HIGHLIGHTS DEVICE SUPPORT ◼ Cellebrite introduces physical extraction while bypassing user lock for 22 Samsung Galaxy devices including Galaxy S6, S6 Edge and Note 5 – with forensic recovery partition. ◼ A unique lock-bypassing method that allows physical extraction of more than 140 LG models, including 22 previously-unsupported models, such as the MS330 and VS880. This method additionally allows the removal and restoration of the user screen lock. ◼ A unique user screen lock removal method supporting 137 Samsung device (for some devices, there is more than 1 method).* ◼ First in Industry – Physical extraction while bypassing lock and decoding support for 19 Huawei devices. ◼ A unique user screen lock removal method supporting 17 selected LG devices, including the G5. ◼ Cellebrite introduces physical extraction while bypassing user lock as well as decoding support for 3 Nokia 105 devices: RM-1133, RM-1134 and RM-1135. You are required to use cable 153 in order to perform this type of extraction. ◼ An enhanced lock-bypassing physical extraction method supporting 28 Samsung devices (MSM8916), overcoming previous firmware limitations. * This method is expected to unlock all Samsung devices last updated before October 2015. This roughly correlates to Android 5.1.1 releases, however there may be exceptions. APPS SUPPORT ◼ New applications for iOS and Android devices: Don’t Touch This (iOS), HereMaps (Android), HideSMS (Android), Hot or Not, Kakao Story, Mappy (Android), Meet24, MeetMe, Nike+ Running, Scruff (Android), SpringPad FlipNote (iOS) and TextMe. ◼ 183 updated application versions. FUNCTIONALITY ◼ Improved performance for image thumbnails. ◼ Improved performance for unallocated carving. ◼ Enhanced Application Usage. ◼ Cell Towers information. ◼ WhatsApp decryption support for older BlackBerry devices. UFED TOUCH, UFED 4PC, UFED PHYSICAL ANALYZER, UFED LOGICAL ANALYZER RELEASE NOTES Version 5.1 | June 2016 NOW SUPPORTING DEVICE PROFILES +1,729 APP VERSIONS 19,776 Cellebrite introduces physical extraction while bypassing user lock for Samsung Galaxy S6, S6 Edge and Note 5. Known for its breakthroughs in mobile data technology, Cellebrite is the industry’s leader – delivering comprehensive and innovative solutions for mobile forensics. Staying true to our vision, UFED 5.1 introduces unique and exclusive capabilities, providing unmatched access to case-critical evidence. EXCLUSIVE - ONLY AT CELLEBRITE: A unique lock-bypassing method that allows physical extraction of more than 140 LG models, including 22 previously- unsupported models, such as the MS330 and VS880. A user screen lock removal method supporting 137 Samsung devices. Physical extraction while bypassing user lock and decoding support for 19 Huawei devices. A user screen lock removal method supporting 17 selected LG devices, including the G5. FORENSIC DEVICE PROFILES Logical extraction Physical extraction* File system extraction Extract/disable user lock Total 146 190 137 100 573 v.5.1 8,539 4,444 4,462 2,331 19,776 Total *Including GPS devices The number of unique mobile devices with passcode capabilities is 3,558 Physical extraction while bypassing user lock and decoding support for 3 Nokia 105 devices, including RM-1133, RM-1134 and RM-1135.
7
Embed
RELEASE NOTES UFED TOUCH, UFED 4PC, UFED … · HIGHLIGHTS DEVICE SUPPORT Cellebrite introduces physical extraction while bypassing user lock for 22 Samsung Galaxy devices including
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
HIGHLIGHTS
DEVICE SUPPORT
◼ Cellebrite introduces physical extraction while bypassinguser lock for 22 Samsung Galaxy devices including Galaxy S6, S6 Edge and Note 5 – with forensic recovery partition.
◼ A unique lock-bypassing method that allows physicalextraction of more than 140 LG models, including 22 previously-unsupported models, such as the MS330 and VS880. This method additionally allows the removal and restoration of the user screen lock.
◼ A unique user screen lock removal method supporting137 Samsung device (for some devices, there is more than 1 method).*
◼ First in Industry – Physical extraction while bypassinglock and decoding support for 19 Huawei devices.
◼ A unique user screen lock removal method supporting17 selected LG devices, including the G5.
◼ Cellebrite introduces physical extraction while bypassinguser lock as well as decoding support for 3 Nokia 105 devices: RM-1133, RM-1134 and RM-1135. You are required to use cable 153 in order to perform this type of extraction.
* This method is expected to unlock all Samsung devices last updated before October 2015. This roughly correlates to Android 5.1.1 releases, however there may be exceptions.
