Difference between pages "Talk:Main Page" and "Cellebrite UFED"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
 
Line 1: Line 1:
== what about the validation of legal/illegal licenses of commercial software? ==
+
The Cellebrite 'Universal Forensic Extraction Device' , or UFED, is a unique and very cost effective mobile phone, smartphone, and PDA forensic device that is completely stand alone.
 +
  
I'm sometimes requested by the Courts to process with investigations in order to detect is a company is using software (e.g. AutoCad, MS Office, Adobe) with licenses or not.
+
As of February 2009, the UFED is compatible with 1,874 mobile phones (including GSM, TDMS, CDMA, iDEN), with the standard package containing 71 different phone cables. The UFED has an intergrated SIM reader, with Wireless connection options also being integrated, such as IR and Bluetooth.
The evidence of such stuff is easy or not. The display of the "About" is sometimes enough but for some software the evidence is not so easy.
+
  
May I propose we open a new section to address such topics?
 
  
What do you think? --[[User:Chuv|Chuv]] 04:16, 19 July 2007 (PDT)
+
The UFED also supports native Apple iPOD Touch, and Apple iPHONE extraction on both 2G and 3G versions. This is clientless, and via a physical cable, and works on jailbroken and non-jailbroken devices.
  
: Sounds like a good idea. How about [[How to determine if software is legally licensed]]? It should probably go in the [[:Category:Howtos]]. [[User:Jessek|Jessek]] 16:11, 19 July 2007 (PDT)
 
  
 +
Using the MD5 Hash Algorithm, and SHA-256, subject data can be retrieved via logical extraction or via physical extraction (ie: hex dump). Moreover, all cable connectors from subject (source) side act as a write-blocker, being read only via the onboard hardware chipset. Extracted data includes:
  
  
== Global Directory of Analysts ==
+
- Handset data (IMEI, ESN, Manufacturer, Model No., ect.)
  
I am setting up a global directory of computer forensics analysts, and am looking for feedback to the idea. Although the directory is in the UK, I want it to be global. Any thoughts, please put them on Computer Forensics [http://www.computer-forensics.co.uk] in the forums section. Thanks and regards, Simon
+
– Phonebook
: Given the lack of response I'm not sure this is a viable idea. [[User:Jessek|Jessek]] 21:13, 26 February 2007 (PST)
+
: Doesn't seem like a good idea to me. [[User:Simsong|Simsong]] 18:50, 15 March 2007 (PDT)
+
– SMS and MMS messages
: Response is small because the very idea and both sites are not well known within North America.  Computer forensics here has been mostly a secondary role rather than a principal focus.  To raise awareness of both efforts, this wiki and computer-forensics.co.uk, you need to get their existence promoted in major publications and the primary professional organizations.
+
  
 +
- SIM data
  
 +
- SIM cloning
  
== List of OS changed files at boot time or poweroff. ==
+
- Multimedia (images, videos, audio, ect.)
  
Some times i found useful to know which files are changed on boot time of OS or on poweroff.  For example to know what happened with OS ( Windows or Linux or ... ) what files to exclude or include by investigation. So i started collect this information with qemu and mactime. I think this wiki is the best place to post it,  what do you think haw should i name it and the category? Also i will thankful if some one can correct my English.
+
- Date and Time stamps (with GMT and daylight savings options)
  
I would encourage you to post it at [[Files changed at boot:Windows XP]], [[Files changed at boot:Windows Vista]], and the like. [[User:Simsong|Simsong]] 18:53, 25 October 2007 (PDT)
+
- Deleted data
  
== Organizing Anti-Forensics and Page Naming query ==
+
- Fragmented or Partial data
I've made a start on trying to organize the Anti-Forensics information creating a number of sections including Category:Anti-Forensics.  I created a category for Category:Anti-Forensics Tools(uppercase) with out realising there was already a Category:Anti-forensics tools (lowercase).  Is there any standardization on whether page titles should be upper or lower case? I would have though upper case being the better option...
+
[[User:Fsck|Fsck]] 22:43, 4 July 2008 (UTC)
+
  
