UFED Touch/4PC , UFED Physical/Logical Analyzer

Transcription

NOW SUPPORTING
17,135
DEVICE PROFILES
+968 APP VERSIONS
RELEASE NOTES
Version 4.2.6 | August 2015
UFED TOUCH/4PC
UFED PHYSICAL/LOGICAL ANALYZER
UFED INFIELD KIOSK
EXCLUSIVE! NEW PHYSICAL EXTRACTION SUPPORT
Physical extraction using an enhanced
bootloader method now supports the latest
firmware running Android 5.x on 72 Samsung
Android devices for selected chipsets including:
Chipset MSM8974
SM-G900V Galaxy S5, SM-G9008W Galaxy S5
Duos, SM-G860P Galaxy S5 Sport, SM-T525
Galaxy Tab Pro 10.1, SM-G900P Galaxy S5,
SM-N900V Galaxy Note 3, SM-G900A Galaxy S5,
SM-G900F Galaxy S5, SM-G900T Galaxy S5 and
SM-N900T Galaxy Note 3
Chipset QC8916
SM-A300F Galaxy A3, SM-A500F Galaxy A5 and
SM-E700F Galaxy E7
Chipset APQ8084
SM-N915V Galaxy Note Edge, SM-N910A Galaxy
Note 4 and SM-N910T Galaxy Note 4
Chipset MSM8226
SM-T537A Galaxy Tab 4, SM-G710 Galaxy Grand
2, SM-G7102 Galaxy Grand 2 and SM-G7106
Galaxy Grand 2
FORENSIC DEVICE PROFILES
v.4.2.6
Total
Logical extraction
188
7,605
Physical extraction*
100
3,794
File system extraction
126
3,586
Extract/disable user lock
38
2,150
452
17,135
Total
The number of unique mobile devices
with passcode capabilities is 3,137
*Including GPS devices
NEW DECODING METHOD FOR WHATSAPP DATA
Extract the WhatsApp key (on non-rooted
Android devices), when a file system Android
backup extraction was performed to decode the
WhatsApp data via UFED Physical Analyzer.
HIGHLIGHTS
DEVICE SUPPORT
FUNCTIONALITY
◼◼ Physical extraction using an enhanced bootloader method
now supports the latest firmware running Android 5.x on
72 Samsung Android devices for selected chipsets.
◼◼ Physical extraction while bypassing lock for the latest firmware
up to Android 5.1, using the forensic recovery partition method.
This includes Samsung Galaxy S4.
◼◼ Logical extraction is now more comprehensive than ever!
Extract even more apps data from more devices up to Android
5.1. Enhanced applications data extraction up to iOS version (8.4).
◼◼ Physical extraction and decoding support for Nokia 108.
◼◼ Extraction of multimedia via Bluetooth from Android devices.
◼◼ Physical extraction while bypassing lock from LG devices
UFED InField Kiosk:
including E960 Nexus 4 and LG F260s Optimus LTE III.
APPS SUPPORT
◼◼ New applications for iOS and Android devices.
◼◼ 90 updated application versions.
◼◼ Now supporting the latest version of the encrypted BBM app
for Android devices with decryption and decoding.
◼◼ Now supporting the latest version of the encrypted
Snapchat app for iOS & Android devices with decryption
and decoding.
◼◼ Decoding of attachments and their metadata information
of the Yahoo Messenger application.
◼◼ Manage customized crime types.
◼◼ Extraction of memory card and USB drives.
◼◼ Application user interface is now available in 24 languages.
UFED Physical/Logical Analyzer:
◼◼ Push notifications support for Android and iOS devices.
◼◼ Color code per project.
◼◼ Indication of the Google Location History setting is now available.
When enabled, it might be obtained using UFED Cloud Analyzer.
◼◼ View extracted user accounts as part of the UFED Cloud
Analyzer account package.
◼◼ Lithuanian, Latvian, Estonian & Arabic interface languages supported.
◼◼ The installed applications table indicates any decoded apps.
◼◼ Location information and Map view in the event’s right pane.
◼◼ Load passwords from file when extraction/application is
encrypted with a password.
◼◼ Device information now presents the device model and
vendor information for Android devices.
◼◼ Generate reports with bookmarks information only.
◼◼ Additional WhatsApp timestamps (read & delivered) for iOS,
Android & BlackBerry 10 devices are now presented in reports.
◼◼ Locations & attachments info in Timeline now presented inreports.
◼◼ Easily open UFDR reports.
HOW SHOULD I PERFORM MY EXTRACTION AND GET THE MOST OF THE DATA?
As an ongoing commitment to our customers, we will continue to provide you with new and great capabilities to perform data
extraction, while avoiding device limitations and extraction challenges.
For many devices, there is more than one data extraction method that you can use. If you sometimes struggle in understanding
what the best data extraction type is, or unsure what data can/can’t be extracted, you don’t need to struggle anymore. We have
now provided you with tips that will help you perform the most effective extraction process, giving you the most data out of
your extraction.
For a better understanding on all our extraction methods, we have added a tool tip information icon. The tool tips provide
information about the possible output data, and limitations available to each extraction type and extraction method. Information will
also be available for every device tool under the Device Tools menu. In addition, to improve the clarity of the extraction process, UFED
now presents the extraction method for every extraction type, even if there is only one method available for selection.
OUR RECOMMENDATION FOR PERFORMING DATA EXTRACTION FROM ANDROID DEVICES
1 Physical extraction using Bootloader method – An extraction method that performs a physical extraction when the device
is in bootloader mode. During extraction, the operating system does not run and therefore, the device cannot connect to
the mobile network. It bypasses any user lock and is forensically sound. The bootloader extraction method does not support
extractions from a memory card.
2 Physical extraction using ADB method – Android Debugging Bridge (ADB) uses a built-in protocol that runs within the
operating system. With this extraction, it is possible to perform a physical or file system extraction, provided that the device’s
USB debugging option is enabled. Some devices with recent Android operating systems prevent UFED from accessing the file
system and reading the application files. For a rooted device, the operating system is not a limitation, and the extraction can
be completed on any Android version. In some cases, data from a memory card will be extracted. However, the recommended
method is to read the card with an external memory card reader.
3 File system extraction using ADB method – This extraction enables the acquisition of the files embedded in the memory
of a mobile device. The file system can contain hidden system files that may not be visible with a logical extraction. Android
Debugging Bridge (ADB) uses a built-in protocol that runs within the operating system. With this extraction, it is possible to
perform a complete file system extraction, provided that the device’s USB debugging option is enabled. Some devices with recent
Android operating systems prevent UFED from accessing the file system and reading the application files. For a rooted device, the
operating system is not a limitation and the extraction can be completed on any Android version.
4 File system extraction using Android Backup method – Android backup communicates with a connected Android device and
extracts data from the device. The data that is extracted is dependent on the device’s specific characteristics. It supports Android
devices with version 4.1 and later. Android Backup may provide less data than other extractions, and therefore, you should use
this extraction when other file system extractions (e.g., ADB) are not successful, or unavailable (e.g., If the Android version is
not supported). Android backup does not support extractions from a memory card.
Cellebrite Release Notes | UFED Touch/4PC , UFED Physical/Logical Analyzer, UFED InField Kiosk v4.2.6 | August 2015 | 2
HOW SHOULD I PERFORM MY EXTRACTION AND GET THE MOST OF THE DATA? (CONT...)
5 Logical including apps data - A quick extraction method that supports the greatest number of mobile devices. The data types
that can be extracted from a source device include: Call logs, phone books, SMSs, calendar events, multimedia files (images,
videos, audio), and apps data. The available types of extracted data may vary depending on the source device manufacturer
and model. In most cases, a logical extraction is not possible for locked devices.
*
If none of the physical methods are working and you need physical extraction (when other physical extraction method extractions
are not successful or not available), perform physical extraction using Recovery Partition method (An extraction method that
performs a physical extraction while the device is in recovery mode. In this extraction method, UFED replaces the device’s
original recovery partition with Cellebrite’s custom forensics recovery partition. The original recovery partition on the Android
device can be considered as an alternative boot partition that may also change user data partitions while Cellebrite’s recovery
partition doesn’t affect any of the user data. It bypasses any user lock and is forensically sound. This extraction does not support
extractions from a memory card and SIM card).
1
Physical Bootloader Method
Is the device locked?
Yes
Disable User Lock
No
2
Physical ADB Method
3
File System ADB Method
4
File System
Android Backup Method
5
Logical Including Apps Data
No physical
method is available
and physical
extraction is
needed
Physical Recovery Partition
Method
APP SUPPORT
Apps provide a rich source of data to investigations.
Cellebrite keeps you ahead by providing support for
the highest number of 3rd party applications in the
industry running on iOS, Android, Windows Phone and
BlackBerry devices.
iOS
ANDROID
◼◼Copy – Decoding of file system and user accounts
◼◼AntiVirus Security (AVG) – Decoding of SMSs
◼◼InstaMessage – Decoding of chats, contacts and user accounts
◼◼InstaMessage – Decoding of chats, contacts and user accounts
◼◼Tinder – Decoding of chats, contacts and and user accounts
◼◼Tinder – Decoding of chats, contacts and and user accounts
◼◼TextSecure – Decoding of chats and contacts
DEVICE SUPPORT
◼◼Physical extraction using an enhanced bootloader method
which supports the latest firmware.
As part of our ongoing effort to provide the best physical
extraction capabilities for the latest Samsung Android devices,
you can now obtain additional data by performing a physical
extraction using the enhanced bootloader method that
supports the latest firmware running Android 5.x on
72 Samsung Android devices, including SM-G900V,SM-G900A,
SM-N900V, SM-N910V,SM-G860P.
◼◼Physical extraction while bypassing lock for the latest
firmware up to Android 5.1, using the forensic recovery
partition method
Following our new physical extraction method capabilities
introduced in version 4.2.2, we have enhanced the device
support coverage and added additional support for 33
Samsung Android devices, including Galaxy S4 and more.
◼◼Logical extraction is now more comprehensive than ever!
Extract even more apps data from more devices up to
Android 5.1.
Today, extraction is done using the Android Backup Services.
When this fails, the extraction process will also fail to complete.
To overcome this known problem, we have improved the
file system extraction process to provide you with the most
successful results for pulling extracted data using the Android
Backup Services. If the extraction of the application fails, the
extraction process will automatically resume, skipping the
problematic application that causes the extraction to fail.
◼◼Enhanced applications data extraction up to the
latest iOS version (8.4)
Now supporting file system and logical extractions of
applications data for iOS devices running up to version OS 8.4.
◼◼Physical extraction and decoding is now supported for the
Nokia 108 mobile device.
◼◼Extraction of multimedia via Bluetooth from
Android devices
You can now get multimedia data when performing logical
extraction via Bluetooth in the generic Android profile,
on prepaid/Tracfone Android devices with damaged or locked
USB ports.
◼◼Physical extraction while bypassing lock from LG devices
Now available for the following devices: E960 Nexus 4,
LG VK810 G Pad 8.3, VS920 Spectrum, F160S Optimus LTE II,
F260S Optimus LTE III, LW-770 Regard, MS-870 and
P870 Escape.
UFED INFIELD KIOSK FUNCTIONALITY
DEVICE SUPPORT
Extract and disable user lock capabilities from more than
250 mobile devices.
MANAGE CUSTOMIZED CRIME TYPES
The crime type value is one of the case information fields
you need to complete when performing a new extraction.
Now you have the ability to manage and customize the
crime type list by adding, editing and deleting new crime
times via the UFED Permission Manager. The permission
management file can then be imported into the UFED InField
Kiosk application.
EXTRACTION OF MEMORY CARD AND USB DRIVES
You can now perform extraction of memory cards and
USB drives.
Note: Decoding is currently not supported via InField Kiosk.
Alternatively, you can use UFED Physical/Logical Analyzer for
decoding and viewing the data.
