The ADB method vs Cellebrite Inseyets — differences that matter in criminal proceedings

In the work of a court digital-forensics expert, the choice of appropriate tools for analysing digital data is crucial for the quality, completeness and procedural value of the opinion produced. One of the most common misunderstandings in law-enforcement practice is comparing professional forensic tools (e.g. Cellebrite Inseyets) with generally available methods such as ADB backup. Although both techniques serve to acquire data from mobile devices, their capabilities and legal effects are radically different.

What is ADB backup?

ADB backup is a function available in the Android Debug Bridge (ADB) that allows a user to make a logical backup of data from an Android device. Although it can be useful in everyday technical use, in the context of criminal proceedings ADB backup has significant limitations:

• It does not allow the recovery of deleted data,
• It omits data from many applications (especially encrypted ones),
• It does not cover system data, logs or metadata,
• It does not generate technical documentation or checksums confirming data integrity,
• In newer versions of Android (from 12), its functionality is reduced almost to zero.

What does Cellebrite Inseyets offer?

Cellebrite Inseyets is an advanced tool used by investigative services, the police and forensic laboratories worldwide. It enables:

• Data extraction in logical, file-system and physical modes,
• Recovery of some deleted data — to an extent depending on the device model, system version and encryption (messages, chats, multimedia),
• Analysis of data from encrypted applications (e.g. WhatsApp, Telegram; in the case of Signal, the scope is often severely limited by strong local encryption),
• Automatic generation of reports with a full event structure (timeline, location, contacts),
• Maintaining data integrity (SHA-256/MD5 hashing),
• Work compliant with evidentiary requirements and a methodology tested, among others, in the NIST CFTT programme and the ENFSI guidelines.

Differences that affect procedural value

In criminal proceedings, every expert opinion is a document of potentially high evidentiary weight. Using a simplified method (ADB backup) may result in:

• The omission of important information,
• An inability to demonstrate data integrity,
• The risk of the opinion being challenged by the court,
• The need to appoint another expert or to re-examine the evidentiary material.

An opinion prepared using tools such as Cellebrite, by contrast, is complete, transparent and technically reproducible, which translates into the efficiency of the whole proceedings and reduces the need to prolong or supplement them.

Price differences – a result of technology, not policy

Many of those commissioning expert reports wonder about the difference in cost between opinions produced using free tools and those based on licensed solutions such as Cellebrite. This difference results not from operating costs, but from:

• The scope of the data obtained,
• The ability to recover deleted information,
• Integration with reporting and hashing tools,
• Compliance with forensic and court standards.

It is worth emphasising that although the unit cost of an opinion using Cellebrite is higher, from the perspective of the economics of criminal proceedings it is an efficient solution:

• it eliminates the risk of appointing further experts,
• it allows the procedural authorities to reach key evidence more quickly,
• it reduces the investigators' workload thanks to reports ready for interpretation.

Standards worth following

At FireNet, all expert reports are prepared in accordance with the current Digital Forensics guidelines, using licensed, auditable tools. Our approach ensures not only the effectiveness of data acquisition but, above all, high evidentiary value and the resilience of the opinion to challenge.

It is worth noting that the scope and type of possible extraction (logical, file-system, physical) depend on the device model, the system version and the encryption used — in newer phones with File-Based Encryption, full physical extraction and the recovery of deleted data are often impossible without dedicated methods. Making a complete copy on site may allow the device to be returned earlier, but the decision to return the evidence always rests with the procedural authority.

If, as a prosecutor, police officer or other procedural body, you are considering commissioning an expert report, we encourage you to get in touch. We will gladly present documentation of sample analyses and help you choose a method appropriate to the type of device and the nature of the case.