Michelle: Hi, everyone. And thank you for joining today’s webinar: Maximizing Data Collection with SaaS Innovations. I’m Michelle Durenberger, and I’m the field marketing manager here with Cellebrite Enterprise Solutions. Before we get started, there are a few notes we’d like to review. We are recording the webinar today and we’ll share an on demand version after the webinar is complete. If you have any questions, please submit them in the question window and we will answer them in our Q&A. If we don’t get to your question, we will follow up with you after.
Now, I’d like to introduce our speaker today, Monica Harris. Monica has decades of experience specializing in the development, implementation, and training of proprietary software for eDiscovery service providers such as KLDiscovery and Consilio. Before joining Cellebrite, she worked with the U. S. Food and Drug Administration, where she oversaw policy and procedure curation, enterprise solution rollout, and training for enterprise solutions. Monica is an active leader and mentor in the eDiscovery community and has lectured on trending topics in eDiscovery at American University and Georgetown University and is the co-project trustee for the EDRM text message metadata project.
Monica has previously served as the assistant director of the DC chapter of Women in eDiscovery and as a board member of the Masters Conference. She currently serves as immediate past president of the ACEDS, Association of Certified eDiscovery Specialists, DC Chapter, and is a member of the EDRM Global Advisory Council.
Thank you so much for joining us today, Monica. If you’re ready, I’ll hand it over to you so we can get started.
Monica: Thank you, Michelle. And thank you everyone for joining us for today’s webinar, Maximizing Data Collection with SaaS Innovations. Let’s jump right in and talk about the critical nature that SaaS solutions have or just talk about the critical nature of SaaS solutions for internal investigations and eDiscovery. I think SaaS solutions are ubiquitous in our industry, with platforms moving from litigation holds to processing to discovery review, and now even collections moving to SaaS. Pretty much, if you can think of a software solution, they are SaaS-based.
And there are several reasons for that, including the fact that organizations need the ability to adapt to constant change, whether that change is happening inside or coming from inside the organization or outside, or maybe even both, organizations need the ability to be as agile as possible. And when you think about traditional software deployment methods where you could be thinking about potentially doing a P.O.C and then from there bringing in hardware, you’re working with a software that’s a little bit more beefier and maybe a little bit more resource-intensive, or whether or not it’s virtual, software deployments or traditional software deployments as we have seen them take careful planning and they are not rapid. Unlike a SaaS solution, which does have the ability the deployment option is removed completely, and then in addition to that, you have consistent innovation, which can always be helpful to stay up with the ever changing or dynamic role of technology and particularly mobile technology.
SaaS solutions are adept because of their ability to consistently update to work with the consistent updates on your mobile devices. I know that in these webinars we have talked over the past year or two about the constant updates that can happen to mobile devices, whether it is the device itself, which you may update annually, or the operating system on your device, which could be set to auto update. And that could be happening once a month, twice a month to the applications on the device itself. With SaaS solutions, updating or evolving in real time, that is perfect for the consistently updating mobile device market.
In addition to that, SaaS solutions are responsive to emerging threats; nefarious actors are always at play. I think we’ve all been through IT training to ensure that we understand what those threats look like. And any innovation that addresses those threats can be added to SaaS in a seamless manner, same for any regulatory changes that an organization could be facing.
And then, of course, the technical advances, the new features, the things that are differentiators in the market, the things that customers want as soon as possible, Saas makes it possible to provide those features, those solutions and add on really that armor against risk in real time. And by doing all of those things, that’s how SaaS solutions really empower organizations to be efficient and to be effective in terms of their operations and in terms of the dynamic climates that they could be facing.
The benefits of SaaS are numerous, but we can cover some of them here, starting with risk mitigation. And oftentimes that risk could be as simple as silos within organizations. It could be eDiscovery teams that may be siloed from a forensics team, but have a need to talk to the forensics team about what it is they need for their discovery or for their integration.
It could be, or speaking of integration, it could be the product integration itself with one software platform being hosted one place and one software platform being on prim and the need for these software platforms to talk to each other because you are moving through a process or a workflow. Let’s say it’s the EDRM workflow, for example, it’s important that there are fluid handoffs between those software products for investigations in cases to close seemly, if not be accelerated.
They’re cost effective. When we talked a little bit on the last slide about traditional deployments, traditional deployments come with overhead cost and SaaS solutions eliminate overhead cost, meaning that your upgrades at any maintenance that happens is seamless. Ao it’s cost effective, reducing overhead and also making it easier for teams that may not be as robust to handle the software.
And then accessibility, which really also is the other side of the coin when we’re talking about the silos within organizations. For SaaS solutions, there is transparency that really removes those silos that really is how we have the risk mitigation, but that accessibility overall is just great for an entire organization.
With SaaS solutions, because of the immediate nature of the SaaS solution in terms of how quickly you can get to them and how quickly you can use them, when it comes to collecting and mobile data in particular, you can avoid data spoliation. I think we have seen a lot of cases in the news in the recent years where we’ve seen data spoliation for no other reason than how much time it took to get to the device.
It could be that a provider or that a firm or that an organization came to understand that they needed to collect data, they then had to go through traditional procurement methods to get a solution that could handle the collection of the data, including the deployment, and then they were able to reach out to an employee or a custodian. And by that time, any number of things, some of which may not have had anything to do or any malintent from the employee or custodian could have happened that would have caused data spoliation. When you remove the need to have those complex deployments, when your access to the capabilities of the software is immediate, you can get to that data faster, reducing the risk of spoliation.
In addition to that, we talked about the ever-changing updates that come with mobile devices, whether it’s to keep them innovative with the latest features or even secure so that malware won’t be present on the device that is constantly evolving data that’s a constantly evolving landscape.
And so having collection software that evolves with that is important. And really, that lends itself to collection readiness, meaning that regardless of the operating system, the device, the application that you want to collect from, or regardless of where the device could be, because now we have a hybrid workforce. So your employees could be at home, they could be in the office, they could be in the field, but just ensuring that your SaaS solution, your SaaS collection solution is adept enough to be able to handle any and all of those scenarios, prepares you and gives you collection readiness.
So, with the benefits of SaaS, what does that all mean or what does that all come to for Cellebrite Enterprise Solutions? That gives us the ability to talk about our full end-to-end SaaS solution, enabling a holistic collection management from end to end. And what does that mean for us? Well, that means from preservation and that goes back to avoiding data spoliation.
So, from preservation of data, whether that be targeted or advanced solutions or advanced collection, it could be that when you’re preserving or even when you’re collecting, what’s most important to your case or your investigation is just text messages. It could be that what’s most important to your investigation is a more fulsome look at what could be on the phone, from text messages to applications that are installed to, let’s say, for instance, it is an insurance use case and your insurance carrier is state farm and a phone to tell you things like whether or not the driver had an application open at the time of the accident or how fast the individual was going at the time of the accident, and that’s a more advanced look at the phone. So it’s not one size fits all, but in an end-to-end solution, you’ll need to have the ability to target responsive or important data and also get as much data as possible.
We’ll also need the ability to do early data assessment, to be able to determine as quickly as possible whether or not the data that you need, the relevant data that you need is present on the phone or whether there are other sources that you need to take a look at. And then searching and filtering, because in eDiscovery sometimes there are still cases where you need all of the data, because you may need to return to it at a later time. But what gets promoted for downstream processes, whether that is review or investigation, that requires searching and filtering.
And, of course, for downstream processes, you will need that reporting, and depending on what the next step is for the data, you may need conversion. So, a full end-to-end SaaS solution will encompass everything from preservation of the data all the way out to its reporting and conversion for other platforms.
Now, let’s look at the SaaS offering solutions that Cellebrite Enterprise has today. Starting with Endpoint Mobile Now, which is our solution for remote targeted collection of mobile data for preservation and EDA. With Endpoint Mobile Now, SaaS, you have immediate access to mobile data. So, when we talked earlier about the need for preservation, this is about as quick as you can get to mobile data as possible with just three simple steps.
This is an online solution where an examiner can go into the product, they can enter the custodian’s name and the custodian’s email address, they can determine what data is needed from the phone. So, if you want to collect everything that you see here, including more, like a list of applications that could be installed on the phone, you can do that, but if you just want to target the text messages because you’ve got a couple of hours and you need that data as soon as possible, you can do that as well.
And then the examiner is going to determine where the data goes, whether or not that be an S3 bucket or an Azure blob or even SFTP, the data will come back to the examiner for immediate examination. So that’s real-time collection of mobile data without any of that overhead, no maintenance, no updates, and scalable pricing and usage for mobile collection.
Now, one of the things, what we’re looking at here on this screen, is what you have the ability to collect. And with our Mobile Now product, we are looking at advanced logical collections. So, let’s take a look at what that looks like. For an iOS device specifically, because while Mobile Now does have the ability to collect from both iOS and Android, we do see more iOS devices in the US.
An advanced logical collection for an iOS is going to show some of the artifacts that you see listed on the left, including a list of applications that are installed on the phone; calendar items; contacts; call logs; any media; messages, whether that be the native messages or iMessages, for example, SMS, or from third party chat apps; and then also web history.
Now, that’s really important for two reasons. One could be that you are needing to collect text messages or preserve text messages, so then you can collect just that and your collection is done. Or it could be that you don’t know what you need to collect just yet, you may not know what you don’t know. And then an advanced logical collection could easily turn into early case assessment with the fact that that advanced logical collection will tell you what applications are on the phone and allow you to either have informed conversations with the service provider that’s going to go in and do more advanced collections for you, or even if you are the service provider, for example, let’s imagine in this scenario that you’ve done this remote collection, you get back your advanced logical and you understand that there is a more complex mobile application on the phone like signal. That now means you have to send someone out into the field to do a more advanced collection. But before you ever sent that person out, you had an understanding you had a business case for doing so. And that is what Mobile Now can provide you with.
Now, everything that we’ve looked at here is from the examiner point of view, but we are talking about remote collection. And so for the custodian or for the employee that’s engaged during the collection process, Mobile Now is about as straightforward for mobile collection as we could possibly design, meaning that once the examiner has set up the collection, the custodian is going to get an email, the email is going to tell them that they need to install a lightweight application, and then it’s going to give them a code that they can put into that application. The application was designed for either a Windows or a Mac, so as long as the custodian of the employee puts that lightweight utility on their machine and uses the charging cable of their device, their either iOS or Android device and plugs into their computer, they can then take the code from the email, put it into the utility, and that code in the email it has all the instructions that the examiner set up at the time of collection. It knows that it’s going to do a full advanced logical collection or that it’s going to collect just text messages and it knows that when it’s done collecting, it’s going to send it back to the repository that the examiner designated, and it does all of that with very minimal custodian engagement. So it’s not disruptive to business at all. A custodian never has to give up their phone, and the collection can be done in minutes. That is the power of Endpoint Mobile Now SaaS.
Endpoint Inspector SaaS would be, I’d say, the big brother to Endpoint Mobile Now. Whereas Endpoint Mobile Now focuses specifically on the remote collection of mobile data, Endpoint Inspector SaaS not only can remotely collect mobile data very much in the same fashion that you just saw in Mobile Now, but it also has the ability to remotely collect data from computers and cloud sources, as well.
Endpoint Inspector SaaS has the same SaaS benefits, so no deployment, you are ready to hit the ground running without traditional methods of software installation. And there’s no need to do any type of traditional maintenance or updates. Some of the added features here is that for Endpoint Inspector SaaS, when you’re looking at the collection of cloud applications like WhatsApp or Telegram, for example, that is agent agnostic.
The agent is that lightweight utility we talked about previously that the employee or custodian would need to install on their PC. There’s no need to do that when you’re collecting with cloud sources and Endpoint Inspector. That can be done with a QR code, for example. When it comes to the computer collections that happen with Endpoint Inspector, those have the ability to be discreet, meaning right now, as I sit here and present to you on my laptop, it could be very possible that a collection could be taking place on my laptop without it being disruptive to what I am doing or working on at all.
You may want to ensure for a more holistic collection or even EDA of a custodian that in addition to collecting from their mobile device, their phone, their tablet and also from cloud sources like M365, that you also go out and do a targeted collection of files on the computer.
Let’s say you’re interested in any documents that could be generated from M365. Email, Excel, Powerpoints, Words and any pdfs, just to ensure that anything that might have,let’s say, be downloaded from in M365 and placed on the laptop, that’s part of the discovery for your collection or part of the evidence for your investigation. So, by ensuring that not only are you going after mobile devices and after a cloud, like in M365 but are also looking at what’s on the computer of a custodian or employee as well, there is no stone left unturned.
One of the great things about Endpoint Inspector is that when you talk about collecting from all of those sources, all of the places where a custodian or even an employee might have data, you can initiate all of these collections with one job. So, I can say I think it’s important to collect from Tom Smith’s phone, Tom Smith’s computer, and also Tom Smith’s WhatsApp collection. I can initiate that with one click once I have set up all of the parameters for the job because I can do targeted collection.
It’s not that I’m going to pull back everything from the computer, it’s that I’m just going to pull back those office files with the right extensions from the past month and particularly anything that was in the documents folder. And I may know that I want to go after those office files for the past month in the documents folder because I’ve used Cellebrite Inspector to do triage on the computer first. So I know exactly what’s located there, exactly what I need to bring back before I ever initiate the collection.
Once I have all that data, using Cellebrite Inspector, I can then begin to examine the data. And if I find that there’s data that I want to take downstream processing, let’s say a review platform, for example, I can create reports and convert data out of Inspector.
So I can create each eDiscovery load files, for example. So here with preservation, you can do the advanced logical or the logical collection that we talked about that you saw in the Mobile Now product that’s also an endpoint inspector. You can target the collections, whether it’s for mobile or for computer. You can even do triage as a form of early data assessment. Using Cellebrite Inspector, you can search and filter that data from any source that Endpoint Inspector can collect from. And last but not least, you can report and convert that data so that it can go on to any downstream processing.
Now, thus far, we have talked about SaaS solutions that deal with logical collection, or that work with logical collections, whether that is mobile or computer. And then we’ve also talked about the type of cloud collection that can come from, say, an app like Telegram or WhatsApp. But the third and final SaaS solution for Cellebrite is not a product, it is a collection of products. And that is our Insights for Enterprise SaaS Solution, which is our advanced collection.
Also provides quick insights, streamline reporting, and conversion. And that is really a coupling of products that we’ve had previously, starting with our flagship advanced collection product, Mobile Elite. Along with Mobile Elite, we’ve combined our flagship product overall, Cellebrite UFED. And then the Physical Analyzer, but specifically our ultra series, which has a database behind it with Legalview as an option, which is what gives you the conversion and reporting for the relativity short message format and also eDiscovery load files.
We’ve added to the solution, UFED Cloud, so that you have access to over 70 cloud applications that you could retrieve data from. And for larger deployments, we have Commander so that you can manage all of those applications, that those products combined or the capabilities or those products combined is Insights for Enterprise SaaS.
Before it was Insights for Enterprise SaaS, it was Mobile Ultra. I know in a webinar that we did earlier, I think about a month ago, when we released Insights for Enterprise, because that was released this year in 2024, we received quite a few questions about what is the difference between Mobile Ultra and Insights for Enterprise. And the answer is they are the same advanced mobile collection solution rebranded. Very similar to say G-suite and Google Workspace or Skype and Link, it is a new fresh look at how to do advanced collections for internal investigations and eDiscovery.
But also one of the things I talked about when I talked about Insights for Enterprise or just generally as we’re talking about it now is the fact that Insights for Enterprise is advanced collection where previously when you heard me talking about Mobile Now or Endpoint Inspector, you heard me talking about logical collection, and there is a difference between the two. On the left-hand side of the screen, when you’re talking about logical collection, these are some of the artifacts that you have the ability to pull back. Now, the artifacts differ depending on whether or not you’re looking at an iOS or an Android, so for instance, archives are going to come from an Android, not an iOS. Likewise, if you saw iMessage on here, that would come from iOS, not Android, but together these are the artifacts that would come from a logical collection.
Now, when you look on the right-hand side of the screen, you’re looking at advanced collection. And so you could see we go from a few artifacts to far, far more. And so the difference really is in the data and also how the extraction is done. So, when we’re talking about logical extraction, whether it be for iOS or Android, or whether it be for Mobile Now or Endpoint Inspector, those collections can happen anywhere, anytime, all at once with the power of SaaS and with the power of remote collection.
However, when we’re talking about advanced collection and Insights for Enterprise, that is a phone in hand for collection. So, either that phone has been sent to an examiner for collection, or there’s an examiner that has gone out into the field to collect. That is not something that we have the ability to do remotely.
So, why would you do one over the other? Well, we did talk a little bit about early case assessment. It could be as simple as planning and understanding costs or cost control. Why send someone out into the field if it’s an unknown or a variable as to whether or not the data is there? So you could do a remote collection first so that you understand what you may potentially be sending out an examiner to collect.
But it also is a matter of data, so let’s take a look at what that looks like. So, on this screen, we have brought up some of the more popular chat applications and some more popular social media. So, including Facebook, Discord and Snapchat, and what we’re comparing here is an iTunes backup, which is very similar to a logical extraction, to a full file system extraction, which is what we call advanced collection, so that you can see the numbers paired up side by side.
We did use an iOS because you get more data generally from them because of the iTunes backup. And now we’re showing you what it looks like in Physical Analyzer. So I know it could be a little challenging to see, but let’s zero in, for instance, on Snapchat, because I know that that’s a very popular application nowadays to collect from and a really challenging application to collect from as well because of the ephemeral nature of the data in the application. But as I often say, when I have an opportunity to speak at conferences, we can collect from Snapchat, but how you collect is important.
If you were to do one of those remote collections that we talked about, where you were using Mobile Now or Endpoint Inspector, it was an iPhone, then the data that you would see in Physical Analyzer when you went to examine it, it looks similar to what you see on the left. So it’s not that you don’t get any data, you do get some, but it is not nearly as robust as the data that you see on the right side of the screen that you would do with a full file system collection. The same can be said as we go through here for Discord. You could see differences in the numbers immediately, particularly within the messages and same for Facebook as well. So, an advanced extraction or a full file system extraction, like what you would see in Insights for Enterprise is going to give you the most data and requires the phone to be in hand.
Insights for Enterprise is a collection of products as we talked about before. So, with Insights for Enterprise UFED specifically, you get the combination of all of the capabilities that were available to you in our flagship product UFED in addition to all of the capabilities that we had in the previous product, Mobile Elite. It is now one product that we call Insights for Enterprise UFED that is part of the Insights for Enterprise Solution. So, between the two, you’ve got the widest range of coverage for any iOS or Android device that you could be collecting and also you’re going to have some in depth extraction and decryption there as well.
But it’s more powerful than that when you begin talking about the Insights for Enterprise Solution as a whole. So not just insights for Enterprise UFED, but Insights for Enterprise PA, Insights for Enterprise Cloud, and also the add on with Legalview. With Insights for Enterprise UFED, you have the ability to have quick insights, and you can see that on the left of the screen. So before you initiate collection, you’ll be able to determine things like the make and the model of the device.
In addition to that, what’s not pictured here is you also have the ability to pull out a list of those installed applications very much like how I showed you with Mobile Now and remote or logical collections, you can see that in the product itself when you’re looking at Insights for Enterprise and you have that phone in hand, but not only can you get those quick insights to determine what’s on the phone, but when Insights for Enterprise UFED and Insights for Enterprise PA are sitting on the same machine, they have the ability to talk to each other.
At the point of collection, you can dictate after you’ve taken a look at your quick insights and done some early case assessment to understand that there are applications on that phone that you want to collect from, you can determine that instead of going through an examination process like you normally would in PA, Instead, you want to harness the power of PA’s reporting ability and perhaps even the power of conversion with Legalview. And at the time of collection, you can tell Insights for Enterprise UFED that you would like to create a UFDR. And that UFDR can then be taken on to downstream review. Coming up in our next release of Insights for Enterprise you’ll even be able to dictate whether or not at the time of collection you want your data to be in RSMF format if a Legalview license is present for Insights for Enterprise PA.
So, all of that combined is the power of Insights for Enterprise, from preservation to advanced collection, early data assessment, searching and filtering, if needed, or you can go straight into reporting and data and conversion.
So, what are the key takeaways from today’s webinar, Maximizing Data Collection with SaaS Innovations? SaaS solutions are critical. I would say they are more than critical, they are paramount for internal investigations and eDiscovery because organizations are consistently working with change and SaaS is always adapting in real time to assist organizations with that.
In addition to that, SaaS solutions have the ability to break down silos by creating transparency throughout an organization, and they reduce overhead because there’s no traditional deployment, making them cost effective. It’s a faster way to get to your data, whether it be mobile or computer, and it always ensures that your collection team is collection ready with the latest innovation.
