Jump to content
llanowar

Cellebrite XML Report source with Cellebrite tags

Recommended Posts

Dear community,

I sent off a Cellebrite phone collection to be reviewed (along with the UFED Reader application). The reviewers tagged a bunch of items using Cellebrite Reader and then saved the results in a .pas (session) file. They now want me to create a load file of their tagged items.

My thoughts: perhaps they can just email me their .pas session file containing their Cellebrite tags, I can load it up in Cellebrite (along with the original phone data), generate an XML report (which will hopefully contain their tagged items identified), use that XML report folder as a source in Intella, and create a load file for them.

So far: They sent me the .pas file. It loaded fine and I see their tagged items in Cellebrite (all good so far). I created a Cellebrite XML report and searched the resulting XML file for their tag names - they exist in the XML file (still good). I created a new Intella v2.2.1 case, set the Cellebrite XML report folder as a source and indexed (still good and going to plan).

Plan appears foiled: In Intella I do not see anything relating to their Cellebrite tags. I searched the case for their tag names = nothing. My plan seems like it won't work - Intella is not identifying the reviewers' tagged items as such after processing. Intella sees the data fine, just not the tags. <- as far as I can tell.

Perhaps I will have to process the Cellebrite phone collection with Intella (ufdr as source) and have them tag from within Intella??

Is that my only / best option to get to the final goal of a load file of their items of interest?

Thanks.

Share this post


Link to post
Share on other sites

Hi llanowar,

Can you check if the tags are shown in the item's Raw Data tab? Also, would it be possible to send us a (redacted) sample of the XML file for investigation? Feel free to open a support ticket if this is possible.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×