This Little Brite of Mine - Mobile Forensics for Fun and (Sometimes) Profit

This talk looks at Cellebrite's UFED platform and why an end-of-life UFED Touch unit can still be worth using. The speaker walks through the product family, from the PC software and the Touch tablet to the laptop, the analyzer that processes extraction files, and the digital collector for Windows and Mac systems. Capabilities depend heavily on the license attached to a unit, and the speaker explains how license expiry limits updates and support.

Much of the session covers where used units turn up and what to inspect before paying for one. Auction sites, online marketplaces and government surplus listings are the main sources, and buyers should watch for storage that has been wiped, firmware locks and missing adapters. The speaker also discusses resale of surplus lots and how an active license changes what a unit can do. Two real examples show the recovery side: returning a phone found at a shooting range to its owner, and pulling family photos from a deceased relative's old phones. One device was blocked by full-disk encryption, and the speaker asked the audience for help with it.

The talk closes with ethics and legal points, including consent, privacy, end-user license terms and local rules such as private investigator licensing. A live demonstration on an older unit runs into display and startup problems, so the extraction does not finish on stage. The questions that follow cover license scope, device generations and whether newer phones need physical access. The takeaway is that older forensic tools remain useful when sourcing, licensing and handling are checked first.