I seem to recall hearing that a report created by Cellebrite could be imported into EnCase. I have phones, tablets and computers in a case. I have searched, but cannot find information on this anywhere. If I simply drag the report into EnCase, it would see it as a single file I'm sure, but would it retain it's formatting and be able to show the data as if I handed over the original Cellebrite report? Instead of handing over one report on the computers, and a report for each phone, it would be much tidier to include it all in one.
If you have Intella you can import Cellebrite directly in…not sure about EnCase though.
I prefer individual reports myself when it comes to mobile devices and computers. However, if they fit having all reports on one storage drive is ideal. Each Computer gets a separate report and each mobile device gets its own report. It will be interesting to see what others think. With the exception of Analytical tools I like to keep each exam separate. Sorry I don't use EnCase 7 so I cannot address a method of integrating say a mobile device report i.e. PDF into it.
Regards,
Chris Currier
I prefer individual reports myself when it comes to mobile devices and computers. However, if they fit having all reports on one storage drive is ideal. Each Computer gets a separate report and each mobile device gets its own report. It will be interesting to see what others think. With the exception of Analytical tools I like to keep each exam separate. Sorry I don't use EnCase 7 so I cannot address a method of integrating say a mobile device report i.e. PDF into it.
Regards,
Chris Currier
You have to generate a XML report with the UFED analyzer and then import the XML report and binary data into encase. Open the hex and process the evidence.
You have to generate a XML report with the UFED analyzer and then import the XML report and binary data into encase. Open the hex and process the evidence.
z19z4, could you expand a bit more on the process please?
Really interested to try this.