APPLICATION USER INTERFACE IS NOW AVAILABLE IN
24 LANGUAGES
The UFED InField Kiosk’s user interface is now
available in 24 languages: Chinese (Simplified),
Croatian, Czech, Danish, Dutch, French, German,
Greek, Hindi, Hungarian, Indonesian, Italian, Japanese,
Korean, Norwegian, Polish, Portuguese (Brazil), Portuguese
(Portugal), Russian, Slovak, Spanish, Swedish, Turkish and
Vietnamese. You can select your own preferred display
language from the Application Settings.
Note: The supported languages apply only to the
application user, not the viewer.
NEW DECODING METHOD FOR WHATSAPP DATA
MANUALLY EXTRACTING THE WHATSAPP KEY
This solution enables you to manually extract the WhatsApp key
so that UFED Physical Analyzer can decode the decrypted data.
During the process, the WhatsApp version will be temporary
downgraded to an earlier version, so that the key can be
extracted and used to decode the WhatsApp database.
The current WhatsApp version will be restored at the end
of the extraction process.
Disclaimers:
◼◼This solution utilizes a third-party script for downgrading and
retrieving the decryption key. It is recommended to document
this process during your extraction.
◼◼ A key is always extracted via the script, but it may not work
for decoding the database. We received several reports that
this process did not provide the right key and decryption was
not always possible.
4.Download and extract the batch script from:
http://revskills.de/WhatsAppKeyExtract.zip
5.Browse to the extracted folder and run the
WhatsAppDbExtract.bat file.
6.Connect the device via USB, unlock the screen, and wait
for Full backup to appear (make sure it is recognized by
the computer).
7.Leave the password field blank and when prompted, click
Back up my data.
8.The required key is now stored in the WA_Xtract folder under
the WhatsAppKeyExtractModPS folder.
9.From the main menu in UFED Physical Analyzer, select Plug-ins
and then Run Plug-in.
PREREQUISITES (PC DESKTOP)
◼◼An internet connection.
◼◼Operation systems: Tested on Windows 7 & 8.
◼◼Java installation: If not installed, download and install the
latest version from https://www.java.com/en/download/.
◼◼ADB (Android Debug Bridge) driver installation: If not installed,
download and install from http://forum.xda-developers.com/
showthread.php?t=2588979.
10.Run the Android WhatsApp with the provided key plug-in.
11.Load the extracted key and click OK.
12.When the plug-in completes, the WhatsApp data is
decoded and a file called msgstore.db that appears under
msgstore.db.crypt8.
PREREQUISITES (MOBILE DEVICE)
◼◼Allow USB Debugging on the device (Settings > Developer >
Options > USB Debugging).
◼◼Android operation system of version 4.0 or later.
To extract the WhatsApp key from a file system extraction:
1.Perform a file system Android backup extraction on the
device using UFED Touch/4PC.
2.When prompted, perform an extraction of shared files.
3.Open the extraction using UFED Physical Analyzer and
locate the encrypted msgstore.
db.crypt8 file. It is usually located in
the following folder: /shared/0/
WhatsApp/Databases/msgstore.
db.crypt8
If the extracted key is valid and the decryption completed
successfully, the plug-in will automatically parse the
decrypted information and place it in the Chats tree item
under Analyzed data.
FUNCTIONALITY
Push Notifications support for Android and iOS devices –
More than 52% of users enable push messaging on their
mobile devices*. Push notifications are short messages sent
directly to a user’s mobile device from different applications.
As part of this release, you can now perform extraction and
decoding of notifications information, presented as part of the
Notification node under Analyzed data.
Note: This capability is fully supported for iOS devices.
Android devices are supported for Facebook Messenger only.
Color code per project – When working with multiple projects,
in some cases it is hard to relate the open tab feature to the
relevant project/extraction. With this feature, each tab is shown
with its color and icon (excluding the Welcome page tab).
The marker color and icon signify which project and
information type this tab relates to. You can manage the
color or enable/disable this feature via Settings.
View extracted user accounts as part of the UFED Cloud
Analyzer account package – The account package is an export
file that contains user account information and can be imported
into UFED Cloud Analyzer. You can now view the list of accounts
extracted including data source and account details. This can
be very useful for generating a relevant search warrant. You can
save this information on a text file by clicking the Save button
and share with other investigators and prosecutors as needed.
Note: The account name is displayed if available. The data
sources can all be used in UFED Cloud Analyzer. Multiple entries
for the same data source may relate to different accounts that
were used on the device, or to previous login information for the
same account.
New interface languages support – The UFED Physical
Analyzer and UFED Logical Analyzer user interface is available
in more than 30 different languages. In this release, Lithuanian,
Latvian, Estonian and Arabic are now available as new interface
languages in the UI and output reports. You can easily select
your preferred display language in the Application Settings.
The installed applications table now indicates any
decoded applications – View indications on each decoded
application on the device as part of Installed Applications node
under Analyzed data. You can view or filter for applications
that were handled during the decoding process.
Indication of the Google Location History setting
is available – Google Location History is a service used by
Google to provide historical location information based on
recommendations to their users. Once the Google user
opts into the location history service, Google frequently
collects location information from the device the user is using,
(mobile/PC) and stores it in the Google cloud servers. The setting
value can be found under Device info in UFED Physical Analyzer.
When this setting value is turned on using UFED Cloud Analyzer,
you could gain access to this valuable data which is only stored
on the Google cloud servers. This information is not available on
the mobile device, and therefore not available through mobile
device extraction.
*Source: Localytics http://info.localytics.com/blog/52-percent-of-usersenable-push-messaging
FUNCTIONALITY (CONT...)
Location info and map view in event’s right pane – For any
event with locations information, you can now view the location
on the map control in the right pane.
Load passwords from file when extraction/application
is encrypted with password – For cases when the
data is encrypted, today you only have the option to enter
the password. There are cases when the password is unknown;
but now you have the option to load passwords from a text
file (dictionary). The file must include a list of possible
passwords, with each password on a separate line. This feature
is supported in the following cases: BlackBerry encrypted
content, BlackBerry password keeper, Apple encrypted iTunes
backup, Android encrypted ADB backup, Android encrypted
memory and TextSecure.
Device information now presents the device model and
vendor information for Android devices – View the model
and vendor information of Android devices under device info.
TRAINING
Cellebrite’s world-class certification training is now
available online. Save time and money! Learn at your
own pace and from the convenience of your own desk.
