Cellebrite UNIVERSAL FORENSIC EXTRACTION DEVICE... User manual

UFED Standard
UFED Ruggedized
UNIVERSAL FORENSIC EXTRACTION DEVICE
USER MANUAL

UFED SYSTEM
UNIVERSAL FORENSIC EXTRACTION DEVICE
USER MANUAL
June 2009 | version 4b

This manual is delivered subject to the following conditions and restrictions:
This manual contains proprietary information belonging to CelleBrite Ltd. Such information is
supplied solely for the purpose of assisting explicitly and properly authorized users of the
UFED.
No part of this content may be used for any other purpose, disclosed to any person or firm, or
reproduced by any means, electronic or mechanical, without the express prior written
permission of CelleBrite Ltd.
The text and graphics are for the purpose of illustration and reference only. The specifications
on which they are based are subject to change without notice.
Information in this document is subject to change without notice. Corporate and individual
names and data used in examples herein are fictitious unless otherwise noted.
Copyright 2007 CelleBrite Ltd. All rights reserved.
WARNING: The UFED is powered a rechargeable, Lithium Polymer battery.Please read and
understand the operation and warnings before charging or using your UFED
device. Improper use or charging may result in fire, personal injury, and damage
to property. See Appendix A.
WARNING: The UFED should be used only with the dedicated AC/DC adapter supplied with
this device.
WARNING: USB, Ethernet and target and source connectors should be connected only to CE
approved devices (according to IEC/EN 60065 standard).
WARNING: Make sure that all external connections to other devices (except for the power
adapter) are only indoor and SELV (safety extra low voltage, not exceed 42.4
Vpeak or 60Vdc).

Table of Contents
Chapter 1. Introduction....................................................................................................1
1.1. Overview......................................................................................................................... 1
Chapter 2. UFED Configuration: Ruggedized and Standard Versions.................... 3
2.1. UFED Kit Contents........................................................................................................ 3
2.2. UFED Device Overview................................................................................................ 5
2.3. Ruggedized UFED Carrying Case.............................................................................. 6
2.4. Ruggedized UFED Rubber Casing............................................................................. 7
2.5. Power and Battery Options .......................................................................................... 8
Chapter 3. Getting Started ............................................................................................ 10
3.1. Initial Setup................................................................................................................... 10
3.2. UFED Menu Navigation.............................................................................................. 11
Chapter 4. Extract Phone Data..................................................................................... 12
4.1. Overview....................................................................................................................... 12
4.2. Flowchart ...................................................................................................................... 12
4.3. Extract Phone Data to USB Disk Drive or SD Card................................................ 13
4.4. Extract Phone Data to a PC....................................................................................... 18
Chapter 5. Extract SIM/USIM Data................................................................................ 21
Chapter 6. Clone SIM ID................................................................................................. 23
6.1. Overview....................................................................................................................... 23
6.2. Flowchart ...................................................................................................................... 24
6.3. SIM Cloning – Steps.................................................................................................... 24
6.4. Manually Creating a Clone SIM Card - Steps.......................................................... 26
Chapter 7. Smart Phones/PDA Support...................................................................... 29
Chapter 8. Using Bluetooth Connectivity................................................................... 30
8.1. Phone Settings............................................................................................................. 30
8.2. UFED Bluetooth Adapter............................................................................................ 30
8.3. Identifying the Phone via Bluetooth........................................................................... 30

Chapter 9. UFED Report Manager Software............................................................... 31
9.1. Overview....................................................................................................................... 31
9.2. UFED Report Manager Software Installation........................................................... 31
9.3. Data Analysis ............................................................................................................... 33
9.4. UFED Report Manager Menu.................................................................................... 35
9.5. Reports.......................................................................................................................... 36
Chapter 10. Services........................................................................................................ 39
10.1. Upgrade ........................................................................................................................ 39
10.2. Software Versions........................................................................................................ 39
10.3. Counters........................................................................................................................ 39
10.4. Help ............................................................................................................................... 40
10.5. Network Settings.......................................................................................................... 40
10.6. Screen Settings............................................................................................................ 40
10.7. Time and Date.............................................................................................................. 40
10.8. User Settings................................................................................................................ 40
10.9. UFED Settings ............................................................................................................. 41
10.10 Admin Settings.................................................................................................................. 42
Chapter 11. Upgrade ........................................................................................................ 43
11.1. Overview....................................................................................................................... 43
11.2. Upgrade from USB Disk Drive or SD Card.............................................................. 44
11.3. Upgrade from PC......................................................................................................... 45
11.4. Upgrade from Web...................................................................................................... 47
11.5. Automatic Upgrade from Web.................................................................................... 49
Appendix A: Battery Replacement (Ruggedized Only) .................................................... 52
Appendix B: Technical Specifications................................................................................ 53
Cellebrite UFED System - Software Update Log................................................................ 54