I've started a weekly posting of forensics research. In my quick review of the other websites that come up when doing a google search for "computer forensics" it seems that nothing is really up-to-date, so perhaps we can start a more active community here. Perhaps this will grow into a blog roll. [[User:Simsong|Simsong]] 23:46, 5 July 2008 (UTC)
+
- HEX Dump
:: What about next Selected Forensics Research? Two months passed without updates [[User:.FUF|.FUF]] 21:10, 17 October 2008 (UTC)
+
:::I got radically overcommitted. I'll try to post something this weekend. [[User:Simsong|Simsong]] 06:35, 18 October 2008 (UTC)
+
== Removal of non-contributing users ==
+
  
I've written a little SQL statement which will remove the 1100 or so usernames that have been registered but which have never contributed anything and have no talk. This was considered for the mediawiki project but never implemented (weird). Anyway, unless there is a suggestion, I'll go ahead and do it... [[User:Simsong|Simsong]] 05:10, 20 August 2008 (UTC)
+
- and much more.  
  
== Tools table ==
 
  
Is it possible to add [[Wireshark]] and [[NetworkMiner]] to the Tools table on the Main Page (here: ''Network Forensics: Snort, ... '')? [[User:.FUF|.FUF]] 17:08, 11 September 2008 (UTC)
+
The UFED is flexible enough to be used in many environments, such as:
: Done [[User:Simsong|Simsong]] 04:40, 12 September 2008 (UTC).
+
  
== Did you know? ==
 
  
What about organizing "Did you know?" section with some interesting facts from articles (like in Wikipedia)? [[User:.FUF|.FUF]] 12:34, 29 October 2008 (UTC)
+
- Fixed to a desk in a crime lab connect to a PC
: I don't think that we have enough people to do this. [[User:Simsong|Simsong]] 06:50, 19 July 2009 (UTC)
+
  
== Wiki News ==
+
- Fixed to a desk in a crime lab (stand alone with no PC)
  
I have updated the version of SpamBlacklist. [[User:Simsong|Simsong]] 23:49, 30 October 2008 (UTC)
+
- Mobile in a car or at a VCP (connected to car 12V power)
  
I have fixed the server config file so we now get /wiki/ URLs. [[User:Simsong|Simsong]] 20:33, 3 November 2008 (UTC)
+
- Mobile in the field (using integrated battery kit)
  
== Forensics Mailing List ==
 
Hello all. I would like to ask, are there any mailing list focus on forensics? I need reference here. --[[User:Zakiakhmad|Zakiakhmad]] 09:48, 13 March 2009 (UTC)
 
  
: It seems a little bit passive this discussion --[[User:Zakiakhmad|Zakiakhmad]] 03:16, 23 March 2009 (UTC)
+
The UFED is completely stand alone, allowing extraction to a USB thumb or USB HDD. With this said, additional software is also included to create specialised reports of the retrieved raw data on a PC/Laptop. Customised reports give the additional option of containing your own logo, case file number, address, etc.
  
== AJAX ==
+
Standard hardware options include a portable mobile phone battery charger set (with 42 plug heads), Faraday bag, and 9-in-1 media card reader.
 
+
Ajax has been enabled by adding these settings to the LocalSettings.php file:
+
  $wgUseAjax = true;
+
  $wgEnableMWSuggest = true;
+
  $wgMWSuggestTemplate =SearchEngine::getMWSuggestTemplate() . '&limit=20';
+
 
+
:Yours wikily, [[User:Simsong|Simsong]] 06:49, 19 July 2009 (UTC)
+
 
+
== Zalety i Wady - obiektywnie wyłącznie inżynierowie forensics ==
+
 
+
'''Analiza SIM karty danych i odzyskiwania usuniętych danych
+
ANALYSIS SIM CARD DATA AND RECOVER DELETED DATA'''
+
 
+
Odzyskiwanie skasowanych wiadomości SMS / tekst i wykonać kompleksową analizę danych na karcie SIM. Karta SIM ma zajęcia nabycia karty SIM i elementy analizy zajęciu urządzenia parabenów i umieszcza je w specjalistyczne karty SIM nabycia kryminalistycznych i narzędzie do analizy. Karta SIM zawiera zajęcia programowe, jak Forensic SIM Card Reader. Jeśli masz już zajęcia Device & Device Seizure Toolbox, nie ma potrzeby, aby otrzymać karty SIM zajęcia, jak również dlatego, że zawierają składniki, aby wykonać kryminalistycznych badań karty SIM i analizy. Jest to narzędzie dla badacza, który chce nabyć tylko karty SIM i nie chcesz wykonać kryminalistycznych egzaminów wszystkich danych z telefonu komórkowego. Karta SIM zawiera bezpłatne zajęcia roczną subskrypcję z zakupu.
+
 