Here at Cellebrite Enterprise Solutions, we offer a full end-to-end SaaS solution for holistic collection management. Whether you need to preserve data, whether that be targeted or advanced, whether you want to perform early case assessment or early data assessment, and then need to move into reporting and conversion that could be automated, we have a SaaS solution for you. And that moves through the data sources of mobile, computer, and cloud.
And we do that With three solutions: Cellebrite Endpoint Mobile Now. or the quick and easy collection of mobile data for preservation, ECA, that uses logical collection. Cellebrite Endpoint Inspector, which also uses logical collection for mobile data that brings in the additional sources of computer and cloud. And Insights for Enterprise, which is our most advanced collection capability paired with decoding, reporting and conversion. Thank you for joining me for today’s webinar, Michelle, do we have any questions?
Michelle: Absolutely. Thank you so much, Monica, for taking us through that. And we have had a few questions come in. So, the first question that we have is, “What happens if the employee disconnects their phone during remote collection?”
Monica: Oh, that’s a great question. So during the remote collection process, as the agent or the utility is working through the collection, if before the data is uploaded to its final destination, the employee disconnects the phone, they do have the ability to reconnect it. Things happen all the time, it could be a faulty charging cable and maybe you need to quickly replace it or maybe there was an internet blip. So there is the opportunity to go ahead and make sure that you reconnect or re-establish that connection. Once the collection is done and uploading is taking place, there’s no interruption there. So, once that happens, the employee can disconnect their phone and the uploads taking place and the data is going to its final destination. But we do have resiliency built into the mobile agents so that we can really work with just life because sometimes things happen. So there is resiliency in the mobile agent for custodians and employees.
Michelle: Fantastic. Thank you so much for that. Okay, we do have some more questions. So Monica, can mobile collections be performed discreetly?
Monica: That is a great question. I know that when we were talking about Cellebrite Endpoint Inspector and computer collections, I talked about the fact that we have the ability to do those discreetly. We have the ability to do those discreetly for Windows, Mac, and in our next release, Linux.
However, for mobile collections, and it will be mobile collections that are happening remotely, right? For mobile collections, those cannot be performed discreetly. You will need the interaction of the employee or the custodian, and that is why we designed a workflow that is as seamless and as non-intrusive to business as possible with just a few quick steps to get that data back to the examiner.
Michelle: Thank you. Okay, Monica, one more. Can full file systems be done remotely?
Monica: That’s a great question. No, not at this time. In order to harness the power of Insights for Enterprise and and really capture all of that data that we saw on some of the comparison shots and be able to get those quick insights and the streamline collection to reporting nature, you will need to have the phone in hand, yes. Full file system collections, which is what we call advanced, advanced collection, yes, that needs to have the phone in hand. Great question.
Michelle: Okay, Monica. Can Endpoint Inspector collect data from servers?
Monica: That’s a great question. Endpoint Inspector for computer collection has the ability to collect data from Windows, Macs, and Linux. So as long as your server has one of those operating systems, absolutely it can do so.
Michelle: Perfect. Thank you for clearing that up. And I think we have time for one more question. Is there a list of third party chat applications Mobile Now can collect from?
Monica: That’s a great question. So the mobile collection innovation that’s in Mobile Now is also an endpoint inspector. We understand that the collection of mobile data is really trending and so we made that available on its own. And when we were looking at that comparison between logical collections and advanced logical collections, that was our engineering team testing several applications to understand where we were pulling back data from applications and also how much data we were pulling back so that we could compare it and be consultative. So to that, and we do have a list of several applications that we have seen present, and advanced logical collections that could be performed with Mobile Now, an Endpoint Inspector, and we can share that. Absolutely we can share that with the audience.
Michelle: Perfect, wonderful, Monica. Thank you so much. Well, unfortunately, we are running out of our allotted time here, so we will have to wrap this up. And we will reach out to you individually after the webinar to answer any of the questions that we did not get to.
I want to give you a big thank you, Monica. That was such a great discussion on how investigators and eDiscovery professionals can close investigations and get to review faster with Cellebrite’s suite of SaaS’s cloud-based collection solutions.
Now, remember, for any additional questions or to learn how you can get started with any of our solutions, please reach out to us at enterprisemarketing@cellebrite.com. Thank you again, Monica, and thank you all for joining us today. Have a great day.