AVAILABLE ONLINE COURSES
Cellebrite Mobile Forensic
Fundamentals (CMFF)
Course – Entry
https://www.cellebritelearningcenter.
com/course/preview.php?id=40
REPORTS
Generate reports with bookmarks information only – In
some cases, you may only need to create a report with your
bookmark items. In this version, we have provided you with the
ability to generate reports with all the bookmark items selected.
Cellebrite Certified Logical Operator
(CCLO) Course – Intermediate
Additional WhatsApp timestamps (read and delivered) for
iOS, Android and BlackBerry 10 devices are now presented
in reports – In WhatsApp chat messages, you can view the Read,
Delivered and Played timestamps of outgoing messages. This is
also available now in all report output formats.
Cellebrite Certified Physical Analyst
(CCPA) Course – Advanced
During your investigation, this information may be valuable.
Delivered and Read messages can indicate that the recipient
most likely received and read the messages. When there is a
gap between the sent timestamp to delivered timestamp, it may
indicate that the recipient’s device was not connected, closed or
located in a position with no signal.
Locations and attachments information in Timeline are now
presented in reports – Locations and attachments associated
to events in the timeline view are now also included in the
report output.
Easily open UFDR reports – You can now easily open UFDR
reports with the UFED Reader executable file, located in the
report output folder. Simply open the UFED Reader and the
report will automatically load and open.
NEW FROM CELLEBRITE ADVANCED
INVESTIGATIVE SERVICES (CAIS)
Unlock iOS devices running iOS 8.3, 8.4 and 8.4.1 with no risk
of device wipe. For further details on this new service, please
contact us here.
SOLVED ISSUES
◼◼ “From” data is now shown for MMS messages in
Conversation View.
◼◼ The project session now successfully loads when
reopening an extraction.
◼◼ If you previously encountered errors while performing an
extraction from an iPhone 5 (A1429), you can now
complete the extraction without any errors.
◼◼ Decoding of file system extraction using ADB Backup
method from Samsung SM-V700 is now available.
◼◼ The web bookmarks of Google Chrome are now
presented correctly in Japanese.
◼◼ Opening an iTunes Backup folder containing Apple maps
is now available without any errors.
◼◼ A numerical issue with images within an excel report
output has now been resolved.
iOS: NEW AND UPDATED APPS
ANDROID: NEW AND UPDATED APPS
3 NEW Apps
Copy 3.2.1, InstaMessage 2.1.5, Tinder 4.4.6
4 NEW Apps
AntiVirus Security (AVG) 4.4.1.1, InstaMessage 1.8.8, TextSecure
2.12.0, Tinder 4.1.2
49 UPDATED Apps
36 UPDATED Apps
Any.DO
3.2.1.2
Badoo
4.0.2
Any.DO
3.4.1.4
BeeTalk
1.4.33
Badoo
4.5.2
Ctrip
3
BeeTalk
2.0.8
Chrome
43.0.2357.56
Chrome
43.0.2357.93
Dropbox
3.9.1
Ctrip
3
Evernote
7.0.4.1, 7.7.7
Evernote
7.0.4.1
Facebook
31
Facebook
35.0.0.48.273
Foursquare
9.1
Facebook Messenger
29.0.0.44.279
Google Maps
4.7.0
FireChat
6.0.5
Google+
4.8.4.51573
Firefox
38.0.5
ICQ
5.8.1
Gmail
5.3.95312851
Instagram
6.14.0
Go SMS Pro
6.28
KakaoTalk
5.0.0
Google Maps
9.10.1
KeepSafe
5.4.5
Google+
5.7.0.95864644
Kik Messenger
8.4.0
Instagram
6.23.0
LinkedIn
8.7
KakaoTalk
4.8.4
Mail.Ru
5.3.1.11731, 5.3.1
Kik Messenger
8.4.0.877
Navitel Navigator
9.5.399
LINE
5.2.0
Nimbuzz
4.0.1
LinkedIn
3.5
Odnoklassniki
5.3
Mail.Ru
3.1.0.10570
ooVoo
2.5.1
Odnoklassniki
4.2.3
Opera Mini
10.1.1.92212
ooVoo
2.5.2
Path
4.3.3
Opera Mobile
30.0.1856.92967
QQ
5.6.0
QQ
5.6.1
Skype
5.13.0.496, 5.13.1
Skype
5.4.0.4165
Snapchat
9.9.0
Snapchat
9.9.0.0
Tango
3.17.158984
Tango
3.17.159863
Telegram Messenger
2.14
Telegram Messenger
2.9.1
TigerText
5.2.3
Truecaller
5.5
TrueCaller
5.31
Twitter
5.63.0
Tumblr
4.1
UC Browser
10.5.0
Twitter
6.29
Viber
5.4.1.365
Twitterrific
5.12
Voxer
2.6.3.014555
UC Browser+
10.5.0.591
WeChat
6.2.0.54
Viber
5.4
WhatsApp
2.12.124
VKontakte
2.2.1
YouTube
10.21.58
Voxer
3.9.4
Waze
3.9.6.1, 3.9.6
WeChat
6.2.0
WINDOWS PHONE: NEW AND UPDATED APPS
WhatsApp
2.12.3
2 UPDATED Apps
Whisper
4.6.4
Yik Yak
2.7.1
Yandex Mail
2.08
Yahoo Mail
3.2.18
Odnoklassniki
3.4.7.0
WhatsApp
2.12.72.0
BLACKBERRY: NEW AND UPDATED APPS
4 UPDATED Apps
BBM
10.9.5.22
Evernote
5.7.0.1010
Facebook Messenger
10.7.31.9
Skype
5.4.0.5191
PHYSICAL EXTRACTION WHILE BYPASSING LOCK
Samsung GSM
(cont...)
