse 133 11 1 1 Performing SIM data extraction 133 11 1 2 The extracted SIM data folder s es 143 TZ Mea 144 11 2 1 Cloning an existing SIM card ID sss 145 11 2 2 Entering SIM data manually 152 Contents 11 2 3 Creating a GSM test SIM sssr 161 Chapter 12 Device tOOIS sss 165 12 DIVE 0 Eat SCN canna 167 12 2 Switch to CDMA offline MOE sssr 170 12 3 Test peek poke functionality sssr 172 12 4 Activate TOMTOM trip LOG sser 174 12 5 Uninstall Windows Mobile Client s s s 174 12 6 Uninstall Android CHONC ssssssesssssssssssssessssse 175 PARION MOE urpsrsnissssssssnsnmma 175 Chapter 13 Settings uss 177 13 1 General settings sssrserssrsrrsrrersersrrsrrersersrrsrrsreersnrenrerens 178 13 1 1 Managing the custom list 179 13 1 2 Changing the ap
56. et License Version Date and time 2015 01 13 12 22 Connected to Cellebrite Guests Signal strength Very Good Wireless status F Mute windows audio Play notification sounds l Disable screensaver Enable bluetooth ULG logs level Disabled Export application logs User Permissions Network Display mode 7 Transactions counter celebrite delivering mobile expertise Chapter 13 Settings 195 Define the following additional settings in the System tab 1 To set the unit to make a sound for UFED Touch operations such as failure select Play notification sounds 2 To display the screensaver that appears after the unit is idle for a period select Disable screensaver 3 To change the ULG log level tap next to ULG logs level and select one of the following e Disable set to not generate log files e Normal set to generate log files If the transaction Is very fast not all the information Is written to the log e Detailed set to generate detailed log files The transaction will be slower in order to write to the log Recommended in case of debugging error situation 4 To export system information tap Export system information 5 To save the application logs tap Export application logs 6 To monitor device usage tap the Transactions counter This counts the number of transactions performed on the UFED Touch Transactions include all extractions per type and device tool actions The coun
57. extraction functions are available for this combination and present those functions as follows celebrite UFED TOUCH s t a gt P D a Keyboard Home Settings Tutonals Boat 97 Samsung GSM GI S55 0 Tass Select Extraction Type Logical Extraction Password Removal File System Extraction Physical Extraction Capture Images Capture Screenshots Chapter 3 Getting started 41 3 2 5 Manual selection To manually select the vendor and model 1 Click Extract from Mobile Device and then click Manual Selection The Select Vendor screen appears where the vendor of the device is chosen celebrite UFED TOUCH t A PE Keyboard Home Settings Tutonals Bat 97 Select Vendor a AUDIOVOX CORPORATION Back Recently Used Chapter 3 Getting started 42 2 After choosing the Vendor the application presents the Select Model screen where the specific model of the device is chosen celebrite UFED TOUCH a a a ee oe Keyboard Home Settings Tutonals Exit 97 Select Model Samsung GSM Samsung Samsung a oo Generic Generic Android ey Samsung QCP Broad Generic SGH BCO1 Generic SGH CCO ti SGH 2Z 10 SGH 2Z 10 SGH 2ZX 10 SGH 2ZX 10 SGH ZX20 SGH ZX20 SGH ZV30 SGH ZV30 SGH ZX30 Back Back Recently Used Recently Used Chapter 3 Getting started 43 Having chosen the Vendor and the Model UFED Touch will determine what extraction functions are available for this combination and present those f
58. file system extraction is that it takes less time You are able to view all vital information including deleted records but excluding deleted files even if file system reconstruction Is not supported Q When selecting the Generic Profile on UFED Touch what are Method 1 and Method 2 Which should I choose A Methods 1 and 2 are different connection configurations It is not possible to tell which Android devices requires which method Try one method and if unsuccessful try the second method Q Does the ADB extraction method change any of the data on the device A When extracting using the ADB method a few client applications are written to the device data local tmp folder Chapter 16 Extracting Android devices 225 16 1 2 Bootloader extraction Q What is bootloader extraction A The bootloader extraction method performs a physical extraction when the device is in bootloader mode In this extraction method the Android operating system is not running so the device cannot connect to the mobile network Q Does this method bypass the unlock password or pattern Will be able to retrieve the code A Using this method you are able to bypass any type of lock and can retrieve a numeric PIN lock or unlock pattern Q Does this extraction method change any of the data on the device A No this method is completely forensically sound Q Which devices are supported by this method A Currently most Motorola Andr
59. form the following procedure to perform a file system extraction 1 Tap File System Extraction 2 Do one of the following e Foran advanced File System extraction including application system files select Android FS app sys files e Forastandard File System extraction select the device model NOTE If you do not see the device model in the list select lt Vendor gt Generic option 3 Follow the on screen instructions File system extraction is successful for unlocked devices celebrite 230 delivering mobile expertise 16 3 Technical terms Android Google s mobile operating system You can find a list of Android devices here http en wikipedia org wiki List_ of Android devices Another very helpful resource is http pdadb net Brick A device that cannot function in any capacity such as a device with damaged firmware Refer to http en wikipedia org wiki Brick 28electronics 29 Client A program written by Cellebrite that runs on the Android operating system itself Root rooting A process that allows users of cell phones and other devices running the Android operating system to attain privileged control known as root access within Android s Linux subsystem similar to jailbreaking on Apple devices running the iOS operating system overcoming limitations that the carriers and manufacturers put on such phones Attp en wikipedia org wiki Rooting 28Android_OS 29 Chapter 17 Appendix 231 Chapter 17 Append
60. g a file system extraction for an Android device sssri 226 16 2 1 Locked Motorola devices s 226 16 2 2 Locked HTC Huawei and ZTE devices 227 16 2 3 Other locked devices s 228 16 2 4 Unlocked devices 229 16 3 FECNAICAlTEMNS isansa 230 Chapter 17 AppendiX ssss sssssssrrrrssssssssssssssssssns 231 celebrite delivering mobile expertise Chapter 1 Introduction 9 Chapter 1 Introduction UFED Touch is anew generation handheld unit that empowers law enforcement military intelligence corporate security and e discovery personnel to capture critical forensic evidence from all mobile devices This includes mobile phones handheld tablets portable GPS devices and devices manufactured with Chinese chipsets With an intuitive touch screen interface and an integrated battery UFED Touch Is portable easy to operate and can be used in the forensic lab and field 1 1 Overview UFED Touch enables you to e Perform physical file system and logical extraction of device data and passwords Capabilities may vary based on the UFED Touch product purchased UFED Touch Logical or UFED Touch Ultimate e Extract vital data such as call logs phonebook entries text messages SMS pictures videos audio files ESN IMEI ICCID and IMSI information and more from a wide range of mobile devices e Extract data from the widest selection of operating systems such as Apple iOS Blackberry Android Symbian Microsoft Mobile and Palm
61. hapter 10 Capture images and screenshots 119 celebrite UFED TOUCH Samsung GSM GT 19205 Samsung Galaxy Mega 6 3 Capture Images Chapter 10 Capture images and screenshots 120 4 Do one of the following Tap a to start a video recording and tap D to stop the video recording Tap to take a picture Tap Os 7 to change the default category Images and videos will be displayed in UFED Physical Logical under these categories Tap an image or video to add notes bookmarks Was categories L or delete the file iil w Tap gt to move backto live view NOTE To rotate a picture or video or play a recorded video tap the picture or video and then tap the picture or video in the leftmost screen Use the rotate buttons or video wil Alaa See the following example buttons Chapter 10 Capture images and screenshots 121 5 Tap OK and then tap Next to continue The Capture Images Summary screen appears Chapter 10 Capture images and screenshots 122 Capture Images Summary Transfer completed successfully Source GT i9205 Samsung Galaxy Mega 6 3 Target Removable Drive CaptureImages 01 Content Type Items Pictures 2 pictures Videos 2 videos Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data Open Preview Additional Extractions Chapter 10 Capture images and screenshots 123 6 Click the required button
62. ice 3 Tap Continue and follow any on screen instructions The following the screens appears Source Instructions GT S5570 Galaxy Mini The extraction completed successfully Please remove and re insert the battery If the battery is non removable please switch the phone off The phone s lock code will now be disabled any password or pattern could unlock it Press Continue to finish Continue gt Chapter 7 Password extraction 4 Tap Continue The following screen appears Remove Passwords Summary Extraction completed successfully Source Samsung GT 55 0 Galaxy Mini 5 Tap Finish 90 Chapter 8 File system extraction 91 Chapter 8 File system extraction The File System Extraction function enables you to perform a full system extraction from a device to a removable storage device or PC 8 1 Performing a file system extraction 1 Tap Extract from Mobile Device and identify the device then tap File System Extraction T H File System Extraction The Select Mode screen appears The Select Extraction Location screen appears Chapter 8 File system extraction 92 celebrite UFED TOUCH a a Keyboard Home Settings Tutonals Bat 97 isung GSM GT S55 0 Tass File System Extractions Select Mode Q ADB Android Backup 2 Select ADB for Android Backup see Android backup page 98 The Select Extraction Location screen appears Chapter 8 File system extraction
