Does anyone know of a program / device where while extracting data from a phone I can set a date limit for the data I want to collect. We currently have a Cellebrite UFED and it gave us all the sims messages from the I-Phone. The suspect has never deleted any messages and it took 9 hours to get all of the data, where we were only interested in a few hour period for one day.
thank you in adavnce
Ryap,
I'm no forensics expert, but I believe if you don't get all the available data you could potentially be at odds with the defense because YOU determined what was relevant and what wasn't. If it were me I would get all the available data and save that as your master copy. Then you could delete the data you don't feel is applicable, but on discovery you would need to turn over all the evidence.
Just my two cents.
Normally I would agree and that would be the best practice to get everything and then sort the time frame needed. However, in this case we got the phone via consent and due to the amount of time it took to get the call logs and text messages [9 hours] we came very close to having the consent revoked. At that point we could have seized the phone and obtained a search warrant, but since we had consent it would have been better if we could have gotten the data quickly since we were only interested in a few hours.
So you actually have all the content? A couple of Months ago I had a case involving a small ammount of text content. After downloading all the sms content with my Cellebrite I was able to cut n paste the data I needed into a word document and save it that way. You might want to see if that works? I've never tried to save downloaded data from a Cellebrite in a csv format, but IF you could you might be able to sort out the needed data?
Let us know what works!
rayp, are you saying that cellebrite UFED doesn't have a search function? We were doing this basic process with the devices over ten years ago before cellebrite, xry etc.
May not help you immediately, but some observations.
1. Ask cellebrite to incorporate this features ASAP
2. Previously to devices which exported escrowed data to html, the device had its own viewer to examine the data before exporting
3. Within the viewer window searches could be conducted for names, date and time stamps and the use of wild card *.* searches
4. Importantly, content seen through the mobile phone screen can be lost if the device/viewer iso charsets are not kept up-to-date and that also goes for the application (Word, Excel etc) you are exporting to, as well. Exporting to .csv (or Excel, for that matter) can be problematical because at the 'request to save' should the app not ask whether you wish to "save" encoded data when exporting a failure occurs to comply with the doctrines in the tenets of forensic procedure "nothing lost in translation".