Cellebrite Release Notes

What’s New in Endpoint Inspector SaaS 2.6

Mobile Test Devices

Each instance of Endpoint Inspector can register up to two mobile devices for testing purposes. You may find this useful for testing updates to your Endpoint Inspector instance or the mobile collection agents, to test your network configuration, or to test a new mobile OS version. Test devices may also be useful for audits, compliance, or certification purposes, and even for training new users of Endpoint Inspector.
All normal collection capabilities are available with no limitations. Test devices have no affect on the mobile collections entitled by your license. To remove a test device, please contact Cellebrite customer support at [email protected].
An Endpoint Inspector administrator can either register an existing mobile device as a test device or register an entirely new mobile device as a test device. When you register an entirely new device, the owner of the device receives an email message from your instance of Endpoint Inspector. The device owner follows instructions in that email message to download and use the mobile agent to enable the initial collection required for registration. After a mobile device is registered as a test device, you can request collections from it exactly as you would from any other mobile device. You can see and manage its collections on the Collections page, review a collection’s details, and examine the collection in Cellebrite Inspector. You can the status of your test devices on the License page. For more information, see the “What’s New” chapter of the Endpoint Inspector User Guide.

Mobile Collection Features Now Available in the UK

Customers in the UK can now use these recently released mobile collection features:

• Filtering by date range when decoding is enabled.
• Connecting your RelativityOne instance to your Endpoint Inspector instance, to enable collecting message data from mobile devices directly from within RelativityOne.
• RSMF file format for message collections from mobile devices.
  To use these features, you must acknowledge the Data Processing Agreement. For more information, see these topics in the Endpoint Inspector User Guide:
• Data Processing Agreement
• Filter by Data Range
• RelativityOne Integration
• Integration with RelativityOne
• Setting Up Your RelativityOne Connection to Endpoint Inspector
• Define a Mobile Collection

Workflow Enhancements

Small user interface enhancements were made to improve the workflows for defining mobile and computer collections. For computer collections, there are two new options for selecting according to file extensions

• Office Files includes these extensions for commonly searched office applications: DOC, DOCX, DOCM, DOT, XLS, XLSX, XLSB, XLSM, PPT, PPTX, PUB, PDF, TEXT, TXT, PAGES, NUMBERS, RTF, ACCDB, ACCDE, ACCDR, ACCDT, and ACCDU
• Email Files includes these email file types: EML, EMLX, MSG, MBOX, PST, and OST

New Advice for Custodians of iOS Devices

This advice is added to the information provided in the “Custodian Tips and Requirements” topic in the “Custodian Tasks” chapter of the Endpoint Inspector User Guide.

• For devices running on iOS 18.2 and later, open Settings and then tap FaceID&Passcode > Stolen Device Protection > Turn off.
  To note: These features are available only for Endpoint Inspector SaaS. There are no new or changed features for Endpoint Inspector on-premise.
  For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the
  MyCellebrite Portal.

Image Analyzer Update

These categories were added to Image Analyzer:

• Aircraft
• Medical
• Meme
• Offensive Gesture
• Schematic

Bitlocker Improvements

Bitlocker Improvements

Improvements were made to the workflow and user interface for decrypting and ingesting evidence sources protected by Bitlocker.

Improvements to Filtering

These improvements were made to filtering within specific views:

• For Internet History in the Actionable Intel view, Safari (10+) was changed to simply be Safari. This is consistent will all other views and ensures consistent filtering behavior.
• You can now use the colon (:) as an OR filter, the same way you can in the File Filter view. For example, in a text entry view filter such as Participants, typing ParticipantFirst:ParticipantSecond:ParticipantThird returns all results where participant is ParticipantFirst, or ParticipantSecond, or ParticipantThird.

For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the MyCellebrite Portal.

What’s New in Endpoint Inspector SaaS 2.5

Decoding and Filtering Mobile Collections

Until this release, choosing the categories of data for the Endpoint mobile agent to target has been the only way to narrow the focus of a mobile collection.
Endpoint Inspector SaaS version 2.5 lets you additionally filter the resulting mobile collection file by enabling decoding. Decoding creates meaning from the raw data, thereby allowing you to apply additional filters. The resulting collection includes both UFDR and RSMF files. The precision enabled by decoding and filtering ensures that only relevant data is collected, resulting in smaller, more refined mobile collection files.
This release makes the first decoding filter available, which is date range. If you specify a date range, data is collected for the selected categories only when at least one of these activities falls within that range: sent, received, last written, and last accessed. You can also choose whether to include or exclude mobile data that has none of these dates. If you do not specify a date range, all mobile data is collected from the selected categories.
You must enable decoding at the time you define a mobile collection with Endpoint Inspector or RelativityOne. You cannot decode and filter a collection after it is complete.

Online Help

From the new Resources page in the Endpoint Inspector web interface, you can now access all technical publications in the form of online help. You can also send an email to Cellebrite technical support.

Update Requirements

Cellebrite updates environments for Endpoint Inspector SaaS over the course of the day of release. After your environment is updated, users may need to clear their browser cache to ensure the newest user interface is loaded. Endpoint Inspector may prompt users to do so.

Mobile Agent on Windows Computers

On Windows computers, the mobile agent must be uninstalled before installing a newer version. New mobile agents cannot be installed directly over a previous version of the mobile agent on Windows computers.

Linux Agents

Endpoint agents for Linux computers cannot be updated directly from version 2.2.3 to version 2.3. Linux agents must first be uninstalled, then you can install version 2.3.

To note: Note: These features are available only for Endpoint Inspector SaaS. There are no new or changed features for Endpoint Inspector on-premise.

For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the MyCellebrite Portal.

Cellebrite is pleased to announce the following new features in this release of Endpoint Inspector.

Note: These integration features are available only for Endpoint Inspector SaaS. This release for Endpoint Inspector on-premise will be available later this month.

Integration with RelativityOne

Cellebrite is pleased to announce the integration of Endpoint Inspector with RelativityOne. With your RelativityOne instance connected to your Endpoint Inspector instance, you can seamlessly collect messages and attachments from remote devices running on Android and iOS with the speed and precision of Endpoint Inspector, without ever leaving RelativityOne.
Each export package that Endpoint Inspector automatically sends to your RelativityOne storage repository includes these files:

• The original collection file in UFED zip format
• Messages and attachments in an RSMF collection
• The UFED reader file (UFDR]
• The Device Report
• The Collection Report
• The Results.csv file

Getting Support

For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the MyCellebrite Portal.

Mobile Agent Branding

Organizations can now customize the branding of the Endpoint mobile agent, including the name and icon. This is particularly beneficial for service providers. Contact Cellebrite for customization options.

Enhanced Mobile Collection Information

The Details panel for completed mobile collections now includes more information about the device, such as:

• Types of data targeted in the collection.
• Device details and a list of installed apps, indicating whether they were installed by the system or the user.
  PDF files with this information, along with the collection summary, are also uploaded to the repository.

Enhanced iOS Message Collections

When selecting Messages for a mobile collection, messages and their attachments from popular third-party apps (such as WhatsApp, Facebook Messenger, Line, and approximately 15 others) are now automatically collected from iOS devices.

Features Exclusive to Endpoint Inspector SaaS

Single Sign On with Multi-factor Authentication Endpoint

Inspector SaaS users can now implement single sign-on (SSO) with multi-factor authentication (MFA), enhancing security and simplifying access management.

Deployment for Endpoint Inspector SaaS

SaaS Endpoint servers will be updated over the course of the day of release. After your Endpoint server is updated, users may need to clear their browser cache to load the newest user interface. Endpoint Inspector may prompt users to do so. This ensures that each user will see the updated interface.

Linux Agents

Endpoint agents for Linux computers cannot be updated directly from version 2.2.3 to version 2.3. Linux agents must first be uninstalled, then you can install version 2.3.

Features Exclusive to Endpoint Inspector On-Premise

These features were previously available to customers using Endpoint Inspector SaaS.

