MOBILedit Forensic Express

MOBILedit Forensic is a phone extractor, data analyzer and report generator all in one solution. A powerful 64-bit application using both the physical and logical data acquisition methods, MOBILedit Forensic is excellent for advanced application analyzer, deleted data recovery, live updates, a wide range of supported phones including most feature phones, fine-tuned reports, concurrent phone processing, and easy-to-use user interface. With the password and PIN breaker, you can gain access to locked ADB or iTunes backups with GPU acceleration and multi-threaded operations for maximum speed.

MOBILedit Forensic offers maximum functionality at a fraction of the price of other tools. It can be used as the only tool in a lab or as an enhancement to other tools through its data compatibility. When integrated with Camera Ballistics it scientifically analyzes camera photo origins.

Main Functions:

Phone extractor with an extremely wide range of supported phones
Password breaker with GPU acceleration and multi-threaded operation for maximum speed
iTunes backup analyzer
Android ADB backup analyzer
Applications data analyzer
Photo Recognizer
Deleted data recovery
Cellebrite UFED data analyzer
Cellebrite UFED data generator
Oxygen data analyzer
Report generator
Security Bypassing

Security bypassing
MOBILedit Forensic has a built-in phone unlocking feature for many phone models, allowing you to acquire a physical image even when the phone is protected by a password or gesture. It can bypass the lock-screen on a wide range of Android phones. It is ready to utilize the full potential of modified recovery images in order to perform physical acquisition with just a few clicks. Lock-screen patterns, gestures, PINs and passwords are no longer an obstacle in your way of acquiring any data from a wide variety of Android devices.

Physical data acquisition and analysis
In addition to advanced logical extraction we also provide Android physical data acquisition, allowing you to extract physical images of investigated phones and have exact binary clones. Physical analysis allows you to open image files created by this process, or those obtained through JTAG, chip-off or other tools to recover deleted files plus all other deleted data where our product is known to be excellent.

Advanced application analysis
The use of apps to communicate and share has grown rapidly. Many apps are released or updated everyday. It is obvious that the analysis of apps is vital to retrieving as much evidence as possible. This is the strongest point of MOBILedit Forensic, we dedicate a large part of our team specifically for application analysis. We employ adaptive and in-depth methods to ensure you retrieve the most data available for each app- especially recovering deleted data. Data is analyzed for its meaning so you see it on a timeline as a note, a photo, a video or a flow of messages no matter what app was used to send them. Check our database of supported apps.

Live Updates
The use of apps to communicate and share has grown rapidly. Many apps are released or updated everyday. It is obvious that the analysis of apps is vital to retrieving as much evidence as possible. This is the strongest point of MOBILedit Forensic, you get updates of application analysis live and as often as needed. Data is analyzed for its meaning so you see it on a timeline as a note, a photo, a video or a flow of messages no matter what app was used to send them.

Deleted data recovery
Deleted data is almost always the most valuable information in a device. It often hides in applications; and because this is our strongest expertise, we deliver great results in finding deleted data. Our special algorithms look deeply through databases, their invalidated pages and within caches to find any data that still resides in a phone. MOBILedit Forensic retrieves the deleted data and presents it clearly in a special section of the report.

Fine-tuned reports
A tremendous amount of effort has been dedicated to refining reports so they are customizable, easy to read, concise and professional. An enhanced report configurator allows you to define exactly which data will be extracted from the phone and how the report will look. Each report is divided into sections, labeled with icons, pictures, and highlighted relevant data so you can find evidence quickly. A complete, configurable and comprehensive list of all events with a time-stamp is shown on a timeline and messages can be filtered by conversation or by contact names.

Reports are available in PDF, XLS, or HTML formats, and you can generate data exports compatible with the other data analysis tools you use in your lab, such as UFED. Have a look on the sample report.

Apple Watch direct reading
MOBILedit is able to read data directly from Apple Watch via a special reader and extract data such as device info including MAC addresses, memory, UID, SW revisions, notes with recordings and files, app list, synchronized pictures with related locations and system logs.

Concurrent extractions and new 64-bit engine
The new 64-bit engine provides stability and the ability to analyze huge amounts of data, apps with hundreds of thousands of messages, photos and other items, plus several phones at once. Speed up your investigation process by extracting multiple phones at the same time, and generating multiple outputs for each one. All you need is a USB hub, cables and a computer powerful enough to perform concurrent jobs. You can finish a week's worth of work overnight!

Malware detection
The new Malware detection is based on the Yara project. Yara works on the basis of rules that describe any pattern of data, in our case patterns that may indicate malware. MOBILedit Forensic applies these rules and searches the file to see if it accomplish any of these rules, and returns a list of results. This means that it contains the data patterns described.

Easy to use UI
Having the right tool is not enough, you need the right staff to work with it. The shorter the learning curve the better. Because we have designed software for millions of consumers, it was a welcome challenge for us to make MOBILedit Forensic the most user-friendly forensic tool available. With a straightforward interface, each step is simple and guided with clear instruction. It is also optimized for touch screens allowing for easy use in the field.

Camera Ballistics - scientific image analysis
When combined with Camera Ballistics you are able to identify which images present on the analyzed phone were actually taken by the phone's camera using a sensor fingerprint. This process delivers new insight into the images such as make, model, GPS, camera settings, mean square error, fingerprint presence result, probability, and correlation will be organized into a well designed and comprehensive PDF report suitable for submission as evidence.

Reports in any language
Reports are now under the user’s control. You can customize reports to your own style or translate them to your language, so you can meet the criteria defined by the law.

Photo Recognizer
This module automatically locates and recognizes suspicious content in photos such as weapons, drugs, nudity, currency and documents. Photo Recognizer utilizes artificial intelligence and deep machine learning to quickly analyze an unlimited number of photos, and is designed to eliminate countless hours that would be spent manually searching for key evidence in huge databases of photos. Each photo is placed in its own specific category so the investigator can keep the case well-organized and easily present the suspicious content in a fine-tuned report.

Face Matcher
This important feature easily finds photos of people you are looking for. Based on the newest deep learning techniques, Face Matcher rapidly analyzes even large quantities of photos that users often have in their phones. Eliminate countless hours spent manually looking through photo albums. Simply supply photos of faces you want to find, and let Face Matcher find right photos in a phone or PC.

3rd party plugins
Possibility to use 3rd party plugins.