Home

AccessData - Amazon Web Services

1. 61 AccessData Product Licenses says a eee ee ee mn tees 61 Installing and Managing Security Devices 61 Installing LicenSeManager ascii n Using LicenseMan ger ne 13 Opening and Saving Dongle Packet Files 19 Adding and Removing Product Licenses 80 Updating Products sus sm a ae ne mas 84 Send a Dongle Packet File to Support 85 Virtual CodeMeter Activation Guide 86 IAN OAWCUO AA te ere tiv gg een gi norte ege EE 86 Preparation sf site rte rss ideas 86 Setup for Online Systems sm aa 87 Setup for Offline Systems ate eae mue set pts ee Ee e a a a zao 88 Creating a Virtual CM Stick with Server 2003 2008 Enterprise Editions 90 Additional Instructions for AD LAB WebUI and eDiscovery 92 Virtual CodeMeter FAQS 2 Zn ee re 93 Network License Server NLS Setup Guide 95 INMODUCUON ee a n nn creed Va liana Ea E arie 95 Preparation Notes 95 SEtUP OVEVIEW etori rase er hak wh III bao uses 95 Network Dongle AKEk 96 NLS Server System NOLS kk eeu tees eerie ce EEE ual ala 96 NES Client System Notes nme ede nr a 97 CHAPTER 1 INTRODUCTION The AccessData AD Mobile Phone Examiner Plus MPE is a powerful mobile devi
2. LG ILG G4015 LG ILG TM520 LG ILG V15225 LG LG VX10 LG LG VX6000 LG IVI5225 LG W3000 LG 5200 LG 7000 LG 7020 Mivvy Chat Mivvy Dual Motorola A1200 Motorola C250 Motorola C385 Motorola C450 Motorola C550 Motorola C650 Motorola E770 Motorola IE770v Motorola Ki Motorola Kim Motorola Kiv Motorola K3 Motorola 2 Motorola ILO Motorola JL Motorola Lie AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Motorola IL7v Motorola L9 Motorola U6 Motorola V1075 Motorola V1100 Motorola V180 Motorola V186 Motorola V220 Motorola V235 Motorola NA Motorola V325 Motorola V325M Motorola V360 Motorola V360v Motorola V3c Motorola V3c Motorola V3cm Motorola V3i Motorola V3iv Motorola V3m Motorola V3m Sprint Motorola V3mM Motorola V3x Motorola IV 3xv Motorola V3xx Motorola V3xxv Motorola V6 Motorola W490 Motorola W510 Appendix A MPE Supported Mobile Devices 41 TABLE A 1 Motorola 73 Motorola IE8 Motorola IEM30 Motorola U9 Motorola NE Motorola V9 Motorola 76 Motorola IZN5 Motorola A 1000 Motorola A835 Motorola E Motorola E1000 Motorola 121070 Motorola 12398 Motorola E550 Motorola E815 Motorola IE815m Motorola T190 Motorola T720 Motorola T720c M
3. INokia 6125 Nokia 6131 Nokia 6150 INokia 6151 Nokia 6233 Nokia 6280 INokia 6288 INokia 7370 INokia 7373 INokia 93001 INokia E61 Nokia EOI INokia E65 Nokia IN70 INokia IN71 INokia IN72 INokia IN73 INokia IN80 INokia IN90 INokia B105 INokia 51401 INokia 6020 INokia 6021 INokia 6070 INokia 6080 INokia 6100 INokia 6101 INokia 6101b Nokia 6103 Appendix A MPE Supported Mobile Devices 45 TABLE A 1 INokia 6310 INokia 63101 INokia 6820 INokia 6822 INokia 7260 INokia 7360 INokia 7650 INokia 2610 INokia 6030 INokia 6060 INokia 3109 classic INokia 3110 classic INokia 3500 classic INokia 5200 INokia 7500 Prism INokia 2100 INokia B310 INokia 3330 INokia B410 INokia B510 INokia 3510i Nokia 5210 Nokia 8210 Nokia 8250 Nokia 8850 INokia 5110 Nokia 6210 Nokia 6250 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 INokia 7110 INokia 7210 INokia 3230 Nokia B650 INokia 3660 INokia 6170 INokia 6234 INokia 6260 INokia 6270 INokia 6630 INokia 6670 Nokia 6680 INokia 6681 INokia 7270 INokia 7280 INokia 7380 INokia 7600 INokia 7610 INokia 7710 INokia 8910 Nokia 89101 INokia 9300 INokia 9500 INokia IE50 INokia 3100 INokia B120 INokia B200 INokia B210 INokia B220
4. Appendix A MPE Supported Mobile Devices 41 TABLE A 1 INokia 5070 Nokia 5100 Nokia 6220 Nokia 6220 classic Nokia 6225 INokia 6800 INokia 6810 INokia 7200 INokia 7250 INokia 72501 INokia 3360 Panasonic X700 Panasonic GD67 Philips 530 Philips 630 Philips Fisio 820 Philips Fisio 822 Philips Fisio 825 Philips 650 Philips 755 Philips 535 Philips Fisio 620 Philips Fisio 625 Sagem Imy400V Sagem myC 2 Sagem myC2 3 Sagem ImyC 3b Sagem myC 4 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Sagem ImyC5 2 Sagem Imy411V Sagem ImyV 65 Sagem myX2 2 Sagem myX 7 Sagem myZ 55 Samsung GT i8510 Samsung SGH G810 Samsung SGH D410 Samsung SGH E300 Samsung SGH E600 Samsung SGH E710 Samsung SGH P400 Samsung SGH S300 Samsung SGH S300M Samsung SGH V200 Samsung SGH X200 Samsung SGH X210 Samsung SGH X450 Samsung SGH X480 Samsung SGH X510 Samsung SGH X520 Samsung SGH X650 Samsung SGH E100 Samsung SGH E330 Samsung SGH E330N Samsung SGH E335 Samsung SGH E630 Samsung SGH E700 Appendix A MPE Supported Mobile Devices TABLE A 1 Samsung SGH E800 Samsung SGH E820 Samsung SGH M3200 Samsung SGH S500 Samsung SGH S730i Samsung SGH
5. Open A Packet File 9 Create A Local Virtual CMStick Create Empty Virtual CMStick offline Create Activation File online gt Activate Virtual CMStick offline 4 Click OK The Confirmation Code Required dialog appears Please enter your confirmation code 9 Enter your confirmation code 6 Click OK AccessData License Manager will automatically synchronize with the License Server over the Internet 1 Click OK when the update completes License Manager will then create the VCM on your system 8 At this point AccessData License Manager now displays a serial number for the VCM on the Licenses tab and the VCM can now operate in a similar way to a hardware CodeMeter device Appendix B Licensing Information 87 SETUP FOR OFFLINE SYSTEMS PERFORM THESE STEPS ON THE OFFLINE SYSTEM 1 Unplug any AccessData dongles you currently have connected 2 Launch License Managet Note When creating a VCM on Windows Server 2003 or 2008 Enterprise Edition please refer to the special set of steps written for those platforms See Creating a Virtual CM Stick with Server 2003 2008 Enterprise Editions on page 90 8 Select Create Empty Virtual CMStick offline Operations Without A Security Device W Open A Packet File Create A Local Virtual CMStick 9 Create Empty Virtual CMStick offline Create Activation File online Activate Virtual CMStick offline
6. GSM License MPE License Activation Key C5FM3 C5FM3 SFWS8K SFWSK BBOBE User Name Deactivate Close 2 Click Deactivate The Activation Key and User Name deactivates and the Deactivate button becomes the Activate button To reactive your software enter the Activation Key and User Name that came with your software and click Activate Note For help on deactivating the GSM license on an offline computer please contact an AccessData technical support representative CONNECTING DEVICES The process of connecting a device to the system for the purpose of examination is made up of two basic tasks installing device drivers and establishing a data connection to the device INSTALLING DEVICE DRIVERS Each supported mobile device that you plan to examine must have the correct driver installed before the device is connected For any device to be detected by MPE the manufacturer s device driver must first be properly installed Note Mobile device drivers can be found on the MPE installation disk as well as in the ZIP archive of the MPE download Users of the MPE Field Tablet will find that many of the most common drivers have been pre installed on their system To install a manufacturer device driver perform the following steps 1 Verify the device manufacturer and model is listed in the Supported Device list See Appendix A MPE Supported Mobile Devices on page 35 Chapter 3 Getting Started ti
7. 2 Locate the correct USB cable and connect the phone to the computer through the USB cable 8 Upon connecting the devcie Windows will automatically attempt to locate the appropriate driver You will likely be prompted to provide the path to the appropriate driver if so browse to the path of the driver based on the name of the manufacturer found in the device drivers folder 4 Once you have selected a driver Windows will provide feedback as to whether ot not the driver was successfully installed If the selected driver fails to install you may need to repeat the process starting from Step 1 If Windows indicates that the driver did install successfully however proceed to the next step 9 Once the driver has been successfully installed you may be prompted to locate additional drivers this is normal and you should continue to repeat the process for as many drivers as Windows detects that it needs 6 Verify the device is properly listed in the Windows Device Manager Note Only currently connected devices will be listed in Windows Device Manager Device drivers y y 8 you have installed previously will not be listed unless the device is connected ESTABLISHING A DATA CONNECTION TO A MOBILE DEVICE To connect a mobile device for the first time 1 Power up the device wait until the device is fully powered on before proceeding to the next step 2 Plug in the device data cable 8 Check Windows Device Manager to ensure
8. not supported the GSM License is not properly activated and or MPE and all associated processes need to be restarted Contact technical support for more information 18 AccessData Mobile Phone Examiner Plus User Guide Use the following table to understand the options in the Device Selection dialog TABLE 3 1 Device Selection Options Manufacturer Model COM Port Cable Advanced Refresh Ports Identify Device Identify Reset Connect Cancel Status IDENTIFYING A DEVICE Select the manufacturer of the connected device You can find the manufacturer underneath the battery of the device or by clicking the Identify button Select the model of the connected device You can find the model underneath the battery of the device or by clicking the Identify button Select the port that the device is connected to Click the Advanced button to identify the correct port Displays the cable number for the selected device after the manufacturer and model are selected For more information on cables see Supported Mobile Devices on page 35 Click to open the Advanced Port Selection dialog From here you can see the port being used by the connected device Click to refresh the COM Port dropdown Click to populate the Device Identify group box Displays information about the connected device including manufacturer and model Populated by clicking the Identify button Removes all selected inform
9. 2005 1 18 PM 0 06 07 E E Calendar Outgoing 71312005 11 44 AM 0 00 56 Outgoing 7 2 2005 3 35PM Home 0 00 40 Media Incoming 6 9 2005 1 07PM Jeff Warren 0 05 25 Incoming 6 9 2005 4 24 PM 0 01 02 Incoming 6 11 2005 12 52 PM 0 00 20 A File System Incoming 6 12 2005 9 52 AM Flaco 0 01 56 E Incoming 6 13 2005 4 08 PM Sal cell 0 01 16 Incoming 6 19 2005 5 15 PM Kelley cell 0 04 49 Incoming 6 20 2005 10 02 AM Incoming 6 20 2005 10 50 AM Unavailable 0 00 24 Incoming 6 24 2005 10 35 AM Mike c 0 01 24 Outgoing 6 21 2005 1 17 AM 0 02 23 Outgoing 6 21 2005 8 10 AM 0 01 18 Outgoing 6 28 2005 6 17 PM 0 00 33 Outgoing 6 30 2005 2 03 PM 0 01 05 Outgoing 6 28 2005 5 21 PM Keith Cell 0 00 41 Outgoing 6 28 2005 5 37 PM Keith Home 0 00 56 Outgoing 6 24 2005 11 00 AM Dad 0 00 24 Outgoing 6 25 2005 12 11 PM_ Mike c 0 00 51 Status Viewing call history Chapter 4 User Interface 29 CALENDAR DATA The Calendar tab displays the items found in the device s calendar including start and end times descriptions locations priority alarms notes ect The figure below shows an example of extracted calendar data FIGURE 3 11 MPE Calendar Data View Priority Alarm All Day Notes Categories Ringtone ER Phonebook Start End Description Location 8 12 2010 5 00 PM 12 31 2999 6 00 PM 0 Farewell 3 Messages E MMS ye Call History Calendar GG Media dA File System Cs Ld Status Viewing ca
10. 9 Activate Virtual CMStick offline ox J d 11 Click OK 18 The resulting dialog prompts you to browse to the location of the newly updated wibucmrau file Locate the file then click Open License Manager creates the VCM on your system 19 19 At this point AccessData License Manager should now display a serial number for the VCM on the Licenses tab and the VCM can now operate in a similar way to a hardware CodeMeter device CREATING A VIRTUAL CM STiCK WITH SERVER 2003 2008 ENTERPRISE EDITIONS CREATE AN EMPTY CODEMETER LICENSE CONTAINER 1 On the Server 2003 2008 machine unplug any CodeMeter devices 2 Open the CodeMeter Control Center Make sure the window on the License tab is empty indicating that no licenses are currently loaded 8 Select File gt Import License 4 Browse to the License Manager program files directory 32 bit systems C Program Files AccessData LicenseManager 64 bit systems C Program Files x86 AccessData LicenseManager 9 Highlight the TemplateDisc5010 wbb file then click Import 6 Click the Activate License button 1 When the CmFAS Assistant opens click Next 90 AccessData Mobile Phone Examiner Plus User Guide 8 Select Create license request and click Next 9 Confirm the desired directory and filename to save WibuCmRaC Example Test1 WibuCmRaC 10 Click Commit 11 Click Finish Copy TO ANOTHER MACHINE 12 Copy the new Wi
11. A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE DOCUMENTATION CONVENTIONS REGISTRATION In AccessData documentation a number of text variations are used to indicate meanings or actions For example a greater than symbol gt is used to separate actions within a step Where an entry must be typed in using the keyboard the variable data is set apart using variable data format Steps that required the user to click on a button or icon are indicated by Gatz A trademark symbol TM etc denotes an AccessData Group LLC trademark Unless otherwise notated all third party product names are spelled and capitalized the same way the owner spells and capitalizes its product name Third party trademarks and copyrights are the property of the trademark and copyright holders AccessData claims no responsibility for the function or performance of third party products The AccessData product registration is done at AccessData after a purchase is made
12. AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IP ADVISED OF THE POSSIBILITY OF SUCH DAMAGE AFF and AFFLIB are a registered US trademarks US 3232830 amp US 3232831 of Simson Garfinkel and Basis Technology Corp The terms of this license can be modified by Simson L Garfinkel or Basis Technology Corp AYENDE RAHIEN Copyright 2005 2009 Ayende Rahien ayende ayende com All rights reserved Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met e Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer e Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution AccessData Legal and Contact Information iii e Neither the name of Ayende Rahien nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
13. Co JE es 4 Click OK 9 The resulting dialog prompts you to save the wibucmrau file Enter a name and path for the file then click Save 6 Transfer the wibucmrau to the Online system PERFORM THESE STEPS ON THE ONLINE SYSTEM 1 Unplug any AccessData dongles you currently have connected 8 Launch License Manager 9 Select Create Activation File online AccessData Mobile Phone Examiner Plus User Guide Operations Without A Security Device Open A Packet File Create A Local Virtual CMStick C Create Empty Virtual CMStick offline 9 Create Activation File online Activate Virtual CMStick offline 10 Click OK The Confirmation Code Required dialog appears 11 Enter your confirmation code and click OK 12 AccessData License Manager will automatically synchronize with the License Server over the internet Data synchronized from the server will be written to the wibucmrau file Click OK when the update completes 13 Transfer wibucmrau back to the offline system PERFORM THESE STEPS ON THE OFFLINE SYSTEM 14 Unplug any AccessData dongles you currently have connected 19 Launch License Manager 16 Select Create Activate Virtual CMStick offline Appendix B Licensing Information 89 Operations Without A Security Device Open A Packet File Create A Local Virtual CMStick Create Empty Virtual CMStick offline Create Activation File online
14. Ericsson T290i Sony Ericsson T300 Sony Ericsson T310 Sony Ericsson T610 Sony Ericsson T61c Sony Ericsson T630 Sony Ericsson T 68i Sony Ericsson Z1010 Sony Ericsson 17600 Sony Ericsson C702 Sony Ericsson C902 Sony Ericsson C905 Sony Ericsson D750i Sony Ericsson G502 Sony Ericsson K310i Sony Ericsson IK3201 Sony Ericsson K510i Sony Ericsson K530i Sony Ericsson Sony Ericsson K550i K610i Sony Ericsson K610im Sony Ericsson K660i Sony Ericsson K750i Sony Ericsson K770i Appendix A MPE Supported Mobile Devices 9 TABLE A 1 Sony Ericsson K790i Sony Ericsson IK8001 Sony Ericsson K810i Sony Ericsson K850i Sony Ericsson S500i Sony Ericsson Sony Ericsson S700i T6501 Sony Ericsson IV 630i Sony Ericsson IV 640i Sony Ericsson W200i Sony Ericsson W300i Sony Ericsson Sony Ericsson W350i W380i Sony Ericsson W550i Sony Ericsson W580i Sony Ericsson W610i Sony Ericsson W660i Sony Ericsson W700i Sony Ericsson Sony Ericsson Sony Ericsson W710i W760i W800i Sony Ericsson W810i Sony Ericsson W850i Sony Ericsson W880i Sony Ericsson W890i Sony Ericsson Sony Erics
15. Q S Q How do I get a Virtual CodeMeter VCM A Contact your AccessData product sales representative They will provide you with a VCM confirmation code Q How do VCMs work A A VCM operates in almost exactly the same way as a hardware CodeMeter device except that they exist as a file stored on the hard disk During activation the VCM file named with a WBB extension is tied to the hardware of the system using unique hardware identifiers Those unique identifiers make VCMs non portable When AccessData License Manager is launched it will automatically load the VCM and display its license information From there you can refresh remove add existing licenses etc just the same you would with a hardware security device Q Are VCMs supported on virtual machines VM A No Due to the fact that virtual machines are portable and VCMs are not VCMs are not supported on virtual machines Currently it is recommended to use AccessData Network License Service NLS to license systems running as virtual machines CLICK HERE for more information Q Does the AccessData Network License Service NLS support VCMs A The current release of NLS does not support using VCM as a network dongle AccessData is considering this support for a future release Q How can I unplug a VCM A If you want to prevent License Manager from automatically loading the VCM you can unplug it by stopping the CodeMeter Runtime Service server and then movin
16. icon that looks like this For the most part there is nothing you need to do with this control center and you need make no changes using this tool with very few exceptions If you have problems with your CmStick contact AccessData Support and an agent will walk you through any troubleshooting steps that may need to be performed AccessData Mobile Phone Examiner Plus User Guide INSTALLING KEYLOK DONGLE DRIVERS To install the Keylok USB dongle drivers do the following 1 If installing from CD insert the CD into the CD ROM drive and click Install the Dongle Drivers If auto run is not enabled select Start gt Run Browse to the CD ROM drive and select Autorun exe OR If installing from a file downloaded from the AccessData Web site locate the Dongle_driver_1 6 exe setup file and double click it Dongle Driver Setup E AccessData USB Parallel Dongle Installation for AccessData 32 and 64 bit systems This program will install the AccessData dongle drivers 1 6 beta 1 Appendix B Licensing Information 67 2 Click Next Dongle Driver Setup Setup Type Select the setup type that best suits your needs Please select the dongle type you wish to install USB O Parallel InstallShield E 8 Select the type of dongle to install the drivers for 4 Click Next Dongle Driver Setup A If you have a USB Dongle Make sure the dongle is NOT plugged in 5 If you have a USB dongle verify that it
17. license from the first dongle You must release that dongle and connect the second dongle before continuing When the second dongle is connected and recognized by Windows and LicenseManager click on the Licenses tab to add the product license to the second dongle REMOVE A LICENSE To remove unassociate a product license 1 From the Licenses tab mark the program license to remove This action activates the Remove License button below the Program list box 2 Click Remove License This connects your machine to the AccessData License Server through the Internet AccessData Mobile Phone Examiner Plus User Guide 8 You will be prompted to confirm the removal of the selected license s from the device LicenseManager zi This will remove selected license s from this physical device The license s will remain available to install onto another device at anytime Do you wish to remove the selected license s from this device No Click Yes to continue or No to cancel 4 You will see some screens indicating the connection and activity on the License Server and when the license removal is complete you will see the following screenl TN x i Packet Update Successful 5 Click OK to close the message box You will then see an Internet browser screen from LicenseManager with a message that says The removal of your license s from Security Device was successful You may close this box at any tim
18. that the device is being detected correctly If the device is not listed in the Windows Device Manager double check that the appropriate driver is properly installed For mor information See Installing Device Drivers on page 11 4 Once a data connection has been established you are now ready to select the device in MPE See Selecting a Device on page 18 Note If you unable to connect your device follow the steps in Resetting Mobile Device Connection Procedure on page 13 AccessData Mobile Phone Examiner Plus User Guide RESETTING MOBILE DEVICE CONNECTION PROCEDURE To connect a mobile device 1 Exit the MPE application 2 Unplug the device data cable 8 Remove the battery cover on the device 4 Remove the battery from the device 5 Remove the SIM card if applicable 6 Properly clean all battery and SIM card contacts 1 Reassemble the device 8 Power up the device wait until the device is fully powered on before proceeding to the next step 9 Plug in the device data cable 10 Check Windows Device Manager to ensure that the device is being detected correctly If the device is not listed in the Windows Device Manager double check that the appropriate driver is properly installed For mor information See Installing Device Drivers on page 11 11 Launch MPE 12 Once a data connection has been established you are now ready to select the device in MPE See Selecting a D
19. the device In this pane the examiner is able to drill down into the file system and view the extracted data using either the Hex view or the naturual view Additionally the examiner can click the Find button or use CTRL F to search for either text or hex string within the extracted data The figure below shows an example of an extracted mobile device file system FIGURE 3 14 MPE File System Data View 3 67 LGLG VX6100 Name Date Modified Type Size Bytes Name Value DE Phonebook LI ART Mem00005 gcp E OWS Mem00006 qcp EO VoiceDB Mem00007 qcp Messages Sun All Mem00009 gcp wT Mem00010 qcp n Patt Mem00011 qcp le MMS Tags Mem00012 qcp Su Lang NextMemo int LI alam uivrState dat Pa Call History E brew L cam L cer Fin LHA Calendar 8 1 download b Li eri 8 1 mms AG Media Su mm pim Esch LI sms b File System EI Oudb user Hex _ Natural Status ABOUT STATUS BARS PHONE DATA BAR The Phone Data bar is below the toolbar It shows the following information Phone The name of the currently connected and recognized device 32 AccessData Mobile Phone Examiner Plus User Guide Port The port number on which the currently connected device is configured to communicate FIGURE 3 15 Phone Data Bar Phone LG VX5200 Port LGE CDMA USB Serial Port COMS STATUS BAR The Status Bar is at the bottom of the main window Use the Sta
