±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 2
Overall: 27483
Visitors: 65

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Cellebrite Physical Analyzer 3.0

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Cellebrite Physical Analyzer 3.0

Post Posted: Fri Feb 01, 2013 2:08 pm

Has anyone had any issues using PA 3 (Version 3.2-3.6) with phones that have alot of data on them? I'm attempting to process an iPhone 3G (8GB), with over 10,000 photos and 30,000 SMS.

I confirmed it was not a hardware issue, as my CPU was using 5%, and my memory was at 40% max. I have the engine installed on its own HD, and the IOS data dump on a RAID 5.

The anaylzer is almost unusuable...it's like 56K dial up all over again. Any tips or tricks to speed this up?

I called Cellebrite Support and the employee stated it's a known software engine issue that they are working on. I hoping some of you have experienced this and may know a trick or two to assist me.

Thanks!

-Steven  

sward6
Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Sat Feb 02, 2013 5:32 am

Steven,

UFED PA v3.5 that was released 3 months ago addressed both memory and performance improvements related to heavy extractions.

Still if the extracted device has 50,000 images and 200,000 other data elements (SMS, MMS, Emails ...) you might need to upgrade your computer to a 64bit Windows OS.

For over a year, we recommend using a 64bit Windows 7 with at least 8GB of memory.
A 32bit Windows OS limits the amount of memory UFED PA (or any other application can use)

If you have a lower computer configuration, I would suggest to upgrade.

I sent you more info in a PM

Ron  

RonS
Senior Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Sat Feb 02, 2013 12:00 pm

sward,
As Ron says, maybe you need to go to 64 bit.
We are using PA for all our ios systems, some exams have returned well over 50,000 images, the record in our office is 197,666 images returned - 8.5 hr dump-
You should not be experiencing problems with PA with "just" 10,000 images  

bigjon
Senior Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Sun Feb 03, 2013 11:17 am

Agreed - 10,000 images are nothing when you dump an iPhone or and iPad.. my shop also had had in access of 150,000 images, 70,000+ SMSs extracted from a device.

As was mentioned, ensure you have enough processing power and using 64-bit. We use an iMac that runs Win 7 Pro on it and it runs PA quite brilliantly.
_________________
Twitter: twitter.com/forensicranger 

ForensicRanger
Senior Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Sun Feb 03, 2013 12:46 pm

- RonS

A 32bit Windows OS limits the amount of memory UFED PA (or any other application can use)

Just for the record, yes, but no Shocked .

The issue is the license, Server type of 32 bit OS will use 8 Gb and more happily:
www.geoffchappell.com/...memory.htm

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Sun Feb 03, 2013 2:14 pm

The maximum available amount of RAM per process for a 32-bit OS is 2 GB.
Yes, you can use the /3GB switch to get 3GB, but other applications on your computer might not like it and we decided not to use this.

msdn.microsoft.com/en-...s.85).aspx

Ron  

RonS
Senior Member
 
 
  

Re: Cellebrite Physical Analyzer 3.0

Post Posted: Wed Feb 06, 2013 9:09 am

Thanks for all the replies!

Originally, I had installed the analyzer on our laptop (Duo Core/4GB/Win7 32b) because I wanted to use it out in the field, if needed. However, due to the processing issues, I opted to install the analyzer on our examination machine -- which is due to be replaced soon, pending our new budget, but is still a very capable workstation. It's a FRED, 2x Xeon Quad Core/12GB RAm/Win 7 64b. Does this setup look adequate to run PA? It runs FTK 4.?? just fine.

While using the FRED, and to my surprise, I noticed the same processing issues. I noted while processing the data dump, the memory was at 40-percent of max and the proceesor was at 5-percent of max.

When attempting to view images, it's nearly impossible to do. Any time you scroll down, it's take 30-60 seconds for images to load, while the application freezes or states "not responding." It eventually starts to respond. SMS is faster, but still seems slower than it should be.

I have viewed several non-IOS data dumps on the laptop (not the FRED) and never had an issue with analyzing the data on earlier versions of PA. I have not yet tested non-IOS data dumps on the new version, which is something I ought to do.  

sward6
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next