Cellebrite Digital Collector

As the only forensic solution on the market today that does live and dead box imaging for Windows and Mac, Digital Collector is a must-have tool in the digital forensic toolbox.
Digital Collector is designed for investigators to do quick triage and analysis, on-scene or in the lab, with the reliability they’ve come to trust from Cellebrite.

Cellebrite Digital Collector Features

Triage Devices:

• Determine if relevant data exists prior to imaging
• Search for data on devices with advanced search features
• See file previews of images and MS Office files on Windows computers and all file types supported by Mac computer

Collect Targeted Data:

• Selectively acquire email, chat, address book, and other data on a per-user, per-volume basis
• Create decrypted physical images of M1 and T2 Macs
• Authenticate collected data using any or all MD5, SHA-1, or SHA-256 hash function

Collect from Live Systems:

• Capture RAM, volatile memory, and targeted collections live on M1 Macs running Monterey
• Capture important live data such as Internet, chat, and multimedia files in real time
• Save live collections to a forensically-sound destination device

Create Forensic Images:

• Support for imaging APFS Fusion drives
• Decrypt FileVault 2 volumes if the password, Keychain file, or recovery key is provided, and then mount the volume as read-only to allow triage, collection of specific files, or imaging
• Write-protect source devices while maintaining read-write access on destination devices