Cellebrite UFD
| Format | Cellebrite UFD |
|---|---|
| Short name | UFD |
| Category | logical_image |
| Platforms | iOS, Android |
| Crush support | Supported (UFDVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-06 |
Forensic relevance
Plain-text INI file written beside a mobile device extraction by Cellebrite products, and by other tools writing the same layout (UfdVer=1.2 in the files seen). [Dumps] names the extraction's dumps and the file each is in, typically one ZIP: FileDump for the file system, and others such as KeyStore or KeyChain. One section per dump gives its Type (e.g. ZIPfolder) and the ZIP folder holding it (ZIPLogicalPath, e.g. Dump, iPhoneDump). Further sections record, among others, the device (model, OS, IMEIs), the acquisition (tool, extraction type, start and end as local time with the UTC offset written after it, case fields), a SHA-256 of each file ([SHA256]) and an HMAC ([Hash]) keyed by the vendor. An extraction holding an encrypted iTunes backup may record its password (BackupPassword, IsEncrypted).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 5B | [ | INI text: it starts with a [section] header, whose name varies (e.g. [DeviceInfo], [Crime Case]) -- no fixed signature |
Known extensions
.ufd
References
- prosch88/UFADE — source that writes a UFED-layout .ufd for an iOS extraction https://github.com/prosch88/UFADE/blob/50fd711d651aa3113dccb98755e5e6ccb7c3d48c/ufade.py
Cite this entry
Crush Format Reference, “Cellebrite UFD”. https://kalink0.github.io/crush-forensics/formats/ufd/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction