Hi friends,
I'm reviewing the ufdr file created by the judicial law enforcement. OS is Android. I'm doing this with the Cellebrite Reader software.
Looks instagram installed on the phone but there is no instagram menu on Cellebrite Reader software. Can I see instagram direct messages in udfr file with Cellebrite Reader? Where is the file of instagram direct messages?
Thank you all of you.
I guess I asked a very difficult question )
I guess I asked a very difficult question )
Yes, I don't think that any personnel on duty on forensicfocus.com on saturday and sunday - particularly between Christmas and New Years Eve - have a sufficient level of knowledge/experience to answer your question.
As an example, personally I have not even an idea what an "ufdr" file is nor whether an "ufdr file created by the judicial law enforcement" is in any way different (there must be a reason why I normally am allowed to assist at tier 1 level only, and my pay is so low).
You should wait until monday 1200 GMT, then - if by then noone from tier 2 has replied - you should make a new post, specifying "elevation to support tier 3 required, URGENT!" this will allow the Tier 1 support personnel to forward your request to the chief engineer.
jaclaz
If it was just a logical acquisition, you won't find much of Instagram in it.
If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.
Good luck )
If it was just a logical acquisition, you won't find much of Instagram in it.
If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.
Good luck )
Thank you for reply.
I have logical and physical files. But since I don't have a Ufed Pysical Analyzer license, I can't open the UFD file ( I can only open the logical UFDR file.
Where can I find Trial UFED Pysical Analyzer? I requested it from the Cellebrite website, but there is no return.
Greetins.
How do you know that a physical acquisition was performed ?! )
Send me in PM a dir listing of the dump. I still think you got just a logical dump.
you most likely won't get instagram data unless the person who performed the collection using cellebrite leveraged the APK Downgrade method during collection or if a full physical extraction was performed. Most of the newer android you won't be able to get a full physical on unless the phone was rooted.
Also you cannot download a trial of UFED PA. It requires a license and is a fairly expensive software suite.