GT-I9505G Galaxy S4 Google Edition, SHV-E330S
Galaxy S4 LTE-A, GT-i9508V Galaxy S4, SM-T211
Galaxy Tab 3 7.0, SM-T210 Galaxy Tab 3 7.0
130 NEW devices supported
PHYSICAL EXTRACTION
Bootloader
Alcatel
OT-255, 319 One Touch BIC V4, OT-C701
HTC
PL80100 One SV
Kyocera
S2300 Torino
LG CDMA
LG-VN170 Revere 3, LG-VN210 Terra, VN370,
VK810 G Pad 8.3, LG-AS991 G4
LG GSM
LGL24 au isai, LG-F370K F70, LG-H340n Leon,
D290g L70+ L Fino, LG-V400 G Tablet 7.0, LGD400hn L90, LG-H422 Spirit, LG-F460L G3 Cat.6,
LG-V480 G Tablet 8.0, LG-V490 G Tablet 8.0 4G,
LG-V495 G Pad F 8.0, LG-D625 G2 Mini, LG-V700
G Tablet 10.1, LG-D855P G3, E960 Nexus 4, F160S
Optimus LTE II, F260S Optimus LTE III, P870
Escape
Samsung CDMA
Samsung GSM
Sony (SonyEricsson)
SM-G900V Galaxy S5, SM-G860P Galaxy S5 Sport,
SM-G360P Galaxy Core Prime, SM-N910P Galaxy
Note 4, SM-N915V Galaxy Note Edge, SM-N915P
Galaxy Note Edge, SM-P605V Galaxy Note 10.1,
SM-G900R7 Galaxy S5, SM-G900P Galaxy S5,
SM-G900T1 Galaxy S5, SM-N900P Galaxy Note 3,
SM-N900V Galaxy Note 3, SM-N900R4 Galaxy Note
3, SM-P905V, SPH-M910 Intercept(Virgin), VS920
Spectrum, LW-770 Regard, MS-870
GT-i9508V Galaxy S4, SM-G9008W Galaxy S5 Duos,
SM-G870W Galaxy S5, SM-G900M Galaxy S5, SMP905 Galaxy Note Pro 12.2, SM-N9008S Galaxy
Note 3, SM-P607T Galaxy Note 10.1, SM-T325
Galaxy Tab Pro 8.4, SM-T525 Galaxy Tab Pro 10.1,
SM-A300F Galaxy A3, SM-A300FU Galaxy A3, SMA500F Galaxy A5, SM-E500M Galaxy E5, SM-E700F
Galaxy E7, SM-G7508Q Galaxy Mega 2, SM-G901F
Galaxy S5 Plus, SM-G906L Galaxy S5 LTE-A, SMG906K Galaxy S5 LTE-A, SM-N910A Galaxy Note
4, SM-N910G Galaxy Note 4, SM-N910F Galaxy
Note 4, SM-N910W8 Galaxy Note 4, SM-N910T
Galaxy Note 4, SM-N910R4 Galaxy Note 4, SMN915A Galaxy Note Edge, SM-N915F Galaxy Note
Edge, SM-N915FY Galaxy Note Edge, SM-N9109W
Galaxy Note 4, SM-N915W8 Galaxy Note Edge,
SM-N9100 Galaxy Note 4, SM-N9108V Galaxy Note
4, SM-T537A Galaxy Tab 4, SM-G710 Galaxy Grand
2, SM-G7102 Galaxy Grand 2, SM-G7106 Galaxy
Grand 2, GT-i9506 Galaxy S4, SGH-N075T Galaxy J,
SHV-E330S Galaxy S4 LTE-A, SHV-E470S Galaxy S4
Active, SM-N750S Galaxy Note 3 Neo, SM-G870A
Galaxy S5 Active, SM-G900A Galaxy S5, SM-G900F
Galaxy S5, SM-G900i Galaxy S5, SM-G900T Galaxy
S5, SM-G900W8 Galaxy S5, SM-N900K Galaxy
Note 3, SM-N900U Galaxy Note 3, SM-N9008V
Galaxy Note 3, SM-N900W8 Galaxy Note 3, SMN900S Galaxy Note 3, SM-N900T Galaxy Note 3,
SM-G9008V Galaxy S5, SM-G9009D Galaxy S5, SMG910S Galaxy Round, SM-N9002 Galaxy Note 3
Duos, SM-N9005 Galaxy Note 3, SM-N9006 Galaxy
Note 3, SM-B310E Guru Music 2, SHV-E310S
Galaxy Mega,
Alcatel
OT-255, 319 One Touch BIC V4, OT-510APIB One
Touch 510A, OT-C701, 4033A One Touch Pop C3,
5036A One Touch Pop C5, 6040D One Touch Idol
X, 7041X One Touch Pop C7, 6050Y Infinity X2\One
Touch Idol 2S
BLU
D171a Dash 3.5
Dopod
D. S900 Touch Diamond
Fly
Ezzy 4, DS115, E200, IQ442 Quad
HTC
T828X Touch HD, PL80100 One SV
Huawei
Y320-U151 Ascend, G535-L11 Kestrel EE,
G610-U20 Ascend G610
IUSACELL
M8047IU Dilo
Kyocera
S2300 Torino
LG CDMA
VK810 G Pad 8.3, LG-AS991 G4, VS-920 Spectrum,
LG GSM
LG-V495 G Pad F 8.0, LG-E612g Optimus L5, LGD625 G2 Mini, LG-V700 G Tablet 10.1, LG-P768g
Optimus L9, LG-D855P G3, T5100, G7200
Meizu
MX3 M351
Motorola GSM
XT919 RAZR D3
Nokia GSM
108 (RM-944), 108 (RM-945), 110 (RM-827), 3711a1 Cooper (RM-511)
Pantech
IM-A870L VEGA Iron
Philips
W732 Xenium
Samsung CDMA
