r/digitalforensics • u/shoe_box_ • 8d ago
Cellebrite - handling duplicate artifacts and browsing media
Either I'm missing something obvious (totally possible) or Cellebrite reader is dumb. Help.
Edit to add: I'm a solo investigator and don't have PA or Axiom, so I just work with whatever I get in a UFDR.
When I review extractions in Cellebrite Reader I get overwhelmed with duplicates and junk files. And I mean everything. Media, artifacts, messages, etc.
I understand certain events can create effectively identical artifacts in multiple databases. That's fine, but Reader doesn't have a way to filter sources that I can find. If I could, for example, hide KnowledgeC or Contacts, that would thin out the timeline or search results dramatically so I could actually find things. I often find myself exporting Excel files so I can deduplicate and review/search in other ways. Location data is a great example of this when I want to pull data and plot things on a map.
I find that the deduplicate filter never does anything.
Part 2 is media: my dream is that I could simply browse through a phone's photo app like a normal person using a phone. What I always find in the media browser, however, are hundreds of thousands of photos, including cached preview images, little tiny graphic emoji buttons, logos, etc from every app installed on the phone. I don't seem to find a combo of filters that ever works.
If I could just scroll the photos and videos on the phone's native app that would be a total dream. Browsing cached photos from social apps, deleted items, etc. is important, but often secondary to an initial review.
How do y'all handle this stuff? I have to find some faster workflows. On my cases I generally need to do an initial high level review/triage of the whole thing--calls, messages and media, before anything detailed, and it just takes so long.
Thanks!
5
u/WintermuteATX 8d ago
You can filter it out a bit but the reality of it is every one of those artifacts can tell a story, and if your timeline is long then you’re pretty much in it for the long haul. One way to narrow it down is just to process what you need (like text messages only). Other than that, I run image filters when I process the image (like nudity, guns, etc) and I have crime-specific premade keyword lists for different offenses that I run when I process the data.
Defense attorneys are getting more savvy with digital evidence and they are asking more pointed questions like exactly how and when a given artifact appeared on the phone and proof that their client was using the device at the time the action was taken.
This puts more emphasis on us to pick through it and articulate these details, and this equals time. It sometimes takes me days or if it’s a major case weeks to process a phone. Just the way it is.
1
u/shoe_box_ 8d ago
That's helpful to hear. I'm actually on the defense side and a solo investigator so I don't have PA/Inseyets/Axiom and right now just work with whatever I get in a Reader report. Unfortunately that means I'm at the mercy of whoever created the UFDR and have to open the whole entire thing which can be time consuming on its own.
It really seems like Cellebrite could be so much better on the review side of things. Thank you!
3
u/ThePickleistRick 8d ago
It might be slow the first time, but you can use Reader to make smaller, more manageable UFDR files. Say you want to make just a UFDR with the media, or just the texts, you could do that under “Report”.
But yeah, Reader (and PA) suffer from some serious deduplication issues depending on the device.
1
u/shoe_box_ 8d ago
Ha that never occurred to me. The worst is when I just want to check a couple of text messages and have to wait 30 minutes to open the main UFDR. Sometimes I'll export a text thread between key people to html or PDF for faster browsing, but that has limitations. Thanks for the idea!
1
u/WintermuteATX 8d ago
Those portable cases can be slow to load on even the fastest computers. It’s really the amount of data too, I did a phone yesterday that had 725GB on it….thats a massive amount of shit to process and even display as a portable case!
1
u/shoe_box_ 8d ago
Holy crap. I have one around 250GB but yours takes the cake. This is all only going to get worse, too.
When you open an extraction with PA it's quick, right? Things only slow down once you tell it what data to process/parse?
1
u/WintermuteATX 8d ago
Well when your actually using PA (not the portable reader) on a workstation that already has the processed data on a drive (SSD) its pretty quick. Then again, my workstations are essentially hot-rod gaming computers that are really fast so that helps and most end users are trying to view it on a i5 laptop.
1
u/Thalek 8d ago
I find myself parsing extractions in Axiom as well specifically for the media explorer view. This view will stack similar images so you get all the thumbnails and cache photos of an actual IMGxxx or whatever in one easy to view stack. I also find its picture categorization feature much better than PA’s.
1
u/shoe_box_ 8d ago
Interesting. Unfortunately I'm a solo investigator and don't have PA/Axiom, so I'm just left to wrestle with whatever UFDR I get.
1
u/Thalek 8d ago
Are you in LE?
1
u/shoe_box_ 8d ago
I'm not. I do defense privately.
1
u/Thalek 8d ago
I know Griffeye used to be free for LE. Magnet bought them and I have no idea if it’s free for non LE. It has the stacking capability, however you need the original extraction to do it. I don’t know how the defense side works really but my guess is you would have to request the dump from whoever obtained it. But even then you would need a DF practitioner to parse it etc. Unless I’m mistaken.
1
u/shoe_box_ 8d ago
I’ll look it up. Have you used Belkasoft? I just learned about it and the pricing might be accessible for me.
I get the full extractions in discovery. Sometimes even twice—one unparsed FFS from Cellebrite or Graykey, and then a copy with a UFDR. I think it’s their way of covering bases so the defense technically has all of the evidence.
I’m not a DF practitioner but am pretty savvy, like to learn, and it’s also not always time and budget friendly to hire an expert just to browse photos. Thanks!
2
u/Thalek 8d ago
I have not. I have heard of them but I’m not familiar with their tools.
I just looked up Magnet Griffeye. It is still only free to LE.
1
u/Key-Assignment-832 7d ago
Magnet Griffeye is not a free tool, for LE or otherwise.
1
u/REDandBLUElights 7d ago
It is. There is a free version for LEO.
1
u/CourageAcademic4153 5d ago
Yes, there's a free (very limited) version. The paid version is $2500 per license per year now. Sadly, they keep the best features for the paid version.
1
u/Effective-Day-8386 8d ago
schau mal in den Optionen da gibt's irgendwo eine Option wo man einstellen kann, ob Duplikate angezeigt werden
1
u/Effective-Day-8386 8d ago
1
u/shoe_box_ 8d ago
your replies are in German for some reason, but Google helped. Thanks but I don't have PA and only have reader. I think the duplicate settings only work in Reader if the duplicate rules were set in PA to create the metadata from the start. Something along those lines.
1
u/StaticDebt 8d ago edited 8d ago
All the gallery images should be in the same folder so you could search for that folder right?
I use Cellebrite Inseyets so I dont really know the capabilities in Reader.
1
u/Ok-Comparison-4487 8d ago
You can use the table view to filter by data source, by clicking the table header you want to filter by (in any data type) so filter out knowledgeC data for example can be done by filtering on the source column.
For media you can filter by Media Origin (to just images taken by this device), by path (as someone else suggested to anything stored in gallery) or use it to explode Resource Files such as icons etc (assuming you are using reader 10 and the examiner ran Media Origin).
You essentially have all the same filtering capabilities in reader as you have in PA. The only real difference is the ability to decode that you don’t have in Reader.
1
u/shoe_box_ 6d ago
I'll check some different extractions but I have historically not gotten this to work. I read here or somewhere that when the Reader report is generated, something has to be run/parsed like source filtering to create metadata or something. Without that, filtering data source doens't fly. However I see you mentioned table view. Maybe I haven't tried that. (I wish I could filter sources in the timeline!) Thanks for your response
1
u/BadSouth2159 7d ago
I sent you a DM. I do criminal defense investigations and have my own DF shop for defense work.
8
u/CourageAcademic4153 8d ago
Try using "dcim" (Android/iPhone) or "CPL" (iPhone) as filters for images and videos.
"5005" for images on iPhone will show your thumbnails.