Reviewing Mobile Data

Indexed I/O now supports mobile data review of a variety of forensic image types, including Cellebrite, Axiom, and Oxygen. Once your data has been loaded into a project, navigate to the collection and click on the second file on the list (the xml file) to get started. 

From here you have several options to start reviewing the data. All of the conversation threads will appear on the left, and the contents of those conversations will appear on the right. You can select individual messages on the right to turn into "extracted conversations", which are PDFs of the selected messages that will retain the bubble view, original metadata, and include information about the device they were collected from. You can also save the entire conversation, which will break it into PDFs for each 24 hour period. When you save a conversation like this all of the individual messages will get tagged "Extracted Conversation Element" to help you keep track of what's already been extracted. 

These extracted conversations will appear under the pre-made saved search "Extracted Conversations" available on your sidebar and in advanced search. 

Rather than extract conversations from the phone image, you can also work with the individual messages. Highlighting a message on the right will give you a "view resource" button where you can view the individual message and work with it just like any other file thats loaded into indexed I/O. 

If you want to go back to the full conversation just click the green "View in conversation" button in the bottom left. 

Working with the messages individually can be helpful if you need to search for specific keywords. After entering the collection, enter your keyword(s) into the search bar at the top. 

Once you've found the relevant messages you can open them and tag them directly, or switch to the conversation view in order to see them in context and extract conversations. 

The conversation view will also let you tag all of the individual records that are a part of it using the bulk tag field in the top right. This can be helpful for marking entire threads as relevant/irrelevant, and then using those tags to filter your search results to specific conversations.

In the above search we also included a "record type" field. This field can help you search a device for voicemails, photos, messages, and more! Hit the drop down at the end of the search field to view all of the record types that have been found in your data. 

Once you've finished your review you can use the tag "extracted conversations" to export any saved conversations, or if you've been working with individual messages you can use the tags you've been applying to those documents instead.