Importing a UFDR: Import Settings
Data Types
Each source will have unique data that can be imported into ESI Analyst. These data types will be listed under Import Settings as a checklist of options. For example, the ESI Desktop wizard for importing data from a Cellebrite UFDR file allows you to import MMS, SMS, Chat, iMessage, Geolocation, and Call logs from a cellphone image into CloudNine Analyst. Select the data types you would like to import by clicking on them - only checked items will be imported into CloudNine Analyst.
Attachment Size
You can also choose to skip uploading attachments that exceed a certain size. Attachments larger than 100MB generally are poor choices for web-based review and you may want to review them in an alternate form. By default, this is 100MBs, but you can alter the size threshold or turn off this functionality altogether if desired. Any attachment that is filtered will have a placeholder loaded for it with the original attachment name and size and a note stating that it was not loaded to CloudNine Analyst due to user-selected size filters.
Empty Communication
You can also select which missing options define empty communications. For example, if you would like to exclude files that have a missing body, select the "body" option.
Processing Options
You can also filter by the date upon import and will filter that data using the UTC timestamp so adjust your date accordingly.
Deduplication
Finally, select the scope for deduplication. Global means that items loaded will be deduplicated against all other items within the project, Evidence container means that items loaded will only be deduplicated against the current evidence container, and none means there will be no deduplication. Note, Evidence Container dedupe combined with dynamically generated Evidence Containers will effectively be device-level deduplication as each device will get its own Evidence Container.
When you have finished configuring control numbers and selected the import options, click “ Next >”.