Short message conversion for Cellebrite

This page covers information for Cellebrite conversion. To view the Relativity supported and unsupported file type tables, see Supported file types for processing.

During processing, Relativity automatically converts Cellebrite's Universal Forensic Data Report (UFDR) chat extract from mobile devices to Relativity's Short Message Format (RSMF). Chat data includes text messages (SMS, MMS), and chat applications data (WhatsApp, Facebook Messenger, WeChat, Telegram). Chat data is extracted independent of the device operating system (iOS or Android). Relativity extracts all the other data available in the UFDR and makes it available for review.

Recommended workflow

(Optional) Relativity recommends the following workflow to convert UFDR files to RSMF data format.

Flowchart showing the recommended process for extracting Cellebrite data.

  1. Use Cellebrite to extract UFDR data from a mobile device.
  2. Open the file in Cellebrite Reader and remove any unnecessary data. This ensures you have the latest UFDR version.
  3. Re-export the UFDR from Cellebrite to your storage area.

Processing the files into Relativity:

  1. Use Import/Export (or Express Transfer) to upload UFDR files into Relativity.
    OR
    Use ROSE to upload UFDR files. If you use ROSE, create a processing set with the uploaded data as the data source.
  2. Run processing discovery. Relativity automatically converts the files to RSMF. You can monitor the progress through the processing set layout details screen.
    • The number of discovered documents equals the number of generated RSMF files plus any attachments.
    • If you encounter processing errors, see Troubleshooting.
  3. Publish the files and then navigate to the Documents tab to view the RSMF files.

Generated RSMF fields

The following table lists the metadata fields found in RSMF files after Cellebrite conversion.

Relativity source field name Field type Description
Subject Long Text The name of the conversation.
  • For public/private channels: CHANNEL_NAME
  • For group chats/dms: LIST OF PARTICIPANTS
File Name   The conversation name + date + slice.
EmailFrom Long Text The display name and email of sender of first event in the conversation.
EmailTo Multiple Choice A list of display names and emails of all participants in conversation,
Date Date The date of first event in conversation.
Rsmf/Version Long Text 2.0.0
Rsmf/Participants Multiple Choice
Use the Long Text field type when mapping the Rsmf/Participants field. Selecting Multiple Choice can lead to hundreds of unique choices that may impact performance.
 A list of display names of all participants in conversation.
Rsmf/Generator Long Text Relativity Processing
Rsmf/Application Long Text Specific to the chat data type. For example, SMS or WhatsApp.
Rsmf/MessageCount Whole Number The number of events in the conversation.
Rsmf/AttachmentCount Whole Number The number of attachments in conversation.
Rsmf/EventCollectionId Long Text The conversation ID that is persisted between file slices.
Rsmf/BeginDate Date The date and time of first event in conversation.
Rsmf/EndDate Date The date and time of last event in conversation.

Troubleshooting

Errors reported during advanced access include:

Discover error message Details
Processing UFDR did not create any RSMF files. Make sure you have selected the correct processing profile. It is also possible the UFDR did not contain any chat data that could be converted to RSMF.
Error message, “An error occurred during the batching of the Ufdr-to-RSMF conversion. The error may be due to an unsupported package structure […]."  Relativity encountered an unexpected format of metadata in the UFDR. Ensure the metadata fields are mapped correctly and with the correct field type.
Error message, "An error occurred while adding some attachments in Ufdr-to-RSMF conversion." The error is likely due to a corrupt attachment. You can ignore this warning as the missing attachments will appear as links in the generated RSMF files.
Error message, "An error occurred during parsing date time of some messages in Ufdr-to-RSMF conversion." The error is likely due to a missing date time value. You can ignore this warning as the missing date time will appear as default value (01/01/0001 00:00:00) in the generated RSMF files.

Known issues and limitations

  • Slicing settings reflect the original timezone.
  • Any missing metadata following conversion to RSMF is likely due to the data not being in the UFDR file.
  • Inventory is not supported for Cellebrite UFDR. We recommend you cull the files in Cellebrite Reader prior to uploading to Relativity.
  • Encrypted UFDR files are not supported. Use the Cellebrite Reader to decrypt, then import into Relativity.

Resources

Additional resources include: