How to Use UFED Smart Flow For Selective Data Collection During Mobile Forensics
In this Tip Tuesdays session, we will be looking at UFED Smart Flow.
Select Mobile Device, and you’ll see that the phone is detected by the PC. Choose Smart Flow and make sure to follow the on-screen instructions. If it is not recognized by the PC, just disconnect and reconnect the phone.
Choose the location where you want to save your extraction. You will see that the computer is communicating between the phone and UFED and preparing the device for extraction. There are four steps and they may take a different length of time depending on the device, so you need to be patient.
Once the device is recognized, choose View All to get insights into the applications that are installed. This shows what a selective file system extraction would look like.
Choose Selective File System, and receive a list of every application that’s installed. You can manually check the app required, or type the name in the search apps box for apps you require.
When you press next, the extraction will continue, and UFED is going to extract specifically what you require. This is extremely important in many departments and organizations where you have limited consent or legal authority to extract specific data. If that is not a concern, then this feature may be really beneficial to you.
I always recommend full file system extraction and then paring down what you need for analysis.
Watch the full episode to learn more.