63. image capturing or access the device tools All extraction functionality is driven by automatic identification of the device by searching for the device or by manually selecting the vendor and model UFED determines what functions are available for the specific device and displays the relevant functions The home screen is displayed next Chapter 3 Getting started celebrite UFED TOUCH Extract from Mobile Device Capture Images Device Tools e a ne oe Keyboard Home Settings Tutonals Boat 97 Extract Data Extract from Extract from SIM Card USB Device 34 Chapter 3 Getting started 35 To extract data from a device e Select Extract from Mobile Device The following window appears celebrite UFED TOUCH sf P E Keyboard Home Settings Tutorials Boat 97 Identify your device For auto detection please plug O Use the search box to manually in the device now identify the device Back Recently Used Manual Selection Chapter 3 Getting started 36 3 2 3 Detect automatically To use the Autodetect function to locate the mobile device 1 Connect the mobile device to the UFED Touch unit Device Detected Successfully To continue please select a device Samsung GSM GT i9205 Samsung Galaxy Mega 2 Tap the device 3 In the event that the device has not been connected a waiting for a device to be connected prompt appears with a red Source arrow flashing on the left side of the screen
64. ing the battery To charge the UFED Touch battery connect the supplied power adapter to the power supply jack on the right target panel of the device The battery indicator is located within the LED panel and lights up when the power adapter Is connected and displays one of the following color indications e Orange battery is charging e Green battery is fully charged Chapter 3 Getting started 49 3 5 Enabling wireless and Bluetooth communication The UFED Touch unit is equipped with integrated wireless and Bluetooth communication interfaces configurable in the operating system Device Manager list and can be used to connect UFED Touch to standard WLAN networks and Bluetooth enabled devices using the standard WLAN and Bluetooth features of the operating system NOTE For information regarding the use of Wi Fi Wireless Networks and the operating system s wireless features contact your IT manager or system administrator When using the wireless interfaces when the device is in battery operation mode increases battery power consumption resulting in a shorter operation time When the wireless interfaces are disabled the WLAN and Bluetooth interfaces are turned off and cannot be tumed on or used by the operating system thus saving battery power To enable or disable the wireless interfaces e Tum the Wi Fi switch located in the back panel of the UFED Touch unit to ON or OFF Chapter 3 Getting started 50 Chapter 4 Using U
65. ing voting interests in such entity or otherwise Authorization Product means a product sold by Cellebrite or an authorized reseller of Cellebrite with embedded License Authorization Software including but not limited to a USB stick with embedded License Authorization Software Chapter 17 Appendix 233 Authorized Users means the number of Concurrent Users that Buyer is licensed to have access to the Software Cellebrite means i Cellebrite Mobile Synchronization Ltd an Israeli corporation with offices at 94 Em Hamoshavot Road Petach Tikva Israel 49130 or ii any subsidiary of Cellebrite Mobile Synchronization Ltd including without limitation Cellebrite USA Inc and Cellebrite GMBH which is engaged by Buyer and issue invoices to Buyer with respect to the Software and or the Product as applicable Concurrent Users means the number of Users of Buyer concurrently accessing the Software If a single User connects to Software using multiple concurrent log ins or connections each such active logical connection or log in is counted toward the number of Concurrent Users Documentation means any documentation related to any Software Embedded Software means a copy of Software delivered embedded in or loaded onto Cellebrite hardware equipment when such equipment Is sold by Cellebrite Updates or Upgrades to Embedded Software are also deemed Embedded Software to the extent such an Update or Upgrade would be deemed Embedded Softw
66. ip any replacement Product FCA Cellebrite s premises Incoterms 2010 freight prepaid to Buyer s destination Any replaced Product or replaced parts of any Product shall become Cellebrite s property In no event shall Cellebrite be responsible for de installation or reinstallation of any Product or for the expenses thereof Repairs and replacements covered by the above warranty are warranted to be free from Defects as set forth above with respect to any Defect that appears i within six 6 months from the date of repair or replacement or li prior to the expiration of the original Warranty Period whichever is later B Touch Screen Exclusion Notwithstanding Section A the Warranty Period for the touch screen of any Product with a touch screen is the period from the date of Buyer s initial receipt of the Product until thirty 30 days after such date and Cellebrite warrants such touch screen only to the extent any damage to it was not caused by Buyer s negligence or willful misconduct C Warranty of Title Cellebrite warrants that any title conveyed hereunder excluding Software shall be good and its transfer rightful and that the Products delivered under this EULA shall be free from all liens encumbrances and restrictions Cellebrite further warrants that it has all rights and powers necessary to perform its obligations under this EULA and that to its knowledge it has the right to grant the licenses and other rights provided to Buyer by thi
67. ix IMPORTANT PLEASE READ THIS END USER LICENSE AGREEMENT CAREFULLY DOWNLOADING INSTALLING OR USING CELLEBRITE SUPPLIED SOFTWARE CONSTITUTES ACCEPTANCE OF THIS AGREEMENT CELLEBRITE IS WILLING TO LICENSE THE SOFTWARE TO YOU ONLY IF YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS AGREEMENT THE EULA ANY ADDITIONAL TERMS IN AN AGREEMENT SIGNED BY BUYER AS DEFINED BELOW AND CELLEBRITE AND ANY CLICK ACCEPT AGREEMENT AS APPLICABLE TO THE EXTENT OF ANY CONFLICT AMONG THIS AGREEMENT ANY ADDITIONAL TERMS IN AN AGREEMENT SIGNED BY BUYER AND CELLEBRITE ANY CLICK ACCEPT AGREEMENT ANY TERMS ON A PURCHASE ORDER AND CELLEBRITE S TERMS AND CONDITIONS OF SALE THE ORDER OF PRECEDENCE SHALL BE A AN AGREEMENT SIGNED BY BUYER AND CELLEBRITE B THIS AGREEMENT C THE CLICK ACCEPT AGREEMENT D CELLEBRITE S TERMS AND CONDITIONS OF SALE AND E BUYER S PURCHASE ORDER TO THE EXTENT SUCH TERMS ARE PERMISSIBLE UNDER CELLEBRITE S TERMS AND CONDITIONS OF SALE ORAN AGREEMENT SIGNED BY BUYER AND CELLEBRITE COLLECTIVELY A E AFTER APPLYING THE ORDER OF PRECEDENCE THE AGREEMENT BY DOWNLOADING INSTALLING OR USING THE SOFTWARE OR OTHERWISE EXPRESSING YOUR AGREEMENT TO THE TERMS CONTAINED IN THE AGREEMENT YOU INDIVIDUALLY AND ON BEHALF OF THE BUSINESS OR OTHER ORGANIZATION THAT YOU REPRESENT THE BUYER CONSENT TO BE BOUND BY THIS AGREEMENT IF YOU DO NOT OR CANNOT AGREE TO THE TERMS CONTAINED IN THE AGREEMENT THEN A DO NOT DOWNLOAD INS
68. l it via the Version tab Settings gt Version gt File IV Chapter 3 Getting started 46 Icon Description 7u Battery indicator 64 3 2 7 Virtual keyboard The virtual keyboard allows you to type text whenever needed RRR ENN CHEAP HN RCH la z lt ce v o o m GR Figure 17 Virtual keyboard e To show the virtual keyboard tap the keyboard icon in the application taskbar e To hide the virtual keyboard tap the E icon in the top right comer of keyboard panel NOTE The virtual keyboard is not limited for use in the UFED Touch application It can be accessed by tapping the keyboard icon in the UFED shortcuts panel at the right of the screen Chapter 3 Getting started 47 Table 3 2 Virtual keyboard icons and descriptions Key Function Switch to numbers and symbols mode 124 Switch to letters mode from numbers and symbols mode 4l Create a new line Delete the last character a a Switch between the keyboard layouts of supported languages Activate CAPS LOCK Chapter 3 Getting started 48 NOTE Any external USB keyboard can be connected to a USB port in the back panel or a Bluetooth keyboard paired with the Bluetooth interface of the device 3 3 Waking up from sleep mode The UFED Touch unit enters sleep mode after being idle for 20 minutes in order to reduce power consumption To wake the unit up e Press any of the navigation buttons on the top of the unit 3 4 Charg
69. le expertise 15 6 Temperature UFED Standard and Ruggedized Operating temperature 0 C 40 C Storage temperature 20 C 40 C Chapter 15 Technical specifications 219 15 7 Regulatory compliance This device complies with the essential requirements the R amp TTE 1999 5 EC Directive and the following standards EN 301 489 1 EN 61000 6 1 EN 61000 6 3 EN 55022 Safety IEC EN 60950 1 CB Scheme Radio frequency EN 300 328 V1 7 1 spectrum usage FCC celebrite 220 delivering mobile expertise Chapter 16 Extracting Android devices 221 Chapter 16 Extracting Android devices This chapter covers the pros and cons of each Android extraction method and provides answers to frequently asked questions about the extraction methods 16 1 Android extraction methods Many different devices run the Android operating system phones MP3 players tablets eBook Readers and more There are two main extraction methods for Android devices e ADBdebugging extraction using a built in protocol that runs within the operating system This method uses the Android Debugging Bridge ADB which is active when USB Debugging is enabled Using this method it is possible to perform a physical or file system extraction on almost any Android device provided that the device USB debugging option is enabled All currently available Android OS versions are supported For more information see Android Debugging Bridge method page 2
