Performing Mobile Device Forensics with Cellebrite

When to Use

• When extracting evidence from smartphones or tablets during an investigation
• For recovering deleted messages, call logs, and location data from mobile devices
• During investigations involving communications via messaging apps
• When analyzing mobile application data for evidence of criminal activity
• For corporate investigations involving employee mobile device misuse

Prerequisites

• Cellebrite UFED Touch/4PC or UFED Physical Analyzer (licensed)
• Alternative open-source tools: ALEAPP, iLEAPP, MEAT, libimobiledevice
• Appropriate cables and adapters for target device
• Faraday bag to isolate the device from network signals
• Legal authorization (warrant, consent, or corporate policy)
• Knowledge of iOS and Android file system structures

Workflow