[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVZ10MM2P2RAFQNAYHX6CD":3,"skill-same:01M6EVZ10MM2P2RAFQNAYHX6CD":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6EVZ10MM2P2RAFQNAYHX6CD","performing-mobile-device-forensics-with-cellebrite",null,"Acquire and analyze mobile device data using Cellebrite UFED and open-source tools to extract communications, location data, and application artifacts.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","forensics","device","mobile","cellebrite","performing mobile device forensics with cellebrite","android-forensics","communications","open-source","acquire","analyze","open","android","ios-forensics","smartphone-analysis","mobile-forensics","analysis","t1059","artifacts","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-mobile-device-forensics-with-cellebrite\ndescription: Acquire and analyze mobile device data using Cellebrite UFED and open-source\n  tools to extract communications, location data, and application artifacts.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- mobile-forensics\n- cellebrite\n- smartphone-analysis\n- ios-forensics\n- android-forensics\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1005\n- T1074\n- T1119\n- T1070\n- T1059\n---\n\n# Performing Mobile Device Forensics with Cellebrite\n\n## When to Use\n- When extracting evidence from smartphones or tablets during an investigation\n- For recovering deleted messages, call logs, and location data from mobile devices\n- During investigations involving communications via messaging apps\n- When analyzing mobile application data for evidence of criminal activity\n- For corporate investigations involving employee mobile device misuse\n\n## Prerequisites\n- Cellebrite UFED Touch\u002F4PC or UFED Physical Analyzer (licensed)\n- Alternative open-source tools: ALEAPP, iLEAPP, MEAT, libimobiledevice\n- Appropriate cables and adapters for target device\n- Faraday bag to isolate the device from network signals\n- Legal authorization (warrant, consent, or corporate policy)\n- Knowledge of iOS and Android file system structures\n\n## Workflow\n\n### Step 1: Prepare the Device and Isolation\n\n```bash\n# CRITICAL: Immediately place device in airplane mode or Faraday bag\n# This prevents remote wipe commands and additional data changes\n\n# Document device state before acquisition\n# Record: make, model, IMEI, serial number, OS version, screen lock status\n# Photograph the device from all angles\n\n# For Android - Enable USB debugging if accessible\n# Settings > Developer Options > USB Debugging > Enable\n\n# For iOS - Trust the forensic workstation\n# When prompted on device, tap \"Trust This Computer\"\n\n# If device is locked, document lock type (PIN, pattern, biometric)\n# Cellebrite UFED can bypass certain lock types depending on device model\n\n# Install open-source tools as alternatives\npip install aleapp    # Android Logs Events And Protobuf Parser\npip install ileapp    # iOS Logs Events And Properties Parser\nsudo apt-get install libimobiledevice-utils  # iOS acquisition on Linux\n```\n\n### Step 2: Perform Device Acquisition\n\n```bash\n# === Cellebrite UFED Acquisition ===\n# 1. Launch UFED 4PC or connect UFED Touch\n# 2. Select Device > Identify device model automatically\n# 3. Choose extraction type:\n#    - Logical: App data, contacts, messages, call logs (fastest, least data)\n#    - File System: Full file system access including databases\n#    - Physical: Bit-for-bit image including deleted data (most complete)\n#    - Advanced (Checkm8\u002FGrayKey): For locked iOS devices (specific models)\n# 4. Select output format and destination\n# 5. Begin extraction\n\n# === Open-source iOS acquisition with libimobiledevice ===\n# List connected iOS devices\nidevice_id -l\n\n# Get device information\nideviceinfo -u \u003CUDID>\n\n# Create iOS backup (logical acquisition)\nidevicebackup2 backup --full \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup\u002F\n\n# For encrypted backups (contains more data including passwords)\nidevicebackup2 backup --full --password \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup\u002F\n\n# === Android acquisition with ADB ===\n# List connected devices\nadb devices\n\n# Full backup (requires screen unlock)\nadb backup -apk -shared -all -f \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_backup.ab\n\n# Extract specific app data\nadb shell pm list packages | grep -i \"whatsapp\\|telegram\\|signal\"\nadb pull \u002Fdata\u002Fdata\u002Fcom.whatsapp\u002F \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fwhatsapp\u002F\n\n# For rooted Android devices - full filesystem\nadb shell \"su -c 'dd if=\u002Fdev\u002Fblock\u002Fmmcblk0 bs=4096'\" | \\\n   dd of=\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_physical.dd\n\n# Hash the acquisition\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002F*.dd > \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Facquisition_hashes.txt\n```\n\n### Step 3: Analyze with ALEAPP (Android) or iLEAPP (iOS)\n\n```bash\n# === Android analysis with ALEAPP ===\n# ALEAPP processes Android file system extractions\npython3 -m aleapp \\\n   -t fs \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_extraction\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faleapp_report\u002F\n\n# ALEAPP extracts and reports on:\n# - Call logs, SMS\u002FMMS messages\n# - Chrome browser history and searches\n# - WiFi connection history\n# - Installed applications\n# - Google account activity\n# - Location data (Google Maps, Photos)\n# - WhatsApp, Telegram, Signal messages\n# - App usage statistics\n# - Device settings and accounts\n\n# === iOS analysis with iLEAPP ===\npython3 -m ileapp \\\n   -t tar \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup.tar \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fileapp_report\u002F\n\n# iLEAPP extracts and reports on:\n# - iMessage and SMS messages\n# - Safari browsing history\n# - WiFi and Bluetooth connections\n# - Health data and location history\n# - App usage (KnowledgeC)\n# - Photos with EXIF\u002FGPS data\n# - Notes, Calendar, Reminders\n# - Keychain data (if decryptable)\n# - Screen time data\n```\n\n### Step 4: Extract Communications and Messaging Data\n\n```bash\n# Extract WhatsApp messages from Android\npython3 \u003C\u003C 'PYEOF'\nimport sqlite3\nimport os\n\n# WhatsApp database location\ndb_path = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_extraction\u002Fdata\u002Fdata\u002Fcom.whatsapp\u002Fdatabases\u002Fmsgstore.db\"\n\nif os.path.exists(db_path):\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    # Extract messages\n    cursor.execute(\"\"\"\n        SELECT\n            key_remote_jid AS contact,\n            CASE WHEN key_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,\n            data AS message_text,\n            datetime(timestamp\u002F1000, 'unixepoch') AS msg_time,\n            media_mime_type,\n            media_size\n        FROM messages\n        WHERE data IS NOT NULL\n        ORDER BY timestamp DESC\n        LIMIT 1000\n    \"\"\")\n\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwhatsapp_messages.csv', 'w') as f:\n        f.write(\"contact,direction,message,timestamp,media_type,media_size\\n\")\n        for row in cursor.fetchall():\n            f.write(','.join(str(x) for x in row) + '\\n')\n\n    conn.close()\n    print(\"WhatsApp messages extracted successfully\")\nPYEOF\n\n# Extract iOS iMessage\u002FSMS from sms.db\npython3 \u003C\u003C 'PYEOF'\nimport sqlite3\n\ndb_path = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_extraction\u002FHomeDomain\u002FLibrary\u002FSMS\u002Fsms.db\"\n\nconn = sqlite3.connect(db_path)\ncursor = conn.cursor()\n\ncursor.execute(\"\"\"\n    SELECT\n        h.id AS phone_number,\n        CASE WHEN m.is_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,\n        m.text,\n        datetime(m.date\u002F1000000000 + 978307200, 'unixepoch') AS msg_time,\n        m.service\n    FROM message m\n    JOIN handle h ON m.handle_id = h.ROWID\n    ORDER BY m.date DESC\n\"\"\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fimessage_sms.csv', 'w') as f:\n    f.write(\"phone,direction,text,timestamp,service\\n\")\n    for row in cursor.fetchall():\n        f.write(','.join(str(x) for x in row) + '\\n')\n\nconn.close()\nPYEOF\n```\n\n### Step 5: Extract Location Data and Generate Report\n\n```bash\n# Extract GPS data from photos\npip install pillow\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nfrom PIL.ExifTags import TAGS, GPSTAGS\nimport os, json\n\ndef get_gps(exif_data):\n    gps_info = {}\n    for key, val in exif_data.items():\n        decoded = GPSTAGS.get(key, key)\n        gps_info[decoded] = val\n\n    if 'GPSLatitude' in gps_info and 'GPSLongitude' in gps_info:\n        lat = gps_info['GPSLatitude']\n        lon = gps_info['GPSLongitude']\n        lat_val = lat[0] + lat[1]\u002F60 + lat[2]\u002F3600\n        lon_val = lon[0] + lon[1]\u002F60 + lon[2]\u002F3600\n        if gps_info.get('GPSLatitudeRef') == 'S': lat_val = -lat_val\n        if gps_info.get('GPSLongitudeRef') == 'W': lon_val = -lon_val\n        return lat_val, lon_val\n    return None\n\nlocations = []\nphoto_dir = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_extraction\u002FCameraRollDomain\u002FMedia\u002FDCIM\u002F\"\nfor root, dirs, files in os.walk(photo_dir):\n    for fname in files:\n        if fname.lower().endswith(('.jpg', '.jpeg', '.heic')):\n            try:\n                img = Image.open(os.path.join(root, fname))\n                exif = img._getexif()\n                if exif and 34853 in exif:\n                    coords = get_gps(exif[34853])\n                    if coords:\n                        locations.append({'file': fname, 'lat': coords[0], 'lon': coords[1]})\n            except Exception:\n                pass\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fphoto_locations.json', 'w') as f:\n    json.dump(locations, f, indent=2)\nprint(f\"Found {len(locations)} geotagged photos\")\nPYEOF\n\n# Extract location history from Google Location History (Android)\n# File: \u002Fdata\u002Fdata\u002Fcom.google.android.gms\u002Fdatabases\u002Flbs.db\n# or exported Google Takeout location data\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Logical extraction | Extracts accessible user data through device APIs (contacts, messages, photos) |\n| File system extraction | Full access to the device file system including app databases |\n| Physical extraction | Bit-for-bit copy of device storage including deleted and unallocated data |\n| UFED | Universal Forensic Extraction Device - Cellebrite's flagship acquisition platform |\n| ADB | Android Debug Bridge for communicating with Android devices |\n| KnowledgeC | iOS database tracking detailed app and device usage patterns |\n| SQLite databases | Primary storage format for mobile app data (messages, contacts, history) |\n| Checkm8 | Hardware-based iOS exploit enabling extraction on A5-A11 devices |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Cellebrite UFED | Commercial mobile device acquisition and analysis platform |\n| Cellebrite Physical Analyzer | Deep analysis of mobile device extractions |\n| ALEAPP | Open-source Android artifact parser and report generator |\n| iLEAPP | Open-source iOS artifact parser and report generator |\n| libimobiledevice | Open-source iOS communication library |\n| Magnet AXIOM | Commercial mobile and computer forensics platform |\n| MEAT | Mobile Evidence Acquisition Toolkit |\n| ADB | Android Debug Bridge for device interaction and data extraction |\n\n## Common Scenarios\n\n**Scenario 1: Criminal Communications Investigation**\nAcquire device with UFED physical extraction, decrypt messaging databases, extract WhatsApp\u002FTelegram\u002FSignal conversations, recover deleted messages from WAL files, build communication timeline, export for legal proceedings.\n\n**Scenario 2: Employee Data Theft via Personal Phone**\nPerform logical extraction with employee consent, analyze corporate email and cloud storage app data, check for screenshots of confidential documents, review file transfer app activity, examine browser history for cloud uploads.\n\n**Scenario 3: Missing Person Location Tracking**\nExtract location data from Google Location History, parse GPS data from photos, analyze WiFi connection history for last known locations, check fitness app data for movement patterns, examine messaging apps for last communications.\n\n**Scenario 4: Child Exploitation Investigation**\nPhysical extraction preserving all data including deleted content, hash all images against NCMEC\u002FICSE databases, extract communication records, recover deleted media from unallocated space, document chain of custody meticulously for prosecution.\n\n## Output Format\n\n```\nMobile Forensics Summary:\n  Device: Samsung Galaxy S23 Ultra (SM-S918B)\n  OS: Android 14, One UI 6.0\n  IMEI: 353456789012345\n  Extraction: Physical (via Cellebrite UFED)\n  Duration: 45 minutes\n\n  Extracted Data:\n    Contacts:       1,234\n    Call Logs:       5,678\n    SMS\u002FMMS:         3,456\n    WhatsApp Msgs:   12,345 (234 deleted, recovered)\n    Telegram Msgs:   2,345\n    Photos\u002FVideos:   4,567 (345 geotagged)\n    Browser History: 2,345 URLs\n    WiFi Networks:   67 saved connections\n    Installed Apps:  145\n\n  Key Findings:\n    - Deleted WhatsApp conversation with suspect recovered\n    - 23 geotagged photos at crime scene location\n    - Browser searches related to investigation subject\n    - Signal app used during incident timeframe (encrypted, partial recovery)\n\n  Reports:\n    ALEAPP Report:   \u002Fanalysis\u002Faleapp_report\u002Findex.html\n    Messages Export: \u002Fanalysis\u002Fwhatsapp_messages.csv\n    Locations:       \u002Fanalysis\u002Fphoto_locations.json\n```\n","# Performing Mobile Device Forensics with Cellebrite\n\n## When to Use\n- When extracting evidence from smartphones or tablets during an investigation\n- For recovering deleted messages, call logs, and location data from mobile devices\n- During investigations involving communications via messaging apps\n- When analyzing mobile application data for evidence of criminal activity\n- For corporate investigations involving employee mobile device misuse\n\n## Prerequisites\n- Cellebrite UFED Touch\u002F4PC or UFED Physical Analyzer (licensed)\n- Alternative open-source tools: ALEAPP, iLEAPP, MEAT, libimobiledevice\n- Appropriate cables and adapters for target device\n- Faraday bag to isolate the device from network signals\n- Legal authorization (warrant, consent, or corporate policy)\n- Knowledge of iOS and Android file system structures\n\n## Workflow\n\n### Step 1: Prepare the Device and Isolation\n\n```bash\n# CRITICAL: Immediately place device in airplane mode or Faraday bag\n# This prevents remote wipe commands and additional data changes\n\n# Document device state before acquisition\n# Record: make, model, IMEI, serial number, OS version, screen lock status\n# Photograph the device from all angles\n\n# For Android - Enable USB debugging if accessible\n# Settings > Developer Options > USB Debugging > Enable\n\n# For iOS - Trust the forensic workstation\n# When prompted on device, tap \"Trust This Computer\"\n\n# If device is locked, document lock type (PIN, pattern, biometric)\n# Cellebrite UFED can bypass certain lock types depending on device model\n\n# Install open-source tools as alternatives\npip install aleapp    # Android Logs Events And Protobuf Parser\npip install ileapp    # iOS Logs Events And Properties Parser\nsudo apt-get install libimobiledevice-utils  # iOS acquisition on Linux\n```\n\n### Step 2: Perform Device Acquisition\n\n```bash\n# === Cellebrite UFED Acquisition ===\n# 1. Launch UFED 4PC or connect UFED Touch\n# 2. Select Device > Identify device model automatically\n# 3. Choose extraction type:\n#    - Logical: App data, contacts, messages, call logs (fastest, least data)\n#    - File System: Full file system access including databases\n#    - Physical: Bit-for-bit image including deleted data (most complete)\n#    - Advanced (Checkm8\u002FGrayKey): For locked iOS devices (specific models)\n# 4. Select output format and destination\n# 5. Begin extraction\n\n# === Open-source iOS acquisition with libimobiledevice ===\n# List connected iOS devices\nidevice_id -l\n\n# Get device information\nideviceinfo -u \u003CUDID>\n\n# Create iOS backup (logical acquisition)\nidevicebackup2 backup --full \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup\u002F\n\n# For encrypted backups (contains more data including passwords)\nidevicebackup2 backup --full --password \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup\u002F\n\n# === Android acquisition with ADB ===\n# List connected devices\nadb devices\n\n# Full backup (requires screen unlock)\nadb backup -apk -shared -all -f \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_backup.ab\n\n# Extract specific app data\nadb shell pm list packages | grep -i \"whatsapp\\|telegram\\|signal\"\nadb pull \u002Fdata\u002Fdata\u002Fcom.whatsapp\u002F \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fwhatsapp\u002F\n\n# For rooted Android devices - full filesystem\nadb shell \"su -c 'dd if=\u002Fdev\u002Fblock\u002Fmmcblk0 bs=4096'\" | \\\n   dd of=\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_physical.dd\n\n# Hash the acquisition\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002F*.dd > \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Facquisition_hashes.txt\n```\n\n### Step 3: Analyze with ALEAPP (Android) or iLEAPP (iOS)\n\n```bash\n# === Android analysis with ALEAPP ===\n# ALEAPP processes Android file system extractions\npython3 -m aleapp \\\n   -t fs \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_extraction\u002F \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Faleapp_report\u002F\n\n# ALEAPP extracts and reports on:\n# - Call logs, SMS\u002FMMS messages\n# - Chrome browser history and searches\n# - WiFi connection history\n# - Installed applications\n# - Google account activity\n# - Location data (Google Maps, Photos)\n# - WhatsApp, Telegram, Signal messages\n# - App usage statistics\n# - Device settings and accounts\n\n# === iOS analysis with iLEAPP ===\npython3 -m ileapp \\\n   -t tar \\\n   -i \u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_backup.tar \\\n   -o \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fileapp_report\u002F\n\n# iLEAPP extracts and reports on:\n# - iMessage and SMS messages\n# - Safari browsing history\n# - WiFi and Bluetooth connections\n# - Health data and location history\n# - App usage (KnowledgeC)\n# - Photos with EXIF\u002FGPS data\n# - Notes, Calendar, Reminders\n# - Keychain data (if decryptable)\n# - Screen time data\n```\n\n### Step 4: Extract Communications and Messaging Data\n\n```bash\n# Extract WhatsApp messages from Android\npython3 \u003C\u003C 'PYEOF'\nimport sqlite3\nimport os\n\n# WhatsApp database location\ndb_path = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fandroid_extraction\u002Fdata\u002Fdata\u002Fcom.whatsapp\u002Fdatabases\u002Fmsgstore.db\"\n\nif os.path.exists(db_path):\n    conn = sqlite3.connect(db_path)\n    cursor = conn.cursor()\n\n    # Extract messages\n    cursor.execute(\"\"\"\n        SELECT\n            key_remote_jid AS contact,\n            CASE WHEN key_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,\n            data AS message_text,\n            datetime(timestamp\u002F1000, 'unixepoch') AS msg_time,\n            media_mime_type,\n            media_size\n        FROM messages\n        WHERE data IS NOT NULL\n        ORDER BY timestamp DESC\n        LIMIT 1000\n    \"\"\")\n\n    with open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fwhatsapp_messages.csv', 'w') as f:\n        f.write(\"contact,direction,message,timestamp,media_type,media_size\\n\")\n        for row in cursor.fetchall():\n            f.write(','.join(str(x) for x in row) + '\\n')\n\n    conn.close()\n    print(\"WhatsApp messages extracted successfully\")\nPYEOF\n\n# Extract iOS iMessage\u002FSMS from sms.db\npython3 \u003C\u003C 'PYEOF'\nimport sqlite3\n\ndb_path = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_extraction\u002FHomeDomain\u002FLibrary\u002FSMS\u002Fsms.db\"\n\nconn = sqlite3.connect(db_path)\ncursor = conn.cursor()\n\ncursor.execute(\"\"\"\n    SELECT\n        h.id AS phone_number,\n        CASE WHEN m.is_from_me = 1 THEN 'SENT' ELSE 'RECEIVED' END AS direction,\n        m.text,\n        datetime(m.date\u002F1000000000 + 978307200, 'unixepoch') AS