search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
944 stars 218 forks source link

Support new Media Classification properties from Cellebrite UFDR reports #493

Closed rodrigohunk closed 2 years ago

rodrigohunk commented 3 years ago

It would be useful if IPED could identify Media Classification properties from Cellebrite UFDR reports

lfcnassif commented 3 years ago

Could you give an example of such media classification properties? Are them related to the new IA classification algorithm included in PA software?

rodrigohunk commented 3 years ago

Perfect, they're related to new classification algorithm included in PA software. As you can see, a new column is generated if you choose to perform Media Classification. This metadata would be interesting to be used in IPED. Media Classification media

aberenguel commented 2 years ago

This feature in PA very useful! It can detect weapons, money, nudity, child sexual exploitation (CSE) with reasonable accuracy. This information could be appended in metadata for awhile.

aberenguel commented 2 years ago

Inspecting an UFDR file, I noticed the media classification information is not in the report.xml file. For each media file, it was created a file in the MediaResults folder.

For example, for the file with id="003b0819-25fe-4804-914d-61de999d8fc9" in the report.xml, there is a file MediaResults/003b0819-25fe-4804-914d-61de999d8fc9.json in the UFDR.

The json content is:

{"FileId":"003b0819-25fe-4804-914d-61de999d8fc9","Classifications":[],"Categories":[{"Value":"SuspectedCSA","Score":85.03613}]}
lfcnassif commented 2 years ago

Thanks @aberenguel for digging into this.

lfcnassif commented 2 years ago

Currently I have other issues in my roadmap for 4.0. If you could help implementing this, that would be great.

aberenguel commented 2 years ago

Nice! I'm implementing this feature. @tc-wleite will check the changes prior I submit a PR.

lfcnassif commented 2 years ago

Thank you @aberenguel! So I'll assign to you to avoid duplicated efforts.