Examiners need reporting options that allow them to quickly and easily provide critical information to others; whether they are giving an overview of the device to an investigator or providing another team only the most relevant findings. 

We’ve updated Cellebrite Inspector to make it easier than ever to report on devices, including options that don’t require the user to tag items.  In addition, when exporting large reports we automatically break up the report into smaller more manageable sections.  Here are some tips and examples of how to use these new enhancements.

Comprehensive Device Level Reporting

Starting in Inspector 2018 R3, the report sidebar now includes the ‘Case Data’ option which, when selected, will include a comprehensive report of all the data from the device(s) in the case without having to tag any items.

The new Case Data Report options allow users to report on an entire category without tagging items.

Choosing Which Devices and Categories to Report On

Examiners can report on all devices in a case or selected devices by accessing the gear level options. If ‘All Evidence Items’ is chosen, the Case Data section will display Case Data (All items).  If they choose to report Case Data on selected evidence items, the menu option will show which devices are currently selected and the root will show Case Data (for selected items).

Next, they can check the Case Data root item to report across all the categories or choose only those categories they would like to report on. If a category is selected where the device does not have that type of data, that section will not be included in the report.  In order to make selection easier to select all or none hold the <SHIFT> key down while clicking on the report element header.

Choosing which Device(s) to include in the Report

In the preview view, before generating the report, users will be able to see the first 50 items in a given category, below you can see the message category with over 800,000 messages. This allows the Report Preview to still be responsive while examiners adjust the report.

Users will see the first 50 items in the Preview for the report

How to Customize Reporting for Mobile Device Summary

For examiners who want to quickly provide a summary of what is contained on a mobile device, they can now click on the ‘Add’ button or drag and drop the image into a Inspector Case and then skip directly to the report tab. 

Examiners can then choose to provide investigators just the most relevant categories, like all contacts, all messages, and all calls.  Examiners can also control the order they’d like these categories to appear in the report by dragging and dropping each category into the order they’d like from top to bottom, skipping unchecked categories.

Rearrange Category Order through drag and drop

Producing the Report

When a user clicks on Generate Report, a report will export to the selected format and include only those areas of the report the investigator has checked.  The HTML report generation has been updated to break up sections with large amounts of data, for instance, all the pictures or messages on a device, into segments within the category.

The exported HTML report now breaks up large sections into pages

Opening the HTML report provides a new streamlined navigation menu to jump to relevant sections. For the document format reports, the properly hyperlinked table of content allows users to locate important sections.

Navigating HTML Report

Learn more about Cellebrite Inspector here.

Share this post