20. to extract if File System is selected T Select All Cancel 1 Check the options that you want to extract from the connected device and click Extract The files are extracted and the data is displayed in the main MPE window Use the Data Type tabs to review the data For more information on the how to review the data see Data Type Tabs on page 26 Note Not all devicess carry the same information and not all device drivers will allow the extraction of all the data the device holds The Select Data for Extraction dialog only gives you the options appropriate for the device and driver combination you have connected Ifa data type is not supported on the device you will not be able to select it in this dialog and it will not be activated in the main MPE window FIGURE 3 4 MPE Window 22 AccessData Mobile Phone Examiner Plus User Guide LE miner Plus v 4 0 0 32123 gen e donc OF Tasks Help Phone Nokia E71 Title Name Type Number Email Address Jo Phonebook Ss Messages E MMS za Call History Calendar Media Ther File System Status Viewing phonebook data AT amp T Directory Assistance AT amp T Dir AT amp T VoiceDial AT amp T VoiceDial AT amp T Now AT amp T Now AT amp T Pay My Bill AT amp T Pay My Bill A c AT amp T Music ID AT amp T Music ID AT amp T Customer Care AT amp T Custome Brad Scofield Brad Sc
21. 0 Sanyo SCP 4900 Sanyo SCP 5300 Sanyo SCP 5400 Sanyo SCP 5500 Sanyo SCP 6600 Katana Sanyo SCP 6650 Katana IT Sanyo SCP 7050 54 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Sanyo SCP 7200 Sanyo SCP 7300 Sanyo SCP 8100 Sanyo SCP 8100 Bell Sanyo SCP 8400 Sanyo IVI 2300 Sharp 550SH Sharp 703SH Sharp 770SH Sharp 903SH Sharp GX17 Sharp GX29 Sharp GX33 Sharp GX40 Siemens C35 Siemens C35i Siemens C45 Siemens IM35i Siemens M50 Siemens IME45 Siemens IMT50 Siemens S351 Siemens S45 Siemens SL45 Siemens SL45i Siemens S55 Siemens A65 Siemens A75 Siemens AX75 Appendix A MPE Supported Mobile Devices TABLE A 1 Siemens C55 Siemens C60 Siemens C65 Siemens C72 Siemens C75 Siemens CF62 Siemens CF75 Siemens CX65 Siemens CX70 Siemens CX75 Siemens CXT65 Siemens IM55 Siemens IM65 Siemens IM75 Siemens IMC60 Siemens IME75 Siemens S451 Siemens S65 Siemens 65 Siemens SL55 Siemens SL65 Siemens SX1 SK 6100 Sony Ericsson IDU Sony Ericsson K300i Sony Ericsson K500i Sony Ericsson K600i Sony Ericsson K700i AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Sony Ericsson IP800 Sony Ericsson IP900 Sony Ericsson Sony Ericsson Sony Ericsson IP910i T200 T230 Sony
22. 4 10b or newer must be installed on the computer where MPE will be run e An GSM License Activation Key e Either a USB CodeMeter device a Virtual CodeMeter VCM or a properly licensed Network License Server NLS must be present HARDWARE AND SOFTWARE REQUIREMENTS Before using MPE to image and use phone images as part of an investigation certain hardware and software requirements must be met Software and License Requirements To run MPE in addition to the hardware requirements you need the following e An additional license with separate installation e MPE operates as a standalone product on the Microsoft Windows OS platform e AccessData FTK must be installed if you intend to add the imaged phone data to a case for further investigation Images creatd by MPE are AccessData proprietary AD1 type images MPE images can be imported back into MPE and can be added as evidence to a case in any AD FTK core product Chapter 2 MPE Installation MPE requires third party drivers to read the information on the phone and make it into a forensic image This is further explained in Installing MPE on page 4 Hardware Requirements MPE requires the following additional hardware e USB ports on your machine e WIBU SYSTEMS CodeMeter USB or Virtual CmStick with current licenses installed e A data cable specific to the mobile device Several are shipped with MPE For a list of mobile phones and the cable require
23. AccessData MOBILE PHONE EXAMINER A AccessData A Pioneer in Digital Investigations Since 1987 ACCESSDATA LEGAL AND CONTACT INFORMATION LEGAL INFORMATION AccessData Group LLC makes no representations or warranties with respect to the contents or use of this documentation and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose Further AccessData Group LLC reserves the right to revise this publication and to make changes to its content at any time without obligation to notify any person or entity of such revisions ot changes Further AccessData Group LLC makes no representations or warranties with respect to any software and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose Further AccessData Group LLC reserves the right to make changes to any and all parts of AccessData software at any time without any obligation to notify any person or entity of such changes You may not export or re export this product in violation of any applicable laws or regulations including without limitation U S export regulations or the laws of the country in which you reside 2010 AccessData Group LLC All rights reserved No part of this publication may be reproduced photocopied stored on a retrieval system or transmitted without the express written consent of the publisher AccessData Group LLC 384
24. E IN FTK An MPE ADI image is added as evidence in FTK the same way any other ADI image is added Simply select Acquired Image s as the Evidence Type For more information see the AccessData FTK User Guide MANAGING SETTINGS SETTINGS The Settings button on the toolbar opens the Settings dialog which shows you your Activation Key User Name License Host and License Port 24 AccessData Mobile Phone Examiner Plus User Guide On the GSM License tab you can view the Activation Key and User Name that you used when you activated your software You can deactivate your license from this dialog if you want to reactivate your software with a different key or user name FIGURE 3 5 Settings GSM License tab Settings ee GSM License MPE License Activation Key C5FM3 C5FM3 SFW8K SFWSK 8B0BE User Name fuser 0603 Deactivate Close The MPE License tab displays the License Host that is providing the GSM Activation information this can be either localhost or the computer name or IP Address of a remote network computer and the License Port the port number being used for transmitting activation information The default port is 6921 but if this is in use you can change it FIGURE 3 6 Settings MPE License tab Settings GSMLicense MPE License License Host License Port Apply Close About HELP MENU Use the Help menu to select from the following options e Sup
25. LG KE820 LG KE850 LG KE970 LG KF300 LG KE310 LG IKF510 LG IXF600 LG KF700 LG KG320 LG KG328 LG KG800 LG KG810 LG KM380 LG KM500 LG KU250 LG IKU311 LG KU380 LG KU990 LG LG AX8600 LG ILG LX570 Muziq LG ILG VX10000 Voyager Appendix A MPE Supported Mobile Devices 37 TABLE A 1 ILG LG VX5400 LG LG VX8350 LG ILG VX8500 Chocolate LG ILG VX8550 Chocolate 2 LG LG VX8560 Chocolate 3 ILG LG VX8600 LG LG VX8700 LG ILG VX8800 Venus LG ILG V X9400 ILG ILG V X9900 enV LG ILX1200 LG M6100 LG S5200 ILG ILG LG6190 ILG ILG LG6200 ILG ILG LG8100 ILG ILG LX5450 ILG ILG LX5550 LG ILG PM225 LG ILG PM325 ILG ILG UX5000 LG LG VI125 LG LG VX3200 LG LG VX4650 LG LG VX5200 LG LG VX5300 LG LG VX6100 LG LG VX7000 38 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 LG LG VX8000 LG LG VX8100 LG LG VX8300 LG LG VX9800 LG G7100 LG LG VX4400 LG 510w LG B2100 LG C1200 LG C3300 LG C3320 LG IF2400 LG G3000 LG G7000 LG G7020 LG G7030 LG G7050 LG KG110 LG KG120 LG KG130 LG KG225 LG KG290 LG KG920 LG KP130 LG KP202 LG KP202i LG KP230 LG IL343i LG ILG C2000 Appendix A MPE Supported Mobile Devices TABLE A 1