70. lebrite prior to the effective date of termination shall survive in accordance with its terms 9 CHOICE OF LAW J URISDICTION The construction interpretation and performance of the Agreement and all transactions under it shall be governed by the laws of the State in which the Cellebrite entity engaged by Buyer is incorporated the Governing State excluding its choice of law rules and excluding the Convention for the International Sale of Goods Buyer acknowledges that the courts of the Governing State shall have exclusive jurisdiction with respect to any dispute arising under this Agreement which is initiated against Cellebrite by Buyer or any Third Party on its behalf Notwithstanding the above i to the extent Cellebrite Mobile Synchronization Ltd has engaged Buyer the courts of Tel Aviv shall have exclusive jurisdiction with respect to any dispute arising under this Agreement which is initiated against Cellebrite by Buyer or any Third Party on its behalf and ii to the extent Cellebrite USA Inc has engaged Buyer the courts of the State of New York shall have exclusive junsdiction with respect to any dispute arising under this Agreement which is initiated against Cellebrite by Buyer or any Third Party on its behalf For the avoidance of any doubt Buyer further acknowledges and agrees that Cellebrite shall be allowed at its sole and absolute discretion to initiate any dispute against Buyer in any jurisdiction worldwide whether in
71. leted successfully Source GT i9205 Samsung Galaxy Mega 6 3 Target Removable Drive FileSystem 01 Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data Additional Extractions 8 Tap the required button To add additional extraction types for the same device To end the process and return to the home screen Finish Chapter 9 Physical extraction 105 Chapter 9 Physical extraction The Physical Extraction function enables you to perform a physical bit for bit image of the source device memory to aremovable storage device or PC 9 1 Performing a physical extraction 1 Tap Extract from Mobile Device and identify the device then tap Physical Extraction LJ H Physical Extraction The Select Mode screen appears Chapter 9 Physical extraction 106 cellebrite UFED TOUCH a a a ee eS Keyboard Home Settings Tutonals Bat 96 9205 Samsung Galaxy Mega 6 3 Physical Extractions Select Mode Q Boot Loader Recommended 2 Tap ADB or Boot Loader recommended The Select Extraction Location screen appears Chapter 9 Physical extraction 107 Ccellebrite UFED TOUCH a a a ee oe Keyboard Home Settings Tutonals Bat 96 g Galaxy Mega 6 3 Physical Extractions Select Extraction Location Q Removable Drive 3 Tap Next Chapter 9 Physical extraction 108 Depending on whether or not the device requires the UFED Device Adapt
72. manner that violates a person s fourth amendment rights under the United States Constitution or its equivalent in the Territory or misappropriating a persons list of contacts or other personal information ii reimburse Cellebrite for any expenses costs and liabilities including reasonable attorney fees incurred relating to such claim and ill pay all settlements damages and costs assessed against Cellebrite and attributable to such claim Chapter 17 Appendix 243 7 DISABLING CODE A Disabling Code Software may be provided to Buyer with disabling code that allows Cellebrite to disable such Software or the Products such Software is embedded in Any Updates or Upgrades to the Software may include disabling code Cellebrite agrees not to invoke such disabling code except as provided for in Section 7 B without Buyer s prior consent which may be given by telephone or email B Invocation of Disabling Code In addition to the invocation of disabling code when Cellebrite has received Buyer s consent described in Section 7 A Cellebrite may at its option invoke disabling code in Cellebrite s Software without receiving Buyer s consent i if in Cellebrite s sole reasonable discretion Cellebrite believes that such Software has been is being or will be used in violation of laws ii if Cellebrite is required to do so because of a court or regulatory order iii if Buyer has not paid an outstanding invoice more than sixty 60 days afte
73. movable drive During the extraction process the progress bar for the Source and then the Target is active NOTE For QCP and Samsung MTK devices an estimation of the time the extraction will take is displayed Chapter 8 File system extraction 96 When extraction is complete the File System Extraction Summary screen appears File System Extraction Summary Extraction completed successfully Source GT 555 0 Tass Target Removable Drive Filesystem 01 Need additional extractions for this device Perform another extraction or capture visual evidence to recover more data Additional Extractions 8 Tap the required button To open the extraction in UFED Physical Logical Analyzer To add additional extraction types for the same device To end the process and return to the home screen Finish Chapter 8 File system extraction 97 8 2 The file system extraction folder At the end of the file system extraction process the extracted data Is saved in the location you selected previously see Performing a File System Extraction NOTE The extracted data folder is named FileSystemDump with the selected device model and name and the extraction operation date For example FileSystemDump Nokia GSM Nokia 2626 2014 03 12 001 The extracted data folder contains e Zipped archive of the device file system containing files and folders in the same structure they were extracted e UFD file containing the system extr
74. nd save it to a directory on a PC or external device 2 Run the UFED Permission Manager and follow the setup instructions The UFED Permission Manager screen appears Chapter 13 Settings 205 fox UFED Permission Manager AN Profiles D Users p 206 3 Click Profiles O UFED Permission Manager Profiles 4 Click New Profile The following screen appears celebrite delivering mobile expertise Chapter 13 Settings 207 New profile 5 Enter a name and description for this profile and then click the Extraction Types tab celebrite 208 delivering mobile expertise New profile Extraction Types 4 Admin Manage Users a Extraction Type t E Logical Extraction SIM Data extraction t E Password Extraction i Device Tools E File System extraction E Clone SIM Physical Extraction 6 Select the options for this profile such as Admin who can manage users and the Extraction Type Logical Extraction SIM Data extraction Password extraction etc NOTE At least of the enabled users must be an Administrator Admin 7 Click Save and proceed to create a new user Chapter 13 Settings 209 To create a new user 1 In the UFED Permission Manager screen click Users The following screen appears C UFED Permission Manager 2 Click New User The following screen appears celebrite 2 10 delivering mobile expertise New user Username Display Name a l
75. nt is installed on the device In some cases due to device failure or if the mobile device was improperly disconnected from the UFED Touch the client remains installed on the mobile device This option enables the client to be manually uninstalled 12 7 Exit Odin mode In order to perform Logical Extraction the device Is placed in Odin mode In some cases due to device failure or if the mobile device was improperly disconnected from the UFED Touch the mobile device remains in Odin mode This option enables the device to be taken out of Odin mode celebrite 176 delivering mobile expertise Chapter 13 Settings 177 Chapter 13 Settings The settings screen provides access to a set of functional and behavioral setup options used to control the functionality and usability of UFED Touch Br To access the settings screen tap BEES in the application taskbar The settings are grouped in the settings screen in the following tabs e General page 178 e Report settings page 188 e System settings page 194 e License settings page 196 e Version details page 200 e Users permissions page 202 e Network page 212 178 The settings screen opens on the General tab 13 1 General settings The settings screen opens on the General tab General License Version User Permissions Edit custom list Swap first and last name in phonebook Interface language English English Mobile extraction client
76. ny right title or interest in the Software or Documentation and any derivative works thereof Notwithstanding anything to the contrary all Software is licensed and not sold and any reference to a sale of Software shall be understood as a license to Software under the terms and conditions of the Agreement 4 CONFIDENTIALITY Buyer agrees the Software and Documentation are the confidential information of Cellebrite Buyer shall maintain the Software and Documentation in confidence using the same degree of care it uses for its own confidential information but at least reasonable care 5 EXCLUSIVE REMEDIES AND LIMITATION OF LIABILITY A Definitions For purposes of the exclusive remedies and limitations of liability set forth in this Section 5 Cellebrite shall be deemed to include its subsidiaries and affiliates and the directors officers employees agents representatives shareholders subcontractors and suppliers of each of them and damages shall be deemed to refer collectively to all injury damage loss or expense Incurred B Exclusive Remedies Cellebrite s entire liability and Buyer s exclusive remedies against Cellebrite for any damages caused by any Software defect or failure or arising from the performance or non performance of any obligation hereunder regardless of the form of action whether in contract tort including negligence strict liability or otherwise shall be i For bodily injury or death to any person proximat
