u/shoe_box_

Either I'm missing something obvious (totally possible) or Cellebrite reader is dumb. Help.

Edit to add: I'm a solo investigator and don't have PA or Axiom, so I just work with whatever I get in a UFDR.

When I review extractions in Cellebrite Reader I get overwhelmed with duplicates and junk files. And I mean everything. Media, artifacts, messages, etc.

I understand certain events can create effectively identical artifacts in multiple databases. That's fine, but Reader doesn't have a way to filter sources that I can find. If I could, for example, hide KnowledgeC or Contacts, that would thin out the timeline or search results dramatically so I could actually find things. I often find myself exporting Excel files so I can deduplicate and review/search in other ways. Location data is a great example of this when I want to pull data and plot things on a map.

I find that the deduplicate filter never does anything.

Part 2 is media: my dream is that I could simply browse through a phone's photo app like a normal person using a phone. What I always find in the media browser, however, are hundreds of thousands of photos, including cached preview images, little tiny graphic emoji buttons, logos, etc from every app installed on the phone. I don't seem to find a combo of filters that ever works.

If I could just scroll the photos and videos on the phone's native app that would be a total dream. Browsing cached photos from social apps, deleted items, etc. is important, but often secondary to an initial review.

How do y'all handle this stuff? I have to find some faster workflows. On my cases I generally need to do an initial high level review/triage of the whole thing--calls, messages and media, before anything detailed, and it just takes so long.

Thanks!

Last year I read about a site just like MDSave, where you can search by procedure/lab and find self-pay pricing. The site I checked out had far more providers in my area that Mdsave.

Are there any other similar sites out there? Google and Claude have not yielded the answer. Thanks!

Howdy all,

(Throat-clearing preamble: I'm a private defense investigator so I can't get Cellebrite training, from the vendor, anyway. I'm not a forensic analyst, am not going to testify, etc. but like to understand enough to look for leads before hiring a pro; time and financial resources always have to be considered and attorneys don't love hiring experts to go on fishing expeditions based on a long shot theory of mine.)

I look at Cellebrite reports all of the time and am pretty familiar with the basics. However, I was wondering if someone could help me with a few more technical questions.

Also, I'm very happy to be pointed towards any training resources.

- Is it correct that the Biome is not a complete log of device events? I read that it has more to do with something like a prediction engine and Siri but not certain.

- Are more complete logs (than Biome) accessible via database queries? If so, can those be accessed from within a UFDR report? Or does that require the FFS extraction? I usually get the UFDR report, but sometimes get the zipped FFS as well.

- To open a Cellebrite FFS or Greykey extraction requires law enforcement grade tools like Physical Analyzer, correct?

- Are DevicePluginStatus events in Biome exactly what they appear to be? Someone is plugging/unplugging the cable at those time stamps?

- In the timeline I see Power Events (mobileactivationd.log) but only Power On. Are Power Off events not logged?

I have so many questions, but if y'all could help with these that would be brilliant!

-