26. Samsung SGH E360 Samsung SGH E390 Samsung SGH E760 Samsung SGH E770 Samsung SGH X660 Samsung SGH X660V Samsung SGH X680V Samsung SGH X700 Samsung SCH A310 Samsung SCH A650 Samsung SCH A670 Samsung SCH A870 Samsung SCH A930 Samsung SCH A950 52 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Samsung SGH A800 Samsung SGH S400i Samsung SGH S401i Samsung SPH A620 VGA1000 Samsung SPH A660 Samsung SPH A660 VI660 Samsung SPH A680 Samsung SPH A740 Samsung SPH A840 Samsung SPH A840 Telus Samsung SPH A900 Samsung SGH E530 Samsung SGH C100 Samsung SPH A460 Samsung SPH N200 Samsung SPH N400 Samsung SGH P730 Samsung SGH S100 Samsung SCH U470 Samsung SCH U750 Alias 2 Samsung SGH F400 Samsung SGH F480 Samsung SGH F490 Samsung SGH F490V Samsung SGH G400 Samsung SGH G600 Samsung SGH J700 Samsung SGH J700V Samsung SGH L700 Appendix A MPE Supported Mobile Devices TABLE A 1 Samsung SGH L770V Samsung SGH L810V Samsung SGH S720i Samsung SGH U700 Samsung SGH U900 Samsung SGH U900V Samsung SPH M300MEDIA Samsung SPH M300PIM Samsung SGH E715 Samsung SGH E720 Sanyo IMM 5600 Sanyo IMM 7400 Sanyo IMM 7500 Sanyo IMM 8300 Sanyo IPM 8200 Sanyo IRL 4920 Sanyo IRL 4930 Sanyo SCP 200 Sanyo SCP 2400 Sanyo SCP 3100 Sanyo SCP 320
27. South 400 West Suite 200 Lindon Utah 84042 U S A www accessdata com AccessData Legal and Contact Information I ACCESSDATA TRADEMARKS e AccessData is a registered trademark of AccessData Group LLC e Distributed Network Attack is a registered trademark of AccessData Group LLC e DNA is a registered trademark of AccessData Group LLC e Forensic Toolkit is a registered trademark of AccessData Group LLC e FTK is a registered trademark of AccessData Group LLC e Password Recovery Toolkit is a registered trademark of AccessData Group LLC e PRTK is a registered trademark of AccessData Group LLC e Registry Viewer is a registered trademark of AccessData Group LLC COPYRIGHT INFORMATION A trademark symbol TM etc denotes an AccessData Group LLC trademark With few exceptions unless otherwise notated all third party product names are spelled and capitalized the same way the owner spells and capitalizes its product name Third party trademarks and copyrights are the property of the trademark and copyright holders AccessData claims no responsibility for the function or performance of third party products AFF ann AFFLIB Copyright 2005 2006 2007 2008 Simson L Garfinkel and Basis Technology Corp All rights reserved This code is derived from software contributed by e Simson L Garfinkel e Olivier Castan Redistribution and use in source and binary forms with or without modificat
28. U800 Samsung SGH X100 Samsung SGH X460 Samsung SGH X 600 Samsung SGH X 640 Samsung Armani Samsung GT B2700 Samsung GT S7330 Samsung SCH U420 Samsung SCH U740 Samsung SGH B520 Samsung SGH D800 Samsung SGH D820 Samsung SGH D830 Samsung SGH D880 Samsung SGH D900 Samsung SGH E250 Samsung SGH E251 Samsung SGH E2510 Samsung SGH E340 Samsung SGH E570 Samsung SGH E570V Samsung SGH E590 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Samsung SGH E780 Samsung SGH E840 Samsung SGH E900 Samsung SGH E950 Samsung SGH F200 Samsung SGH F210 Samsung SGH F250 Samsung SGH F300 Samsung SGH G800 Samsung SGH J150 Samsung SGH J600 Samsung SGH J800 Samsung SGH M150 Samsung SGH M310 Samsung SGH M310V Samsung SGH M3510 Samsung SGH M7500 Samsung SGH P300 Samsung SGH S3600 Samsung SGH U100 Samsung SGH U300 Samsung SGH U600 Samsung SGH X820 Samsung SGH X830 Samsung SGH Z300 Samsung SGH Z320i Samsung SGH Z400 Samsung SGH Z400V Samsung SGH Z500V Appendix A MPE Supported Mobile Devices 51 TABLE A 1 Samsung SGH Z540 Samsung SGH Z540V Samsung SGH Z560 Samsung SGH Z560V Samsung SGH Z650i Samsung SGH Z720 Samsung SGH ZV10 Samsung SGH ZV30 Samsung SGH ZV40 Samsung SGH D500 Samsung SGH D500E Samsung SGH D600 Samsung SGH D600E Samsung SGH E350
29. UCTS You can use LicenseManager to check for product updates and download the latest product versions For more information on the general features of the subscription service see the AccessData Website at http www accessdata com subscription renewal htm CHECK FOR PRODUCT UPDATES To check for product updates on the Installed Components tab click Newest This refreshes the list to display what version you have installed and the newest version available 84 AccessData Mobile Phone Examiner Plus User Guide DOWNLOAD PRODUCT UPDATES To install the newest version mark the box next to the product to install then click Install Newest Note Some products such as FTK 2 x Enterprise and others are too large to download and are not available A notification displays if this is the case To download a product update 1 Ensure that LicenseManager displays the latest product information by clicking the Installed Components tab Click Newest to refresh the list showing the latest releases then compare your installed version to the latest release If the latest release is newer than your installed version you may be able to install the latest release from our Website 2 Ensure that the program you want to install is not running 8 Mark the box next to the program you want to download then click Install Newest 4 When prompted click Yes to download and install the latest install version of the product 5 If ins
30. Wait while the installation completes 8 If you want to launch LicenseManager after completing the installation select Run LicenseManager AccessData LicenseManager InstallShield Wizard 7 LicenseManager Installation Complete AccessData Setup has finished installing LicenseM anager on your computer Run LicenseManager later by selecting Start gt Programs gt AccessData gt LicenseManager gt LicenseManager or by double clicking the LicenseManager icon on your desktop Em AccessData Mobile Phone Examiner Plus User Guide USING LIGENSEMANAGER LicenseManager manages AccessData product licenses on a Keylok dongle or WIBU SYSTEMS CodeMeter Stick security device or in a security device packet file LicenseManager and the CodeMeter Stick installation are no longer integrated with FTK installation LicenseManager displays license information allows you to add or remove existing licenses to a dongle or CmStick LicenseManager can also be used to export a security device packet file Packet files can be saved and reloaded onto the dongle or CmStick or sent via email to AccessData support In addition you can use LicenseManager to check for product updates and download the latest product versions LicenseManager displays CodeMeter Stick information including packet version and serial number and licensing information for all AccessData products The Purchase Licenses button connects directly to the AccessData w
31. a Cal History ea ET User Will Arrive 15 Minutes Calendar User Thank You User Love You Media Sent 2 9 2005 8 21 PM Call Me Normal Inbox 2 9 2005 8 34 PM Call Me Normal Sent 1 20 2005 7 57 AM Cool in canada will be done at 5 Est Normal SL File System Inbax 6 2 2005 2 55 PM Kelley wants to visi Kelley wants to visit weekend of june 24 yik Normal Inbox 2 9 2005 8 31 PM Call Me Normal Inbox 12 9 2004 9 38 AM Estimate as of 12 09 Estimate as of 12 09 09 10AM Pk 358 Normal Inbox 3 5 2005 9 11 PM Hi Hi Normal Inbox 14 12 2005 7 47 PM Thamd Thanx Normal Inbox 2 9 2005 8 27 PM Good I m having som Good I m having some spaghetti at macaroni Normal Sent 2 9 2005 8 33 PM Call Me Normal Sent 2 9 2005 8 29 PM Call Me Normal Sent 1 20 2005 8 01 AM Ti Sorry just got these Sorry just got these Normal Sent 2 9 2005 8 25 PM il Tgi fridays looks Tgi fridays looks better on my exp report Normal inbox 172072005 12 18 AM 1 have a sweet news Ji have a sweet new setup at home that would Normal Sent 4 12 2005 6 55 PM 310 8561 Call Me Normal Inbox 3 16 2005 2 14 PM Free Msg from VZW Y Free Msg from VZW You re a TXT user U Normal Inbox 1 20 2005 12 17 AM Can you get online Can you get online Normal x Status Viewing text messages MMS files are text messages that include media Note MPE does not currently extract MMS messages from CDMA phones If you have a device that contains media text messages but the MMS option
