Surface key evidence from Apple devices and popular applications

Version7.19  |  UFED Physical Analyzer, UFED Logical Analyzer, Cellebrite Reader  |  May 29, 2019

Obtaining the maximum amount of data from new data sources can help expedite investigations.  With this version of UFED Physical Analyzer 7.19, decode data from Apple’s KnowledgeC database, surface a user’s activity from the Apple Health app, and uncover important data from Instagram production sets, Telegram and Snapchat.

  1. KnowledgeC – Find valuable information about a user’s activities on the device at any given time with new access to the KnowledgeC database. Take a closer look at application activity – when was the app installed, opened, how was it invoked; all of the spotlight searches, when was the device locked and unlocked, when was it plugged into a charger or PC, and much more.

  2. Health App – Apple’s Health app tracks a user’s physical activities and health based on data from a user’s iPhone, Apple Watch and other apps. Decode and present data such as body measurements, steps, as well as location data.

  3. Decode additional data from Telegram – UFED Physical Analyzer 7.19, now provides decoding support for user account information, contacts and chat messages.

Note: Data from KnowledgeC, the Health app and Telegram are only accessible via a full-file system extraction, usually performed with the help of Cellebrite Advanced Services or UFED Premium.

Uncover essential data from Instagram production sets to accelerate investigations

In this version of UFED Physical Analyzer, you can process and decode an Instagram production set and gain access to images, messages and user account.

Recover media files from the Snapchat feature, My Eyes Only (Memories)

Snapchat, the popular multimedia social application, has a feature called My Eyes Only (Memories). This feature allows its users to keep items private and hide content behind a passcode. The content is also encrypted. Cellebrite has enhanced the support of this app for Android devices and enables decoding, decryption and recovery of media files kept in the ‘My Eyes Only’ gallery.