Extracting data fro...
 
Notifications
Clear all

Extracting data from iPhone in Cellebrite PA vs UFED 4 PC

10 Posts
9 Users
0 Likes
2,393 Views
ForensicMeteor
(@forensicmeteor)
Posts: 60
Trusted Member
Topic starter
 

I see many people are performing advanced logicals on iPhones via Cellebrite PA. I've always used UFED 4 PC to perform File System Extractions. Is there a benefit to using PA? Differences?

 
Posted : 01/10/2016 2:26 am
Mark_Eskridge
(@mark_eskridge)
Posts: 50
Trusted Member
 

My own experience (non-scientific testing) is that using PA is significantly quicker.

 
Posted : 01/10/2016 10:57 am
(@dandaman_24)
Posts: 172
Estimable Member
 

My own experience (non-scientific testing) is that using PA is significantly quicker.

Quicker isnt always better !!

Why not extract in PA and 4PC and merge the reads in PA and there you will find the differences.

 
Posted : 03/10/2016 12:22 am
(@ellivro)
Posts: 13
Active Member
 

Hi guys can i ask some help why is it that when i extracting data from iphone 6 using UFED 4 PC version 4.1 it says "extra info failed" it seems that i already disable password of the unit?

 
Posted : 03/10/2016 6:52 am
(@dandaman_24)
Posts: 172
Estimable Member
 

4.1 is a bit old now, It might be worth updating to the latest version currently at 5.3.

 
Posted : 03/10/2016 12:49 pm
(@wookieshaver)
Posts: 27
Eminent Member
 

I see many people are performing advanced logicals on iPhones via Cellebrite PA. I've always used UFED 4 PC to perform File System Extractions. Is there a benefit to using PA? Differences?

I find with iPhones that there is an advantage to imaging with all methods available - file system and logical in UFED4PC and Advanced Logical Method 1 and 2 in Physical Analyzer. While file system generally gets all the data I need, I may get additional data like last computer synced with and user id/host id of that computer from the advanced logical methods or other tidbits not found in the file system method in UFED4PC. Once imaged and placed in a UFDR report they all load very fast after the fact in UFED reader, so speed is not that big of an issue.

 
Posted : 04/10/2016 6:54 pm
(@tackleberry)
Posts: 30
Eminent Member
 

Anyone have results yet?

on a similar thought….We are looking to decide on UFED4PC or UFED Touch2.
anyone have an opinion?

I dont see how there would be a difference in data obtained. Would be interested in speed differences.

 
Posted : 19/11/2016 1:18 am
(@frankc)
Posts: 3
New Member
 

If your budget is an issue, go with the UFED4PC. however, i prefer the pc version.

Apparently I responded to the wrong thread lol.

The preferred method is using PA for IPhone extractions. Cellebrite recommends to run both methods in PA.

Anyone have results yet?

on a similar thought….We are looking to decide on UFED4PC or UFED Touch2.
anyone have an opinion?

I dont see how there would be a difference in data obtained. Would be interested in speed differences.

 
Posted : 19/11/2016 7:34 am
 RonS
(@rons)
Posts: 358
Reputable Member
 

In one of the coming UFED releases, the UFED 4PC and UFED Touch iPhone extraction method will be aligned to the one used in Cellebrite Physical Analyzer.

Best regards,
Ron Serber

 
Posted : 20/11/2016 6:08 pm
(@sahar55)
Posts: 16
Active Member
 

Anyone have results yet?

on a similar thought….We are looking to decide on UFED4PC or UFED Touch2.
anyone have an opinion?

I dont see how there would be a difference in data obtained. Would be interested in speed differences.

they only reason i see for buying UFED Touch is if you need a standalone unit and u dont want it to occupy much space (i have used UFED Touch for years).
otherwise in my opinion UFED4PC is much better, if you need to go portable you can install it on a laptop, and if you happend to need a stronger machine you can always upgrade your PC or laptop while UFED Touch is there to stay as is.

 
Posted : 25/12/2016 9:00 pm
Share: