Workflow Aids: Digital Collector 3.1

Version3.1  |  Digital Collector   |  February 10, 2021

Are you trying to collect forensic data from a Windows or Mac computer, but need extra support? Cellebrite Digital Collector 3.1 will help you maximize your extraction and collection efforts no matter where your data lives.

With the workflow aids we’ve incorporated into this update, it’s easier and speedier for you to extract data and perform additional tasks too—like triage, logical data collection, and imagining—all from a single Digital Collector device.

Luckily, Digital Collector’s cutting-edge technologies can detect and inform you about file systems and encryption on Windows or Mac computers in a flash. But hey, we’re just scratching the surface here…

Windows-installed Computer

  • Digital Collector will work best on any 64-bit hardware system running on Windows 10, but it might even work on computers with older Windows operating systems too.
  • Since the variables in filesystems and encryption have no effect on workflows, that makes it easier to acquire data from Windows computers.

Mac Computer

  • A Mac is slightly more complicated. You might encounter a variety of computers with different file systems and software-based or hardware-assisted encryption methods.
  • The interplay of these variables means there are more variations in the workflows for acquiring data from Mac computers.

To better understand how Digital Collector can help you become successful with your data acquisitions, check out the workflow aids below.

Acquiring Decrypted Data from a Mac with a T2 Chip

Source Computer

Digital Collector

Requirements and Constraints

Running

Connect the Digital Collector SSD to the source computer obtain a live logical data collection.

While some user data can be collected without a password, an administrator password is required for full disk access.

 

Cannot acquire an image. Makes changes to the source computer.

Not running

The most forensically sound method requires a host computer, which must be a Mac computer model from 2012-2019. Put the source computer into target disk mode (TDM), start your host computer with Digital Collector, and connect the source to the host.

 

1.  Creating an image is recommended. 

2.  Obtaining a logical data collection is useful when you cannot create an image. 

Does not require an administrator password for the source computer.

 

If Digital Collector detects that FileVault 2 is enabled, you must be able to unlock it.

 

1. Creating an image requires either the FileVault 2 password or the Recovery Key.

2. Creating a logical collection requires either the FileVault 2 password, the Recovery Key, or the keychain file.

Not running

If you do not have a host computer, change the secure start settings on the source computer, and then use the startup manager on the source computer to start it with Digital Collector.

 

1.  Creating an image is recommended. 

2.  Obtaining a logical data collection is useful when you cannot create an image. 

Requires an administrator password to change the source computer’s secure start settings.

 

If Digital Collector detects that FileVault 2 is enabled, you must be able to unlock it.

 

1. Creating an image requires either the FileVault 2 password or the Recovery Key.

2. Creating a logical collection requires either the FileVault 2 password, the Recovery Key, or the keychain file. 

For additional information on this release, including user manuals and data sheets, please log-in to your MyCellebrite account