How Endpoint Inspector SaaS Speeds Up the Collection Process and Gives You More Flexibility

It’s no secret that data collection can be a time-consuming undertaking. Managing and sorting the large amount of data that comes with mobile is a multi-step process. At least, it used to be.  

Today, modern mobile data collection is faster, easier and more flexible than ever with the latest version of Cellebrite’s Endpoint Inspector (EI). The newest version to our SaaS-based Endpoint Inspector platform, version 2.5, allows examiners direct decoding to UFDR, skipping the extra processing tools and sending the mobile data directly to review platforms like RelativityOne. 

Examiners also save time by using precision date filtering for targeted timeframes. This new feature means spending less time going through data you don’t need while also protecting employee privacy. Ultimately, the ability to collect mobile data from a specific timeframe leads to more accurate and accelerated case resolution. 

I have Endpoint Inspector 2.5. What’s Next? 

For Windows: 

Before getting started with the updated Endpoint Inspector 2.5 SaaS, it’s important to note that if you are a Windows user, the mobile agent cannot be installed over older versions. If you have previously installed the Endpoint mobile agent on your computer, it must be uninstalled before a new data collection is initiated. 

Windows users who are also running local virtual machines (such as VirtualBox) need to stop running the software before the collection process begins. USB drivers will break if a virtual machine is running while the Endpoint mobile agent is installed and running. Once collection from the mobile device is complete, virtual machine use can continue. 

Step 1: Check Your Cables 

First things first, you must use an appropriate cable to connect the device to your computer. The cable must comply with the USB3 protocol.  Some USB-A and USB-C cables will support this while some are only chargers.  

Also, check your mobile device to be sure it has the appropriate port. If it does not, you must use an adapter.  

Step 2: Mobile Device and Computer Housekeeping 

Now that you have the correct cables, the next step is to check your device and computer. Your device must be charged, and its ports must be clean. You also need to disable device locking.  

Verify the total amount of storage used on the device and make sure there’s at least that much space available on your computer.  

The computer’s screen needs to remain on during the collection. If the computer is running Netskope or another web monitoring service, make sure it’s disabled before installing the Endpoint mobile agent. 

If you haven’t already, download Chrome as it is the preferred web browser. And make sure to keep the web browser window open during collection. 

You’re Almost Ready to Start Your Collection 

One last thing to check before beginning your collection is to ensure there are not multiple devices connected to your computer. The Endpoint mobile agent will attempt to collect from the first device listed in the USB connections. If you have multiple devices connected, the first connection on the list may not be the device that contains the requested data. 

Finally, do not touch the mobile device or cable (unless prompted) until the collection is complete. 

For Android Devices: 

Android mobile devices should be set into airplane mode with the Wi-Fi disabled before the collection begins. If not, text messages sent to the device during the collection will not be received and will be lost. After the collection is complete and Wi-Fi is enabled again, any messages received during collection will be received. 

The device may also need to have the Google Play Protect turned off. Once the device is connected, check to see if it is in charging mode or file transfer mode. It’s in charging mode, file transfer must be enabled.  

After the collection begins, you will need to allow USB debugging on the mobile device. Select ‘Always Allow’ so you are not prompted several times during the collection. Once the collection is through, revoke the authorization by opening Developer Options on the device, scroll to USB Debugging and tap the toggle to revoke the authorization. 

For Apple Devices: 

Once you’ve connected to the Apple device, enter the iTunes backup password when prompted. This will ensure the targeted data can be collected. The backup password can be reset if needed. 

If a backup password hasn’t been set, it will automatically be 1234. Once the collection is complete, the backup password can be changed. After collection, there will be an attempt to delete the password created by Cellebrite. Cellebrite will not delete a password that a custodian sets. Online help is provided by Apple here: https://support.apple.com/en-us/108313  

Have Questions? We’re Here to Help! 

Our goal is to help your investigations be more efficient, accurate and faster – with fewer clicks. If you have questions, reach out to your sales representative or contact us via customer support. We are always here to help.

Share this post