Cellebrite makes the UFED - Universal Forensic Extraction Device - a suite of hardware and software tools used by law enforcement agencies to extract data from mobile phones. As of 2024, Cellebrite claims its products are used by agencies in over 100 countries, including the FBI, DEA, Homeland Security, and thousands of state and local police departments. The UFED can extract call logs, text messages, photos, app data, deleted files, and location history from phones that are often locked and encrypted. It does this using vulnerabilities in mobile operating systems that Cellebrite researches, purchases, or develops and does not disclose to device manufacturers.

The company exists in a specific legal and ethical gray zone. Its tools are used by legitimate law enforcement with court orders to investigate crimes ranging from child exploitation to terrorism. They are also used without warrants in jurisdictions with weak oversight, against political dissidents, journalists, and activists. Cellebrite sells to governments with documented records of targeting civil society. When Signal creator Moxie Marlinspike published a detailed analysis of Cellebrite's UFED software in 2021 - revealing serious vulnerabilities in the tools themselves - the disclosure highlighted something important: the same vulnerability-hoarding model that makes offensive cyber tools dangerous also applies to forensic extraction tools.

What the UFED Does

The UFED product line covers three extraction methods. Logical extraction retrieves data through the device's normal interfaces - the same data a backup would contain. It works on unlocked devices and produces structured, easily readable output. Physical extraction bypasses the device's access controls to read raw data from the storage chip, including deleted files, artifacts not exposed through normal interfaces, and data that the operating system's encryption has not fully protected. Advanced logical extraction sits between these, using lower-level interfaces (like iOS's AFC protocol) to retrieve more data than a standard logical extraction.

The most consequential capability is bypassing device passcodes. An iPhone with a six-digit passcode and no biometric unlock has approximately one million possible codes. Without rate limiting or data wipe policies, brute forcing is straightforward. With rate limiting (which iOS enforces by default), brute forcing at the interface level could take years. Cellebrite bypasses rate limiting by attacking the Secure Enclave or exploiting vulnerabilities in the iOS bootloader chain - techniques that require maintaining a current inventory of iOS exploits.

Android extraction is more variable: the open platform means more device-specific vulnerabilities, more exploitation paths, but also more fragmentation. Cellebrite maintains extraction profiles for hundreds of device models, each potentially requiring different techniques. Older Android devices with weaker encryption (or full-disk encryption versus file-based encryption) are generally more extractable than recent devices with Titan or equivalent security chips.

[INFO]
Cellebrite distinguishes between "in AFU" (After First Unlock) and "BFU" (Before First Unlock) extraction capability. A phone that has been unlocked at least once since power-on is AFU - the encryption keys have been derived and are in memory, making file-level extraction feasible. A phone that has never been unlocked since power-on is BFU - encryption keys have not been derived, and only metadata and a subset of data is accessible even with a physical dump. This is why law enforcement is advised to keep a seized phone powered on (maintaining AFU state) rather than powering it off, which would reset to BFU.

The Exploit Acquisition Model

Cellebrite's technical capabilities depend on maintaining a supply of vulnerabilities in mobile operating systems. The company employs researchers who discover vulnerabilities, and it purchases vulnerabilities from external researchers and brokers. Critically, these vulnerabilities are not reported to Apple, Google, or device manufacturers - disclosing them would result in patches that eliminate the extraction capability. Cellebrite's business model depends on vulnerabilities remaining unpatched.

This creates a direct conflict with the interests of device security. Every iOS vulnerability Cellebrite holds is one that Apple cannot patch - and that other actors (criminal, state-sponsored, or otherwise) might independently discover and exploit against ordinary users. The company's position is that its tools are used only by authorized law enforcement with legal process. The practical problem is that Cellebrite sells to over 100 countries and cannot control how its tools are used once deployed, and that the underlying vulnerabilities affect all users of those devices, not just criminals.

Apple and Google regularly push iOS and Android updates that close extraction vulnerabilities. Cellebrite's capabilities against current OS versions are therefore constantly being eroded. The company's internal documentation, portions of which have become public, describes specific iOS versions as "supported" and "partially supported" - reflecting the perpetual cat-and-mouse dynamic. Law enforcement investigators work around this by extracting from phones before OS updates whenever possible, and by maintaining older device profiles for legacy extractions.

The 2021 Signal Disclosure

In April 2021, Moxie Marlinspike published a blog post describing vulnerabilities in Cellebrite's UFED software itself. The post began with a framing device: Marlinspike described finding a Cellebrite device that had "fallen off a truck" and examining its contents. The examination found that the UFED software processed untrusted data from devices being analyzed with minimal input validation.

Specifically, the UFED would parse data from examined devices using libraries like FFmpeg (for video processing) that had not been updated in years and contained known exploits. An attacker who anticipated their device being analyzed by UFED could craft a specially formatted file - stored in an app, an image, or an arbitrary location on the phone - that would execute arbitrary code on the Cellebrite analyst's computer when the UFED processed it. This could corrupt the UFED report, insert false evidence, or compromise the analyst's machine entirely.

The implications were significant. Evidence collected by UFED and presented in court could be challenged if the examined device contained crafted payloads. The reliability of the tool itself as a forensic instrument was questioned. Marlinspike noted, with obvious implication, that Signal could include such payloads in its own application data - not as an attack, but as a demonstration that the forensic data extracted from a phone running Signal could not necessarily be trusted.

[WARNING]
The evidentiary implications of the Cellebrite vulnerabilities have not been fully resolved in case law. Defense attorneys have raised UFED reliability in cases, but courts have generally admitted UFED-extracted evidence pending specific challenges. The theoretical attack - crafting data that corrupts a UFED report - requires advance knowledge that one's device will be examined and technical capability to craft the payload. For most criminal defendants, this is not a realistic avenue. For sophisticated adversaries (journalists protecting sources, activists in high-risk environments, intelligence community targets), the question of whether UFED-extracted evidence can be trusted is genuinely open.

Geographic Reach and Misuse

Cellebrite's export of UFED technology to authoritarian governments is documented. Access Now, Amnesty International, and other human rights organizations have tracked cases where Cellebrite tools were used against journalists, opposition politicians, and civil society in Bangladesh, Indonesia, Hungary, UAE, and other countries. Cellebrite has periodically announced restrictions on sales to certain jurisdictions after public pressure - suspending Belarus sales after the 2020 election crackdown, for instance - but the effectiveness of these restrictions in preventing misuse is limited when technology has already been deployed.

The 2021 NSO Group Pegasus Project reporting highlighted the broader market of mobile extraction and surveillance tools. While Cellebrite focuses on physical device access (the phone must be in hand), Pegasus operates remotely - Cellebrite and NSO Group represent different points in the mobile forensics ecosystem. The companies are sometimes described as competitors, sometimes as complementary tools used by the same agencies. A Cellebrite extraction is used for evidence after arrest; Pegasus is used for intelligence gathering before arrest.

Graykey and the Competitive Landscape

Cellebrite is the dominant player but not the only one. Grayshift's GrayKey is a US-only competitor with a more restrictive sales policy (US law enforcement only) that focuses specifically on iPhone passcode bypass. The product is favored by some US federal agencies for its reliability against current iOS versions. Grayshift maintains strict controls on who can purchase and how the device can be used - the GrayKey does not connect to the internet and records all extractions for audit purposes.

MSAB (formerly Micro Systemation), Oxygen Forensics, and Magnet Forensics compete in the lower-end and software-side of mobile forensics. These tools generally rely on logical extraction and are less capable against locked, encrypted devices than UFED or GrayKey, but are more affordable and widely deployed.

The broader forensic extraction market is growing. The increasing amount of evidence that exists only on mobile devices - messaging app histories, location data, app activity - means that mobile extraction capability is essential to modern criminal investigations. The legal framework governing when such extractions require warrants (Carpenter v. United States, 2018, established Fourth Amendment protection for cell site location information) continues to evolve, but the technology moves faster than the law.

[TECHNICAL NOTE]
Practical mobile security hardening against forensic extraction: Enable full encryption (default on modern iOS and Android, but verify). Use a strong alphanumeric passcode - 6-digit PINs are significantly less resistant to UFED attack than 12+ character alphanumeric passcodes. Enable Lockdown Mode on iOS (disables USB accessories including data connections when locked). Power off the device before anticipated law enforcement contact to achieve BFU state - more difficult to extract than AFU. Do not consent to device searches - law enforcement can apply for a warrant, and the legal process creates a record. Use end-to-end encrypted messaging apps (Signal) - content may be on the device but metadata and message content are encrypted. For extreme threat models: regularly factory reset and restore to eliminate accumulated data, use separate devices for sensitive and routine communications. Note: no consumer mobile device provides guaranteed resistance to a nation-state-level adversary with physical access and time.