Cellebrite UFDR
| Format | Cellebrite UFDR |
|---|---|
| Short name | UFDR |
| Category | logical_image |
| Platforms | iOS, Android |
| Crush support | Supported (UFDRVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The report/delivery container exported by Cellebrite Physical Analyzer. It is a ZIP archive: the extracted files are stored under files/<category>/, while the device's original paths, sizes, timestamps and hashes are kept in DbData/database.db (a PostgreSQL custom-format dump). report.xml duplicates the data in an older XML layout. Large exports may be split into several segments.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 50 4B 03 04 | PK.. | ZIP container holding report.xml and DbData/database.db |
Known extensions
.ufdr
References
- UFDR2DIR — UFDR structure and report.xml path mapping (DFIR Science) https://github.com/DFIRScience/UFDR2DIR
- pg_dump custom archive format (PostgreSQL documentation) https://www.postgresql.org/docs/current/app-pgdump.html
- ForensicsWiki — Cellebrite (UFED extraction devices) https://forensics.wiki/cellebrite/
Cite this entry
Crush Format Reference, “Cellebrite UFDR”. https://kalink0.github.io/crush-forensics/formats/ufdr/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction