The proper way to process UFED reports (.ufdr)

[reacan]

Hello!

Nice to see that IPED has a board now 💯

Looking to save some time on trial/error testing. Which processing options should I pay attention to when processing UFED reports (.ufdr)? I asume I should disable adding unallocated and file slacks, but is there anything else I should take into consideration?

Regards
Dāvis

[lfcnassif]

Hi @reacan,

This channel is a beta feature of github. And I delayed a board until now because we don't have a support team, but I hope users will help each other :)

Regarding your question, you don't need to disable unallocated and file slacks to process UFDR reports, because they don't exist in UFDR file, so those features will have no effect.

You must be aware of the phoneParsersToUse option in AdvancedConfig.txt files, I gave an explanation about it in #309, will copy here:

Another option is to change the "phoneParsersToUse" option from "internal" to "external" in conf/AdvancedConfig.txt file in the used profile. With that, IPED will use the results parsed by Cellebrite software, instead using its internal parser to decode the chats.

Be aware the resuts between "internal" and "external" parsers are different. The first does a much better job to link attachments (sha-256 hash needs to be enabled for that), including renamed, moved or carved ones. The last recovers deleted messages and chats, internal parser does not support that for now.

[reacan]

Thank you for the elaborate explanation and all the hard work that you and all the other developers are doing 👍 Community board is a really great idea :)

[lfcnassif]

You're welcome!