List of applications – retrieves a complete application list from the phone.
Application data – retrieves and processes data of applications. Results of the app analysis are shown in the reports, and the raw application data are also stored in the export folder, which makes additional processing and analysis possible.
All applications – will process all available application data from the phone.
Let me choose – if selected then when you press 'Next' to continue, it will show a list of all apps and you will be able to select only the ones that you want to process.
Deleted data – turns on a recovery of the deleted application data.
Download referenced files - download the referenced files from the chat message stored online.
App Downgrade – more detailed information is available here.
List applications files – this option adds a file list section to the reports, that includes all data files retrieved from applications.
Extract APK files from the phone – extract the apk files and automatically verifies if the file is certified or not. This information is displayed in the report under each application section or application list. It is our first level malware detection.
Malware detection - check the extracted application apk files for malware. This information is displayed in the report under each application section or application list.
To be able to use this feature is necessary to install the Java runtime version 8. You can download it here
Selecting only specific applications
If you wish to manually select specific applications to be analyzed, then select the "Let me choose" option above. On the next page, you will see a list of application found on the phone. The list includes the application package name (such as com.apple.android.music in the screenshot), the application name (Apple Music) and the icon.
Sometimes application names and icons can take longer to obtain (and in some circumstances, such as for ADB backup and iTunes Backup, might not be present at all) therefore they are being shown
progressively when data from the phone is found it will be fully displayed in generated reports. Using the edit box and search button at the top of the page you can narrow the list
of applications that you see if you only want to look at an individual app without having to trawl through every other application first.
Please note that as applications are updated it might become increasingly difficult to obtain data from them. However, there are two ways on how to bypass this issue if it does occur.
First, is to root/jailbreak the phone - this will give you a superuser access to the phone's file system and therefore access to all the hidden and normally inaccessible folders with applications data. How do I root a phone? For more information visit our user guide here
App downgrade feature:
Second, is to use MOBILedit Forensic Express´s feature called "App downgrade". This will cause the apps to resort to a previous version, where vulnerabilities are present allowing access to data that otherwise would be unattainable. Find more about the App downgrade feature here.
Example of applications report: