Test Results for Mobile Device Acquisition Tool: CelleBrite UFED 1.1.8.6 - Report Manager 1.8.3 UFED Physical Analyzer 2.3.0

• NCJ Number: 238993
• Date Published: September 2012
• Length: 210 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

This document reports the results from testing CelleBrite's UFED, version 1.1.8.6 against the Smart Phone Tool Text Assertions and Test Plan.

Abstract

Test results provide the information needed for developers to improve tools, users to make informed choices, and the legal community and others to understand the tools' capabilities. The CelleBrite Universal Forensic Extraction Device (UFED) is designed for logical and physical acquisitions; data analysis; and report management from mobile phones, Smart Phones, Subscriber Identity Modules (SIMs), and Global Positioning System devices. The tool was tested for its ability to acquire active and deleted data from the internal memory of mobile devices and SIMs. Except for the following anomalies, the tool acquired all supported data objects completely and accurately for all nine mobile devices tested. The anomalies found pertain to personal information management (PIM) data, MMS messages, call logs, subscriber and equipment-related information, address book entries that contain non-ASCII characters, and device acquisition disruption. The remaining sections of the report describe how the tests were conducted, discuss any anomalies that were encountered, and provide documentation of test-case run details that support the report summary. Another section presents justification for the selection of test cases from the set of possible cases defined in the test plan for smart phone forensic tools. Generally, the test cases are selected based on features offered by the tool. Hardware and software used to run the test cases are listed. The concluding section of the report describes each test-case run. The description of each test run lists all test assertions used in the test case, the expected result, and the actual result. Extensive tables