llanowar Posted January 30, 2019 Report Posted January 30, 2019 Dear community, I sent off a Cellebrite phone collection to be reviewed (along with the UFED Reader application). The reviewers tagged a bunch of items using Cellebrite Reader and then saved the results in a .pas (session) file. They now want me to create a load file of their tagged items. My thoughts: perhaps they can just email me their .pas session file containing their Cellebrite tags, I can load it up in Cellebrite (along with the original phone data), generate an XML report (which will hopefully contain their tagged items identified), use that XML report folder as a source in Intella, and create a load file for them. So far: They sent me the .pas file. It loaded fine and I see their tagged items in Cellebrite (all good so far). I created a Cellebrite XML report and searched the resulting XML file for their tag names - they exist in the XML file (still good). I created a new Intella v2.2.1 case, set the Cellebrite XML report folder as a source and indexed (still good and going to plan). Plan appears foiled: In Intella I do not see anything relating to their Cellebrite tags. I searched the case for their tag names = nothing. My plan seems like it won't work - Intella is not identifying the reviewers' tagged items as such after processing. Intella sees the data fine, just not the tags. <- as far as I can tell. Perhaps I will have to process the Cellebrite phone collection with Intella (ufdr as source) and have them tag from within Intella?? Is that my only / best option to get to the final goal of a load file of their items of interest? Thanks. Quote
arjohn Posted February 1, 2019 Report Posted February 1, 2019 Hi llanowar, Can you check if the tags are shown in the item's Raw Data tab? Also, would it be possible to send us a (redacted) sample of the XML file for investigation? Feel free to open a support ticket if this is possible. Quote
llanowar Posted February 1, 2019 Author Report Posted February 1, 2019 Thanks for the reply. When I have the next opportunity, I will check the item's Raw Data tab. Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.