Most forensic analysts use write blockers when capturing an image of a device to ensure data integrity (no tampering). If Cellebrite altered something during extraction, investigation, etc. it would be easy to go back to the original image (collected with the aid of a write blocker) or the device itself to show that discrepancy.

Edit - For the uninitiated: https://www.geeksforgeeks.org/write-blockers-an-introduction...

A point of contention as someone who uses write blockers and forensic tools... write blockers protect the connection of dumb storage to a computer but a phone is not a dumb storage device (it's not a SATA drive), it's actually a full device which manages it's own storage.

For mobile forensics, it's actually done through the built-in backup systems included in each of the major OS providers (Android/iOS).

This is a back and forth that has been ongoing since we began moving away from Hard Disks, as SSDs tend to manage their own internal state so an image of "an SSD" can change even if the underlying media hasn't changed as the SSD cell balancing can actually shift around deleted data or delay to clear certain cells.

These are great points. Thanks!

Well, I'm a forensics researcher, so thank you.

If you'd like to know about the current issues around mobile device acquisition, you can check this out (https://ieeexplore.ieee.org/document/9116458) which contains the last paper I wrote on the latest issues on iOS and Android acquisitions.

Although I'd love to blame the big bad Cellebrite and the big bad police departments for junk science, computer forensics is quick to dismiss scientifically unsound items so I would expect a response from Cellebrite soon.

The modified content would be on the Cellebrite system. And the investigator may not notice until much later. The write blocker has no effect when the reader is exploited.

You are correct that the source system would not be modified. But the content you are presenting and analyzing via Cellebrite would.

Exactly, but it could be easily proven that the data was tampered with as you still have the original/clean image and the device itself. So if they are altering data, it can be shown.

I'm not a lawyer, but my understanding is the best time to present exculpatory evidence is after the prosecutor has prepared their case. In theory, if the investigator doesn't notice the tainted data and the case is built around the tainted data they could argue that everything from that source (system/lab/department) should be thrown out and that the experts who collected it can't be trusted anymore due to incompetence. Sounds like a prosecutors worst nightmare.

Right and if they have a file or group of files that are central to the case, all the accused has to do is say, "those were not on my phone" and then the 'experts' go back and look at the read-only image to verify.

If the phone could have been altered to add data before a forensic image was acquired in a way that looks like it was via normal use (reasonable timestamps, browser logs, etc.) then we'd have a real problem. Cellebrite potentially being used to do this as it reads the image is not that problem.

This doesn’t apply to mobile devices, since it’s not feasible to remove the internal storage device and take a bit-perfect image of it using another computer. You need to plug the device into a Cellebrite kiosk, trust Cellebrite to send read-only commands over the USB interface, and trust the device firmware not to write data when it receives those commands.

> trust Cellebrite to send read-only commands over the USB interface, and trust the device firmware not to write data when it receives those commands.

So most of these suites really just automate the backup extraction process and the automated analysis piece.

In the real world, you don't interface down at the USB interface other than just to kick off a backup (think an iTunes or adb backup) of the device and just grab it via USB then extract it on your computer and analyze it.

> To be effective Signal would need to exploit the major vendors equally.

Maybe they could, and that would be the problem. Cellebrite's case now raises the issue of what will happen to those decisions where Cellebrite's products were used. This can void those court decisions retroactively, which could also happen to any major vendor in the next couple of years.

In any case, I doubt that this will make them stop using their products.

> To be effective Signal would need to exploit the major vendors equally.

I bet they could. Any industry that's shrouded in secrecy tend not to have the sort of incentives that would ensure better security practices.