What Cellebrite Physical Analyzer is

An extraction is just a large bundle of files and databases. Physical Analyzer, usually shortened to PA, reads that bundle, works out which app each database belongs to and shows the content as chats, calls, locations, photos and timelines. It also lets the examiner look at the raw hexadecimal data and the SQLite tables behind every parsed item, which is how a careful examiner checks that the tool decoded a record correctly rather than taking the summary on trust.

Cellebrite has run two lines of the product. PA 7 is the long-serving version and Cellebrite says it shares the same decoding abilities as Inseyets.PA. PA Ultra, also known as Physical Analyzer 8.x, moved to a database design and has transitioned into Inseyets.PA 10.x. PA 7 is now on Cellebrite's discontinued list. The decoding skills carry over. What a learner must add is an understanding of the new case database, the Cellebrite Max dongle requirement and the fact that cloud extraction now sits inside the same program.

Primary applications

Where it is used

  • Decoding extractions produced by UFED, Inseyets.UFED and Premium
  • Searching chats, call logs, media and location records across many apps
  • Verifying parsed results against the underlying SQLite tables and hex
  • Building timelines that combine app activity, device events and media metadata
  • Producing UFDR reports for investigators and prosecutors
  • Ingesting cloud warrant returns alongside device data

Who uses it

  • Mobile forensic examiners in laboratories
  • Analysts preparing evidence for investigators and courts
  • Expert witnesses explaining how a record was decoded
  • Students learning app database analysis

Capabilities and limits

Major capabilities

  • Parsing of app databases into readable artefacts with links back to the source record
  • Hex and SQLite views for manual verification
  • Timeline, search, filtering and tagging across a whole extraction
  • Media viewing with categorisation support
  • UFDR export for the free Cellebrite Reader
  • Database-backed case handling in Inseyets.PA 10.x for very large extractions
  • Runs on a standard forensic workstation with a Cellebrite dongle

Technical limitations

  • A parser can miss or misread an app version it has not seen, so manual checking of key records is part of the job
  • Deleted records are recovered only where the database still holds them; the tool cannot restore what has been overwritten
  • PA 7 is being discontinued, so labs must plan the move to Inseyets.PA and retrain on its case database
  • Decoding depends on the quality of the extraction; a logical extraction gives far less to decode

Learning with DFRTI

Independent professional education covering the principles and workflows of Cellebrite Physical Analyzer. DFRTI is not a vendor training centre and its courses are not vendor certifications.

Before you learn it

  • SQLite structure: tables, rows, deleted record space and write-ahead logs
  • How iOS and Android store messages, media and location data
  • Report writing that separates what the tool parsed from what the examiner concludes

Disciplines

Courses that cover this tool

Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.

Go deeper with DFRTI

Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.