APPS SUPPORT
◼ New applications for iOS and Android devices: Don’t Touch This (iOS), HereMaps (Android), HideSMS (Android), Hot or Not, Kakao Story, Mappy (Android), Meet24, MeetMe, Nike+ Running, Scruff (Android), SpringPad FlipNote (iOS) and TextMe.
◼ 183 updated application versions.
FUNCTIONALITY
◼ Improved performance for image thumbnails. ◼ Improved performance for unallocated carving. ◼ Enhanced Application Usage. ◼ Cell Towers information. ◼ WhatsApp decryption support for older BlackBerry devices.
Cellebrite introduces physical extraction while bypassing user lock for Samsung Galaxy S6, S6 Edge and Note 5.
Known for its breakthroughs in mobile data technology, Cellebrite is the industry’s leader – delivering comprehensive and innovative solutions for mobile forensics. Staying true to our vision, UFED 5.1 introduces unique and exclusive capabilities, providing unmatched access to case-critical evidence.
EXCLUSIVE - ONLY AT CELLEBRITE:
A unique lock-bypassing method that allows physical extraction of more than 140 LG models, including 22 previously-unsupported models, such as the MS330 and VS880.
A user screen lock removal method supporting 137 Samsung devices.
Physical extraction while bypassing user lock and decoding support for 19 Huawei devices.
A user screen lock removal method supporting 17 selected LG devices, including the G5.
FORENSIC DEVICE PROFILESLogical extraction
Physical extraction*
File system extraction
Extract/disable user lock
Total
146
190
137
100
573
v.5.1
8,539
4,444
4,462
2,331
19,776
Total
*Including GPS devicesThe number of unique mobile devices with passcode capabilities is 3,558
Physical extraction while bypassing user lock and decoding support for 3 Nokia 105 devices, including RM-1133, RM-1134 and RM-1135.
Cellebrite Release Notes | v5.1 | June 2016 | 2
◼ Improved performance for image thumbnails – Creationand presentation of images and video thumbnails has been drastically improved. Version 5.1 now provides you with a faster and more efficient examination of media files.
◼ Improved performance for unallocated carving – Theunallocated carving time has significantly decreased, providing you with the fastest decoding time – than ever before. Note: the number of items recovered might be reduced compared to previous version due to reduction if the number of false positive items.
◼ Gain access to wireless network locations – Additionallocation events can now be recovered from Android devices. These location events include timestamps, network names (SSID) and basic service set identifier (BSSID) information. SSID is the name of the WLAN network Name and the BSSID represents the wireless network MAC address (can be converted to a physical location).
◼ Enhanced Application Usage – To help you analyze the usageof applications, version 5.1 has now added identifier and action identifier information. In addition, start time and end time of usage were added, indicating the total usage time of any app.
◼ Cell Towers information – Cell Towers information, includingcell ID is now presented under a new node/model – located in the project tree.
◼ WhatsApp decryption support for older BlackBerry devices- In many instances, we were unable to decrypt WhatsApp databases with older versions of BlackBerry devices. This was because one of the keys, which is essential to the decryption process, was missing. The key can now be recovered using
UFED PHYSICAL ANALYZER AND UFED LOGICAL ANALYZER FUNCTIONALITY
SOLVED ISSUES
◼ A decoding issue with Samsung Gt-E1200i device hasbeen resolved.
◼ An issue with media files decoding of Moto xt1080 JTAGextraction has been resolved.
◼ When opening a UFDX file created using UFED PhysicalAnalyzer, absolute paths were presented. This issue is now resolved, presenting relative paths.
◼ A decoding issue of notes items for an iPhone 6S devicerunning OS 9.3 specific has been resolved.
◼ A decoding issue of Nokia C2-01 (RM-721) has been resolved. The decoding process can now successfully complete.
◼ A decoding issue of SMS messages and call logs forSamsung GT-B3210 device has been resolved.
◼ A decoding issue of BlackBerry dump (.bbb) file has been resolved.
◼ A decoding issue with Nokia Asha 206.1 (RM873) hasbeen resolved.
◼ A decoding of TextNow application, version 4.4.37, for iOSdevices has been resolved.
◼ A decoding issue of Whisper application, version 5.9.0, forAndroid devices has been resolved.
◼ An issue with call logs for pay phone appears asoriginating in number ‘-3’. This issue is now resolved, presenting the accurate participant information.
CELLEBRITE INTRODUCES PHYSICAL EXTRACTION WHILE BYPASSING USER LOCK FOR SAMSUNG GALAXY S6, S6 EDGE AND NOTE 5Cellebrite introduces physical extraction while bypassing user lock for 22 Samsung Galaxy devices including Galaxy S6, S6 Edge and Note 5 – with forensic recovery partition.
The latest version replaces the device’s original recovery partition with Cellebrite’s custom forensic recovery – based on TWRP (Team Win Recovery Project). Cellebrite’s recovery image prevents any modifications to user data, maintaining a forensically sound extraction. It is recommended to use the Forensic Recovery Partition method when other physical extraction methods (e.g., Bootloader) are not successful, or unavailable (i.e. if the Android’s firmware version is not supported).
Note: This capability does not currently support Android 6 and requires the device’s bootloader to be unlocked (usually associated with FRP) in order to flash the recovery partition. Devices with a locked bootloader or other such scenarios that are not compatible with Cellebrite’s recovery partition may be unlocked through CAIS. For more information click here or contact support at [email protected].
If the device does not have a screen lock, or if the lock can be disabled via a Cellebrite method, you should unlock the bootloader (usually associated with FRP): Under Settings > Developer options > Enable OEM unlock > Turn on OEM unlock. This setting may not be available on all specific versions of the operating system.
Cellebrite is proud of its unmatched, industry-leading research efforts, resulting in a constant stream of innovative methods and world-unique capabilities provided exclusively to Cellebrite customers. These methods enable physical extractions and lock bypasses on the most recent flagship smartphones, as well as many popular feature phones. For early access to cutting-edge, unpublished lab capabilities contact CAIS.
a short procedure and it can be loaded into UFED Physical Analyzer to complete the decoding process.
◼ New offline map packages – New offline map packages arenow available for Argentina, Brazil and Chile.
APP SUPPORTApps provide a rich source of data to investigations. Cellebrite keeps you ahead by providing support for the highest number of 3rd party applications in the industry running on iOS, Android, Windows Phone and BlackBerry devices.
iOSApplication Type Decoding FeatureDon't Touch This Media tools Photos, videos, notes, contacts, visited Pages
and password Hot or Not Game User account and contactsKakao Story Social PasswordsMeet24 Social User account and passwordMeetMe Social User account, contacts and chatsNike+ Running Health & Fitness Locations, notes and user accountSpringPad FlipNote
Tools Calendar entries
TextMe Communication User account, contacts and calls
ANDROIDApplication Type Decoding FeatureHereMaps Navigation LocationsHideSMS Media tools Chats, user account and passwordHot or Not Game Contacts and chatsKakao Story Social Contacts and user accountMappy Navigation Locations and searched itemsMeet24 Social User account and passwordMeetMe Social ContactsNike+ Running Health & Fitness Locations, notes and user accountScruff Social User account, contacts, chats and locationTextMe Communication User account
UFED CLOUD ANALYZER 3 MONTH FREE TRIALSign up today and solve more cases with UFED Cloud Analyzer. This limited time offer is available between March 15 - June 15, 2016.
In UFED Physical Analyzer version 5.0, you can now gain insights to data that can be extracted using UFED Cloud Analyzer.
iOS: NEW AND UPDATED APPS8 NEW Apps 100 UPDATED Apps
NEW FARADAY BAGWe have launched a new faraday bag with new and improved attenuation and shielding capabilities. Please do not crumple the bag for this may reduce the shielding effect.
ANDROID: NEW AND UPDATED APPS10 NEW Apps 83 UPDATED Apps
For 17 selected LG Android devices (Unique to Cellebrite)
LG CDMA AS375, VK815 G Pad X, AS992 G5
LG GSM LGL24 au isai, H221g Joy, K371 Phoenix 2, H340n Leon, H345, D290n L Fino, MS395 Optimus F60, LG V520 G Pad X 8.0, H525n G4c, H820 G5, H830 G5, H860 G5, H900 V10, K428
DISABLE USER LOCK CAPABILITY
For 137 Samsung devices (Unique to Cellebrite)
AU SCL21 Galaxy S
Samsung CDMA SCL21 Galaxy S III, SCH-i535 Galaxy S III, SCH-i545L Galaxy S4, SCH-i605 Galaxy Note II, SCH-I739 Galaxy Trend II Duos, SPH-L710 Galaxy S III, SCH-R760 Galaxy S II, SCH-R760X Galaxy S II, SM-T817V Galaxy Tab S2, SGH-M819N Galaxy Mega, SPH-M830 Galaxy Rush, SCH-I829 Galaxy Style Duos, SPH-M840, SCH-I869 Galaxy Win, SM-G900R7 Galaxy S5, SPH-L600 Galaxy Mega, SM-G920P Galaxy S6, SM-G920V Galaxy S6, SM-G925R7 Galaxy S6 Edge, SM-G925V Galaxy S6 Edge, SCH-I925 Galaxy Tab 10.1 Note, SCH-I939D Galaxy S III, SPH-M950 Galaxy Reverb, SCH-P709 Galaxy Mega 5.8, GT-P3113TS Galaxy Tab 2 7.0, SM-G3509I Galaxy Trend 3, GT-S6812i Galaxy Fame, SM-G3819D Galaxy Win Pro