±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 36595
New Yesterday: 5 Visitors: 131

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Instagram Direct Message Database

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

mtnslck
Newbie
 

Instagram Direct Message Database

Post Posted: Dec 28, 19 23:13

Hi friends,


I'm reviewing the ufdr file created by the judicial law enforcement. OS is Android. I'm doing this with the Cellebrite Reader software.
Looks instagram installed on the phone but there is no instagram menu on Cellebrite Reader software. Can I see instagram direct messages in udfr file with Cellebrite Reader? Where is the file of instagram direct messages?

Thank you all of you.  
 
  

mtnslck
Newbie
 

Re: Instagram Direct Message Database

Post Posted: Dec 29, 19 15:25

I guess I asked a very difficult question Smile  
 
  

jaclaz
Senior Member
 

Re: Instagram Direct Message Database

Post Posted: Dec 29, 19 16:58

- mtnslck
I guess I asked a very difficult question Smile

Yes, I don't think that any personnel on duty on forensicfocus.com on saturday and sunday - particularly between Christmas and New Years Eve - have a sufficient level of knowledge/experience to answer your question.

As an example, personally I have not even an idea what an "ufdr" file is nor whether an "ufdr file created by the judicial law enforcement" is in any way different (there must be a reason why I normally am allowed to assist at tier 1 level only, and my pay is so low).

You should wait until monday 12:00 GMT, then - if by then noone from tier 2 has replied - you should make a new post, specifying "elevation to support tier 3 required, URGENT!" this will allow the Tier 1 support personnel to forward your request to the chief engineer.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

passcodeunlock
Senior Member
 

Re: Instagram Direct Message Database

Post Posted: Dec 30, 19 20:23

If it was just a logical acquisition, you won't find much of Instagram in it.

If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.

Good luck Smile
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

mtnslck
Newbie
 

Re: Instagram Direct Message Database

Post Posted: Dec 30, 19 21:20

- passcodeunlock
If it was just a logical acquisition, you won't find much of Instagram in it.

If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.

Good luck Smile


Thank you for reply.

I have logical and physical files. But since I don't have a Ufed Pysical Analyzer license, I can't open the UFD file Sad I can only open the logical UFDR file.

Where can I find Trial UFED Pysical Analyzer? I requested it from the Cellebrite website, but there is no return.

Greetins.  
 
  

passcodeunlock
Senior Member
 

Re: Instagram Direct Message Database

Post Posted: Dec 31, 19 12:42

How do you know that a physical acquisition was performed ?! Smile

Send me in PM a dir listing of the dump. I still think you got just a logical dump.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

cs1337
Senior Member
 

Re: Instagram Direct Message Database

Post Posted: Jan 17, 20 20:59

you most likely won't get instagram data unless the person who performed the collection using cellebrite leveraged the APK Downgrade method during collection or if a full physical extraction was performed. Most of the newer android you won't be able to get a full physical on unless the phone was rooted.

Also you cannot download a trial of UFED PA. It requires a license and is a fairly expensive software suite.  
 

Page 1 of 1