Under “Actionable Intel” in Cellebrite Inspector, there is a lot of useful information that can be gained by looking at some of the insights.

There is a new tab labeled “Correlation” that helps you piece together the who, what, where, when, and how of an investigation. You can see what apps were opened, what was done during set time frames, what discs were inserted, what networks were connected to, and more. It is even possible to filter by date and time or by event type.

Additionally, on the right-hand side of each file, under “Event Attributes,” you can find all the information that ties these pieces of evidence together to correlate the artifacts.

Share this post