What Happens When You Press that Button?

1 what Happens When You Press that Button? Explaining Cellebrite UFED Data Extraction Processes Table of Contents UFED Basics ..3. Extraction Types ..4. Logical Logical extractions of iOS How does the examiner know which method to choose?..6. File system Can decoding miss some data?..8. Wear leveling and garbage Physical extraction ..9. Boot Why Cellebrite boot loaders are forensically Other physical extraction Authentication and In Glossary of Page 2. UFED Basics Cellebrite makes mobile device evidence Don't store digital evidence on any comput- extraction available on two different platforms: er that is or will be connected to the Internet the UFED Touch, or the UFED 4PC.

2 The UFED at any time. 4PC is extraction software that can be installed on any PC platform, accessible and securable If performing an over-the-air software in the same way as any other PC-based update, the operator should not simultane- software. ously have an evidence device or evidence storage connected to the forensic machine. The UFED Touch consists of standalone proprie- tary hardware, with the UFED software installed Extract mobile device evidence to a storage on the Microsoft Windows Embedded Stand- medium specifically designed and ard 2009 platform. Users can only access prepared for that purpose: a Flash drive, limited functionality shut down, log external hard drive, a location on an internal on/off and cannot access the Windows operat- forensic network, or internal drive or ing system.

3 Partition within the forensic computer. The UFED Touch and UFED 4PC interfaces and As of April 2014, a permission management architecture are exactly the same. UFED feature was included in the UFED update. software is designed to execute only read com- UFED Permission Management is an optional mands, and to prevent the opportunity to alter it feature that allows forensic lab administrators to to issue write commands to mobile devices. enforce operator accountability and limit search While the operator should document which scopes, either based on extraction type or to platform, version, and extraction type were specific data types. used, no other differences fundamentally exist between UFED Touch and UFED 4PC extrac- This way, administrators can control who tions.

4 Performs extractions based on their level of training, job responsibilities, or other right to UFED operators should also adhere to the same know, need to know criteria as specified in their best practices for both Touch and 4PC organization's policies or standard operating platforms that they do for any forensic computer procedures. Cellebrite encourages all custom- installation: ers who distribute mobile evidence collection in their organizations to use UFED Permission Isolate the forensic machine from the Inter- Management. net while performing forensic examinations. Page 3. Extraction Types There are two different methods of mobile In the rare instances when the extraction fails, device data extraction: logical and physical.

5 (A the user must simply start the extraction over. third extraction type, the file system extraction, The failure does not affect the quality or integrity technically falls under the logical heading.) of evidentiary data because it only affects the Different data types, if they are supported for transmission of data from the device, not the the device, are available from each extraction data on the device. category, as shown in the graphic below. Logical File System Physical SMS SMS SMS. Contacts Contacts Contacts Call logs Call logs Call logs Media Media App data Media App data Files Files Hidden Files App data Hidden Files Deleted data In most cases, mobile phones are connected to Depending on the subject phone's OS, logical the UFED device via a USB cable connection, extractions may instead use USB/Bluetooth which communicates with the phone to extract protocol APIs or, with older devices, serial proto- its data.

6 The use of a USB connection provides cols in order to extract the data. Operators a proven reliable channel upon which to copy should document which connection type they data from evidence device to the forensic used for each extraction. image. Page 4. Logical extraction Logical extraction of data is performed, for the Therefore, the API will not see that they exist most part, through a designated API (Applica- and will not make them available to a UFED. tion Programming Interface), available from the logical extraction. To access this data, an exam- device vendor. Just as the API allows commer- iner would need to access the file system and cial third-party apps to communicate with the examine the data associated with the particular device OS (operating system), it also enables application in question.

7 In addition, not all devic- forensically sound data extraction. es have a common interface to extract emails, and the API will not be Upon connection, the UFED loads the relevant applicable. vendor API to the device. The UFED then makes read-only API calls to request data from the phone. The phone replies to valid API requests to extract designated content items such as text messages (SMS), phonebook entries, pictures, etc. Logical extractions of iOS devices In July 2011 Cellebrite identified the need for a faster means of extracting data from iOS devic- From a technical standpoint, API-based logical es. The pre-UFED Touch hardware, the UFED. extraction is straightforward to implement and Classic or UFED 36, could take many hours to the results are provided in a readable format.

8 Perform these extractions. Cellebrite solved the However, the logical method is limited to the problem by implementing iOS extraction within scope of content the specific vendor has made its analysis software, UFED Physical Analyzer, available through its API. as of version Pictures taken via third-party app, for example, It is possible for iOS device extractions to differ are likely stored in a folder that is different from between the UFED Touch/UFED 4PC interface the default. and the UFED Physical Analyzer. Page 5. That's because the UFED Touch/UFED 4PC How does the examiner know which method obtains the Apple iTunes backup interface to choose? using its API, the Apple File Connection The UFED Physical Analyzer interface automati- (AFC) the same interface used to back up the cally selects the appropriate extraction meth- device to a computer.

9 Od based on the device's backup configura- tion, jailbreak status, model, and iOS. File system extraction with UFED Physical version but the operator has the option to use Analyzer is almost identical to physical extrac- other methods as well, and to combine the data tion in that it relies on a boot loader to access sets. The interface explains which data is availa- the device's memory; however, rather than ble with each extraction method. Users should obtain a bit-for-bit image including unallocated document which method(s) they used and why space, the software extracts only the device file they used it, when possible. system. This extraction process is proprietary rather than dependent on Apple's API.

10 File system extraction Moreover, UFED Physical Analyzer makes three different types of iTunes backup ( Advanced Another logical method extends the examiner's Logical ) extractions possible. reach to the phone's live partition. Available with the UFED Ultimate license, a file system extrac- Method 1 like the UFED Touch, relies on the tion uses different device-specific methods to iTunes backup using Apple's backup infra- copy the file system. While these are compara- structure ble to the API used in logical methods, they use different sets of built-in protocols, depending on Method 2 extracts backup data if the the OS. The mix of protocols often differs from device is encrypted and the UFED operator device family to device family.