NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.Cellebrite
Cellebrite UFED Cloud
UFED Cloud is Cellebrite's component for collecting data from cloud services tied to a device, using tokens found on the phone or credentials provided under legal authority. Cellebrite now ships this inside Inseyets.PA.
SoftwareCommercialTransitioning
Profile
- Manufacturer
- Cellebrite
- Category
- Mobile forensics
- Product type
- Software
- Platforms
- Not stated by the manufacturer
- Licensing
- Commercial
- Product status
- Transitioning
- Educational level
- Intermediate
- Last verified
- 2 November 2026
No standalone UFED Cloud product page was reachable on 2 Nov 2026. The Inseyets FAQ lists Cloud Analyzer as discontinued and describes UFED Cloud as an Inseyets feature using device-based tokens or known credentials. Cellebrite's April 2024 explainer says cloud extraction is included in Inseyets.PA and no longer a separate component.
What Cellebrite UFED Cloud is
A phone extraction captures what is on the handset. Much of a person's data, however, sits with cloud services: backups, photo libraries, email, social media and messaging accounts. UFED Cloud is the Cellebrite component that reaches those services. It can use authentication tokens recovered from an extraction, so the examiner never needs the password, or it can use credentials obtained lawfully, for example from a consenting account holder or through a legal order served on the provider.
The name has moved around. The earlier product was UFED Cloud Analyzer, which Cellebrite's Inseyets FAQ now lists as discontinued. Cellebrite's April 2024 explainer says cloud extraction is included in Inseyets.PA and is no longer a separate component, while its Physical Analyzer FAQ still names UFED Cloud as one piece of the Inseyets suite. The legal side is the hard part. Collecting from a cloud account is a search of data held by a third party, and in India it must rest on the authority given under the applicable procedural law, with the scope limited to what that authority allows.
Primary applications
Where it is used
- Collecting cloud backups and account data linked to a lawfully examined phone
- Using tokens recovered from an extraction to access accounts without the password
- Collecting from an account with the holder's written consent, for example in a corporate or victim-side matter
- Preserving social media and messaging content before it changes or is deleted
- Bringing cloud data into the same Physical Analyzer case as the device data
Who uses it
- Mobile examiners handling cases where the device points to online accounts
- Investigators planning legal requests to cloud providers
- Corporate investigators working with consenting employees
- Students learning cloud evidence and its legal footing
Capabilities and limits
Major capabilities
- Token-based access using credentials recovered from a device extraction
- Credential-based access where the password is lawfully known
- Collection from cloud storage, social media, email and messaging services, as supported in the current release
- Output that is decoded and reviewed inside Physical Analyzer or Inseyets.PA
- Now included in Inseyets.PA rather than licensed as a separate add-on
Technical limitations
- Supported services and the data each returns change whenever the provider changes its platform
- Tokens expire and two-factor protection can block access, so timing after seizure matters
- Cloud collection is a live action against a third-party system; it must be covered by the legal authority and logged
- Cellebrite's own pages describe UFED Cloud differently from one another, so a lab should confirm what its licence includes
Learning with DFRTI
Independent professional education covering the principles and workflows of Cellebrite UFED Cloud. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- How authentication tokens work and why they matter for evidence
- The Physical Analyzer or Inseyets.PA workflow
- Procedural law on accessing stored data held by a service provider
Disciplines
Related tools
- Cellebrite InseyetsInseyets is Cellebrite's current flagship for mobile evidence. It puts the extraction side (Inseyets.UFED) and the decoding side (Inseyets.PA) under one name and one licence.Cellebrite
- Cellebrite Physical AnalyzerPhysical Analyzer is the decoding and analysis side of Cellebrite's mobile workflow. PA 7 is being discontinued and the database-backed PA Ultra has become Inseyets.PA 10.x.Cellebrite
- Oxygen Forensic DetectiveOxygen Forensic Detective is an all-in-one extraction and analysis tool for phones, cloud accounts, drones and other connected devices. On 2 November 2026 the maker's website could not be checked, so this profile is marked unverified.Oxygen Forensics
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- MSAB XRYXRY is MSAB's mobile data extraction software, sold as a family of modules and delivered on office, field, kiosk and tablet platforms. Its output is analysed in XAMN and managed through XEC.MSAB
Courses that cover this tool
NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.
MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reports
MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone cases
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.