Jump to content

Cellebrite XML Report source with Cellebrite tags


Recommended Posts

Dear community,

I sent off a Cellebrite phone collection to be reviewed (along with the UFED Reader application). The reviewers tagged a bunch of items using Cellebrite Reader and then saved the results in a .pas (session) file. They now want me to create a load file of their tagged items.

My thoughts: perhaps they can just email me their .pas session file containing their Cellebrite tags, I can load it up in Cellebrite (along with the original phone data), generate an XML report (which will hopefully contain their tagged items identified), use that XML report folder as a source in Intella, and create a load file for them.

So far: They sent me the .pas file. It loaded fine and I see their tagged items in Cellebrite (all good so far). I created a Cellebrite XML report and searched the resulting XML file for their tag names - they exist in the XML file (still good). I created a new Intella v2.2.1 case, set the Cellebrite XML report folder as a source and indexed (still good and going to plan).

Plan appears foiled: In Intella I do not see anything relating to their Cellebrite tags. I searched the case for their tag names = nothing. My plan seems like it won't work - Intella is not identifying the reviewers' tagged items as such after processing. Intella sees the data fine, just not the tags. <- as far as I can tell.

Perhaps I will have to process the Cellebrite phone collection with Intella (ufdr as source) and have them tag from within Intella??

Is that my only / best option to get to the final goal of a load file of their items of interest?


Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...