The Cellebrite 'Universal Forensic Extraction Device' , or UFED, is a unique and very cost effective mobile phone, smartphone, and PDA forensic device that is completely stand alone.
As of February 2009, the UFED is compatible with 1,874 mobile phones (including GSM, TDMS, CDMA, iDEN), with the standard package containing 71 different phone cables. The UFED has an intergrated SIM reader, with Wireless connection options also being integrated, such as IR and Bluetooth.
The UFED also supports native Apple iPOD Touch, and Apple iPHONE extraction on both 2G and 3G versions. This is clientless, and via a physical cable, and works on jailbroken and non-jailbroken devices.
Using the MD5 Hash Algorithm, and SHA-256, subject data can be retrieved via logical extraction or via physical extraction (ie: hex dump). Moreover, all cable connectors from subject (source) side act as a write-blocker, being read only via the onboard hardware chipset. Extracted data includes:
- Handset data (IMEI, ESN, Manufacturer, Model No., ect.)
– SMS and MMS messages
- SIM data
- SIM cloning
- Multimedia (images, videos, audio, ect.)
- Date and Time stamps (with GMT and daylight savings options)
- Deleted data
- Fragmented or Partial data
- HEX Dump
- and much more.
The UFED is flexible enough to be used in many environments, such as:
- Fixed to a desk in a crime lab connect to a PC
- Fixed to a desk in a crime lab (stand alone with no PC)
- Mobile in a car or at a VCP (connected to car 12V power)
- Mobile in the field (using integrated battery kit)
The UFED is completely stand alone, allowing extraction to a USB Thumb Stick or USB HDD. With this said, additional software is also included to create specialised reports of the retrieved raw data on a PC/Laptop. Customised reports give the additional option of containing your own logo, case file number, address, etc.
Standard hardware options include a portable mobile phone battery charger set (with 42 plug heads), Faraday bag, and 9-in-1 media card reader.