User Manual 1
Chapter 1. Introduction
1.1. Overview
The Cellebrite UFED Forensics system empowers law enforcement, anti-
terror and security organizations to capture critical forensic evidence from
mobile phones, Smartphones and PDAs.
UFED extracts vital data such as phonebook, camera pictures, videos,
audio, text messages (SMS), call logs, ESN IMEI, ICCID and IMSI
information from over 1,600 handset models, including Symbian, Microsoft
Mobile, Blackberry and Palm OS devices.
Cellebrite UFED enables SIM ID cloning, allowing you to extract phone data
while preventing the cellular device from connecting to the network.
The UFED can extract data from a phone, or directly from the SIM card.
When extracting from phone, the UFED connects to the phone via cable,
Bluetooth or infrared, and the data is read logically from the phone. It also
performs a physical extraction from SIM cards, allowing extraction of
additional data such as deleted SMS, ICCID, IMSI, location information and
more.
Data is copied to any standard USB flash drive or SD card and is then
organized into clear and concise reports.
Cellebrite’s industry expertise provides reliability and ease-of-use, and
ensures the broadest support for handset varieties, including updates for
newly released models even before they are available in the market.
Portable and easy to operate, the UFED can be used in the forensic lab as
well as in the field. The UFED is a handheld device, without the need for a
PC in the field. The Ruggedized version of the UFED comes with hard-sided
case and battery power, for even greater mobility and flexibility and fully
loaded with all needed accessories.

Chapter 1 –Introduction
2 UFED System
The UFED Report Manager software on your PC creates detailed reports of
the extracted data that can be used as evidence. Reports include full
extraction details as well as MD5 hash information that proves that the data
is original and untouched.

User Manual 3
Chapter 2. UFED Configuration:
Ruggedized and Standard Versions
2.1. UFED Kit Contents
The UFED comes equipped with all you need for mobile phone analysis. You
can choose from either of two kit types: Standard Kit and Ruggedized Kit.
Standard Kit
Ruggedized Kit
The following table lists the features and accessories that come with each
kit. Some of the accessories can be purchased separately, allowing you to
upgrade some features of a Standard Kit UFED.

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
4 UFED System
Kit Features
Standard Kit
Ruggedized Kit
Kit Carrying Case
Convenient vinyl
carrying case
Hard-side plastic casing
with secure latches
UFED Device √√
UFED Device Casing Standard
Rubber casing with
dataport flap coverings
Cable Organizer
√
√
Data Cables
Full Set
Full Set
Small Cable Pouch for quick
excursions - √
Bluetooth Dongle for wireless phone
connection √√
USB Flash Drive for saving
examination data √√
AC Power Supply
√
√
UFED Battery Pack
-
√
12V In-vehicle (Cigarette Lighter)
Power adapter √√
SIM ID Cloning Cards
√
√
Card Reader
-
√
Mobile Phone Battery Charger set
-
√
Faraday Bag
-
√
UFED Manager- Report Viewing
and Printing Software √√
Phone Connection Cleansing Brush
√
√
User Manual and Support CD
√
√

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
User Manual 5
2.2. UFED Device Overview
1. Power Supply (Connect to
power adapter)
2. LCD Display
3. Function Keys (F1 for help. F2
for select/deselect all)
4. ON/OFF Power Button
5. Target-side Connectors (For
extraction to USB disk drive)
6. SIM / Smart Card Slots (Slot for
reading SIM cards and smart
cards)
7. Navigation Keys (For navigating
the UFED menu)
8. Source-side Connectors
(Connect phone via USB, serial
or IR)
9. Cancel Button
10. SD Card Slot (For extraction to
SD card)
11. USB Port Extension (Use for
Bluetooth dongle or other
external devices such as
keyboard)

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
6 UFED System
12. Serial connection (not in use)
13. Ethernet port (Connect to
network for automatic updates
and for uploading data to a
network hosted PC)
14. Mini-USB Port (Connect to a PC
via mini-USB cable, for
extraction to PC)
15. Battery kit and battery housing
protective covering
16. Charging switch.
17. Battery's state-of-charge –test
and LED indicators.
2.3. Ruggedized UFED Carrying Case
The UFED Ruggedized carrying case is designed specifically for field use
conditions.
To open the case, flip the two latches open.
NOTE: The case is air-tight sealed. When the case undergoes changes in
atmospheric pressure (ex. mountain areas, after airplane flights), the latches
may be ‘stuck’ closed. When this happens, you should release the vacuum
by unscrewing the vacuum release valve, located in the center of the case,
next to the handle.

