Logical Extraction ...
 
Notifications
Clear all

Logical Extraction Hash?

eightflat
(@eightflat)
New Member

Very new to this still. I got access to a Cellebrite report of a logical extraction, but I don't see any hash values. Is that because it's a mobile device, because it's a logical extraction, or is it something else?

Quote
Topic starter Posted : 20/08/2020 3:30 pm
Mark_Eskridge
(@mark_eskridge)
Member

Cellebrite will not give you a hash value on a logical image report, because it consists of individual sets of data downloaded through the phone's interface. In my opinion, the best you can do on the front end, as the person originally acquiring the logical image data, is to hash the resulting download folder/sub-folders which contain the extracted logical data. 

ReplyQuote
Posted : 20/08/2020 5:02 pm
eightflat
(@eightflat)
New Member

@mark_eskridge, makes sense, thank you very much!

ReplyQuote
Topic starter Posted : 20/08/2020 6:56 pm
armresl
(@armresl)
Community Legend
Posted by: @eightflat

Very new to this still. I got access to a Cellebrite report of a logical extraction, but I don't see any hash values. Is that because it's a mobile device, because it's a logical extraction, or is it something else?

I wouldn't sweat it as you see this lots of times for entire bodies like phones.

Now if you need an individual file and don't get 2 matching hashes, then you would have to begin a search on the culprit for that.

 

ReplyQuote
Posted : 22/08/2020 4:59 am
Share: