All
results of the data extraction and analysis are contained in one
folder, which is the base folder of all the reports and exports. By
default this folder has a name consisting of the phone name, the date
and time when the processing started, such as: Samsung Galaxy S7 (2020-03-03 10h36m23s). You can select the destination folder and rename the export before starting the export.
HTML reports are saved in two ways – one is the whole report stored in one file, Report_long.html,
and the other one is the full report divided into multiple files (one
file per main report section) and the index to the whole report is Report_index.html. The reason for this division is that the reports might be big and some browsers cannot open such big files.
PDF report is similar to the html report – in fact it is generated from a
special version of the html file – and the name of the report is Report.pdf.
In this report all images are stored inside of the PDF, in a suitable
resolution so the PDF file itself can be used for distribution of the
report, but there are links from the PDF to additional content stored in
the folder named pdf_files, such as all the extracted files (application databases and the like) and also the images in their original resolution.
When the resulting pdf report file might be too large causing the pdf generation phase could fail, it is better to use the PDF Report – Multiple Files
option, which generates multiple PDF files, one per each report
section. The files start with numbers such as
01_Screenshots_of_User_Settings.pdf, 02_Summary.pdf etc., and all the
pdf files are again linked to the pdf_files folder.
This report format generate multiple files divided by the content
of the phone, saved as a .XLSX
document (for this you need to have MS Excel installed on your PC).
There is no folder related to this format as no additional files are
saved during the report, and if you need the related files they have to
be taken from the other report folders.
MOBILedit Backup is the format which stores all the information that has been
extracted from the phone, and that can be opened later to create
additional reports, either with different options and parameters, or in a
newer version of Forensic Express with improved features such as
enhanced recovery of deleted data. The file name is backup.mobiledit, all related files are stored in the folder backup_files, and to open the backup use the option Open file in the main window (when you press Start after launching the application.)
This
export format contains all analyzed information from the phone,
including data from applications and the recovered deleted data, its
file name is export.mobiledit and the related folder with files is mobiledit_export_files.
Name | Content |
application0 | applications and their data, not user shared galeries |
application1 | special content, logs from apps or content providers |
raw0 | the whole phone file system |
raw3 | file system which is shared with apps, for example images, music, downloads, user galeries |
misc | temporary files, icons, thumbnails, contacts pictures, message attachments |
If
you specify that you want an Android (ADB) backup or iTunes
backup, then these additional phone backups are stored in the
output folder as well, in subfolders named adb_backup and apple_backup, respectively. These separate backups can be opened too, using the Open file option.
ADB backup is also typically created when any application data are needed,
and iTunes backup (which contains lots of useful information) is used
for most of the operations with an iPhone or an iPad.
If you are using the iCloud analyzer, then downloaded iCloud backups are stored in subfolder named icloud_backups.
There are three specific files in the report folder.
File log_full.txt
contains all information that was presented on the screen in the white
log window, together with all files copied from the phone, and if the
password breaker has been used then it contains the resultant password
as well.
In the log_short.txt there is a summary
info of the extraction phase, together with a list of failed items
indicating what might be missing in the report, such as skipped folders.
Contents of this file is also included in the html and pdf reports in
the Data Extraction Log section.
File report_configuration.cfg
contains all parameters of the whole report, and if you need to create
the same report from a different phone you can load this configuration
file using the Load report configuration at the start of the report.
All
the files in the report subfolders are stored in a tree structure that
is based on the original data in the phone, so advanced users might be
able to get any files for additional analysis or any other purpose.
When
copying the subfolders (or the whole report folder) please be aware
that the full paths might be longer than the usual limit of 255
characters still present in the Windows shell. It means that while the
file system supports paths as long as 32000 characters (and this is true
for many older versions of MS Windows), the standard copy/paste or drag
and drop file operation will not work well with these folders. In
Windows 10 it seems to be finally addressed, and in other cases you
might use either a third party file manager (such as Total Commander),
or a zip/archive file manager that can handle these long paths.