SPH-M910 Intercept(Virgin), SM-G360P Galaxy
Core Prime, SM-N910V Galaxy Note 4, SM-N910P
Galaxy Note 4, SM-N915V Galaxy Note Edge, SMN915P Galaxy Note Edge, SM-G925P Galaxy S6
Edge, SM-G925R7 Galaxy S6 Edge
Samsung GSM
SM-B310E Guru Music 2, SHV-E310S Galaxy Mega,
SHV-E330L Galaxy S4 LTE-A, SM-G386W Galaxy
Core LTE, SM-P607T Galaxy Note 10.1, SM-N9008S
Galaxy Note 3, SM-G9008V Galaxy S5, SGH-I908E,
SGH-I908L, SM-N915F Galaxy Note Edge, C3510
Corby Pop, SM-G3815 Galaxy Express 2, GT-I8190L
Galaxy S III Mini, SM-N9109W Galaxy Note 4, GTI9515L Galaxy S4, SM-T325 Galaxy Tab Pro 8.4,
SM-A300F Galaxy A3, SM-A300FU Galaxy A3 LTE,
SM-A500F Galaxy A5, SM-E500F Galaxy E5, SME500M Galaxy E5, SM-E700F Galaxy E7, SM-G710
Galaxy Grand 2, SM-G7102 Galaxy Grand 2, SMG7106 Galaxy Grand 2, SM-G7508Q Galaxy Mega
2, SM-G906L Galaxy S5 LTE-A, SM-G920T Galaxy
S6, SM-G925F Galaxy S6 Edge, SM-G925i Galaxy
S6 Edge, SM-G925T Galaxy S6 Edge, SM-P905
Galaxy Note Pro 12.2, SM-N910A Galaxy Note 4,
SM-N910R4 Galaxy Note 4, SM-N915A Galaxy Note
Edge, SM-N915FY Galaxy Note Edge, GT-C3510
Genoa, GT-S5330 Wave 533, GT-S5380D Wave Y,
GT-S8500M Wave, SM-N915W8 Galaxy Note Edge,
GT-i9508V Galaxy S4
SFR
StarTrail III by SFR
Sonim
XP7700 XP7
Sony (SonyEricsson)
J105a, J105i, C1904 Xperia M, D5306 Xperia T2
Ultra, D5503 Xperia Z1
ZTE GSM
V829 Blade G Plus, S218
J105a, J105i
Recovery Partitions
Samsung CDMA
SCH-i545 Galaxy S4, SCH-R970 Galaxy S4, SCHR970C Galaxy S4, SCH-R970X Galaxy S4, SPH-L720
Galaxy S4, SPH-L720T Galaxy S4, SCH-i959 Galaxy
S4, SCH-i545L Galaxy S4, SGH-i337M Galaxy S4,
SHV-E330L Galaxy S4 LTE-A
Samsung GSM
SGH-i337 Galaxy S4, GT-I9505G Galaxy S4 Google
Edition, GT-i9500 Galaxy S4, SGH-i537 Galaxy S4
Active, SGH-M919 Galaxy S4, SGH-M919N Galaxy
S4, GT-I9295 Galaxy S4 Active, SHV-E300K Galaxy
S4, SHV-E300S Galaxy S4, SHV-E300L Galaxy S4,
GT-I9515 Galaxy S4, GT-i9506 Galaxy S4, SHVE470S Galaxy S4 Active,
PHYSICAL EXTRACTION
FILE SYSTEM EXTRACTION
Alcatel
OT-255, 319 One Touch BIC V4, OT-510APIB One
Touch 510A, OT-C701, 4033A One Touch Pop C3,
5036A One Touch Pop C5, 6040D One Touch Idol
X, 7041X One Touch Pop C7, 6050Y Infinity X2\One
Touch Idol 2S
Alcatel
BLU
D171a Dash 3.5
Dopod
D. S900 Touch Diamond
Orange Nura, OT-510APIB One Touch 510A, 4033A
One Touch Pop C3, 5017B One Touch, 5036A One
Touch Pop C5, 5042X Orange Roya, 6040D One
Touch Idol X, 6043A One Touch Idol X+, 7040A One
Touch Pop C7, 7040T One Touch Pop Icon, 7041X
One Touch Pop C7, 7046T Conquest, 9006W One
Touch Pixi 7
Fly
Apple
iPod Nano Touch 6G
HTC
T828X Touch HD, PL80100 One SV
BLU
D171a Dash 3.5
Huawei
Y320-U151 Ascend, G535-L11 Kestrel EE,
G610-U20 Ascend G610
Coolpad
3320A
Fly
IUSACELL
M8047IU Dilo
HTC
Kyocera
S2300 Torino
LG CDMA
VK810 G Pad 8.3, LG-AS991 G4, VS-920 Spectrum,
OPKX210 Desire 626, 0PFH1 Desire EYE, 0PCV220
Desire 510, 0PM912, PL80100 One SV, 0PM9110
Desire 626s
Huawei
LG GSM
LG-V495 G Pad F 8.0, LG-E612g Optimus L5, LGD625 G2 Mini, LG-V700 G Tablet 10.1, LG-P768g
Optimus L9, LG-D855P G3, T5100, G7200
PE-CL00 Honor 6 Plus, MT7-UL00 Ascend Mate
7, GL07S STREAM X, Y221-U03 Ascend, H60-L01
Honor 6, Y320-U151 Ascend, Y520-U03 Ascend,
G535-L11 Kestrel EE, G610-U20 Ascend G610
IUSACELL
M8047IU Dilo
Kyocera
S2300 Torino, C6740, C6740N Hydro Wave, C6745
LG CDMA
LG-VN170 Revere 3, VK810 G Pad 8.3, LG-AS991
G4
LG GSM
LGL24 au isai, LG-H735L G4 Beat, LG-D120 L30
Sporty, LG-F370K F70, LG-H340n Leon, D290g