Enhanced iOS Message Collection

The process for collecting messages from iOS devices has been streamlined. Now, when you select Messages for mobile collection, all attachment types—such as images, videos, audio, and documents—are automatically included in the collection from iOS devices.

Improved WhatsApp Cloud Collection

Collecting data from WhatsApp has become more efficient. The collection now starts immediately once the custodian scans the authorization QR code, speeding up the process.

Deployment for Endpoint Inspector On-Premise

Endpoint Inspector On-Premise must be updated incrementally unless specified otherwise. In other words, you cannot skip a version when you update the Endpoint server. For example, you cannot update to version 3 directly from version 1. You must first update to version 2, then update to version 3.

Note: On-premise Endpoint servers must be updated from version 1.8 directly to version 2.2. No intermediate version was released for on-premise servers. From there, servers can be updated to version 2.3.

What’s New in Endpoint Inspector 2.2

Deployment for Endpoint Inspector SaaS

SaaS Endpoint servers will be updated over the course of the day of release. After your Endpoint server is updated from version 2.1 to 2.2, each user must clear their web browser’s cache before they log in. This ensures that each user will see the updated interface. (This is necessary only for this release, not all releases.)

Deployment for Endpoint Inspector On-Premise

Endpoint Inspector on-premise must be updated incrementally unless specified otherwise. In other words, you cannot skip a version when you update the Endpoint server. For example, you cannot update to version 3 directly from version 1. You must first update to version 2, then update to version 3.

Note: On-premise Endpoint servers must be updated from version 1.8 directly to version 2.2. No intermediate version was released for on-premise servers.

Agent for Linux Computers

Cellebrite is pleased to announce that Endpoint Inspector can now collect data from Linux computers running either RedHat RHEL 9.3 or Ubuntu 22.04 LTS.

Linux collection capabilities are similar to capabilities for collecting from Mac and Windows computers. You can target specific files for collection, create disk images, and collect incident response information and artifacts. However, volatile artifact collections from Linux computers do not include screen shots or clipboard data. Linux collection and image files are in L01 format. You can ingest collections from Linux computers into Inspector for examination.

Android 14 Support

Mobile collections can now be made from devices running Android 14.

Enhancements to the Server Interface

The web interface for the Endpoint server has been improved to enhance usability and optimize workflows.

Improvement to WhatsApp Cloud Collections

WhatsApp cloud collections have been improved. Profile pictures are now included in the collected data.

Documentation and Guides

For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the MyCellebrite Portal.

What’s New in Cellebrite Digital Collector 3.7

Support for macOS Sonoma 14.3

Mac T2, M1, and M2 computers running macOS Sonoma 14.3 can be started (booted) from Digital Collector as well as run Digital Collector live.

Digital Collector Devices

On 120 GB dongles updated to version 3.7, the DCData partition is a bit smaller than in version 3.6.

Improvement to the Image View

In the Image view, the Image Name field was moved to just above the Destinations box. This change ensures that the image file has the same name across all destinations. The Image Name field also now ensures that you can type only characters that are valid.

Improved Logging Information

The new Acquisition Hardware folder contains a file named SystemSummary.txt. That file contains information about the computer that Digital Collector is running from. The AcquisitionLog.txt file provides information about the computer that is the source of the acquired data.

For more enhancements and issues fixed in this release, a user guide, and a quick start guide, visit the MyCellebrite Portal.

Get ready to simplify the extraction workflow for even more devices with the new UFED and Responder v7.69 update.

What’s new:

• Full file system support using Smart Flow for the following devices:
  • Samsung Galaxy S23 FE, A05, A15, A25
  • Samsung Galaxy Tab A9, Tab A9+, Tab S9, Tab S9+, Tab S9 Ultra, Tab S9 FE, Tab S9 FE+
  • Motorola Moto G14, Moto G34, Moto G54, Moto G84
• Infrastructure changes to enhance memory usage during extraction and accommodate newer, larger mobile devices.

For more information about about the new capabilities and features, read the Release Notes document available to you on the MyCellebrite Portal.