FAQ
What to do to make reports smaller?
As a forensic expert, who is working with the evidence and a lot of reports on daily basis you might find this article very useful. it brings you some tips which can makes your daily duties much easier. Split the PDF report file to multiple files. ...
How to buy additional licenses
The best way is to connect the desired phone which has not been activated, then click on next and in the activation window which will appear click on purchase license and proceed with purchase. If you have any activation licence's left, then Forensic ...
Does MOBILedit Forensic Express offer viewer or data analysis tool?
MOBILedit Forensic Express is intended for extraction and express work, to provide you all possible exports and reports. We expect you to read the data in PDF, Excel, HTML, UFED and other 3rd party tools, as we provide all data in open file structure ...
Where to find previous Android backup
Here are a few places you can look for your Android backups if one or more exists. You could then restore the phone or import the backup and run the program. 1. Log-in to your Google account, in the upper right of the screen there is a small grid ...
iTunes backup password is required each time I run analysis
Normally when you extract iTunes backup and a temporary password is set-up by MOBILedit Forensic Express is this password removed after successful extraction. It looks like your first extraction didn't finish successfully and the iTunes Backup ...
Does MOBILedit Forensic Express have the capability of extracting data from iCloud?
Yes. Cloud Analyzer can extract and analyze iTunes backups from iCloud without the need to have the phone physically present in your lab. Complete parsing of low level phone backup provides maximum data such as data from applications, including ...
How to get communication logs
1. Start MOBILedit Forensic Express 2. On home screen click on "Settings" 3. Select a level of logging and set the max log size to 4096KB: "Logging off" is for best performance, "Debug" is best if you will send logs to us with a bug or issue report. ...
Cannot see too much information in a report from iPhone
As for the empty sections in the report, the crucial thing is to enter the proper password so the iTunes backup can be created, from where we get most of the data. If this fails, it is cancelled or you don't know the password, there is not much ...
How reliable is recovered data?
Message timestamps are stored in databases as single numbers. More information about the most popular format of storing timestamps can be found here: https://en.wikipedia.org/wiki/Unix_time. Recovered data are often already partially rewritten, and ...
What deleted data can I retrieve?
Some deleted data will appear in the report. Deleted data type depends on the phone used. Android: We can retrieve deleted messages if the phone is rooted. If the phone is not rooted we can still get some deleted application data (messages, browsing ...
Types of logs
Extraction logs Main log of the extraction process is located in export folder, filename is “log_full.txt”. It contains information about extracted files and everything else you can see on the screen during extraction process and during the report ...
I connected the phone but can not press 'next' to next step
The phone might be connected through MTP protocol. It is required to have proper connection established by using our Connector app in order to continue. For this you need to turn on 'USB debugging' and have a proper device driver installed. Please ...
Connector installation has failed
Connector installation is a reliable process, so if it is not successful the phone is rejecting the installation. In this case, there is probably not enough of RAM memory, storage memory or there is something wrong with the phone. Try deleting a few ...
My PDF report is empty or incomplete
The PDF report generator will require a lot of memory especially if there is a large amount of photos or videos. It is recommended to have at least 16GB of RAM and also at least 32GB of free space on system disc for temporary data swapping. If it is ...
Wrong information in recovered data
Recovering any deleted data is a special and complex process and it is not possible to recover them always fully with 100% data accuracy. We deeply analyze data and bring the best possible results, however if you know about any other tool bringing ...
Software is crashing
MOBILedit Forensic Express is known to be very stable. We pay maximum attention to this issue and want to fix it. Please send us a screenshot and description of the moment when the crash happens. Plus following information: Exact phone model and OS ...