Specific selection
Data - Applications list
List of applications ever installed in the device List of applications - list of all applications located in your device Extract APK files from the phone - does extract additional APK installation files from your device Malware detection - check the ...
Data - data extraction log
Following tab displays information about ongoing extraction: if you select the Data Extraction Log option in the Specific selection, you will get a brief resume of the extraction tab in your report as well:
Data - SIM card
Extracts data from the SIM card such as IMSI, Country, ICCID, and Operator as shown below:
Data - Large images
Additional section in the report showing one image per page in full size. You can filter them by time, file name or location and choose between ascending and descending order.
Data - Photos
This selection provides you with photos from your device - no other images. Usually found in DCIM folder. If available, the report will provide geo-location information- You can filter the report by time, file name or location and choose between ...
Data - Accounts
This section shows all the accounts linked to the device such as Facebook, Google, and others:
Data - Summary
A synoptic list showing all the gathered data as well as their amount:
Data - Screenshots of report settings
Screenshots of report settings allow you to display the settings you chose for your extraction. They will be displayed in the report and simplify the troubleshooting. They can be also used as a reference for different report settings for other cases ...
Data - Deleted data
We do offer more ways to recover deleted data. The first one is recovering the data from SQLite databases, the second one is recovering the files and folders from physical images. SQL databases allow you to recover the data which were marked as ...
Data - Captured phone photos
Captured phone photos selection allows you to: Webcam: take a picture of the examined phone using the web camera. Phone: capture screenshot of the phone display (Android and iOS only) Import: select photos of your selection from your internal or ...
Data - Web
MOBILedit Forensic Express can extract and analyze web searches, bookmarks, and history made by any app in the investigated device. You can filter and customize the results as seen on the screenshot below: Example of web search report:
Data - User dictionary
MOBILedit Forensic Express can extract cached words written by a user on both Android and iOS devices. On Android devices, you can also extract the whole user dictionary from the keyboard.
Data - Documents
MOBILedit Forensic Express can extract the following formats of documents: .doc .docx .ppt .pptx .xls .xlsx .odt .odp .ods .pdf .rtf .txt .pps .ppsx .msg .pages .tex .wpd .wps .dotx .gdoc .xlr .gsheet .htm .html .ps You can specify your preferences ...
Data - Face Matcher
With this feature MOBILedit Forensic Express is able to find photos with faces and compare them with provided source images. This comes in handy when you need to quickly find photos of a specific person in the investigated phones. The source image ...
Data - Photo recognizer
This feature offers a photo analysis from device or folder on a PC disk. The report will consist of photos tagged and sorted into categories. The analysis is powered by artificial intelligence module utilizing machine learning to automatically ...
Data - WiFi networks
This section contains data about all Wi-Fi networks saved in a device. Such as the last connection timestamps as well as session time and passwords are especially interesting here. Such as networks that the phone has been previously connected ...
Data - Cookies
System cookies are only obtainable from iOS devices. Application specific cookies are analyzed for every installed application. Cookies contain information about web domain as well as their creation time. Specific application session cookies can be ...
Data - Cell towers
Data about cell towers that the subject phone was connected to can be obtained. However, this is only possible with rooted Android phones. Obtained cell tower locations can be individually viewed on the map through the provided link. Example of cell ...
Data - Timeline
Timeline section aggregates all extracted items that contain time and date information and shows them agian in chronological order. Exact parameters of generated timeline can be configured here. Creation and modification time of files and folders ...
Data - Contact analysis
Contact analysis is a section with analyzed relationships between contacts and the way they were used in various modes of communication. It is also possible to skip contacts that have rarely been communicated with on that mobile phone. Example of ...
Data - Web history
This section contains consolidated Web history from all analyzed browser applications. One web history entry usually consists of visited URL as well as time of the visit. Sometimes the total number of visits of a given URL is also available, with ...
Data - System logs (Android only)
System logs and "DumpSys" files can be extracted from Android phones. Android system keeps these files for debugging and monitoring purposes and the files can contain various system data like recent locations, recently connected Wi-Fi networks, ...
Data - Passwords
On iOS devices all system passwords and most application passwords are managed through dedicated and encrypted Keychain. We are able to decrypt the keychain and retrieve all passwords that have been saved/stored within it. Passwords contained in ...
Data - Notifications
Notifications are retrievable from both iOS and Android devices. Application specific notifications gathered from iOS devices include notifications that are no longer active and can contain otherwise unobtainable information such as emails and ...
Data - GPS locations
Locations Forensic Express is able to extract 'accurate location data' from Android devices. Application analysis can also provide GPS detailed location data and sometimes entire routes- especially with mapping, fitness and transportation ...
Data - Bookmarks
Global browser bookmarks can be obtained on iOS devices (Safari bookmarks) and on android devices up to Android 5.1. From later versions of android only application specific bookmarks can be obtained. Example of bookmarks report:
Data - Bluetooth
Bluetooth pairing history can be discovered on both Android and iOS devices. In the "Configure your report" page, select Bluetooth Pairings. Please note that on Android phones the Bluetooth adapter will be turned on during the extraction, and then ...
Data - Video storyboard (FFmpeg)
Overview Because of FFmpeg's license and legal considerations, we cannot provide the FFmpeg library with our product, but you are able to download it on your own. Please read the FFmpeg's legal page at https://ffmpeg.org/legal.html. Installation Go ...
Data - Video files
Phone video files – retrieves video files from the phone. Application video files – includes video files stored in the application data. Generate thumbnails - thumbnails are shown in the report Generate storyboard - videos are ordered in a sequence ...
Data - Audio files
Data - audio files Phone audio files – copies audio files from the phone and shows them in this report section. Application audio files – includes also audio files retrieved from the applications. Files can be sorted by: Filename, which means only ...
Data - Image files
Data - Images Phone images – all other images from the phone's file-system. Application images – images retrieved from the application's data, which might also include images stored in temporary files or caches that has been detected as potential ...
Data - Filesystems
Full FileSystem - if this option is selected then all files from the phone will be copied, and will be included within the list in the report. Please note that this might analysis may take a long time and can consume a considerable disk space, ...
Data - Applications
Applications Application data – retrieves and processes data of applications. Results of the app analysis are shown in the reports, and the raw application data are also stored in the export folder, which makes additional processing and analysis ...
Data - Organizer
Phone organizer – retrieves available items (events, tasks, notes) from the standard phone organizer. Application organizer – merges also organizer items retrieved from the application data. Organizer entries can be sorted by time in the ascending ...
Data - Calls
Phone call logs – all the standard calls from the phone. Application call logs – if selected it will merge all calls retrieved from any application analysis into the main section. Deleted calls – turns on recovery of deleted entries from the call ...
Data - Emails
Emails section, if enabled, shows all email messages from all sources, merged into one list. The sources are typically email applications from the phone, and if it's possible you can also get deleted emails. Please note, that many applications (such ...
Data - Messages
Messages "Phone messages" groups the SMS, MMS, iMessages, application messages and any standard phone messages together. Forensic Express can find any variation of these types of message, and present the gathered data in the report generated. Emails ...
Data - Contacts
Contacts Phone contacts – retrieves all contacts from the phone; typically what is contained in the standard phone book. SIM contacts – contacts from the SIM card, if present in the phone and the phone allows access to the SIM card data. Application ...