32. a Mobile Phone Examiner Plus User Guide TABLE OF CONTENTS AccessData Legal and Contact Information i Ligi MIA RE riss i AccessData Trademarks li Copyright Information AE ii AFF and AFFLIBQ rr il Avende RAN EE D Documentation CONVENtIONS iv Eau AN iv SUDSCN PUO NS 348 bai EAEE E ai ER Coed AES es v AccessData Contact Information v Mailing Address and General Phone Numbers v zle beala vi Documentations ans gn ea eee eee vi Professional Services AA antenne ben rre vi Contact Information for Professional Services vii Table of Contents 1 Chapter 1 Introduction 1 AUdIeNCe ss Eee gela ea ea Siesta a ee dager zetara der 1 Forensic Cases and Evidence Handling 1 Chapter 2 MPE Installation 3 Prer quisit s 25 ne ss biked ck of a anna tan nent ERT erta 3 Hardware and Software Requirements 3 stan AIR SE 4 Upgrading from a Previous Version green eee eee oe cernes 1 Chapter 3 Getting Started 9 egar eee cer cia snare erst
33. alled DI FTK Mobile Phon Not Installed O SilentRunner Not Installed The following information is displayed on the Installed Components tab TABLE 3 1 LicenseManager Installed Components Tab Features Item Description Program Lists all AccessData products installed on the host Appendix B Licensing Information 19 TABLE 3 1 LicenseManager Installed Components Tab Features Item Description Installed Version Displays the version of each AccessData product installed on the host Newest Version Displays the latest version available of each AccessData product installed on the host Click Newest to refresh this list Product Notes Displays notes and information about the product selected in the program list AccessData Link Links to the AccessData product page where you can learn more about AccessData products The following buttons provide additional functionality from the Installed Components tab TABLE 3 2 LicenseManager Installed Components Buttons Button Function Help Opens the LicenseManager Help web page Install Newest Installs the newest version of the programs checked in the product window if that program is available for download You can also get the latest versions from our website using your Internet browser Newest Updates the latest version information for your installed products About Displays the About LicenseManager screen Provides version copyright and trademark information for Licens
34. and before the product is shipped The licenses are bound to either a USB security device or a Virtual CmStick according to your purchase AccessData Mobile Phone Examiner Plus User Guide SUBSCRIPTIONS AccessData provides a one year licensing subscription with all new product purchases The subscription allows you to download and install the latest releases for your licensed products during the active license period Following the initial licensing period a subscription renewal is required annually for updating your products You can renew your subscriptions through your AccessData Sales Representative Use LicenseManager to view your current registration information to check for product updates and to download the latest product versions where they are available for download You can also visit our web site www accessdata com anytime to find the latest releases of our products For more information see Managing Licenses in your product manual or on the AccessData web site ACCESSDATA CONTACT INFORMATION Your AccessData Sales Representative is your main contact with AccessData Group LLC Also listed below are the general AccessData telephone number and mailing address and telephone numbers for contacting individual departments MAILING ADDRESS AND GENERAL PHONE NUMBERS You can contact AccessData in the following ways TABLE CONTACT INFORMATION 1 AD Mailing Address Hours and Department Phone Numbers Corporate H
35. ata License Manager ver 2 2 4 or newer to migrate licenses off other devices and onto a network device e AccessData products running on Windows Vista 7 or Server 2008 must be Run as administrator at least once in order to lease a license from a NLS server e If the NLS client application is having trouble leasing a license either from the NLS server it is recommended to delete and recreate the NLS registry key located at HKEY_LOCAL_MACHINE SOFTWARE AccessData Products Common in order to reset the licensing configuration to default AccessData Mobile Phone Examiner Plus User Guide
36. ation from the Device Selection dialog Connects to the connected device This button is only active after a manufacturer model and port are selected Closes the Device Selection dialog Displays the status of the device selection process If the device is already connected and the drivers are correctly installed the Identify button is active in the Device Selection dialog Click the Identify button to populate the Device Identify group box This group box gives you the details that you need to add the Manufacturer and Model dropdown information Note Successfully identifying a device relies on the appropriate COM port to be selected Chapter 4 User Interface 19 USING THE ADVANCED DIALOG Click the Advanced button in the Device Seleciton dialog to open the Advanced Port Selection dialog This dialog shows you the port information you need to make the correct selection from the COM Port dropdown of the Device Selection dialog Note Each device is different so it may take some trial and error to get the device into the correct mode for detection and extraction If your device is set to Mass Storage according to the device or according to Windows Device Manager try setting the device to Modem mode sometimes also listed as USB or PC Sync mode instead FIGURE 3 2 Advanced Port Selection Advanced Port Selection Modems Ports Port Name Description Port Name Descriptio
37. ay to submit and track your trouble tickets and in depth contact information Note All support inquiries are typically answered within one business day If there is an urgent need for support contact AccessData by phone during normal business hours DOCUMENTATION Please email us regarding any typos inaccuracies or other problems you find with the documentation to documentation accessdata com The AccessData Professional Services staff comes with a varied and extensive background in digital investigations including law enforcement counter intelligence and AccessData Mobile Phone Examiner Plus User Guide corporate security Their collective experience in working with both government and commercial entities as well as in providing expert testimony enables them to provide a full range of computer forensic and eDiscovery services At this time Professional Services provides support for sales installation training and utilization of FTK Enterprise eDiscovery Lab and Lab Lite They can help you resolve any questions or problems you may have regarding these products CONTACT INFORMATION FOR PROFESSIONAL SERVICES Contact AccessData Professional Services in the following ways e Washington DC 410 703 9237 e North America 801 377 5410 e North America Toll Free 800 489 5199 option 7 e International 1 801 377 5410 adservices accessdata com AccessData Legal and Contact Information vil AccessDat
38. buCmRaC to another machine that is not running Windows Server 2003 2008 Enterprise Note The destination system must have an active internet connection 13 Unplug any AccessData dongles you currently have connected 14 Launch License Manager 19 Select Create Activation File online Operations Without A Security Device Open A Packet File Create A Local Virtual CMStick Create Empty Virtual CMStick offline Create Activation File online Activate Virtual CMStick offline 16 Click OK The Confirmation Code Required dialog appears 11 Enter your confirmation code and click OK 18 AccessData License Manager will automatically synchronize with the License Server over the internet Data synchronized from the server will be written to the wibucmrau file Click OK when the update completes FINISH THE ACTIVATION ON THE WINDOWS SERVER 2003 2008 ENTERPRISE SYSTEM 19 Copy the activated WibuCmRaC file to the Server 2003 2008 machine 20 On the Server 2003 2008 machine unplug any CodeMeter devices Appendix B Licensing Information 91 21 Open the CodeMeter Control Center Make sure the window on the License tab empty indicating that no licenses are currently loaded 22 Select File gt Import License 23 Browse to the location where the activated WibuCmRaC is stored Click Import 24 At this point AccessData License Manager now displays a serial number for the VCM on the Lic
