Cellebrite Takes Ho...
 
Notifications
Clear all

Cellebrite Takes Hours to Open Extractions

the_Grinch
(@the_grinch)
Active Member

Anyone else noticing that it takes literally hours to open up extractions with Cellebrite?  I'm running an Alienware desktop with 64 gigs of ram, 2.5 tbs of storage, i7 8 cores and it has quite literally been 3 hours trying to open an iPhone extraction.  I moved the extraction off of the external media it was on so that's definitely not the issue.  I mean it's getting pretty ridiculous, how are we supposed to do this with every extraction that comes through the shop?  Going to spend a day just opening the thing...hope they figure something out because this just isn't conducive to investigative work. 

Quote
Topic starter Posted : 03/02/2021 7:16 pm
John000
(@john000)
Junior Member

Hi,

 

I didn't notice...

Which version are you running? what is the image size?

I run the latest PA version with 32G image and didn't experience any issues.

 

J.

ReplyQuote
Posted : 04/02/2021 7:30 am
AmNe5iA
(@amne5ia)
Active Member

If you open the Trace window in PA it will tell you what exactly it is doing during the opening of an extraction.  The reason it takes so long is because PA 'analyses' the data every time you open it again.

MSAB XRY analyses it once and stores the 'analysis data' within the .xry file.  If you upgrade XRY and want to use the new capabilities you manually have to select to re-analyse it.

If you upgrade PA, as it reanalyses it every time it opens it you don't have to manually re-run it.

It's not unusual for large iPhone extractions with large amounts of large database files to take hours to open in my experience.

I generally almost immediately create a Cellebrite Reader version, as a lot of the work can simply be done on that and it doesn't have to re-analyse everything every time you open it.

ReplyQuote
Posted : 04/02/2021 10:03 am
the_Grinch
(@the_grinch)
Active Member

@john000

Running the latest version 7.42.0.50.  Extraction was 192 gigs in size.  Took 12 hours to open it in PA so I could then create a Reader file (which has been running for at least an hour now).

ReplyQuote
Topic starter Posted : 04/02/2021 7:09 pm
John000
(@john000)
Junior Member

@the_grinch 12 hours is WOW.

Callout for Cellebrite. 

ReplyQuote
Posted : 05/02/2021 1:30 pm
Share: