Short message conversion for Cellebrite

This page covers information for Cellebrite conversion. To view the Relativity supported and unsupported file type tables, see Supported file types for processing.

During processing, Relativity automatically converts Cellebrite's Universal Forensic Data Report (UFDR) chat extract from mobile devices to Relativity's Short Message Format (RSMF). Chat data includes text messages (SMS, MMS), and chat applications data (WhatsApp, Facebook Messenger, WeChat, Telegram). Chat data is extracted independent of the device operating system (iOS or Android). Relativity extracts all the other data available in the UFDR and makes it available for review.

Relativity supports UFDR files generated by Cellebrite tools. UFDR files generated by other tools are not supported.

Recommended workflow

(Optional) Relativity recommends the following workflow to convert UFDR files to RSMF data format.

Flowchart showing the recommended process for extracting Cellebrite data.

  1. Use Cellebrite to extract UFDR data from a mobile device.
  2. Open the file in Cellebrite Reader and remove any unnecessary data. This ensures you have the latest UFDR version.
  3. Re-export the UFDR from Cellebrite to your storage area.

Processing the files into Relativity:

  1. Use Import/Export (or Express Transfer) to upload UFDR files into Relativity.
    OR
    Use ROSE to upload UFDR files. If you use ROSE, create a processing set with the uploaded data as the data source.
  2. Run processing discovery. Relativity automatically converts the files to RSMF. You can monitor the progress through the processing set layout details screen.
    • The number of discovered documents equals the number of generated RSMF files plus any attachments.
    • If you encounter processing errors, see Troubleshooting.
  3. Publish the files and then navigate to the Documents tab to view the RSMF files.

Generated RSMF fields

The following table lists the metadata fields found in RSMF files after Cellebrite conversion.

Relativity source field name Field type Description
Subject Long Text The name of the conversation.
  • For public/private channels: CHANNEL_NAME
  • For group chats/dms: LIST OF PARTICIPANTS
File Name   The conversation name + date + slice.
EmailFrom Long Text The display name and email of sender of first event in the conversation.
EmailTo Multiple Choice A list of display names and emails of all participants in conversation,
Date Date The date of first event in conversation.
Rsmf/Version Long Text 2.0.0
Rsmf/Participants Multiple Choice
Use the Long Text field type when mapping the Rsmf/Participants field. Selecting Multiple Choice can lead to hundreds of unique choices that may impact performance.
 A list of display names of all participants in conversation.
Rsmf/Generator Long Text Relativity Processing
Rsmf/Application Long Text Specific to the chat data type. For example, SMS or WhatsApp.
Rsmf/MessageCount Whole Number The number of events in the conversation.
Rsmf/AttachmentCount Whole Number The number of attachments in conversation.
Rsmf/EventCollectionId Long Text The conversation ID that is persisted between file slices.
Rsmf/BeginDate Date The date and time of first event in conversation.
Rsmf/EndDate Date The date and time of last event in conversation.

Deduplication mechanism in Relativity Processing (UFDR-specific)

Relativity applies message-level deduplication during UFDR processing, where messages with identical time stamps, sender, body, and attachments are considered duplicates. Only one is retained, and the others are excluded from the final processed count.

When referencing the Rsmf/MessageCount field, note that it reflects only the messages retained after deduplication. Additionally, Cellebrite Reader may extract and label extra messages as "Genie" messages, which are displayed separately but included in Relativity's total message count. To learn more about Cellebrite's App Genie tool, see the App Genie blog on the Cellebrite website.

Troubleshooting

Errors reported during advanced access include:

Discover error message Details
Processing UFDR did not create any RSMF files. Make sure you have selected the correct processing profile. It is also possible the UFDR did not contain any chat data that could be converted to RSMF.
Error message, "An error occurred while adding some attachments in UFDR-to-RSMF conversion." The error is likely due to a corrupt attachment. You can ignore this warning as the missing attachments will appear as links in the generated RSMF files.
Error message, "An error occurred during parsing date time of some messages in UFDR-to-RSMF conversion." The error is likely due to a missing date time value. You can ignore this warning as the missing date time will appear as default value (01/01/0001 00:00:00) in the generated RSMF files.
Error message, "Multiple source extraction is not supported in UFDR-to-RSMF conversion. You can only process UFDR files created from a single device." Relativity has encountered files within a single UFDR created from multiple devices, which is not currently supported. Create the UFDR file to include data from only one device and proceed with reprocessing.
Error message, "An unexpected internal error occurred during UFDR-to-RSMF conversion. Please retry the dataset to proceed." Relativity may have experienced internal issues while processing the UFDR file(s). Retry the data set. If the issue persists, do not hesitate to contact support.
Error message, “An error occurred during UFDR-to-RSMF conversion. The error may be due to an unsupported package structure. Please consider opening the file in Cellebrite Reader and exporting again before reprocessing the data." Relativity has identified an unsupported structure in the UFDR file. Verify the file's integrity using Cellebrite Reader and export it again prior to reprocessing the data.
Error message, ”The input file appears to be corrupted or is not a complete UFDR file. Please consider opening the file in Cellebrite Reader and exporting again before reprocessing the data." Relativity has encountered an unexpected format in the UFDR file. Verify that the UFDR file was correctly exported from Cellebrite Reader, or consider re-exporting it before reprocessing.
Error message, "Extraction partially completed: X of Y media files were not fully processed due to data corruption issues. To resolve this issue, repair the corrupted media files, and export a new UFDR file before reprocessing." The error is likely due to a corrupted media file within the UFDR file. To effectively process these files, verify their integrity in Cellebrite Reader prior to reprocessing.
Error message, “The UFDR report is encrypted or corrupted.” Relativity has identified UFDR file(s) that are likely encrypted, and this file type is currently unsupported. Use Cellebrite Reader to decrypt these files prior to reprocessing them in Relativity.
Error message, “An exception occurred during creation of EML file from emails in UFDR. The exception is due to invalid email addresses saved in UFDR report. The EML file is generated anyways but without the problematic data.
You can ignore the warning or try reexporting the UFDR without the problematic emails and retry processing."		 The exception arises from the presence of invalid email addresses stored in the UFDR report. You may choose to either disregard the warning or re-export the UFDR, excluding the problematic email addresses, and then attempt the processing again.

Known issues and limitations

  • Slicing settings reflect the original timezone.
  • Any missing metadata following conversion to RSMF is likely due to the data not being in the UFDR file or the metadata is associated with a media file such as images or videos.
  • Inventory is not supported for Cellebrite UFDR. We recommend you cull the files in Cellebrite Reader prior to uploading to Relativity.
  • Encrypted UFDR files are not supported. Use the Cellebrite Reader to decrypt, then import into Relativity.

Resources

Additional resources include: