CloudNine Discovery Portal - CloudNine Analyst: I have a Cellebrite UFDR file, how do I do process and load it for review in CloudNine Analyst?

CloudNine Discovery Portal offers a simple workflow for sending and processing your UFDR file to CloudNine Analyst.

When cell phone data is collected, the investigator will often provide a UFDR file which is a summary report of data collected from smartphones or other devices.  Use this workflow when you have a UFDR file to upload into CloudNine Analyst. CloudNine Analyst supports Cellebrite's Physical Analyzer Version 7 and Version 8 UFDR files.

This article provides details for each step in the workflow which includes: 

Video: CloudNine Discovery Portal - CloludNine Analyst UFDR Workflow

Workflow Diagram

Step 1: Discovery Portal Welcome Screen

Step 2: Selecting the CloudNine Analyst Project and Evidence Container

Step 3: Select the UFDR File for Upload 

Step 4: Import Settings

Step 5: Confirm & Upload

Workflow Diagram

Step 1: CloudNine Discovery Portal Welcome Screen

The Welcome screen is where you choose your CloudNine Discovery Portal workflow. 

1. Launch CloudNine Discovery Portal.
2. The Welcome screen appears. On the Welcome screen, there are two sections: Select Data From and Review Data Using.
3. Under Select Data From: choose File System (e.g. File Share, Hard Drive, Forensic Image, etc) option.
4. Under Review Data Using: select CloudNine Analyst, and click Continue.
   
   
5. You are prompted to enter your login credentials for CloudNine Analyst. Enter your CloudNine Analyst Username, Password, and Domain, then click OK.
   
6. The Login to CloudNine Analyst Duo authentication prompt appears. Select the authentication method you have set up in CloudNine Analyst.
   
7.  Once you have logged in and connected to CloudNine Analyst, the What Kind of Data are you Uploading? overlay displays. Select UFDR Cell phone data and then OK.  
   

Step 2: Selecting the CloudNine Analyst Project and Evidence Container

 The next step is to select the CloudNine Analyst Client, Project, and Evidence Container you will upload the UFDR file to in CloudNine Analyst.  This section provides instructions on the following: 

Select CloudNine Analyst Project Overview

Loading to an Existing CloudNine Analyst Project and Evidence Container

Creating a New Evidence Container

Creating a New Project 

Creating a New Client 

Select CloudNine Analyst Project Overview

1. Client: Drop-down list of clients you have permission to access in CloudNine Analyst.
2. Search projects: Use to search by project name.
3. Plus: Select to create a new client or project.
4. Project: List of projects for the selected client.
5. Selected: Indicates the project and evidence container selected.
6. Search containers: Search for an evidence container.
7. Create Container: Create a new evidence container.
8. Evidence Container: Lists all evidence containers associated with the project.
9. Selected: Indicates the Evidence container selected. 
10. Next: Move to the next step.

Loading to an Existing CloudNine Analyst Project and Evidence Container

When you connect to CloudNine Analyst through CloudNine Discovery Portal you are able to see a list of all clients, projects, and corresponding evidence containers in CloudNine Analyst that you have permission to access.  

1. Under Select CloudNine Analyst use the Client drop-down to select your client. A list of projects for that client appears in the Project list. 
2. Under the Project list, locate the Project you will be loading the data to. Left-click with your mouse to select the Project.
3. When the Project is selected, a list of Evidence Containers for the project is displayed on the right under Select CloudNine Analyst Container, locate and left-click to pick the Evidence container that will receive the data. 
4. Once the desired Project and Container have been selected, click Next at the bottom-right to proceed to Step 3 - Selecting UFDR For Upload. 
   

Creating a New Evidence Container

If the evidence container does not exist in CloudNine Analyst you can quickly create the Evidence Container through Discovery Portal. The Evidence Container is temporary, once CloudNine Analyst receives the data the Evidence Container is created in CloudNine Analyst. 

1. Select the CloudNine Analyst Client then select the Project.
2. Under Select CloudNine Analyst Container, click the Create Container button. 
   
3. The Create New Container overlay appears. Enter a Container Name, then Click OK. 
   
4. The newly created evidence container appears in the Container list and is selected by default. Click Next to proceed to the next screen. 

Creating a New Project

If this is a new project that does not yet exist in CloudNine Analyst, you can create the project in CloudNine Discovery Portal. These projects are temporary; the project is created when CloudNine Analyst receives the data.

1. Select the Client from the client drop-down at the top left. 
   
2. Click the Plus button, then select Create Project (enabled once a Client is selected). 
   
3. The Create New Project overlay appears. Here you will enter: 
   1. Project Name (Required): Follow your CloudNine Analyst project naming policies to type the desired Project Name. 
   2. Project Code (Required): Type the desired project code; this is often your Matter ID or Internal Project ID. 
   3. Description (Optional): Enter information about the project.  
      
      
4. Once you are satisfied with the new project details, click OK to create the project. 
5. Your new CloudNine Analyst project appears in the Project list and is selected. Since this is a new project created through CloudNine Discovery Portal, you will need to also create an Evidence Container.

 

Creating a New Client 

Like Evidence Containers and Projects, it is possible to create a new Client for CloudNine Analyst through CloudNine Discovery Portal. The new client is temporary until data is received by CloudNine Analyst. Once data is received, the Client is created in CloudNine Analyst. 

You must have the appropriate permissions in CloudNine Analyst to create a new Client through CloudNine Discovery Portal. If you cannot create a new client in CloudNine Analyst, you will not be able to create a client through CloudNine Discovery Portal. 

1. In the Select CloudNine Analyst Project section,  click the plus button, then select Create Client.
   
2. The Create New Client overlay appears. Enter the Client Name, then click OK.
   
   The newly added client now appears in the Client drop-down list and is selected by default. 

Once you have selected the Client, Project, and Evidence Container, click OK to go to Step 3: Selecting the UFDR File screen. 

 

Step 3: Select the UFDR File for Upload 

In this step, you will select the data to upload to CloudNine Analyst. CloudNine Analyst supports Cellebrite's Physical Analyzer Version 7 and Version 8 UFDR files.

1. Click the Browse option to browse and select the UFDR file to upload to CloudNine Analyst. 
   
   
2. Click Next to go to Step 4 - Import Settings. 

 

Step 4: Import Settings

On this screen, you will determine your Import Settings and Control Number Settings for the selected UFDR file. 

Settings Overview

     Import Settings

1. Mobile Number (Required): Enter the mobile number of the device from which the UFDR file was created. 
2. Import Type (Required): The communication data type(s) you wish to import. Only the checked items will be imported to CloudNine Analyst. 
3. DeDuplication: Determines the scope for deduplication. Selecting None will import all items in the UFDR file. If you select By Evidence Container, duplicate items found within the evidence container will be omitted from import. If Globally within Project is selected, deduplication will span the entire project. Any duplicates found will not be imported.   
4. Processing Options - Date Filter Import: Imports only the items that fall within the specified date range (Date filtering is done in UTC). 
5. Do Not Import -File Attachments larger than X MBs: Enabled, this will exclude any attachment files that are larger than the specified file size. 
6. Select which missing options define empty communications: Enabled, any item found with empty communications in the selected option(s) is excluded from import. 
   
   Control Number Settings
7. Prefix: An alphanumerical string of characters (20 max) to use at the beginning of each item. The prefix is the same for all data items imported from the selected UFDR file. 
8. Start No: Sets the starting number for the data items imported. Each item increments by one. The start number should be unique to the project. 
9. Include Item Type in Control Number: The Item Type (MMS, SMS, CHT, etc) is included in the Control Number and may be useful when searching and reviewing your data. 
10. Length: The character length (numerical) of each Item Number, with a minimum of 4 and a maximum of 24 characters.  Leading zeros are used to pad the number to the number of characters selected. 
11. Separator: Non-alphanumeric character that separates the Prefix, Item Type, and Item Number. 
12. Example Control No: Shows results of the Control Number scheme you can expect. 

Selecting Your Settings

Now that you have an understanding of the Import Settings and Control Number Settings, you can proceed with making your setting selections based on the scope of your project. 

1. Under Import Settings,  enter the Mobile Number for the UFDR file and select the Import Type(s) you wish to import. You must select at least one communication type. These are the required import settings. Optionally, choose any remaining import options. 
2. Under Control Number Settings, enter a Prefix, Start No, and Length.
   1. Prefix: It is best practice to implement a prefix in your numbering. The prefix can be used to help maintain unique control numbers, as well as locate items in the database. 
   2. Start No:  If using the same prefix throughout the project, the Start No will need to be the next sequential number in the database to prevent duplicate numbering. 
   3. Length: Industry Standard is 8-10 characters.
3. Once you are satisfied with your selected settings, click Next to proceed to the Confirm & Upload. 

 

Step 5: Confirm & Upload 

The Confirm & Upload screen is your chance to review the selections you made before starting the upload process. 

Confirm & Upload Overview

1. Uploading From: Verifies where the data is coming from. For UFDR files, File system is selected. 
2. Uploading To: Shows the application you are going to - CloudNine Analyst, the Client Name, Project Name, and Container Name you selected. 
3. Notes & Comments: Here you can type any notes or comments about the upload. The Import Notes option can be used if you have notes in a text file. 
4. Control Number Settings: Summarizes the Control Number Settings you established and include an example of how the Control Number will look.  
5. Import Settings: Summarizes the Import Settings you selected. 
6. Back: Allows you to go back to a previous screen and make changes. 
7. Start Upload: Starts the upload process. 

Review Your Data

Take the time to review the information on this screen; this is your last chance to go Back to previous screens and make any necessary changes. 

1. Verify you are Uploading To the correct Client Name, Project Name, and Evidence Container. 
2. Add optional Notes & Comments about the upload.
3. Verify Control Number Settings and that the numbering scheme will not cause duplicate numbering in the database. 
4. Verify the Import Settings are aligned with your project scope. 
5. Once you are satisfied with the confirmation details displayed, you are ready to begin the upload. Click Start Upload. 
6. Once the upload has begun, you will automatically be brought to the Global Monitoring Console. From there, you can monitor the upload progress.