Cellebrite UFED.

Cellebrite is an Israeli digital intelligence company best known for UFED (Universal Forensic Extraction Device) and the analysis suite Physical Analyzer / Inseyets. Its hardware and software let law-enforcement, intelligence services and corporate DFIR teams perform logical, file-system and physical extractions from iOS and Android phones, recover deleted records and parse hundreds of app formats including chat, calls, location and cloud artefacts. Cellebrite supports passcode-unlock workflows (Premium) and produces court-ready reports for chain-of-custody handling.

How an extraction flows

flowchart LR
  A[Seized device] --> B{Access method}
  B -->|Logical| C[Backup / API pull]
  B -->|File-system| D[Agent or exploit]
  B -->|Physical| E[Bootloader / chip-off]
  C --> F[UFED extraction]
  D --> F
  E --> F
  F --> G[Physical Analyzer decode]
  G --> H[Deleted-record carving]
  G --> I[App DB parsing]
  H --> J[Court-ready report]
  I --> J

The tools have drawn scrutiny. In April 2021 Signal's Moxie Marlinspike published "Exploiting vulnerabilities in Cellebrite," showing that UFED and Physical Analyzer had arbitrary-code-execution flaws: a specially crafted file placed on a scanned device could run code on the examiner's Windows machine, potentially tainting past and future evidence. He noted the suite bundled a 2012-era FFmpeg build carrying scores of unpatched vulnerabilities, and shipped Apple-signed DLLs without licence. Cellebrite has also been criticised for sales to authoritarian regimes. Defensively, examiners run extractions on isolated, validated workstations, hash images before analysis, and document tool versions to preserve admissibility.