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
User Manual 7
2.4. Ruggedized UFED Rubber Casing
The Ruggedized UFED device is encased in a rubber casing, to hold the
battery house and to protect the UFED from dirt, dust, sand or other
contaminants.
To replace the casing on the UFED, refer to Appendix A.

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
8 UFED System
2.5. Power and Battery Options
The UFED device can be powered by an AC power supply, a car power
supply, or by battery power. (NOTE: car power supply and battery pack
come with the Ruggedized Kit only.)
Battery Power
To run the UFED on battery power, flip the power switch to the right (“BAT”)
position. Battery power will take over.
Charging the Battery
To re-charge the battery, connect the device to an AC adapter (supplied with
the kit), and then flip the power switch to the left (“CHG”) position.
LED Indicator
The LED indicator provides input regarding the state of the UFED power:
Indication
LED Status
Red Battery charge in process
Green Battery fully charged
No light Sleep mode (no input power source) OR
No battery connected OR
Charge suspended (timer fault or thermal shutdown)
OR Over-voltage fault
Flashing Red
Indicates a problem with the battery. Verify that the
battery is connected properly.

Chapter 2 –UFED Configuration:
Ruggedized and Standard Versions
User Manual 9
Inserting or Removing Battery
Please refer to Appendix A for instructions on installing, removing or
exchanging the battery pack.

User Manual 10
Chapter 3. Getting Started
3.1. Initial Setup
2.1.1 Unpacking the UFED
Unpack the UFED device from the kit (See Chapter 1). Connect the
power supply adapter to the UFED. “Please Wait” appears briefly on
the screen, followed by a screen showing the version numbers. When
starting the UFED for the first time, you need to set the date, time and
GMT. At this point, the UFED is ready to be used, and the Main Menu
is displayed.
Extract Phone Data - This option is for extracting data from a mobile
phone. (See Chapter 3)
Extract SIM/USIM Data – This option is physical extraction directly
from a SIM card. (See Chapter 4)
Clone SIM ID– This option copies a SIM card, enabling you to analyze
the phone without it being open for incoming calls, . (See Chapter 5)
Services - Allows you to upgrade your UFED with updated phone
support (see Chapter 1). In addition, you can use Services to perform
various administrative tasks (see Chapter 10).

Chapter 3 –Getting Started
User Manual 11
3.2. UFED Menu Navigation
The UFED shows menu options on the display.
•Use the ▲▼ keys to move between options.
•To select an option, press ► or the OK key.
•To return to the previous menu, press ◄. When additional help
is available, a help icon will appear in the upper left of the
screen. Press F1 to view this help.

12 UFED System
Chapter 4. Extract Phone Data
4.1. Overview
Select Extract Phone Data from the main menu in order to copy data from a
phone (the source) to a PC, USB or SD card (the target).
Use this function to extract phonebook, SMS text messages, pictures, etc.
from mobile phone memory to a USB disk drive, SD card or directly to a
PC.
The UFED guides you each step of the way during this process.
4.2. Flowchart
There are only slight differences in the procedure when the target is a USB
disk drive or a PC. Both procedures are described below. Refer to the
procedure relevant to you.

Chapter 4 –Extract Phone Data
User Manual 13
4.3. Extract Phone Data to USB Disk Drive or SD Card
Follow the steps below to perform a data extraction from a mobile phone to
a USB disk drive or an SD card.
1. Main Menu
Select Extract Phone Data from the
main menu.
Use the ▲▼ keys to move between
options.Press OK or ►to continue.
2.Source Vendor
Select the vendor (manufacturer) of the
source phone.
Use the ▲▼ keys to move between
options.Press OK or ►to continue.
3.Source Model
Select the source phone model.
NOTE: If you do not know the model,
you can often find the phone model on
a sticker beneath the battery.
Use the ▲▼ keys to move between
options.Press OK or ►to continue.
To return to the previous menu, press
◄.

Chapter 4 –Extract Phone Data
14 UFED System
4.Source Memory
Select the source memory location you
wish to extract.
Use the ▲▼ keys to move between
options.Press OK to select the
currently highlgithed option, or press F2
to select all. Press ►to continue.
NOTE: Some phones do not allow access to
the SIM card data via the data cable. In
these cases, you will be prompted
during the process to remove the SIM
card and insert it into the SIM Card Slot.
5.Source Link
This step determines how the phone will
connect to the UFED. This message
appears only if the phone supports
more than one connection method
(Cable, Bluetooth or IrDA-Infrared).
Use the ▲▼ keys to move between
options.Press OK or ►to continue.
NOTE: For best speed and reliability,
we recommend using cable
whenever possible.