Cellebrite UFED

UFED stands for Universal Forensic Extraction Device. For many years it was the unit or the computer program that an examiner connected a seized phone to, so the phone's contents could be copied in a controlled and recorded way. Those copies come in grades. A logical extraction asks the phone's own software for data such as contacts, call logs and messages. A file system extraction copies the folders and database files that apps keep, which gives far more than the logical view. A physical extraction tries to copy the storage at a lower level, which on a modern encrypted phone is rarely possible without a separate access capability.

Cellebrite now describes UFED as the extraction engine of Inseyets and its own pages call it Inseyets.UFED. The older bundle sold as UFED Ultimate, which paired UFED 4PC with Physical Analyzer, sits on Cellebrite's list of products being discontinued as customers move to Inseyets. The examiner's job has not changed much. One still has to decide which extraction type a given handset allows, keep the phone isolated from mobile and Wi-Fi networks during the work and record every setting and hash so the extraction can be explained in court.