UFED Physical Analyzer

The NUMBER 1 software tool in mobile forensics

The UFED Physical Analyzer is the most advanced analysis, decoding and reporting tool in the mobile forensics industry. The result of Cellebrite's extensive research and development provides users with the most unique and powerful features, addressing the needs in the mobile forensic industry.
The UFED Physical Analyzer includes enhanced decoding, enabling support for multiple data types: chat, email, web bookmarks (favorites), web history, SIM data, cookies, notes, MMS, instant messages, Bluetooth devices, locations, journeys, GPS Fixes, call logs, text messages, contacts and more.

The Physical Analyzer enables:

• USB Mass storage devices extraction and decoding for all major GPS portable devices
• Physical extraction from devices running iOS 3.0 or higher, decrypting on-the-fly encrypted partitions for supporting devices
• Advanced decoding of deleted, hidden and existing content from all major mobile devices and platforms including, iOS devices, BlackBerry® devices physical extraction, Android devices and more

Highlights:

• Rich set of data – Handling ever growing rich set of data types (call logs, contacts SMS, MMS, chats and more)
• Hash Verification – Ensures that the extraction being decoded is the same extraction received from the UFED device
• Advanced search – Ability to search based on several parameters either as an open text or based on specific parameters
• Conversation View – View communications between sources in date and time order
• Entities Bookmarks – A quick reference pointer that can be set to an analyzed data item and a data file item
• Generate and Customize Reports – Generates customized reports in different formats such as PDF, HTML, XML, and Excel. The reports can be customized in means of look and feel (header, footer), case related information and content
• Hex Viewer – Shows binary view of the extracted data, enabling advanced search based on multiple parameters, regular expressions and more
• Parsed Content Highlighting in the Hex– Highlights the exact position in extraction for each decoded content entry, enabling full tractability between the analyzed data and the Hex
• Hex Bookmarks – Define and save specific locations in the Hex data
• SQLite Databases Viewer –Viewing, searching and exporting tables and content from SQLite database files
• Python Scripting – Using the python shell, enhances the capabilities for content decoding
• Plugin and Chain Management – Enable to run python scripts via plugins, and edit and create new decoding chains