39. ce s data See Importing an AD1 Image on page 23 for details Chapter 4 User Interface 33 TABLE 3 4 MPE Toolbar Buttons ToolBar Button Description Click the Display Current Device Info button on the toolbar to view basic a information about the device that is currently connected to MPE This infotmation includes the IMEI Phone Number Comments Model Manufacturer Serial Number and Revision Click the Supported Devices button to see the full list of MPE Supported Devices E and the cables associated with those devices The Supported Mobile Devices List can be exported from the list view and is also included in this user guide See Supported Mobile Devices on page 35 Click Settings to see GSM Activation and License Source information See Managing Settings on page 24 AccessData Mobile Phone Examiner Plus User Guide APPENDIX A MPE SUPPORTED MOBILE DEWICES The following table contains a list of all currently supported mobile phone manufacturers and models The specific information that is available for any phone is dependent on the type of phone or device and the device driver provided by the manufacturer SUPPORTED MOBILE DEVICES The following table lists mobile devices that are supported in Mobile Phone Examiner Plus Note To see a list of supported phones and the cables associated with those phones click the Display and Export Supported Device List button in MPE See About To
40. ce data review tool that can be used in the field as part of a mobile field unit or in the lab Additionally data extracted from mobile devices using MPE can be easily imported into an FTK case which offers more in depth drill down categorization full text index searching and all of this right along side other digital evidence collected for a case MPE can extract information such as phone and address book data media files call logs SMS and MMS messages calendar and file system data stored in the memory of a mobile device MPE and its manual are written for law enforcement and corporate security professionals with the following competencies e Basic knowledge of and training in forensic policies and procedures e Basic knowledge of and experience with personal computers mobile phones enhanced PDAs and SmartPhones e Familiarity with the fundamentals of collecting digital evidence from mobile devices e Understanding of forensic data images and how to acquire forensically sound images e Experience with case studies and reports e Basic competency with FTK e Familiarity with the Microsoft Windows environment For information on how to handle the image as evidence in a case see the FTK User Guide Chapter 1 Introduction 1 AccessData Mobile Phone Examiner Plus User Guide CHAPTER 2 MPE INSTALLATION PREREQUISITES Before installing AccessData FTK MPE you need to have the following e The CodeMeter Runtime
41. censed AccessData products without a physical CodeMeter device A VCM can be created using AccessData License Manager but requires the user to enter a Confirmation Code during the creation process The latest revision of this guide can be found at http support accessdata com downloads VCM Activation Guide pdf PREPARATION e Contact your AccessData sales rep to order a VCM confirmation code e Install CodeMeter Runtime 4 10b or newer available on the AccessData download page e Install the latest release of License Manager available on the AccessData download page e The following steps are to be run on the system where you want to permanently attach the VCM Note Once created the VCM cannot be moved to any other system e AD LAB WebUI and eDiscovery administrators please also follow steps outlined under in Additional Instructions for AD LAB WebUI and eDiscovery on page 92 in order to enable VCM licensing on the AccessData License Service 86 AccessData Mobile Phone Examiner Plus User Guide SETUP FOR ONLINE SYSTEMS 1 Unplug any AccessData dongles you currently have connected 2 Launch License Managet Note When creating a VCM on Windows Server 2003 or 2008 please refer to the special set of steps written for those platforms See Creating a Virtual CM Stick with Server 2003 2008 Enterprise Editions on page 90 3 Select Create A Local Virtual CMStick Operations Without A Security Device
42. d to interface each phone with the investigating computer see Appendix A Supported Mobile Device Types on page 33 OPTIONAL HARDWARE AccessData MPEH can be purchased together with an optional portable imaging unit currently referred to as a MPE field Tablet INSTALLING MPE Note The MPE installer automatically configures MPE to run as an administrator In order to function properly MPE 4 0 requires local administrator rights to the system and therefore it must also be installed by a user with local administrator privileges To install MPE 1 Insert the MPE installation media into the CD DVD drive AccessData Mobile Phone Examiner Plus User Guide Autorun launches Setup exe Gi AccessData Mobile Phone Examiner Plus Welcome to the setup wizard for AccessData Mobile Phone Examiner Plus This program will install AccessData Mobile Phone Examiner Plus on your computer To continue click Next WARNING This program is protected by copyright law and international treaties 2 Click Next to begin the installation 1 nce oe ore mine us De License Agreement Please read the following license agreement carefully END USER LICENSE AGREEMENT FOR ACCESSDATA SOFTWARE IMPORTANT READ CAREFULLY This End User License Agreement EULA is a legal agreement between End User Licensee either an individual or a single legal or juridical entity and AccessData Corporation for th
43. e ADD A LICENSE To add new or released license 1 From the Licenses tab under Browser Options click Add Existing License The AccessData LicenseManager Web page opens listing the licenses currently bound to the connected security device and below that list you will see the licenses that currently are not bound to any security device Mark the box in the Bind column for the product you wish to add to the connected device then click Submit 2 An AccessData LicenseManager Web page will open displaying the following message The AccessData product s that you selected has been bound to the record for Security Device nnnnn within the Security Device Database Appendix B Licensing Information 81 Please run LicenseManager s Refresh Device feature in order to complete the process of binding these product license s to this Security Device You may close this window at any time Ticersertonsger x e Were you able to associate a new product with this device If so please click Yes to update your device with the new information now 8 Click Yes if LicenseManager prompts Were you able to associate a new product with this device 4 Click Refresh Device in the Licenses tab of LicenseManager Click Yes when prompted This will cause your security device to be updated to match the customer records at AccessData Do you wish to continue You will see the newly added license in th
44. e AccessData software that accompanies this EULA which includes associated media and AccessData Internet based services Software An amendment or addendum to this EULA may accompany the Software LICENSEE AGREES TO BE BOUND BY THE TERMS OF THIS EULA BY INSTALLING COPYING OR USING THE SOFTWARE IF LICENSEE DOES NOT AGREE DOES NOT INSTALL COPY OR USE THE SOFTWARE LICENSEE MAY RETURN IT TO LICENSEE S Ler Lez con Chapter 2 MPE Installation 8 Read the License Agreement then click Agree to continue 16 AccessData Mobile Phone Examiner Plus Setup W Destination Folder Click Next to install to this folder or click Change to install to a different folder Install AccessData Mobile Phone Examiner Plus to C Program Files x86 AccessData MPE AccessData 4 Select a destination folder and click Nex to continue 18 AccessData Mobile Phone Examiner Plus Setup M Ready to Install your software The wizard is ready to begin installation Click Install to begin the installation Tf you want to review or change any of your installation settings click Back Click Cancel to exit the wizard AccessData 9 Click Install to begin the installation process AccessData Mobile Phone Examiner Plus User Guide 6 Click Finish to close the Wizard when installation is complete 18 AccessData Mobile Phone Examiner Plus Setup n AccessData Mobile Phone Examin
