±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35244
New Yesterday: 3 Visitors: 175

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Exported Threaded Messages from CelleBrite

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

4Rensics
Senior Member
 

Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 04:59

Does anybody know if its possible to get the beautiful threaded message view CelleBrite gives you for its chats as an exported report.

CelleBrite loves to show you the nice, clean message format as the user would see it on their phone, however when you try to put it in to a report, CelleBrite takes a MASSIVE dump all over it and turns that beautiful view into a big steaming pile of shit that nobody can read with any clean context. All I'm looking for is a threaded view of WhatsApp, Telegram, etc the way CelleBrite shows you when it extracts it or puts it in to UFED Reader.

Please help. My sanity is on the line!

Thanks,
4F.  
 
  

randomaccess
Senior Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 05:39

is this what you're after?

www.computerforensicsw...sics-tool/  
 
  

4Rensics
Senior Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 06:06

Tried that.

I had to convert the message export to a .csv, but it just rung up a ton of errors. I think CelleBrite is exporting tons of rows and columns and its confusing that tool. But thanks.

I've heard MobilEDIT does a pretty good export, I'm going to see what that looks like and if its useable in a report. It just needs to be clean and easy on the eye for a report for cops and CPS.  
 
  

hectic_forensics
Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 07:10

Lost count of the number of times I've actually suggested this to Cellebrite...  
 
  

4Rensics
Senior Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 08:00

You and me both buddy. You and me both!

It already does it in the software so why not let us export that view to put in to reports.

(tears hair out... Neutral )  
 
  

Merriora
Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 22, 18 08:28

- 4Rensics
Tried that.

I had to convert the message export to a .csv, but it just rung up a ton of errors. I think CelleBrite is exporting tons of rows and columns and its confusing that tool. But thanks.


Hey

I'm the developer of this, so happy to help out. What type of errors did you observe? What type of 'chat' were you attempting to use it on? (iMessages, SMS/MMS, Facebook, etc)

If you want to contact me off-list, I can try to fix up your data so that the errors don't occur. In some cases, you will need to tidy up the data in the Excel file, especially if it includes a lot of deleted data with missing columns.  
 
  

4Rensics
Senior Member
 

Re: Exported Threaded Messages from CelleBrite

Post Posted: Nov 23, 18 03:47

Hi,

Its a Telegram Chat between two people. I've tried the chat helper tool, but I'm still gettting errors. Its basically saying "ERROR:Source type does not match Source file"
I've opened it in Notepad++ and confirmed it all looks good and the csv is correct. I've also cut it down so that it doesn't have all the crap CelleBrite exports thats not relevant to the basic conversation.

This is the log from the tool:

ERROR: User may have selected incorrect file type. --> EXCEPTION: System.InvalidOperationException: Queue empty.
at System.ThrowHelper.ThrowInvalidOperationException(ExceptionResource resource)
at System.Collections.Generic.Queue`1.Dequeue()
at SMS2HTML.Main.<CollectSource>d__4.MoveNext() in Z:\Forensic Tools\SMS2HTML\MainForm.cs:line 136
ERROR: User may have selected incorrect file type. --> EXCEPTION: System.InvalidOperationException: Queue empty.
at System.ThrowHelper.ThrowInvalidOperationException(ExceptionResource resource)
at System.Collections.Generic.Queue`1.Dequeue()
at SMS2HTML.Main.<CollectSource>d__4.MoveNext() in Z:\Forensic Tools\SMS2HTML\MainForm.cs:line 136

*******************************************************************************************
PROCESSING COMPLETED at: 23 November 2018 09:45:26
*******************************************************************************************

ERROR: System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\Users\726352\Desktop\group-chat-digital-forensics-tool\Output\_PDFs'.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileSystemEnumerableIterator`1.CommonInit()
at System.IO.FileSystemEnumerableIterator`1..ctor(String path, String originalUserPath, String searchPattern, SearchOption searchOption, SearchResultHandler`1 resultHandler, Boolean checkHost)
at System.IO.Directory.GetFiles(String path, String searchPattern, SearchOption searchOption)
at SMS2HTML.Main.GenerateHtml(GeneratingOptions options, Action`1 htmlProcessor) in Z:\Forensic Tools\SMS2HTML\MainForm.cs:line 1430
*******************************************************************************************
DONE PROCESSING
*******************************************************************************************

Please be sure to check this Log for any recorded errors.

NOTE: This product is in BETA release.

Any help or pointers is much appreciated.

Thanks.  
 

Page 1 of 2
Page 1, 2  Next