msg_time,\n        m.service\n    FROM message m\n    JOIN handle h ON m.handle_id = h.ROWID\n    ORDER BY m.date DESC\n\"\"\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fimessage_sms.csv', 'w') as f:\n    f.write(\"phone,direction,text,timestamp,service\\n\")\n    for row in cursor.fetchall():\n        f.write(','.join(str(x) for x in row) + '\\n')\n\nconn.close()\nPYEOF\n```\n\n### Step 5: Extract Location Data and Generate Report\n\n```bash\n# Extract GPS data from photos\npip install pillow\npython3 \u003C\u003C 'PYEOF'\nfrom PIL import Image\nfrom PIL.ExifTags import TAGS, GPSTAGS\nimport os, json\n\ndef get_gps(exif_data):\n    gps_info = {}\n    for key, val in exif_data.items():\n        decoded = GPSTAGS.get(key, key)\n        gps_info[decoded] = val\n\n    if 'GPSLatitude' in gps_info and 'GPSLongitude' in gps_info:\n        lat = gps_info['GPSLatitude']\n        lon = gps_info['GPSLongitude']\n        lat_val = lat[0] + lat[1]\u002F60 + lat[2]\u002F3600\n        lon_val = lon[0] + lon[1]\u002F60 + lon[2]\u002F3600\n        if gps_info.get('GPSLatitudeRef') == 'S': lat_val = -lat_val\n        if gps_info.get('GPSLongitudeRef') == 'W': lon_val = -lon_val\n        return lat_val, lon_val\n    return None\n\nlocations = []\nphoto_dir = \"\u002Fcases\u002Fcase-2024-001\u002Fmobile\u002Fios_extraction\u002FCameraRollDomain\u002FMedia\u002FDCIM\u002F\"\nfor root, dirs, files in os.walk(photo_dir):\n    for fname in files:\n        if fname.lower().endswith(('.jpg', '.jpeg', '.heic')):\n            try:\n                img = Image.open(os.path.join(root, fname))\n                exif = img._getexif()\n                if exif and 34853 in exif:\n                    coords = get_gps(exif[34853])\n                    if coords:\n                        locations.append({'file': fname, 'lat': coords[0], 'lon': coords[1]})\n            except Exception:\n                pass\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fphoto_locations.json', 'w') as f:\n    json.dump(locations, f, indent=2)\nprint(f\"Found {len(locations)} geotagged photos\")\nPYEOF\n\n# Extract location history from Google Location History (Android)\n# File: \u002Fdata\u002Fdata\u002Fcom.google.android.gms\u002Fdatabases\u002Flbs.db\n# or exported Google Takeout location data\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Logical extraction | Extracts accessible user data through device APIs (contacts, messages, photos) |\n| File system extraction | Full access to the device file system including app databases |\n| Physical extraction | Bit-for-bit copy of device storage including deleted and unallocated data |\n| UFED | Universal Forensic Extraction Device - Cellebrite's flagship acquisition platform |\n| ADB | Android Debug Bridge for communicating with Android devices |\n| KnowledgeC | iOS database tracking detailed app and device usage patterns |\n| SQLite databases | Primary storage format for mobile app data (messages, contacts, history) |\n| Checkm8 | Hardware-based iOS exploit enabling extraction on A5-A11 devices |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Cellebrite UFED | Commercial mobile device acquisition and analysis platform |\n| Cellebrite Physical Analyzer | Deep analysis of mobile device extractions |\n| ALEAPP | Open-source Android artifact parser and report generator |\n| iLEAPP | Open-source iOS artifact parser and report generator |\n| libimobiledevice | Open-source iOS communication library |\n| Magnet AXIOM | Commercial mobile and computer forensics platform |\n| MEAT | Mobile Evidence Acquisition Toolkit |\n| ADB | Android Debug Bridge for device interaction and data extraction |\n\n## Common Scenarios\n\n**Scenario 1: Criminal Communications Investigation**\nAcquire device with UFED physical extraction, decrypt messaging databases, extract WhatsApp\u002FTelegram\u002FSignal conversations, recover deleted messages from WAL files, build communication timeline, export for legal proceedings.\n\n**Scenario 2: Employee Data Theft via Personal Phone**\nPerform logical extraction with employee consent, analyze corporate email and cloud storage app data, check for screenshots of confidential documents, review file transfer app activity, examine browser history for cloud uploads.\n\n**Scenario 3: Missing Person Location Tracking**\nExtract location data from Google Location History, parse GPS data from photos, analyze WiFi connection history for last known locations, check fitness app data for movement patterns, examine messaging apps for last communications.\n\n**Scenario 4: Child Exploitation Investigation**\nPhysical extraction preserving all data including deleted content, hash all images against NCMEC\u002FICSE databases, extract communication records, recover deleted media from unallocated space, document chain of custody meticulously for prosecution.\n\n## Output Format\n\n```\nMobile Forensics Summary:\n  Device: Samsung Galaxy S23 Ultra (SM-S918B)\n  OS: Android 14, One UI 6.0\n  IMEI: 353456789012345\n  Extraction: Physical (via Cellebrite UFED)\n  Duration: 45 minutes\n\n  Extracted Data:\n    Contacts:       1,234\n    Call Logs:       5,678\n    SMS\u002FMMS:         3,456\n    WhatsApp Msgs:   12,345 (234 deleted, recovered)\n    Telegram Msgs:   2,345\n    Photos\u002FVideos:   4,567 (345 geotagged)\n    Browser History: 2,345 URLs\n    WiFi Networks:   67 saved connections\n    Installed Apps:  145\n\n  Key Findings:\n    - Deleted WhatsApp conversation with suspect recovered\n    - 23 geotagged photos at crime scene location\n    - Browser searches related to investigation subject\n    - Signal app used during incident timeframe (encrypted, partial recovery)\n\n  Reports:\n    ALEAPP Report:   \u002Fanalysis\u002Faleapp_report\u002Findex.html\n    Messages Export: \u002Fanalysis\u002Fwhatsapp_messages.csv\n    Locations:       \u002Fanalysis\u002Fphoto_locations.json\n```\n",{"name":5,"tags":49,"author":50,"domain":43,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[25,39,28,38,37,30],"mahipal","1.0",[53,54,55,56],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[59,60,61,62,63],"T1005","T1074","T1119","T1070","T1059","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-mobile-device-forensics-with-cellebrite",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-mobile-device-forensics-with-cellebrite",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-mobile-device-forensics-with-cellebrite","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",1964,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",9047,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-mobile-device-forensics-with-cellebrite\u002Fscripts\u002Fagent.py",[104,144,153,162,184,209],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":125,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[111,114,117,120],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,24],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":145,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":152,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[148,149,150,151],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,24],{"skillNo":154,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":161,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[157,158,159,160],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":123,"taxonomyTypeDesc":124},[106,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,24],{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[190],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[192,193,194,195,196,197,40,198,199,200,201,137,138,202,203,204,205,206,207,208],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":108,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":225,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[215,218,221,222],{"categoryNo":216,"categoryName":217,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":219,"categoryName":220,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":223,"categoryName":224,"taxonomyType":123,"taxonomyTypeDesc":124},"01JBSEEDCAT000000000000036","内容创作者",[226,227,228,229,230,231,232,233,134,234,137,138,139,235,236,237,238,239,183,240],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]