Cellebrite XML Report source with Cellebrite tags

[llanowar]

Dear community,

I sent off a Cellebrite phone collection to be reviewed (along with the UFED Reader application). The reviewers tagged a bunch of items using Cellebrite Reader and then saved the results in a .pas (session) file. They now want me to create a load file of their tagged items.

My thoughts: perhaps they can just email me their .pas session file containing their Cellebrite tags, I can load it up in Cellebrite (along with the original phone data), generate an XML report (which will hopefully contain their tagged items identified), use that XML report folder as a source in Intella, and create a load file for them.

So far: They sent me the .pas file. It loaded fine and I see their tagged items in Cellebrite (all good so far). I created a Cellebrite XML report and searched the resulting XML file for their tag names - they exist in the XML file (still good). I created a new Intella v2.2.1 case, set the Cellebrite XML report folder as a source and indexed (still good and going to plan).

Plan appears foiled: In Intella I do not see anything relating to their Cellebrite tags. I searched the case for their tag names = nothing. My plan seems like it won't work - Intella is not identifying the reviewers' tagged items as such after processing. Intella sees the data fine, just not the tags. <- as far as I can tell.

Perhaps I will have to process the Cellebrite phone collection with Intella (ufdr as source) and have them tag from within Intella??

Is that my only / best option to get to the final goal of a load file of their items of interest?

Thanks.

[arjohn]

Hi llanowar,

Can you check if the tags are shown in the item's Raw Data tab? Also, would it be possible to send us a (redacted) sample of the XML file for investigation? Feel free to open a support ticket if this is possible.

[llanowar]

Thanks for the reply. When I have the next opportunity, I will check the item's  Raw Data tab.