Join Us!

UFED v CFID and dif...
 
Notifications
Clear all

UFED v CFID and differences  

  RSS
chrisellis250
(@chrisellis250)
New Member

Hi all,

I currently deal with download data, but do not download it myself. I get given handset reports in an excel format and they seem to differ slightly whether the download has been carried out via UFED or CFID. Furthermore, the excel reports do not include any images, just information about the images. Based on the above, can anything assist me with the following

1. Difference between UFED & CFID (or any others) - i.e. whether one does something that the other doesn't and how their handset reports vary?

2. When looking at the meta data of images on the report, how can I confirm whether images have been sent to the handset or whether they have been taken on the handset?

Finally, does anyone have any experience with 'sorting' excel handset reports, such as extracting call logs, sms and chat logs into a more readable format - such as a concise excel spreadsheet showing row by row data?

Thank you everyone.

Kind Regards.

Quote
Posted : 14/10/2019 2:47 pm
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Hello -

What is a “CFID” report?

If possible, ask for a UFED Reader report, which is an interactive report containing potentially much more information than a UFED Excel format report.

In regards to your question about determining whether or not a photo was taken by a specific phone, you will want to examine EXIF metadata.

MOBILedit Forensic Express Pro has a Camera Balistics capability which can determine if a photo was taken by a specific camera in a smartphone. I have not used this Camera Balistics capability myself so your mileage may vary.

ReplyQuote
Posted : 14/10/2019 7:50 pm
deeFIR
(@deefir)
Junior Member

1. Difference between UFED & CFID (or any others) - i.e. whether one does something that the other doesn't and how their handset reports vary?

2. When looking at the meta data of images on the report, how can I confirm whether images have been sent to the handset or whether they have been taken on the handset?

Finally, does anyone have any experience with 'sorting' excel handset reports, such as extracting call logs, sms and chat logs into a more readable format - such as a concise excel spreadsheet showing row by row data?

Thank you everyone.

Kind Regards.

1. You have access to reports from both software packages - you can compare the two. Is there a reason an operator would use UFED over CFID? Availability of tools, personal preference, licensing restrictions, etc?

2. You can determine this by looking at the location of the file in conjunction with the metadata/report. I daresay if you have to ask this question, you should be seeking guidance from someone who is familiar with the particular device.

IMO, I think it's hazardous to ask internet strangers to explain the provenance of evidentiary product. Is there an examiner/analyst within your company/organisation that can interpret the reports for you?

ReplyQuote
Posted : 15/10/2019 4:22 am
Angel.7
(@angel-7)
New Member

Thanks for mentioning metadata. A few weeks ago I asked a senior FF member to suggest a good software for analyzing metadata and he laughed at me "there is no such thing."

Based on what I am reading I can use MOBILedit Forensic Express Pro to successfully analyze EXIF metadata.

Are there any other software options that can handle analyzing and extracting metadata?

Also, what software can be used to locate (by picture) a person, place or object?

Thanks You!

ReplyQuote
Posted : 15/10/2019 6:00 pm
Share: