How do I process and expand Cellebrite (UFDR) images in FTK?



When adding a Cellebrite image (UFDR) to your case, follow the steps below.

1. In the Manage Evidence window (Evidence >> Add/Remove... ), click Add

2. Choose Individual File(s) as the Evidence Type.

2. Select Expand Compound Files >> Expansion Options... >> Cellebrite UFDR

3. Click OK to process the image(s).


After processing, you should be able to expand see the contents of the UFDR image as shown below.



Support to process and expand UFDR images was added to the 6.0 line of Forensic Tools.