Examining images and videos in Cellebrite Physical Analyzer (PA) is getting easier and easier. You can now:

  • Isolate images and videos recorded with the mobile device in question.
  • Quickly examine thumbnails or application data of interest.
  • Use the “green” arrow beside the directory containing the images to open them in another tab.

(To learn more about these features, watch this short video.)

When you consider the number of different ways you can view data and how many photos are stored on a typical device, it can feel overwhelming to track specific evidence down if you don’t know some of the simple shortcuts to make it easier.

I’m going to show you some of the techniques I use every day using the checkm8 image I have of the iPhone below.

You could start your search by scrolling through all of these graphics, but that’s way too time-consuming. Instead, switch to the “Folder View” and uncheck everything. Go for a completely clean slate and deselect every option that you have there.

Once everything is deselected, you can go to the location where graphics would exist, if a user had picked up the phone and snapped a photo with the camera on their device. (This does not include third-party applications.)

Once you get there, scroll down and look for the directory where these items would exist. As an easy way to understand this, I’m going to select, “DCIM/100Apple.” You may want to include thumbnails or not. It all depends on your preferences and how much you want to include. I usually lean toward excluding the thumbnails initially and then loading them at the end.

For example, in the screenshot below, I chose all of my CPLAssets. This includes anything that’s in the Cloud as well as everything that might reside on the device.

Once you’ve made your checkmarks switch to thumbnail view (below).

The most important thing here is that you choose “Only Selected,” otherwise you’ll end up right back where you began. By choosing “Only Selected,” you will see all of the photos the user took with the camera on that device.

In the next blog of this series, I will cover key features of Cellebrite Physical Analyzer you don’t want to miss.

Share this post