Notifications
Clear all

XAMN - .UFD files?

5 Posts
4 Users
0 Likes
2,411 Views
(@john000)
Posts: 45
Eminent Member
Topic starter
 

I'm trying to import .UFD into MSAB XAMN v4.5 but it seems they support only the UFDR format.
Does anyone know if that's the case here? because I saw their marketing ads and they mentioned .UFD ingestion.

Thank you,
John

 
Posted : 04/02/2020 8:09 am
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

Depends. if the UFD points to a physical extraction then you can just import the physical extraction. Otherwise I believe you need the UFDR file. the UFDR file is basically just a zipped up Extended XML file with attachments (pictures etc.)

 
Posted : 04/02/2020 12:04 pm
(@john000)
Posts: 45
Eminent Member
Topic starter
 

Depends. if the UFD points to a physical extraction then you can just import the physical extraction. Otherwise I believe you need the UFDR file. the UFDR file is basically just a zipped up Extended XML file with attachments (pictures etc.)

This is true for importing extractions using XRY.
I'm talking about importing files via XAMN.

 
Posted : 04/02/2020 2:24 pm
(@mcman)
Posts: 189
Estimable Member
 

I don't use XAMN but the .UFD itself is just a text file, you can open it with notepad and give it a read, won't really have anything of value to load into XAMN which is why AmNe5iA suggested to load the actual image. It will contain extraction and file details at most.

The UFDR is an actual processed report which makes sense why XAMN ingests it. If they take .UFD files, it's likely used as a pointer to process the actual image in their processing engine as opposed to XAMN.

Hope that helps,
Jamie

 
Posted : 04/02/2020 5:38 pm
(@finz_up)
Posts: 1
New Member
 

XAMN does not import UFD file as they are pointers to extracted files/bin files. UFDR files can be imported, however the data will not have been decoded using XRY parsers. It will, however, be another tool to examine the data that was extracted using UFED.

If the device is directly supported with XRY then you can navigate to that profile and perform an import of a bin, zip etc. XRY will then decode the data using their parsers, potentially providing more data. If it is not directly supported then you can choose something such as an Android Generic profile etc depending on the make/model. Once completed you could then open it in XAMN for analysis.

A bin file can be imported directly into XAMN as well, however the data will not have been decoded.

My apologies for the late reply.

 
Posted : 26/02/2020 7:16 pm
Share: