Instagram Direct Me...
 
Notifications
Clear all

Instagram Direct Message Database  

  RSS
mtnslck
(@mtnslck)
New Member

Hi friends,

I'm reviewing the ufdr file created by the judicial law enforcement. OS is Android. I'm doing this with the Cellebrite Reader software.
Looks instagram installed on the phone but there is no instagram menu on Cellebrite Reader software. Can I see instagram direct messages in udfr file with Cellebrite Reader? Where is the file of instagram direct messages?

Thank you all of you.

Quote
Posted : 28/12/2019 11:13 pm
mtnslck
(@mtnslck)
New Member

I guess I asked a very difficult question )

ReplyQuote
Posted : 29/12/2019 3:25 pm
jaclaz
(@jaclaz)
Community Legend

I guess I asked a very difficult question )

Yes, I don't think that any personnel on duty on forensicfocus.com on saturday and sunday - particularly between Christmas and New Years Eve - have a sufficient level of knowledge/experience to answer your question.

As an example, personally I have not even an idea what an "ufdr" file is nor whether an "ufdr file created by the judicial law enforcement" is in any way different (there must be a reason why I normally am allowed to assist at tier 1 level only, and my pay is so low).

You should wait until monday 1200 GMT, then - if by then noone from tier 2 has replied - you should make a new post, specifying "elevation to support tier 3 required, URGENT!" this will allow the Tier 1 support personnel to forward your request to the chief engineer.

jaclaz

ReplyQuote
Posted : 29/12/2019 4:58 pm
passcodeunlock
(@passcodeunlock)
Senior Member

If it was just a logical acquisition, you won't find much of Instagram in it.

If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.

Good luck )

ReplyQuote
Posted : 30/12/2019 8:23 pm
mtnslck
(@mtnslck)
New Member

If it was just a logical acquisition, you won't find much of Instagram in it.

If it was a physical or decrypted filesystem dump and there is still no Instagram section, you should dig up manually the Instagram databases from the "Databases" section. That would simply mean that the UFED Physical Analyzer didn't support - at the time of analysis - the installed Instagram app version.

Good luck )

Thank you for reply.

I have logical and physical files. But since I don't have a Ufed Pysical Analyzer license, I can't open the UFD file ( I can only open the logical UFDR file.

Where can I find Trial UFED Pysical Analyzer? I requested it from the Cellebrite website, but there is no return.

Greetins.

ReplyQuote
Posted : 30/12/2019 9:20 pm
passcodeunlock
(@passcodeunlock)
Senior Member

How do you know that a physical acquisition was performed ?! )

Send me in PM a dir listing of the dump. I still think you got just a logical dump.

ReplyQuote
Posted : 31/12/2019 12:42 pm
cs1337
(@cs1337)
Member

you most likely won't get instagram data unless the person who performed the collection using cellebrite leveraged the APK Downgrade method during collection or if a full physical extraction was performed. Most of the newer android you won't be able to get a full physical on unless the phone was rooted.

Also you cannot download a trial of UFED PA. It requires a license and is a fairly expensive software suite.

ReplyQuote
Posted : 17/01/2020 8:59 pm
Share: