Cellebrite Inspector 10.6 includes many new and enhanced capabilities designed to help you accelerate your investigative efforts.
Improved Ingestion and Processing
We are pleased to introduce a new workflow for ingestion and processing. The more intuitive interface increases the speed, effectiveness, and confidence of examiners, and makes it easier for new examiners to succeed. These tasks are now easier and faster for investigators.
Several key enhancements were made to email processing, export, and reporting.
- Improved Support for MS Outlook for Mac Computers – Inspector can now ingest and parse .Olk15 files and show the content in the Email sub-view with the expected information, including preview and attachments.
- Export Individual Email Messages – In the Email view, you can now select messages and export them as single messages in .eml format.
- Improvement for Message Attachments in Reports – When you tag messages with attachments in the Communications > Messages view and include them in a report, links for attachments appear in Message Details.
Dark Mode for macOS
If dark mode is enabled in system settings on your computer running macOS, Inspector can now display in dark mode (with the exception of reports and emails). You cannot enable dark mode in preferences or options for Inspector.
Updated Media Analysis
These new categories appear in the Media Analysis dialog box:
- Text: This is a form of optical character recognition, finding text within an image.
- Tattoo: This attempts to isolate and show all tattoos. False positives may result for images that seem like tattoos, such as drawings.
- Face: This isolates and shows all faces; it cannot find specific faces.
There are also significant improvements to speed and performance when only one or a few processors are selected as well as some reduction in false positives.
Improvements to Processing and Ingestion
Unified logs can now be parsed from macOS12. Images that are inline or attached to email messages now appear in the Media view. Accordingly, the Media view has a new view filter option, Email Image, which you can set to is or is not with the value True. To ensure you can see these images in the Media view, you must run both the media and email processing options. You can them in any order.
Improvements to Views
These improvements have been made to views within Inspector.
Tag Count for Tagged Items
In all views, the new Tag Count (#) label was added to the Tag ( ) column. If an item was tagged once, Tag Count is empty though the tag icon appears in the Tag column. If an item was tagged more than once, Tag Count shows the quantity of tags that contain the item (two or more).
Now, when you select an .xml file in any view, you can see the data in the Preview tab. In the Tag column, you can click on items in the hierarchy to expand, collapse, and open them to see data in the Value column. Similarly, when you select an EVTX file in the System Logs view, the Preview tab now shows information in an XML style view (similar to the Event Viewer on Windows computers). When you select a .json file in the Browser or File Filter views, you can now see information on the Preview tab. This format of this information resembles and functions similarly to XML style.
In any view, when you select a file from an NTFS formatted drive and click the Metadata tab, you can now see the NTFS ACL Owner and the NTFS ACL Owner Group.
Column Added to Messages Sub-View
The BBTID column has been added to the Messages sub-view. As you examine the list of messages, this change makes it easier to see when identical items were parsed from different locations within the same data source.
Formatting Improvement for Results Tab
On the Results tab for a content search, the names of files from unallocated space are now colored red. This, in conjunction with Unallocated appearing in the Partition column, can make it easier to see these files on the Results tab..
Visit the MyCellebrite Portal for a user guide, quick start guide, and more information.