Does this skill work for both Android and iOS?

Yes, it includes platform-specific workflows for both Android (using ADB and ALEAPP) and iOS (using libimobiledevice and iLEAPP).

Can I recover deleted messages using these workflows?

Yes, the skill provides specific SQL queries and physical extraction methods designed to recover deleted records from SQLite databases and write-ahead logs (WAL).

What is the importance of a Faraday bag in this workflow?

The workflow emphasizes using a Faraday bag or airplane mode immediately to prevent remote wipe commands or incoming network data from altering the device's forensic state.

What forensic tools are covered in this skill?

This skill covers commercial tools like Cellebrite UFED and Physical Analyzer, as well as open-source tools including ALEAPP, iLEAPP, libimobiledevice, and ADB.

How does the skill handle encrypted backups?

It provides commands for handling encrypted iOS backups via idevicebackup2 and guidance on analyzing decrypted database files using Python-based extraction scripts.

Mobile Forensics with Cellebrite

Name: Mobile Forensics with Cellebrite
Author: mukul975

bymukul975

•

4,121

•

Seguridad y Pruebas

Performs professional mobile device forensics to acquire and analyze data from iOS and Android devices using Cellebrite UFED and open-source tools.

This skill equips AI agents with the specialized knowledge required to perform digital forensics on mobile devices. It provides structured workflows for evidence acquisition, device isolation, and deep artifact analysis using industry-standard tools like Cellebrite UFED alongside powerful open-source alternatives like ALEAPP and iLEAPP. Users can efficiently extract and parse communications, location history, and application-specific data while maintaining forensic integrity. It is an essential capability for criminal investigations, corporate security audits, and legal discovery involving smartphone data.

Características Principales

01Comprehensive acquisition workflows for physical and logical device imaging

02Extraction and mapping of GPS location data from photos and system logs

03Detailed guidance on forensic isolation and chain of custody preservation

04Automated parsing of encrypted messaging apps including WhatsApp and Telegram

05Support for both iOS (iLEAPP) and Android (ALEAPP) forensic artifact parsing

064,121 GitHub stars

Casos de Uso

01Recovering lost or deleted mobile data for legal discovery and litigation support

02Performing corporate internal audits for data theft or employee misconduct

03Conducting criminal investigations into mobile communications and deleted evidence

Características Principales

01Comprehensive acquisition workflows for physical and logical device imaging

02Extraction and mapping of GPS location data from photos and system logs

03Detailed guidance on forensic isolation and chain of custody preservation

04Automated parsing of encrypted messaging apps including WhatsApp and Telegram

05Support for both iOS (iLEAPP) and Android (ALEAPP) forensic artifact parsing

064,121 GitHub stars

Casos de Uso

01Recovering lost or deleted mobile data for legal discovery and litigation support

02Performing corporate internal audits for data theft or employee misconduct

03Conducting criminal investigations into mobile communications and deleted evidence