L70+ L Fino, LG-V400 G Tablet 7.0, LG-D400hn
L90, LG-H422 Spirit, LG-F460L G3 Cat.6, LG-V480
G Tablet 8.0, LG-V490 G Tablet 8.0 4G, LG-V495 G
Pad F 8.0, LG-E612g Optimus L5, LG-D625 G2 Mini,
LG-V700 G Tablet 10.1, LG-P768g Optimus L9, LGD855P G3, LG-V930
Chinese Android
phones
Fake Xiaomi HM NOTE 1TD, Aqua T4, Fake Xiaomi
MI-4LTE
Meizu
MX3 M351
Microsoft
Lumia 640 (RM-1072)
Motorola CDMA
XT1096 Moto X, XT1548 Moto G
Motorola GSM
XT919 RAZR D3, XT1063 Moto G, XT1064 Moto
G 2nd Gen, XT1068 Moto G, XT1092 Moto X 2nd
Gen, XT1096 Moto X, XT1514 Moto E 2'nd Gen
Dual, XT1078 Moto E 2'nd Gen Dual
Nokia GSM
Lumia 720 (RM-885), 109 (RM-907), 3120 Classic
Pantech
IM-A870L VEGA Iron
Philips
W732 Xenium
Samsung CDMA
SM-G530P Galaxy Grand Prime, SM-T567V Galaxy
Tab E 9.6, SM-N920P Galaxy Note 5, SM-G928P
Galaxy S6 edge Plus
Samsung GSM
SM-G355H Galaxy Core 2 Duos, SM-J100F Galaxy
J1, SHV-E310S Galaxy Mega, SM-G316M Galaxy
Ace 4, SHV-E330L Galaxy S4 LTE-A, SM-G350E
Galaxy Star 2 Plus, SM-G360T Galaxy Core Prime,
SM-G360T1 Galaxy Core Prime, SM-G386W
Galaxy Core LTE, SM-G388F Galaxy Xcover 3, Fake
Samsung SM-A500F Galaxy A5, SM-G530T Galaxy
Grand Prime, SM-T531 Galaxy Tab 4 10.1, SMP607T Galaxy Note 10.1, SM-T817A Galaxy Tab S2,
SM-N9008S Galaxy Note 3, SM-G9008V Galaxy S5,
SM-N915F Galaxy Note Edge, SM-N920A Galaxy
Note 5, SM-G928A Galaxy S6 edge Plus, SM-G3815
Galaxy Express 2, GT-I8190L Galaxy S III Mini, Fake
Samsung GT-N9006 Galaxy Note 3, SM-N9109W
Galaxy Note 4, SM-G920W8 Galaxy S6, GT-i9300i
Galaxy S III Neo, GT-i9300i Galaxy S III Neo+, GTI9515L Galaxy S4, GT-S5233W Star, GT-S5233S
Star, GT S7710 Skomer Galaxy Xcover 2
Sonim
XP7700 XP7
Sony (SonyEricsson)
C1904 Xperia M, E2303 Xperia M4 Aqua, D5306
Xperia T2 Ultra, C6502 Xperia ZL, C5302 Xperia SP
VIVO
X3L
Verizon
QTAQZ3 Ellipsis 8
Meizu
MX3 M351
Motorola GSM
XT919 RAZR D3
Nokia GSM
108 (RM-944), 108 (RM-945), 110 (RM-827), 3711a1 Cooper (RM-511)
Pantech
IM-A870L VEGA Iron
Philips
W732 Xenium
Samsung CDMA
SPH-M910 Intercept(Virgin), SM-G360P Galaxy
Core Prime, SM-N910V Galaxy Note 4, SM-N910P
Galaxy Note 4, SM-N915V Galaxy Note Edge, SMN915P Galaxy Note Edge, SM-G925P Galaxy S6
Edge, SM-G925R7 Galaxy S6 Edge
Samsung GSM
SM-B310E Guru Music 2, SHV-E310S Galaxy Mega,
SHV-E330L Galaxy S4 LTE-A, SM-G386W Galaxy
Core LTE, SM-P607T Galaxy Note 10.1, SM-N9008S
Galaxy Note 3, SM-G9008V Galaxy S5, SGH-I908E,
SGH-I908L, SM-N915F Galaxy Note Edge, C3510
Corby Pop, SM-G3815 Galaxy Express 2, GT-I8190L
Galaxy S III Mini, SM-N9109W Galaxy Note 4, GTI9515L Galaxy S4, SM-T325 Galaxy Tab Pro 8.4,
SM-A300F Galaxy A3, SM-A300FU Galaxy A3 LTE,
SM-A500F Galaxy A5, SM-E500F Galaxy E5, SME500M Galaxy E5, SM-E700F Galaxy E7, SM-G710
Galaxy Grand 2, SM-G7102 Galaxy Grand 2, SMG7106 Galaxy Grand 2, SM-G7508Q Galaxy Mega
2, SM-G906L Galaxy S5 LTE-A, SM-G920T Galaxy
S6, SM-G925F Galaxy S6 Edge, SM-G925i Galaxy
S6 Edge, SM-G925T Galaxy S6 Edge, SM-P905
Galaxy Note Pro 12.2, SM-N910A Galaxy Note 4,
SM-N910R4 Galaxy Note 4, SM-N915A Galaxy Note
Edge, SM-N915FY Galaxy Note Edge, GT-C3510
Genoa, GT-S5330 Wave 533, GT-S5380D Wave Y,
GT-S8500M Wave, SM-N915W8 Galaxy Note Edge,
GT-i9508V Galaxy S4
SFR
StarTrail III by SFR
Sonim
XP7700 XP7
Sony (SonyEricsson)
J105a, J105i, C1904 Xperia M, D5306 Xperia T2
Ultra, D5503 Xperia Z1
ZTE GSM
V829 Blade G Plus, S218
FILE SYSTEM EXTRACTION (CONT..)
