菜单
Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Compressive Vasomotion Hypothesis (CVH) — vasomotion as a fast compression sweep that collapses ambivalent neural resonances (the Bayesian-blur problem) into a definite state. Use when modeling the ~100ms taṇhā 'grab', precision-weighting as compression forcefulness, or the generative collapse step of vasocomputational active inference.
Latched Hyperprior Hypothesis (LHH) — a sustained vascular contraction engages the smooth-muscle latch-bridge, durably freezing a circuit as a committed hyperprior isolated from global updating; unlatches when its prediction resolves. Use when modeling durable commitments, trauma/PTSD as cemented priors, latch spirals, or the cross-substrate latch (mechanical/bioelectric/immune/sheaf).
Synaptic substrate of biological active inference — long-term potentiation/depression (LTP/LTD) writes priors into synaptic weights = the learning landscape (Deep CANALs). A held vascular latch annealed long enough crystallizes into a neuron prior. Use when modeling consolidation, neuron priors, the inference→learning landscape write-path, or commit-to-disk of a held prediction.
Immune substrate of biological active inference — microglia + complement (C1q→C3b→CR3) tag and phagocytose synapses, acting as the body's TMS justifier / garbage collector. Immunosurveillance = nogood-repair; autoimmunity = the false nogood. Use when modeling immune editing of neural priors, neuroinflammation gating plasticity, or the immune-vascular latch coupling.
Vascular Clamp Hypothesis (VCH) — vascular contraction freezes local neural patterns and plasticity for its duration, storing a specific active-inference prediction as vascular tension = medium-term memory. Use when modeling predictions-as-tension, the FEP-AI top-down model store, or the witness/hold step of vasocomputation.
Vasocomputation paradigm — vascular smooth-muscle (VSMC) tension as the brain's hidden top-down predictive store, unifying Buddhist taṇhā, active inference, and physical reflex (Johnson 2023). Use when modeling held predictions as somatic tension, locating where FEP top-down models hide, building embodied active-inference agents, or relating suffering/clearing to obligation cohomology H¹.
| name | performing-mobile-device-forensics-with-cellebrite |
| description | Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts. |
| domain | cybersecurity |
| subdomain | digital-forensics |
| tags | ["forensics","mobile-forensics","cellebrite","smartphone-analysis","ios-forensics","android-forensics"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
# CRITICAL: Immediately place device in airplane mode or Faraday bag
# This prevents remote wipe commands and additional data changes
# Document device state before acquisition
# Record: make, model, IMEI, serial number, OS version, screen lock status
# Photograph the device from all angles
# For Android - Enable USB debugging if accessible
# Settings > Developer Options > USB Debugging > Enable
# For iOS - Trust the forensic workstation
# When prompted on device, tap "Trust This Computer"
# If device is locked, document lock type (PIN, pattern, biometric)
# Cellebrite UFED can bypass certain lock types depending on device model
# Install open-source tools as alternatives
pip install aleapp # Android Logs Events And Protobuf Parser
pip install ileapp # iOS Logs Events And Properties Parser
sudo apt-get install libimobiledevice-utils # iOS acquisition on Linux
# === Cellebrite UFED Acquisition ===
# 1. Launch UFED 4PC or connect UFED Touch
# 2. Select Device > Identify device model automatically
# 3. Choose extraction type:
# - Logical: App data, contacts, messages, call logs (fastest, least data)
# - File System: Full file system access including databases
# - Physical: Bit-for-bit image including deleted data (most complete)
# - Advanced (Checkm8/GrayKey): For locked iOS devices (specific models)
# 4. Select output format and destination
# 5. Begin extraction
# === Open-source iOS acquisition with libimobiledevice ===
# List connected iOS devices
idevice_id -l
# Get device information
ideviceinfo -u <UDID>
# Create iOS backup (logical acquisition)
idevicebackup2 backup --full /cases/case-2024-001/mobile/ios_backup/
# For encrypted backups (contains more data including passwords)
idevicebackup2 backup --full --password /cases/case-2024-001/mobile/ios_backup/
# === Android acquisition with ADB ===
# List connected devices
adb devices
# Full backup (requires screen unlock)
adb backup -apk -shared -all -f /cases/case-2024-001/mobile/android_backup.ab
# Extract specific app data
adb shell pm list packages | grep -i "whatsapp\|telegram\|signal"
adb pull /data/data/com.whatsapp/ /cases/case-2024-001/mobile/whatsapp/
# For rooted Android devices - full filesystem
adb shell "su -c 'dd if=/dev/block/mmcblk0 bs=4096'" | \
dd of=/cases/case-2024-001/mobile/android_physical.dd
# Hash the acquisition
sha256sum /cases/case-2024-001/mobile/*.dd > /cases/case-2024-001/mobile/acquisition_hashes.txt
# === Android analysis with ALEAPP ===
# ALEAPP processes Android file system extractions
python3 -m aleapp \
-t fs \
-i /cases/case-2024-001/mobile/android_extraction/ \
-o /cases/case-2024-001/analysis/aleapp_report/
# ALEAPP extracts and reports on:
# - Call logs, SMS/MMS messages
# - Chrome browser history and searches
# - WiFi connection history
# - Installed applications
# - Google account activity
# - Location data (Google Maps, Photos)
# - WhatsApp, Telegram, Signal messages
# - App usage statistics
# - Device settings and accounts
# === iOS analysis with iLEAPP ===
python3 -m ileapp \
-t tar \
-i /cases/case-2024-001/mobile/ios_backup.tar \
-o /cases/case-2024-001/analysis/ileapp_report/
# iLEAPP extracts and reports on:
# - iMessage and SMS messages
# - Safari browsing history
# - WiFi and Bluetooth connections
# - Health data and location history
# - App usage (KnowledgeC)
# - Photos with EXIF/GPS data
# - Notes, Calendar, Reminders
# - Keychain data (if decryptable)
# - Screen time data
# Extract WhatsApp messages from Android
python3 << 'PYEOF'
import sqlite3
import os
# WhatsApp database location
db_path = "/cases/case-2024-001/mobile/android_extraction/data/data/com.whatsapp/databases/msgstore.db"
if os.path.exists(db_path):
conn = sqlite3.connect(db_path)
cursor = conn.cursor()
# Extract messages
cursor.execute("""
SELECT
key_remote_jid AS contact,
CASE WHEN key_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,
data AS message_text,
datetime(timestamp/1000, 'unixepoch') AS msg_time,
media_mime_type,
media_size
FROM messages
WHERE data IS NOT NULL
ORDER BY timestamp DESC
LIMIT 1000
""")
with open('/cases/case-2024-001/analysis/whatsapp_messages.csv', 'w') as f:
f.write("contact,direction,message,timestamp,media_type,media_size\n")
for row in cursor.fetchall():
f.write(','.join(str(x) for x in row) + '\n')
conn.close()
print("WhatsApp messages extracted successfully")
PYEOF
# Extract iOS iMessage/SMS from sms.db
python3 << 'PYEOF'
import sqlite3
db_path = "/cases/case-2024-001/mobile/ios_extraction/HomeDomain/Library/SMS/sms.db"
conn = sqlite3.connect(db_path)
cursor = conn.cursor()
cursor.execute("""
SELECT
h.id AS phone_number,
CASE WHEN m.is_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,
m.text,
datetime(m.date/1000000000 + 978307200, 'unixepoch') AS msg_time,
m.service
FROM message m
JOIN handle h ON m.handle_id = h.ROWID
ORDER BY m.date DESC
""")
with open('/cases/case-2024-001/analysis/imessage_sms.csv', 'w') as f:
f.write("phone,direction,text,timestamp,service\n")
for row in cursor.fetchall():
f.write(','.join(str(x) for x in row) + '\n')
conn.close()
PYEOF
# Extract GPS data from photos
pip install pillow
python3 << 'PYEOF'
from PIL import Image
from PIL.ExifTags import TAGS, GPSTAGS
import os, json
def get_gps(exif_data):
gps_info = {}
for key, val in exif_data.items():
decoded = GPSTAGS.get(key, key)
gps_info[decoded] = val
if 'GPSLatitude' in gps_info and 'GPSLongitude' in gps_info:
lat = gps_info['GPSLatitude']
lon = gps_info['GPSLongitude']
lat_val = lat[0] + lat[1]/60 + lat[2]/3600
lon_val = lon[0] + lon[1]/60 + lon[2]/3600
if gps_info.get('GPSLatitudeRef') == 'S': lat_val = -lat_val
if gps_info.get('GPSLongitudeRef') == 'W': lon_val = -lon_val
return lat_val, lon_val
return None
locations = []
photo_dir = "/cases/case-2024-001/mobile/ios_extraction/CameraRollDomain/Media/DCIM/"
for root, dirs, files in os.walk(photo_dir):
for fname in files:
if fname.lower().endswith(('.jpg', '.jpeg', '.heic')):
try:
img = Image.open(os.path.join(root, fname))
exif = img._getexif()
if exif and 34853 in exif:
coords = get_gps(exif[34853])
if coords:
locations.append({'file': fname, 'lat': coords[0], 'lon': coords[1]})
except Exception:
pass
with open('/cases/case-2024-001/analysis/photo_locations.json', 'w') as f:
json.dump(locations, f, indent=2)
print(f"Found {len(locations)} geotagged photos")
PYEOF
# Extract location history from Google Location History (Android)
# File: /data/data/com.google.android.gms/databases/lbs.db
# or exported Google Takeout location data
| Concept | Description |
|---|---|
| Logical extraction | Extracts accessible user data through device APIs (contacts, messages, photos) |
| File system extraction | Full access to the device file system including app databases |
| Physical extraction | Bit-for-bit copy of device storage including deleted and unallocated data |
| UFED | Universal Forensic Extraction Device - Cellebrite's flagship acquisition platform |
| ADB | Android Debug Bridge for communicating with Android devices |
| KnowledgeC | iOS database tracking detailed app and device usage patterns |
| SQLite databases | Primary storage format for mobile app data (messages, contacts, history) |
| Checkm8 | Hardware-based iOS exploit enabling extraction on A5-A11 devices |
| Tool | Purpose |
|---|---|
| Cellebrite UFED | Commercial mobile device acquisition and analysis platform |
| Cellebrite Physical Analyzer | Deep analysis of mobile device extractions |
| ALEAPP | Open-source Android artifact parser and report generator |
| iLEAPP | Open-source iOS artifact parser and report generator |
| libimobiledevice | Open-source iOS communication library |
| Magnet AXIOM | Commercial mobile and computer forensics platform |
| MEAT | Mobile Evidence Acquisition Toolkit |
| ADB | Android Debug Bridge for device interaction and data extraction |
Scenario 1: Criminal Communications Investigation Acquire device with UFED physical extraction, decrypt messaging databases, extract WhatsApp/Telegram/Signal conversations, recover deleted messages from WAL files, build communication timeline, export for legal proceedings.
Scenario 2: Employee Data Theft via Personal Phone Perform logical extraction with employee consent, analyze corporate email and cloud storage app data, check for screenshots of confidential documents, review file transfer app activity, examine browser history for cloud uploads.
Scenario 3: Missing Person Location Tracking Extract location data from Google Location History, parse GPS data from photos, analyze WiFi connection history for last known locations, check fitness app data for movement patterns, examine messaging apps for last communications.
Scenario 4: Child Exploitation Investigation Physical extraction preserving all data including deleted content, hash all images against NCMEC/ICSE databases, extract communication records, recover deleted media from unallocated space, document chain of custody meticulously for prosecution.
Mobile Forensics Summary:
Device: Samsung Galaxy S23 Ultra (SM-S918B)
OS: Android 14, One UI 6.0
IMEI: 353456789012345
Extraction: Physical (via Cellebrite UFED)
Duration: 45 minutes
Extracted Data:
Contacts: 1,234
Call Logs: 5,678
SMS/MMS: 3,456
WhatsApp Msgs: 12,345 (234 deleted, recovered)
Telegram Msgs: 2,345
Photos/Videos: 4,567 (345 geotagged)
Browser History: 2,345 URLs
WiFi Networks: 67 saved connections
Installed Apps: 145
Key Findings:
- Deleted WhatsApp conversation with suspect recovered
- 23 geotagged photos at crime scene location
- Browser searches related to investigation subject
- Signal app used during incident timeframe (encrypted, partial recovery)
Reports:
ALEAPP Report: /analysis/aleapp_report/index.html
Messages Export: /analysis/whatsapp_messages.csv
Locations: /analysis/photo_locations.json