77. oanonnersnnennennns 33 3 2 3 Detect AUTOMALICALY cssssscsssssssssssssssssseeessen 36 3 2 4 Search FUNCTION eeessssssssssssesssssssssssssuessssssssessssssesssseee 39 3 2 5 Manual selection srr 41 3 2 6 Application TASKD AL 44 3 2 7 Virtual keyboard eessssssssssssssssssssessssssssssssseesssssssseessen 46 3 3 Waking up from sleep MOE eeessssssssssssuessssssssssssee 48 3 4 Charging the Dattery ssssssssssssssssssssssesssssssssessee 48 3 5 Enabling wireless and Bluetooth COMMUNICA O P ct Tne 49 Chapter 4 Using UFED TOUCH 51 6 Chapter 5 Extracting Data to PC 55 Chapter 6 Logical extraction wuss 63 6 1 Performing logical extraction srren 64 6 1 1 Connect mobile DEVICE ssssserssersrsisersrsersrrsen 65 6 1 2 Select phone Memory aarccessssssssssssssssssssssesssssssseesee 66 6 1 3 Select extraction location sssrin 67 6 1 4 Select content types s sssserssrsrsrrsrsersrsersrrerserersernns 68 6 1 5 Extraction IN progreSS sssersersrrsrrerserrrsrrersereererrnn 72 6 1 6 The extracted data FOIDES sscsssssssssssessssssee 78 Chapter 7 Password extraction uss 79 7 1 Performing password extraction srren 79 7 2 The extracted passwords folder 85 7 3 Disabling the password ssssssrsrrersersrserrsererrerserrrerserns 86 Chapter 8 File system extraction sses 91 8 1 Performing a file system extraction srr 91 8 2 The file system extraction fold f 97 celebrite delivering mobile exp
78. oid devices and selected Samsung Android Qualcomm LG GSM and LG CDMA are supported celebrite 226 delivering mobile expertise 16 2 Performing a file system extraction for an Android device 16 2 1 Locked Motorola devices If you have a locked Motorola device perform the following procedure to bypass the lock and perform a file system extraction 1 Tap File System Extraction File System Extraction The Select Vendor screen appears NOTE If you do not see the device model in the list select lt Vendor gt Generic option The Select Mode screen opens 2 If lock bypass is supported for the device select File System Bypassing Lock Recommended 3 Follow the on screen instructions File system extraction is successful for locked Motorola devices in the following circumstances e If lock bypass is supported for the device e If lock bypass is not supported for the device but the device USB debugging option is enabled Chapter 16 Extracting Android devices 221 4 If lock bypass is NOT supported for the device and the device USB debugging option is NOT enabled perform a physical extraction in order to retrieve the device lock code and unlock the device Then follow the directions in Unlocked devices page 229 16 2 2 Locked HTC Huawei and ZTE devices If you have alocked HTC Huawei or ZTE device perform the following procedure to bypass the lock and perform afile system extraction 1 Tap File Sys
79. ollowing Bluetooth Scan page 167 Switch to CDMA Offline Mode page 170 Test Peek Poke functionality page 172 Activate TomTom Trip log page 174 Uninstall Windows Mobile Client page 174 Uninstall Android client page 175 Exit Odin mode page 175 celebrite 166 delivering mobile expertise celebrite UFED TOUCH a a a eS Keyboard Home Settings Tutonals Boat 96 Device Tools Select Tool Q Activate Uninstall TomTom trip Windows Mobile log Client Uninstall Android Client Switch to CDMA E Test Peek Poke Bluetooth scan offine meni functionality Exit Odin Mode Nokia WP Fix Back Chapter 12 Device tools 167 12 1 Bluetooth Scan NOTE This feature is available for Bluetooth enabled PCs only This tool scans for available Bluetooth devices in your proximity and enables you to pair with them Make sure that the Bluetooth feature of the device is enabled Make sure that the Bluetooth switch Is on To perform a Bluetooth scan Bluetooth scan 1 Inthe Device Tools gt Select Tool screen tap Bluetooth scan The Connecting Bluetooth prompt appears u Connecting Bluetooth Please make sure that the rear BluetoothAWI Fi switch is turned on and Bluetooth on phone is turned on as well celebrite 168 delivering mobile expertise 2 Tap Continue Device Tool in Progress Source Please Wait Initializing Bluetooth Bluetooth scan 3 A list of Bluetooth devices in the vicinity a
80. out obtaining the applicable consents and approvals Reserved No Right to Sublicense or Assign Except to the extent otherwise required by applicable law or expressly provided for assignment generally in the Agreement no license provided in this Section 2 is sublicensable transferable or assignable by Buyer including by operation of law change of control merger purchase or otherwise without the prior written consent of Cellebrite in each instance Other than as expressly permitted by the foregoing any attempted sublicense transfer or assignment by Buyer shall be null and void License Prohibitions Notwithstanding anything to the contrary in this EULA Buyer shall not alone through a User an Affiliate or a Third Party or allow a User an Affiliate or a Third Party to a modify any Software b reverse compile reverse assemble reverse engineer or otherwise translate all or any portion of any Software c pledge rent lease share distribute sell or create derivative works of any Software d use any Software on a time sharing service bureau application service provider ASP rental or other similar basis e make copies of any Software except as provided for in the license grant above e remove alter or deface or attempt any of the foregoing proprietary notices labels or marks in any Software f distribute any copy of any Software to any Third Party including without limitation selling any Product with Embedded Soft
81. panel Chapter 2 Orientation to the UFED Touch unit 21 2 5 Right panel The right target panel of the UFED Touch unit includes the following components Target USB Target RJ 45 Power Lock Power supply port port switch Jack Figure 11 UFED Touch right panel m celebrite delivering mobile expertise 2 6 Bottom Panel Access to the unit s battery is through the bottom panel This panel is covered by a protective cover which includes a carry handle and brackets The handle brackets and protective cover must be removed in order to reach the battery housing The bottom panel includes the following components Stylus Battery status indicator Handle Bracket Bracket Figure 12 UFED Touch bottom panel Chapter 2 Orientation to the UFED Touch unit 29 The handle strap and brackets must be removed in order to remove the protective cover The brackets are attached to the UFED Touch unit with four Phillip screws Remove the protective covering to access the battery storage area of the UFED Touch unit Battery Storage Area Figure 13 UFED Touch bottom panel with protective covering removed 30 celebrite delivering mobile expertise Chapter 3 Getting started 31 Chapter 3 Getting started 3 1 Turning the UFED Touch Unit On or Off The On off switch of the UFED Touch unit is located on the right target panel Power Lock Power supply switch Jack Figure 14 Device right panel On Off
82. plication interface EIEEE E 183 13 1 3 Mobile extraction client sser 187 132 Repon SEULIING S cesma 188 13 2 1 Managing report fields sssrin 191 7 13 3 System SELCINGS cssssssssssesssssssssssssssssssssssssssssssssseesessees 194 13 4 License Settings sansa 196 13 5 Version CLELAl Siscecccceesescessscecccceeecesssscceccceeceseesssceccceeste 200 13 5 1 Updates and VELSIONS eessssssssssssssssssseesssssssssesee 201 13 6 Users DENMISSIONS sssssssssssssssssssssssssssssssssssssssssesesssee 202 13 6 1 Permission Management 204 13 7 N CWOLMK vassssccssssssssssssssssssssssssssssssssssesessssssssessssssssssseesssse 212 Chapter 14 Special CaDIOS ssccssssssseessseesess 213 14 1 Device power up cable sssssssssssssseessssssssssssesssssie 213 Chapter 15 Technical specifications 215 15 1 General SORCIFICATIONS eessssssssssssssssuesssssssssssseessssee 215 15 2 Battery csscssssssssssssssssssssssssssssssssssssssssseseeseseseesssssssssssssssssses 216 15 3 POWET SUDD IY sinnini nninnnn RSAC 216 15 4 1 0 interfaces eessssssssssssssssssssssssssssssssssssssssssssssessseseeesies 217 15 5 Dimensions and weights sssr 217 15 6 Temperature iT 218 15 7 Regulatory COMPIIANCE essssssssssssssesssssssssssssesssssee 219 Chapter 16 Extracting Android devices 221 16 1 Android extraction Method 221 16 1 1 Android debugging bridge method 222 16 1 2 Bootloader extraction ssir 225 16 2 Performin
83. plication using a stylus or your index finger The screen can be tilted into position as desired celebrite 22 delivering mobile expertise The following components can be found in the top panel LED Indicators Speaker Speaker Navigation Buttons OK Button Rightand Left Touch Mouse Buttons Screen le Figure 6 UFED Touch top view Chapter 2 Orientation to the UFED Touch unit The LED indicator panel displays the following Bluetooth Wi Fi ne m Hard drive activity Figure 7 Top panel LED indicators 23 celebrite 24 delivering mobile expertise 2 2 Front panel The SIM card slot is located in the front panel of the UFED Touch unit SIM Card Slot Figure 8 UFED Touch front panel Chapter 2 Orientation to the UFED Touch unit 25 2 3 Back panel The back panel of the UFED Touch unit includes multiple ports and a security slot The ports are protected by a cover To gain access to the back panel flip the cover open The cover is hinged to the unit The back panel includes the following components Wireless Reset Mini USB USBports SDcard Ethernet Kensington switch button port slot port Security Slot Figure 9 UFED Touch back panel celebrite 26 delivering mobile expertise 2 4 Left panel The left source panel of the UFED Touch unit includes the following components Headphones VGA Port Source RJ 45 Source USB Jack port port Figure 10 UFED Touch left
84. port custom fields to add remove and edit report fields For more information see Managing report fields page 191 11 To set a field as required tap the field in the Required column 12 Tap Save Chapter 13 Settings 191 13 2 1 Managing report fields 1 Tap Report custom fields to customize the report by defining additional fields which will be filled at the end of the extraction Manage report custom fields Field Name Required Case number Department Address Notes Delete Edit Cancel celebrite 192 delivering mobile expertise 2 To add a new field a Tap Add Manage report custom fields Field Name Required b Enter the field name in the Field Name box NOTE To display the keyboard tap Keyboard c To set the field as mandatory select Required next to the field name d Tap Update or to exit without saving tap Cancel 3 To add additional fields repeat step 3 Chapter 13 Settings 4 To edit an existing field a Tap the field in the list and tap Edit b Repeat steps 3b 3d NOTE You cannot edit the field name of a default custom field 5 To delete a field a Tap the field in the list and tap Delete Delete custom report field Are you sure you want to delete test field b In the confirmation message tap Yes 6 Tap Save in the Reports tab 193 194 13 3 System settings Set the following in the System tab e Additional settings e Extraction targ
85. ppears Select one or the following options e Tap one ofthe devices Device summary screen appears e Tap Continue Device summary screen appears Chapter 12 Device tools 169 e Tap Refresh list Device tool in progress screen appears and UFED Touch tries to find additional devices Bluetooth Devices TOUCH 5905968 YANIVO1 LAP Galaxy Mega Refresh List Continue celebrite 170 delivering mobile expertise 12 2 Switch to CDMA offline mode This tool enables you to switch radio on CDMA devices to offline mode To switch to CDMA offline mode 1 Inthe Device Tools gt Select Tool screen tap Switch to CDMA offline mode The Select Link prompt appears Select Link USB cable Serial Cable 2 Select the link type USB cable or Serial cable The Device Tool in Progress screen appears Chapter 12 Device tools 171 UFED Touch E celebrite UFED TOUCH amp 2 ft eee eee a ee Excellent Keyboard Home Settings Exit 95 Device Tool in Progress Source Please Wait Connecting The Device Tool Summary appears ss celebrite delivering mobile expertise 12 3 Test peek poke functionality This tool enables you to perform a Peek Poke test in order to check if the device is supported by the UFED Touch To Test Peek Poke functionality 1 Click Device Tools and then tap Test Peek Poke functionality The Select Link prompt appears Select Link USB Cable Serial Cable 2
86. r iv at the sole discretion of Cellebrite minor enhancements to the Software or Standalone Software as the case may be provided however that Updates shall not include Upgrades Updates are generally identified by Cellebrite by a change to the version number to the right of the first decimal point e g version 4 1 to 4 2 Upgrade means a new release of the Software or Standalone Software that incorporates substantial changes or additions that i provide additional value and utility ii may be priced and offered separately as optional additions to the Software or the Standalone Software as the case may be and or iii are not generally made available to Cellebrite s customers without a separate charge Upgrades are generally identified by Cellebrite by a change to the version number to the left of the first decimal point e g version 4 2 to 5 0 Chapter 17 Appendix 235 User means an individual able to gain access to any Software functionality whether Embedded Software or Standalone Software You means any individual seeking the benefit of or evaluating this EULA 2 LICENSE GRANT A Embedded Software Subject to the terms and conditions of this Agreement Cellebrite hereby grants to Buyer and Buyer accepts upon delivery of the Embedded Software a nonexclusive perpetual and nontransferable license to use only if such use does not violate the prohibitions in Sections 2 F or 2 G each copy of the Embedded Software in
87. r such invoice is due or iv if Buyer has used the Software other than as authorized by Buyer s license Cellebrite shall have no liability to Buyer for any good faith invocation of any such disabling code 8 TERM AND TERMINATION A Term The term of this EULA is while any Software is under Buyer s control or possession Notwithstanding the foregoing i the license to any Embedded Software may be terminated if Buyer has not paid an invoice sixty 60 days after such invoice is due and ii the license to any Standalone Software is only during the License Term The License Term shall be determined in a separate agreement between Cellebrite and the Buyer 244 celebrite delivering mobile expertise B Termination Cellebrite shall have the right to terminate this EULA upon thirty 30 days prior written notice to the other party if such other party has not cured any material breach of this EULA by the end of such thirty 30 day notice period Upon termination of this EULA for any reason i Buyer shall be responsible for payment for all purchase orders delivered to Buyer by Cellebrite before the effective date of termination and ii Buyer shall destroy all copies of the Standalone Software under Buyer s control or possession Survival The provisions of Sections 1 2 C 2 E 2 F 2 G 3 4 5 6 7 8 C and 9 13 of this EULA shall survive any termination in accordance with their terms In addition any purchase order accepted by Cel
88. rd SIM Clone SIM ID Waiting for Device Source SIM Insert sim card with the SIM card s contacts facing down and the clipped corner pointing toward you NOTE The SIM red arrow prompt at the bottom of the screen flashes even after you insert the SIM card into the SIM reader slot Chapter 11 SIM card functionality 162 2 Insert the SIM card into the SIM card reader slot located in the left of the front panel 3 Tap Continue The Select Source screen appears Create GSM 4 Tap Create GSM Test SIM The following screen appears w Insert Target Card Insert SIM ID Access Card into the UFED Touch with the SIM card s contacts facing down and the clipped corner pointing toward you 5 Make sure that the target SIM card is inserted correctly into the SIM card reader slot then tap Continue The Extraction in Progress screen is displayed throughout the data reading process Chapter 11 SIM card functionality 163 At the end of the data wnting process a summary of the SIM cloning process is displayed detailing the ICCID and IMSI information programmed to the SIM card SIM Cloning Summary olM ID Access Card created successfully ICCID 8949000507010014292 Msi 001010123456789 6 To end the process and return to the home screen tap OK Chapter 11 SIM card functionality 164 Chapter 12 Device tools 165 Chapter 12 Device tools The Device Tools are located on the home screen and include the f
89. re update or new version see Updates and versions Chapter 13 Settings 201 13 5 1 Updates and versions When UFED Touch is connected to the network automatic notifications appear in the event of updates and new versions of the application e Tap Refresh in the Settings gt Version tab to update the information available on the screen To install a newer version of the UFED Touch application via the web NOTE Before using this option please ensure that the unit is connected to the network e Inthe Settings gt Version tab in the Version area tap Web The unit upgrades the application to the latest version available on the Cellebrite download server To install a newer version of the UFED Touch application using an external device via USB port 1 Download the latest application version from your account in My Cellebrite and save it to the root directory of the external device 2 Connect the external device to the UFED Touch Ext1 or Ext 2 USB ports on the back panel 3 In the Settings gt Version tab in the Version area tap USB UFED Touch identifies the new software file and starts the upgrade process celebrite 202 delivering mobile expertise 13 6 Users permissions UFED Touch enables user authentication ensuring that only users with the right credentials can access the application Access rights are further enforced by defining permission levels per profile For more information see Permission management page 204
90. s e Multimedia files folders named Audio Images Ringtones and Video folders containing each of the respective type of media files e Phone extraction report files in HTML and XML formats One HTML report per content type e UFED Manager files of the extracted calls log clog phonebook 0 bb SMS messages sms and calendar cal Email Email MM S M MS and IM IM data e UFD file NOTE UFED Manager files are generated only for data types that contain items The XML file can be viewed by both the UFED Logical Analyzer and the UFED Physical Analyzer Chapter 7 Password extraction 19 Chapter 7 Password extraction The Extract Password function can extract the password from a device 7 1 Performing password extraction To extract passwords from a mobile device 1 Click Extract from Mobile Device and identify the device then tap Password Extraction Va N Va J ou 5 o Password Extraction Chapter 7 Password extraction 80 2 The Select Extraction Location screen appears celebrite UFED TOUCH a a a eS Golivoring mobilo exportise Exit Keyboard Home Settings Tutorials UN 610 Lotus 2 Password Extractions Select Extraction Location 3 In Select Extract Location select the desired location e Select Display Only to display the extracted passwords on the UFED Touch display without saving them to any media e Select Removable Drive to save the extracted passwords to a USB drive connected to
91. s upon delivery of the Standalone Software during the License Term a nonexclusive and nontransferable license to i use only if such use does not violate the prohibitions in Sections 2 F or 2 G each copy of the Standalone Software in executable form only provided by Cellebrite and the accompanying documentation only for Buyer s internal use only as authorized in the Agreement ii only use a number of Concurrent Users that is equal to or less than the number of Authorized Users specified in a written agreement signed by both the Buyer and Cellebrite or purchase order accepted by Cellebrite even if available on a higher number of computer systems ili make a reasonable number of copies of the Standalone Software for use only as licensed in this Section 2 B though in no case more than the number of Authorized Users and iv make one 1 copy of the Standalone Software for backup archival or disaster recovery purposes License Authorization Software Subject to the terms and conditions of this EULA Cellebrite hereby grants to Buyer and Buyer accepts upon delivery of the Standalone Software during the License Term a nonexclusive and nontransferable license to use only if such use does not violate the prohibitions in Sections 2 F or 2 G each copy of the License Authorization Software in executable form only provided by Cellebrite and the accompanying documentation only for Buyer s internal use and only in the country in which the Stan
92. s EULA D Software Warranty Cellebrite warrants to Buyer that for a period of sixty 60 days after the date of shipment the Software will perform substantially in conformity with its Documentation As Buyer s sole and exclusive remedy Cellebrite will at its sole expense in its sole discretion and as its sole obligation promptly repair or replace any Software that fails to meet this limited warranty 248 celebrite delivering mobile expertise Exclusions Notwithstanding anything to the contrary in this warranty the warranties herein do not apply to and Cellebrite makes no warranties with respect to defects in Products or Software in the following cases a Buyer s misuse damage or unauthorized modification of the Products or Software b Buyer s combination of the Products or Software with other products or software other than as authorized in writing by Cellebrite c placement of the Products or Software in an operating environment contrary to specific written instructions and training materials provided by Cellebrite to Buyer d Buyer s intentional or negligent actions or omissions including physical damage fire loss or theft of a Product e cosmetic damage to the outside of a Product including ordinary wear and tear cracks or scratches f for any Product with a touch screen any defect in such a touch screen after thirty 30 days from the date of receipt of such Product or any defect Caused in a touch screen by Buyer
93. s device Perform another extraction or capture visual evidence to recover more data Additional Extractions Finish 7 Tap the required button To add additional extraction types for the same device To end the process and return to the home screen Finish Chapter 7 Password extraction 85 7 2 The extracted passwords folder At the end of the passwords extraction process the extracted passwords are saved to a text file named Passwords txt at the location you selected during the data extraction process NOTE The text file is located inside a folder named Password with the name of the selected device name and the extraction date For example Passwords Iden 19 2011 06 11 001 Chapter 7 Password extraction 86 7 3 Disabling the password You can disable the password for particular devices For example SamsungCDMA SPH M820 Galaxy Prevail Android SamsungGSM SGH T499 Dart Android SamsungGSM SGH T589 Gravity Smart Android SamsungGSM SGH i857 Doubletime Android SamsungGSM GT i5500 Europa Galaxy 5 Android SamsungGSM GT i5510 Galaxy Android SamsungGSM GT S5570 Galaxy Mini Android SamsungGSM GT S5660 Galaxy Gio Android SamsungGSM GT S5670L Android SamsungGSM GT S5830 Ace Android For a complete list of supported devices refer to http www cellebrite com mobile forensics support ufed supported devices Chapter 7 Password extraction 87 When you disable the password for these models using UFED To
94. s directly from a Blackberry Android or iOS device see Capturing screenshots on page 127 Both these options can be useful as complimentary evidence or in instances when data cannot be extracted from a device You can add notes categories and bookmarks to the pictures and videos which will be visible in the UFED Physical Logical Analyzer The collected evidence can be shown within a standalone custom report or in addition to the extracted information The report includes information about the device connection type UFED version and serial number Image information includes file name link file size date and time MD5 and SHA256 hash information The images are located in a folder called Snapshots and are in PNG format Video information includes file name file size date and time and a link to the file The videos are located in a folder called Videos and are in AVI format 10 1 The UFED camera The UFED camera is offered as an add on and it is controlled by the UFED Touch All necessary drivers are preinstalled with the application The UFED camera includes a camera stand which enables you to adjust the height and the angle of the UFED camera a pad to place the device and an anti glare pad to prevent glare when taking pictures Connect the camera to an available USB port of the computer Chapter 10 Capture images and screenshots 116 Connect the camera to the EXT1 or EXT2 port at the back of the UFED Touch If there are not enough USB
95. s negligence or willful misconduct g maintenance of the Products or Software in a manner that Is contrary to specific written instructions provided by Cellebrite to Buyer h a product or service not provided authorized or approved by Cellebrite for use with the Products or Software i any repair services not authorized or approved by Cellebrite j any design documentation materials test data or diagnostics supplied by Buyer that have not been authorized or approved by Cellebrite k usage of any test units experimental products prototypes or units from risk lots each of which is provided AS IS I any third party original equipment manufacturer s restrictions on individual phones or models of phones that prevent the phones or models of phones from working with the Products or Software m any damage to a third party device alleged to or actually caused by or as a result of use of a Product or Software with a device n any Products that have had their serial numbers or month and year of manufacture or shipment removed defected or altered o any interactions or other effects relating to or arising out of the installation of copies of the Software beyond the number of copies authorized by an agreement between Cellebrite and Buyer p use of Products or Software Chapter 17 Appendix 249 incorporated into a system other than as authorized by Cellebrite or q any Products or Software that has been resold or otherwise transferred to
96. shots Optional Chapter 1 Introduction 13 The extraction types are Logical extraction page 63 Logical Extraction enables the extraction of various data types This includes call logs phonebook entries SMS text messages MMS emails calendar events multimedia files images videos and so on and more SIM data extraction page 79 Sim Data Extraction enables the extraction of information from a SIM or USIM card to a removable storage device or PC File system extraction page 91 File System Extraction enables a full system extraction of a source mobile device s memory Password extraction page 79 Password Extraction enables the extraction of passwords from a source mobile device and displayed directly in the Password Obtained screen or saved Clone SIM page 144 Clone SIM ID copies a SIM ID from one SIM card to another SIM or to a UFED SIM ID Access Card 14 celebrite delivering mobile expertise e Physical extraction page 165 Physical Extraction uses advanced methods in order to extract a physical bit for bit image of the flash memory of a mobile device including unallocated space Unlike conventional logical extraction processes physical extraction bypasses the mobile device s operating system and extracts data from the phone s internal flash memory directly Unallocated space may contain deleted items such as SMS call logs phonebook entries pictures and videos e Capture images and screenshots
97. switch Chapter 3 Getting started 32 To turn the UFED Touch unit on 1 Push the power switch located on the right panel of the device to the On position The LED power indicator lights up and the startup sequence begins Figure 15 Power indicator During the startup sequence e The operating system Microsoft Windows xP launches automatically e The UFED Touch application launches automatically To turn the UFED Touch unit off NOTE Turning off the UFED Touch unit is similar to the standard process of turning a Windows based computer off 2 Close the UFED Touch application 3 Select Start gt Turn Off Computer gt Turn Off To perform an immediate shut down pull the power switch to the left and hold it until the device powers down Chapter 3 Getting started 33 3 2 Working with UFED Touch 3 2 1 Starting the UFED Touch application manually When you turn on the UFED Touch unit the UFED Touch application is launched automatically If the application does not launch automatically or if you had to previously quit use one of the following to launch the application e Tap the UFED Touch application shortcut located in the UFED shortcuts panel at the right of the screen e Double tap the UFED Touch icon located on the desktop 3 2 2 Home screen The home screen groups the extraction data into distinct areas mobile device SIM card and USB device In addition users can directly operate the camera for immediate
98. t losing critical data including call history and SMS messages There are three different ways that a SIM card can be cloned e Clone an existing SIM card to create a cloned SIM to use to extract device data without a network connection See Cloning an existing SIM card ID Chapter 11 SIM card functionality 145 e Manually enter SIM data to manually program the ICCID and IMSI to the cloned SIM card See Entering SIM data manually e Create GSM Test SIM The GSM test SIM card is used to extract device data when the original SIM is not available a default ICCID and IMSI are programmed into the Cloned SIM ID Card to mimic the original missing card See Creating GSM test SIM 11 2 1 Cloning an existing SIM card ID 1 Tap Clone SIM The Waiting for Device screen appears Chapter 11 SIM card functionality 146 celebrite UFED TOUCH Se a a eS Keyboard Home Settings Tutonals Boat 96 SIM Card SIM Clone SIM Waiting for Device SIM Insert sim card with the SIM card s contacts facing down and the clipped corner pointing toward you Continue NOTE The SIM red arrow prompt at the bottom of the screen flashes even after you insert the SIM card into the SIM reader slot 2 Insert the SIM card into the SIM card reader slot located in the middle of the front panel 3 Tap Continue The Select Source screen appears Chapter 11 SIM card functionality Select Source Clone an Manually Create GSM Test SIM e
99. te UFED TOUCH a a a ee oe Keyboard Home Settings Tutonals Boat 97 5 Samsung Galaxy Mega 6 3 File System Extractions Select Mode ADB Android Backup a 2 Tap Android Backup A message appears to indicate that Android backup mode extracts the data according to the device s specific characteristics 3 Tap Continue 4 Select the target path The waiting for Device screen appears Chapter 8 File system extraction celebrite UFED TOUCH a eS Keyboard Home Settings Tutonals Bit 97 nsung Galaxy Mega 6 3 File System Extractions Waiting for Device Please connect source device to the left USB port GT i9205 Samsung Galaxy Mega 6 3 On an Android 4 2 and above only you must first pre configure the device using a one time procedure To enable the Developer options go to Menu Apps Settings More About Software information More tap the Build number 7 times until they are enabled 1 On an Android v4 0 and above Go to Menu Apps Settings More Developer options turn ON if needed select check boxes Android USB debugging and Stay awake when present 2 Uncheck the Verify apps via USB setting located under the Developer options setting and confirm any pop up that appears on the device during the start of the transaction Samsung GSM GT i9205 Samsung 3 Also set the following Galaxy Mega 6 3 Turn Screen Lock off using Cable A with Black tip T 100 p eS ne
100. tem Extraction NOTE If you do not see the device model in the list select lt Vendor gt Generic option 2 Follow the on screen instructions File system extraction is successful for locked HTC devices in the following circumstances e If lock bypass is supported for the device e If lock bypass is not supported for the device but the device USB debugging option is enabled File system extraction is NOT successful for locked HTC devices in the following circumstances e If lock bypass is NOT supported for the device and the device USB debugging option is NOT enabled 228 celebrite delivering mobile expertise 16 2 3 Other locked devices If you have a locked device that is not an HTC or Motorola device perform the following procedure to bypass the lock and perfom a file system extraction 1 Tap File System Extraction 1 Le w File system Extraction NOTE If you do not see the device model in the list select lt Vendor gt Generic option 2 Follow the on screen instructions File system extraction is successful for locked devices if the device USB debugging option is enabled 3 If the device USB debugging option is NOT enabled perform a physical extraction in order to retrieve the device lock code and unlock the device Then follow the directions in Un ocked devices page 229 Chapter 16 Extracting Android devices 229 16 2 4 Unlocked devices If you have an unlocked device per
101. tem settings 194 celebrite delivering mobile expertise T Technical specifications 215 Technical terms 230 Temperature 218 Test Peek Poke functionality 165 172 The Extracted Data Folder 78 The extracted passwords folder 85 The extracted SIM data folder 143 The file system extraction folder 97 The Physical Extraction folder 113 Top view 21 Turning the UFED Touch Unit On or Off 31 U UFED Touch accessories 15 UFED Touch extraction types and device tools 12 Uninstall Android Client 175 Uninstall Windows Mobile Client 165 174 Unlocked devices 227 228 229 Updates and versions 201 User permissions 202 Using cables and tips 16 V Version details 200 Virtual keyboard 46 W Waking up from sleep mode 48 Working with UFED Touch 33 Index
102. ters are managed locally and can be reset NOTE The password to rest the Transactions counter is the serial number of the unit displayed in the Version tab celebrite 196 delivering mobile expertise 13 4 License settings The license can be updated via the network Web or a using an external device via USB port License Version User Permissions Network Software license Your license will expire on 3 31 2015 This license includes ExtractPhone ExtractSim CloneSim PhysicalDump FileSystemDump ExtractPasswords ChinexFamily Serial 5908884 UFED ID 9337 Change license Sales sales cellebrite com To update the license via the web NOTE Before updating the license from the network ensure that the device is connected to the network 1 In the License tab tap Change license Chapter 13 Settings 197 2 Click Accept to accept the license agreement The following screen appears Cellebrite product license Software license Your license will expire on 3 31 2015 This license includes ExtractPhone Extractsim CloneSim Physicaldump FileSystemDump ExtractPasswords ChinexFamily Serial 5908884 UFEC ID 89337 Update software license salesQ cellebrite com 3 Click Update software license celebrite 198 delivering mobile expertise The following screen appears Cellebrite product license Already have a license file Load from USB Load from the web Need to do
103. the extraction to PC 14 1 Device power up cable In case of a drained or absent battery the device power up cable powers the device instead of the battery while performing an extraction The device power up cable contains four parts marked as Data Extra power Figure 19 Phone power up cable 214 celebrite delivering mobile expertise To connect the device power up cable 1 Connect the Extra Power connector to the UFED Touch USB Port extension 2 Connect the Data connector to the UFED Touch USB Port extension 3 Identify the device s battery contacts Ul e Open the device battery cover e Locate the positive and negative pole markings of the battery usually found next to the contacts area e Make sure that the battery contacts are marked clearly on the device s body e Remove the battery in order to gain access to the device s battery contacts TIP For battery contacts which are not clearly marked on the device s body use the pole markings on the battery body to identify them To do that simply flip the battery along its contacts edge and place it along the edge of the battery housing then mark the device s contacts according to those on the battery NOTE Use a multi meter to identify the positive and negative poles of an unmarked battery Connect the RED alligator clip to the device s positive pole the Primary Black alligator clip to the negative pole
104. ttery should be fully charged 1 Remove the BATTERY 2 Reinsert the BATTERY 3 Leave the phone powered OFF 4 Connect the phone to Forensic Memory Card Reader with the cable 5 Walt until the download mode loge appears on the phone screen 6 Connect the Card Reader to the UFED with Cable 80 7 Press Continue 9 Follow the instructions on the screen 10 Tap Retry Chapter 9 Physical extraction 113 9 2 The Physical Extraction folder At the end of the physical extraction process the extracted data is saved in the location you selected during the physical extraction process See step 5 of Performing a Physical Extraction NOTE The extracted data folder is named Physical with the selected device name and the extraction operation date For example Physical Samsung GSM SGH A711 2011 06 12 001 The extracted data folder contains e Binary file of the device memory e UFD file containing the system extraction information used by the UFED Physical Analyzer application The extraction information can be viewed using the UFED Physical Analyzer You can double tap on the UDF file or open it via the GUI Chapter 9 Physical extraction 114 Chapter 10 Capture images and screenshots 115 Chapter 10 Capture images and screenshots The UFED camera enables you to collect evidence by taking pictures or videos of a device see Capturing images on page 116 You can also use a Screenshot feature to capture internal screenshot
105. uch UFED Touch disables the code that enables the password Each device model has a slightly different process depending on the phone lock combination and how the model connects to UFED Touch 1 Tap Extract from Mobile Device and identify the device then tap Password Removal rt ha Password Removal The Waiting for Device screen appears Chapter 7 Password extraction 88 Se a a ee ba celebrite UFED TOUCH Galivaring mobils expertisa Keyboard Home Settings Tutonals Bat 96 ung GSM GT S55 0 Tass Password Removal Waiting for Device So mia Please connect source device to the left USB port GT S5570 Tass Vol Up Vol Down and connect the phone to the cable while pressing the keys 6 Release the keys when the screen turns on The phone will switch on and LK little kernel will appear on To allow phone connection Battery should be fully charged 1 Remove the battery 2 Re insert the battery 3 Leave the phone powered OFF 4 Connect the cable 5 Press and hold the following key combination te CJ Samsung GT S5570 Tass using USB cable 130 Continue 2 Follow the instructions for the device and then tap Continue NOTE If the device does not unlock click Abort and repeat the procedure Make sure you are using the correct USB cable The following screen appears Chapter 7 Password extraction 89 This operation will permanently remove the passcode from the dev
106. ue e Tap Yes to display the advanced settings Extraction in Progress gt Enter SPN screen appears Proceed to the following step e Tap No to continue Proceed to step 15 Chapter 11 SIM card functionality 158 10 Enter the SIM SPN number up to 16 digits then tap OK Source SPN 0 16 chars Please Enter SPN Q GS cec cs The following screen appears Chapter 11 SIM card functionality 159 Source GID 1 0 8 chars Please Enter GID 1 Gs ca 11 Enterthe SIM GID 1 number up to 8 characters and tap OK The Extraction in Progress gt Enter GID 2 screen appears 12 Enter the SIM GID 2 number up to 8 characters 13 Tap OK The Insert Target Card prompt appears 14 Insert the UFED SIM ID access card into the SIM reader slot 15 Tap Continue NOTE The Extraction in Progress screen is displayed throughout the data writing process Chapter 11 SIM card functionality 160 At the end of the data writing process a summary of the SIM cloning process is displayed detailing the ICCID and IMSI information programmed to the SIM card U SIM Cloning Summary 7 SIM Access Card cer d succes y 16 To end the process and return to home screen tap OK Chapter 11 SIM card functionality 161 11 2 3 Creating a GSM test SIM 1 Tap Clone SIM The Waiting for Device screen appears Q UFED Touch celebrite UFED TOUCH s t amp Gaiivoring mobile exportise Excellent Keyboard Home j SIM Ca
107. unctions The possible extractions are Logical extraction page 63 Logical Extraction enables the extraction of various data types This includes call logs phonebook entries SMS text messages MMS emails calendar events multimedia files images videos and so on and more Password extraction page 79 File system extraction page 91 Physical extraction page 165 Capture images and screenshots page 115 There is also the option to use Device Tools or SIM Card functionality Device tools page 165 Clone SIM page 144 and SIM data extraction page 79 Chapter 3 Getting started 3 2 6 Application taskbar The application taskbar is located at the top of the touch screen a en en oa Keyboard Home Settngs Tutonal boat oe Figure 16 Application taskbar 44 Chapter 3 Getting started 45 Table 3 1 Application taskbar icons and descriptions con _ Description Wireless network connection 2 Disconnected M Connected Show Hide the virtual keyboard Return to home screen Very Good cf H cL Display the Settings page 177 screen from where the device settings can be defined if a thin Quit the application Video tutorials eu NOTE When UFED Touch is connected to the Internet you will receive an automatic notification to install the video tutorials You can also install the video tutorials manually by downloading the media package from MyCellebrite and then instal
108. ung Galaxy Mega 6 3 Detected Manufacturer samsung Detected Model GT I9205 Revision 4 2 2 JDQ39 I9205xXXUCNA2 357426050266879 ICCID 8997 20203585963501 IMSI 425020358596350 Extraction start date time 18 06 14 16 07 43 Extraction end date time 16 06 14 16 11 26 Phone Date Time 18 06 14 16 05 35 GMT 3 Connection Type USB Cable UFED Version Software 3 1 0 134 UFED Full Image 2 121 Tiny Image N A UFED S N 5905968 Case number Note This device is using client in order to communicate with UFED ZZ Extracted phone time stamp time zone is expressed in quarters of an hour Last IMEI digit might be incorrect Please check manually on the device Chapter 6 Logical extraction celebrite UFED TOUCH s tt ne D a Keyboard Home Settings Tutonals Exit 97 GSM GT i9205 Samsung Galaxy Mega 6 3 Select Extraction Type N H Logical Extraction ie File System Extraction Physical Extraction S Capture Images Samsung GSM GT i9205 Samsung Capture Screenshots Galaxy Mega 6 3 11 Chapter 6 Logical extraction 78 6 1 6 The extracted data folder At the end of the data extraction process the extracted data Is saved in the location you selected NOTE The extracted data folder is named UFED with the selected device name the IMEI MEID info and the extraction date For example UFED Samsung GSM GT i9205 Samsung Galaxy Mega 6 3 2014 11 10 0001 The extracted data folder contain
109. ware in a secondhand market g use any Embedded Software other than with Products provided by Cellebrite or an authorized reseller of Cellebrite or for more than the number of Products purchased from Cellebrite or an authorized reseller of Cellebrite h disclose the results of testing or benchmarking of any Software to any Third Party without the prior written consent of Cellebrite i use any Update or Upgrade beyond those to which Buyer is entitled or with any Software to which Buyer does not have a valid current license j deactivate modify or impair the 240 celebrite delivering mobile expertise functioning of any disabling code in any Software k circumvent or disable Cellebrite s copyright protection mechanisms or license management mechanisms l use the Software in violation of any applicable law orto support any illegal activity m use the Software to violate the rights of any Third Party or n attempt any of the foregoing Cellebrite expressly reserves the right to seek all available legal and equitable remedies to prevent any of the foregoing and to recover any lost profits damages or costs resulting from any of the foregoing Legal Exception Buyer agrees that to the extent that any applicable laws including without limitation national laws implementing EC Directive 91 250 on the Legal Protection of Computer Programs give Buyer the right to reverse engineer any Software to make it interoperable without Cellebrite s
110. wnload your software license Go to MyCellebrite Serial 5908884 UFEDID S337 i sales cellebrite com 4 Tap Load from the Web Chapter 13 Settings 199 To update the license from an external device via USB port 1 Save the license file on the root directory of the USB flash drive 2 Connect the external device to the UFED Touch Ext1 or Ext 2 USB ports on the back panel 3 In the License tab tap Change license 4 Click Accept to accept the license agreement 5 Click Update software license 6 Tap Load from USB UFED Touch identifies the license file automatically and updated information appears on screen For more information on licensing see Using UFED Touch page 51 celebrite 200 delivering mobile expertise 13 5 Version details The version details display information about the UFED Touch version and build The Version tab displays current information regarding the license and the available version for upgrade License Version User Permissions Network Version 4 1 0 324 built on 1 12 2015 11 30 58 AM Image Version 2 12L 2015 Cellebrite delivering mobile expertise BIOS Version BIOS Ver 7 BIOS Date 2 28 2013 Battery ID 0001Panasonic613756 Automatically check for software updates No software update available you have the latest version Update version from The following information is displayed e Version The application version For more information on downloading a softwa
111. xisting SIM enter SIM card data Clone an existing SIM 4 Tap Clone an existing SIM card 147 Chapter 11 SIM card functionality 148 The Clone SIM ID prompt appears uw Clone SIM ID Insert Source SIM into the UFED Touch with the SIM card s contacts facing down and the clipped corner pointing toward you 5 Check that the right SIM was inserted into the SIM card reader slot 6 Tap Continue Chapter 11 SIM card functionality 149 lf the SIM card is partitioned a prompt appears ji Salett Partition To Read 7 Select which of the SIM card partitions to read The Extraction in Progress Source screen appears Chapter 11 SIM card functionality 150 When the information has been extracted from the SIM the Insert Target Card prompt appears Celeorite Insert Target Card Insert SM ID Access Card into the UFED Touch with the SIM cards contacts facing down and the clipped comer pointing toward you Continue 8 Remove the original SIM card from the UFED Device Adapter SIM card reader 9 Insert a UFED SIM ID Access Card into the UFED Device Adapter SIM card reader 10 Tap Continue Chapter 11 SIM card functionality 151 At the end of the data process a summary of the SIM cloning process is displayed detailing the ICCID and IMSI information of the cloned SIM card m m SIM Cloning Summary k SIM ID Actess Cad created suttasssiiy ICCD 397 SO IOP Pass 185 aS dS0 1013
112. xtraction Location Drive Chapter 6 Logical extraction 68 NOTE The UFED Physical Analyzer Application must be installed on the PC before the PC option can be selected See Extracting Data to PC page 55 To select a target location 1 In the Select Extract Location screen select the desired target location e Select Removable Drive to extract the device data to a USB Flash drive connected to the UFED Touch TARGET USB port on the right panel or SD card inserted to the SD card reader on the back panel e Select PC to extract the information directly to the PC The Select Content Types screen appears 6 1 4 Select content types Multiple content types are listed The types are displayed in three different ways e Types selected by default shown with a check mark O e Types available for selection shown without check marks e Types not available shown as dimmed Chapter 6 Logical extraction 69 celebrite UFED TOUCH a a a by Keyboard Home Settings Tutonals Bat 97 amsung Galaxy Mega 6 3 Logical Extractions Select Content Types Samsung GT i9205 Extraction Samsung Galaxy Mega 6 3 to removable drive Select All Start Chapter 6 Logical extraction 70 To select content types 1 Select the additional content types required to be included in the information extracted from this device 2 Tap Select All to select all the available types NOTE Only content types that are support
113. y Product during the Warranty Period Buyer after obtaining return authorization information from Cellebrite shall ship suspected defective samples of the Product to Cellebrite in accordance with Cellebrite s instructions No Product will be accepted for repair replacement credit or refund without the written authorization of Cellebrite Cellebrite shall analyze the failures making use when appropriate of technical information provided by Buyer relating to the circumstances surrounding the failures Cellebrite will verify whether any Defect appears in the Product If a returned Product does not have a Defect Buyer shall pay Cellebrite all costs of handling inspection repairs and transportation at Cellebrite s then prevailing rates If a returned Product has a Defect Cellebrite shall at Buyer s option either repair or replace the defective Product with the same or equivalent Product without charge or if such repair or replacement has not occurred by the thirtieth 30th day following Cellebrite s receipt of the returned Product credit or refund at Buyer s option the purchase price within ten 10 days after such thirtieth 30th day provided i Buyer notifies Cellebrite in writing of the claimed Defect within thirty 30 days after Buyer Chapter 17 Appendix 247 knows or reasonably should know of the claimed Defect ii the claimed Defect actually exists and ili the Defect appears within the Warranty Period Cellebrite shall sh

UFED Touch User Manual January 2015 ENGLISH

Contents

Download Pdf Manuals

Related Search

Related Contents