Xiaomi
ZTE GSM
Fake Xiaomi HM NOTE 1TD, 2013121\HM NOTE
1W Redmi Note, Fake Xiaomi MI-4LTE
Blade L3 Plus, S291 Grand S II, Z433 Altair,
Vodafone Smart Ultra 6, V829 Blade G Plus, Z820
Obsidian, Z958, S218
LOGICAL EXTRACTION
Nokia GSM
Lumia 630 (RM-977) (USB), Lumia 630 (RM-977)
(BT, Lumia 630 (RM-978) (USB), Lumia 630 (RM978) (BT), Lumia 720 (RM-885) (USB), Lumia 720
(RM-885) (BT)
Pantech
IM-A870L VEGA Iron
Sagem
MyX5-2
Samsung CDMA
SCH-F339, SM-G530P Galaxy Grand Prime, SMT567V Galaxy Tab E 9.6, SM-N920P Galaxy Note 5,
SM-G928P Galaxy S6 edge Plus
Samsung GSM
SM-J100F Galaxy J1, SM-B310E Guru Music 2, SHVE310S Galaxy Mega, SM-G316M Galaxy Ace 4, SHVE330L Galaxy S4 LTE-A, SGH-T330G, SGH-T340G,
SM-G350E Galaxy Star 2 Plus
SoftBank
SM-G360T Galaxy Core Prime, SM-G360T1
Galaxy Core Prime, SM-G388F Galaxy Xcover 3,
SM-G386W Galaxy Core LTE, Fake Samsung SMA500F Galaxy A5, SM-G530T Galaxy Grand Prime,
SM-T531 Galaxy Tab 4 10.1, SM-B780W Rugby 4,
SM-G9008V Galaxy S5, SM-G920W8 Galaxy S6,
SM-T817A Galaxy Tab S2, SM-N915F Galaxy Note
Edge, SM-N920A Galaxy Note 5, SM-G928A Galaxy
S6 edge Plus, GT-C3011 (USB), GT-C3011 (BT),
GT-C3200 Monte Bar, SM-G3815 Galaxy Express
2, GT-C5110, GT-S5230C, GT-S5292 Star Deluxe
Duos, SM-G355H Galaxy Core 2 Duos, GT-I8190L
Galaxy S III Mini, Fake Samsung GT-N9006 Galaxy
Note 3, SM-N9008S Galaxy Note 3 ,SM-N9108V
Galaxy Note 4 ,SM-N9109W Galaxy Note 4 ,GTi9300i Galaxy S III Neo, GT-i9300i Galaxy S III Neo+,
GT-I9515L Galaxy S4
AU
SOL25, L03, iPhone 6, iPhone 6 Plus, KYL23
AceMobile
Cali
Alcatel
319 One Touch BIC V4, A205G, A392A One
Touch, A392G OneTouch, OT-510APIB One Touch
510A, 536 One Touch, E801, 1011A One Touch,
1011D One Touch, 2010D One Touch, OT-1009X,
OT-1063 BIC V5, 2007D One Touch, 2012G One
Touch, 4033A One Touch Pop C3, 5017B One
Touch, 5036A One Touch Pop C5, 5042X Orange
Roya, Orange Nura, 7046T Conquest, 6040D One
Touch Idol X, 6043A One Touch Idol X+, 7040A One
Touch Pop C7, 7040T One Touch Pop Icon, 7041X
One Touch Pop C7, 9006W One Touch Pixi 7
BLU
Q170w Samba W
Sonim
iPhone 6, iPhone 6 Plus, 401SH, 402SH
BlackBerry GSM
SQR100-1 Q5 (Bluetooth), SQR100-1 Q5 (USB
cable)
Sony (SonyEricsson)
XP5560 Bolt 2, XP7700 XP7
Tecno
Coolpad
3320A
J105a, J105i, K630i, E2303 Xperia M4 Aqua, D5306
Xperia T2 Ultra, C6502 Xperia ZL
Doro
Primo 305, Primo 413, PhoneEasy 621
VIVO
T728
Fly
E200, MC220, IQ442 Quad
Verizon
X3L
HTC
0PCV220 Desire 510, 0PM9120, PL80100 One SV,
OPKX210 Desire 626, 0PM9110 Desire 626s
Xiaomi
QTAQZ3 Ellipsis 8
ZTE GSM
Fake Xiaomi HM NOTE 1TD, Fake Xiaomi MI-4LTE
Huawei
Y320-U151 Ascend, MT7-UL00 Ascend Mate 7,
PE-CL00 Honor 6 Plus, GL07S STREAM X, H60-L01
Honor 6, Y221-U03 Ascend, Y520-U03 Ascend,
G535-L11 Kestrel EE, G610-U20 Ascend G610
IUSACELL
M8047IU Dilo
Kyocera
S2300 Torino, C6740, C6740N Hydro Wave, C6745
LEXAND
S4A2 IRIDA, S4A1 Vega
LG CDMA
LG-VN170 Revere 3, LG-VN210 Terra, VN370, LGAS991 G4
LG GSM
LGL24 au isai, LG-H735L G4 Beat, D290g L70+ L
Fino, T310i Cookie Emmetro, LG-D120 L30 Sporty,
LG-H340n Leon, LG-V400 G Tablet 7.0, LG-H422
Spirit, LG-V480 G Tablet 8.0, LG-V490 G Tablet 8.0
4G, LG-D400hn L90, LG-F460L G3 Cat.6, LG-D315
F70, LG-F370K F70, LG-E612g Optimus L5, LGD625 G2 Mini, LG-V700 G Tablet 10.1, LG-P768g
Optimus L9, LG-D855P G3, LG-V930, T5100
Chinese Android
phones
Fake Xiaomi HM NOTE 1TD, Aqua T4, Fake Xiaomi
MI-4LTE
Maxwest
6200 Orbit
Meizu
MX3 M351
Microsoft
Lumia 535 (RM-1089) (USB), Lumia 535 (RM-1089)
(BT), Lumia 640 (RM-1072) (USB), Lumia 640 (RM1072) (BT), Lumia 640 XL (RM-1063) (USB), Lumia
640 XL (RM-1063) (BT)
Motorola CDMA
XT1548 Moto G
Motorola GSM
XT919 RAZR D3, XT1064 Moto G 2nd Gen, XT1092
Moto X 2nd Gen, XT1514 Moto E 2'nd Gen Dual,
XT1078 Moto E 2'nd Gen Dual
NTT Docomo
iPhone 6, iPhone 6 Plus, SO-01G, SC-01G(GALAXY
NOTE Edge), SC-02G(GALAXY S5), SH-03F, SH-01G,
SH-02G, SO-02G, SC-03G, F-07F, F-01G
Blade L3 Plus, V829 Blade G Plus, Z820 Obsidian,
S291 Grand S II, Z433 Altair, Vodafone Smart Ultra
6, Z958

UFED Touch/4PC , UFED Physical/Logical Analyzer

Transcription

Similar documents

The Hitchhiker`s Guide to the Galaxy

El Universo Magnético

Lesson 1: My Place in Space

The Hitchhiker`s Guide to the Galaxy by Douglas Adams

HCN020 - Haddon

EurekaWeb - Eureka Support

UFED 3.0 - Cellebrite

neaple