1. What Cellebrite Does For Extraction(s):

Android

Physical Extraction

• To allow the most comprehensive and detailed analysis of the device, Cellebrite’s physical extraction capability accesses the additional data layers, in both allocated and unallocated space, that construct the phone’s physical memory. These layers include three different groups of content pertinent to investigators:
  1. "Logical" content unavailable through API (e.g. call logs on smartphones and feature phones)
  2. Deleted content
  3. Content that the phone collects without any user action (and sometimes without user knowledge). For example: wi-fi networks, GPS locations, web history, email headers and EXIF data on images, and system data.

Logical Extraction

• Logical extraction of data is performed, for the most part, through a designated API (Application Programming Interface), available from the device vendor. Just as the API allows commercial third-party apps to communicate with the device OS (operating system), it also enables forensically sound data extraction.
• Upon connection, the UFED loads the relevant vendor API to the device. The UFED then makes read-only API calls to request data from the phone. The phone replies to valid API requests to extract designated content items such as text messages (SMS), phonebook entries, pictures, etc.

File System Extraction

• Another logical method extends the examiner’s reach to the phone’s live partition. Available with the UFED Ultimate license, a file system extraction uses different device-specific methods to copy the file system. While these are comparable to the API used in logical methods, they use different sets of built-in protocols, depending on the OS. The mix of protocols often differs from device family to device family.
• In some cases, not only with iOS devices as described above but also with Android and BlackBerry® models, it may be necessary to rely on device backup files to make available files, hidden files, and other data that is not necessarily accessible through the phone’s API.

iOS

Physical Extraction

• To allow the most comprehensive and detailed analysis of the device, Cellebrite’s physical extraction capability accesses the additional data layers, in both allocated and unallocated space, that construct the phone’s physical memory. These layers include three different groups of content pertinent to investigators:
  1. "Logical" content unavailable through API (e.g. call logs on smartphones and feature phones)
  2. Deleted content
  3. Content that the phone collects without any user action (and sometimes without user knowledge). For example: wi-fi networks, GPS locations, web history, email headers and EXIF data on images, and system data.

Logical Extraction

• It is possible for iOS device extractions to differ between the UFED Touch/UFED 4PC interface and the UFED Physical Analyzer.
• That’s because the UFED Touch/UFED 4PC obtains the Apple iTunes backup interface using its API, the Apple File Connection (AFC)—the same interface used to back up the device to a computer.

Advanced Logical Extraction

• Moreover, UFED Physical Analyzer makes three different types of iTunes backup (“Advanced Logical”) extractions possible.
  • Method 1 like the UFED Touch, relies on the iTunes backup using Apple’s backup infrastructure
  • Method 2 extracts backup data if the device is encrypted and the UFED operator does not know the device passcode
  • Method 3 is recommended for both encrypted and unencrypted jailbroken devices

File System Extraction

• Another logical method extends the examiner’s reach to the phone’s live partition. Available with the UFED Ultimate license, a file system extraction uses different device-specific methods to copy the file system. While these are comparable to the API used in logical methods, they use different sets of built-in protocols, depending on the OS. The mix of protocols often differs from device family to device family.
• In some cases, not only with iOS devices as described above but also with Android and BlackBerry® models, it may be necessary to rely on device backup files to make available files, hidden files, and other data that is not necessarily accessible through the phone’s API.

2. Understanding File Header Patterns:

Below is a basic matrix that matches file header to the file type of some of the generic files. Cellebrite uses these to understand what type each file is, e.g. FF D8 FF FE means it is a JPEG file. Afterwhich, they determine which category to place this file in, following the example JPEG would be in the images folder, etc.

4. Extracting Whatsapp Key Manually:

The below document shows how to extract the Whatsapp Key that allows you to decrypt the contents of the chats, etc from Whatsapp

This documentation guides you on how to decrypt the contents of Whatsapp (mostly chats, profile, etc) manually. Though it is optional for you to use this method as Whatsapp would be automatically decrypted by Cellebrite, in addition the download link for the batch script is no longer valid. (This documentation is the latest and is released in 2015).