+
SIM Card Seizure has unicode support to read multiple languages such as Arabic, Chinese, & Russian: Features:
+
 
+
    * Forensic SIM Card Reader Included
+
    * Calculates MD5 & SHA1 Hash Values
+
    * Search Function
+
    * Recovers Deleted SMS Data*
+
    * Bookmarking Options
+
    * Report Creation Wizard
+
    * Save Workspaces for Further Review
+
    * Time Stamps Calculate GMT Offset
+
    * Access to Paraben's Forum
+
    * Access to Paraben's 24 Hour Support
+
 
+
Data Acquired from SIM Cards
+
 
+
    * Phase Phase ID
+
    * SST SIM Service table
+
    * ICCID Serial Number
+
    * LP Preferred languages variable
+
    * SPN Service Provider name
+
    * MSISDN Subscriber phone number
+
    * AND Short Dial Number
+
    * FDN Fixed Numbers
+
    * LND Last Dialed numbers
+
    * EXT1 Dialing Extension
+
    * EXT2 Dialing Extension
+
    * GID1 Groups
+
    * GID2 Groups
+
    * SMS Text Messages
+
    * SMSP Text Message parameters
+
    * SMSS Text message status
+
    * CBMI Preferred network messages
+
    * PUCT Charges per unit
+
    * ACM Charge counter
+
    * ACMmax Charge limit
+
    * HPLMNSP HPLMN search period
+
    * PLMNsel PLMN selector
+
    * FPLMN Forbidden PLMNs
+
    * CCP Capability configuration parameter
+
    * ACC Access control class
+
    * IMSI IMSI
+
    * LOCI Location information
+
    * BCCH Broadcast control channels
+
    * Kc Ciphering key
+
 
+
Pytanie 1
+
_________
+
 
+
 
+
Jakie zalety na pierwszy plan,  a jakie wady które można zignorować w śledztwie?
+
 
+
==Spam==
+
In an attempt to deal with spam, account creation now requires confirmation.
+

Revision as of 06:40, 6 February 2009

The Cellebrite 'Universal Forensic Extraction Device' , or UFED, is a unique and very cost effective mobile phone, smartphone, and PDA forensic device that is completely stand alone.


As of February 2009, the UFED is compatible with 1,874 mobile phones (including GSM, TDMS, CDMA, iDEN), with the standard package containing 71 different phone cables. The UFED has an intergrated SIM reader, with Wireless connection options also being integrated, such as IR and Bluetooth.


The UFED also supports native Apple iPOD Touch, and Apple iPHONE extraction on both 2G and 3G versions. This is clientless, and via a physical cable, and works on jailbroken and non-jailbroken devices.


Using the MD5 Hash Algorithm, and SHA-256, subject data can be retrieved via logical extraction or via physical extraction (ie: hex dump). Moreover, all cable connectors from subject (source) side act as a write-blocker, being read only via the onboard hardware chipset. Extracted data includes:


- Handset data (IMEI, ESN, Manufacturer, Model No., ect.)

– Phonebook

– SMS and MMS messages

- SIM data

- SIM cloning

- Multimedia (images, videos, audio, ect.)

- Date and Time stamps (with GMT and daylight savings options)

- Deleted data

- Fragmented or Partial data

- HEX Dump

- and much more.


The UFED is flexible enough to be used in many environments, such as:


- Fixed to a desk in a crime lab connect to a PC

- Fixed to a desk in a crime lab (stand alone with no PC)

- Mobile in a car or at a VCP (connected to car 12V power)

- Mobile in the field (using integrated battery kit)


The UFED is completely stand alone, allowing extraction to a USB thumb or USB HDD. With this said, additional software is also included to create specialised reports of the retrieved raw data on a PC/Laptop. Customised reports give the additional option of containing your own logo, case file number, address, etc.

Standard hardware options include a portable mobile phone battery charger set (with 42 plug heads), Faraday bag, and 9-in-1 media card reader.