45. e License Options list ADDING AND REMOVING PRODUCT LICENSES REMOTELY While LicenseManager requires an Internet connection to use some features you can add or remove licenses from a dongle packet file for a dongle that resides on a computer such as a forensic lab computer that does not have an Internet connection If you cannot connect to the Internet the easiest way to move licenses from one dongle to another is to physically move the dongle to a computer with an Internet connection add or remove product licenses as necessary using LicenseManager and then physically move the dongle back to the original computer However if you cannot move the dongle due to organization policies or a need for forensic soundness then transfer the packet files and update files remotely ADD A LICENSE REMOTELY To remotely add associate a product license 1 On the computer where the security device resides Ta Run LicenseManager 1h From the Licenses tab click Reload from Device to read the dongle license information 82 AccessData Mobile Phone Examiner Plus User Guide 1 Click Save to File to save the dongle packet file to the local machine 2 Copy the dongle packet file to a computer with an Internet connection 8 On the computer with an Internet connection da Remove any attached security device 8h Launch LicenseManager You will see a notification No security device found 36 Click OK dd An Open dialog box wil
46. e driver capabilities The figure below shows only name information for each Phonebook entry because the user did not add any more in depth information than that FIGURE 3 7 MPE Phonebook Data View Dan Czapenski Michelle Roger Keith Home Keith Cell Darren Rene Cell Rene Home Heritage Eric Bell Dad Mckenna School Home Mark Mike c Newman Flaco Rob Attoe Status Viewina phonebook data Title Name a Type Number Email Address Lk Phonebook Blush Cell none EO Rusty Pager e Rusty Cell amp Messages Sal cell Sal home 4 Kelley cell E w Salwork Jeff Warren E Kel Lyn Marlene Ga Cal History Motes Rusty D DrKennedy Calendar Regan Home Tom Randolph Ford Home Media Novar Cell Mcabe Resd Denise Cell Denise Work Postal Full b File System Holly Home Type Company Street Street 2 City State dd Country ees Wendy Cell ill The Messages data view provides information such as those listed in the following table TABLE 3 3 Potential Device Message Data Message Type e Date Received Phone Number of Originating Message Phone Number of Recipient Subject e Message Text Priority Chapter 4 User Interface 21 FIGURE 3 8 MPE Messages Data View Type Date From To Subject Text Priority a Phonebook ser Yes User No dg Messages User Call Me L User Need Directions E MMS User Where Are You User Will Call Later 4 User Busy O
47. e rere ne bee urea ma dee Lee nes 9 AboutLicensing EEE 9 Activating a GSM License LEE a ti ananas lement 10 Deactivating a GSM License 12 Connecting Devices anne sus ne wie nr ko ek nn cree rte 13 Installing Device Drivers ce ae ee ek eee tea 13 Establishing a Data Connection to a Mobile Device 14 Chapter 4 User Interface 1 About Tasks NONW sans bra ko kok ie aed ew away ee assioni 11 Sele ting a DEVICE e e pk nen kn n pak e AR ag Eee 18 Extracting Dales aise vet ee vee ko ee avre beet A 20 Importing an AD Image see ea na 23 Exporting To an AD 1 Image aan ee na 24 Managing SCUINGS w lo occa kri nn nec ere ed eee 24 abal da Sue 25 About Review PANO Sezi karikati EEE AEE EE Eee Eta Ee ne A n EEE tite 26 Data Type Tab eesti re se ee Snes eee is es sei 26 Guda aa 21 Messages de ake dda aa a AS e T 21 MN aaa aia etea 28 Cal AISE 29 Calendar Data fossero ariani za EN ka baka bin 30 Media FOS ARAKA A EEA EEA EEE EE 30 File Syst Eee are 32 About Stalus Bas 2a Mas MAINE EEE 32 Phone Data Bar cass tir EE ea lies panne 32 SANS Balz AEE EE nie eee Ge etudes use 33 About Toobar Senasa a ato Re Ae plein de le ZE 33 Appendix A MPE Supported Mobile DEVICES 35 Supported Mobile Devices 35 Appendix B Licensing Information
48. eManager Done Closes LicenseManager Use the Installed Components tab to manage your AccessData products and stay up to date on new releases 16 AccessData Mobile Phone Examiner Plus User Guide THE LICENSES TAB The Licenses tab displays CodeMeter Stick information for the current security device packet file and licensing information for AccessData products available to the owner of the CodeMeter Stick as displayed in the following figure FIGURE 3 2 LicenseManager Licenses Tab LicenseManager O FTK 11 30 09 Up to date AD Lab None AD Lab Lite None AD Enterprise 11 30 09 Up to date DI ona 11 30 09 Upto date O PRTK 11 30 09 Up to date O Registry Viewer 11 30 09 Up to date Beta 11 30 09 Up to date Device Serial Number 1054841 MS Office Hash Ta None Device Version 10 1 D PDF Hash Tables None Lan Hash Tables None License Packets D FTK Mobile Phone 11 3009 Uptodate MF Show Unlicensed dien Paga SilentRunner None Save to File Remove License Finalize Removal Help Browser Options Release Device is Disables when CmStick is Connected The Licenses tab provides the following information TABLE 3 3 LicenseManager Licenses Tab Features Column Description Program Shows the owned licenses for AccessData products Expiration Date Shows the date on which your current license expires Status Shows these status of that product s license None
49. eadquarters AccessData Group LLC 384 South 400 West Suite 200 Lindon UT 84042 USA Voice 801 377 5410 Fax 801 377 5426 General Corporate Hours Monday through Friday 8 00 AM 5 00 PM MST AccessData is closed on US Federal Holidays State and Local Voice 800 574 5199 option 1 Law Enforcement Sales Fax 801 765 4370 Email Sales AccessData com AccessData Legal and Contact Information v TABLE CONTACT INFORMATION 1 AD Mailing Address Hours and Department Phone Numbers Federal Sales Corporate Sales Training Accounting TECHNICAL SUPPORT Voice 800 574 5199 option 2 Fax 801 765 4370 Email Sales AccessData com Voice 801 377 5410 option 3 Fax 801 765 4370 Email Sales AccessData com Voice 801 377 5410 option 6 Fax 801 765 4370 Email Training AccessData com Voice 801 377 5410 option 4 You can contact AccessData Customer and Technical Support in the following ways TABLE CONTACT INFORMATION 2 AD Customer amp Technical Support Contact Information Customer Service Hours Customer Technical Support Free technical support is available on all AccessData products Monday through Friday 7 00 AM 6 00 PM MST Voice 801 377 5410 option 5 Voice 800 658 5199 Toll free North America Email Support AccessData com Web site http www AccessData com Support The Support web site allows access to Discussion Forums Downloads Previous Releases our Knowledgebase a w
50. ebsite and allows you to browse the site for information about products you may wish to purchase Contact AccessData by phone to speak with a Sales Representative for answers to product questions and to purchase products and renew licenses and subscriptions STARTING LICENSEMANAGER LicenseManager exe is located in C Program Files AccessData Common Files AccessData LicenseManager You can execute the program from this location if you wish Click Start gt All Programs gt AccessData gt LicenseManager gt LicenseManager OR Click or double click depending on your Windows settings the LicenseManager icon on your desktop OR From some AccessData programs you can run LicenseManager from the Tools gt Other Applications menu This option is not available in PRTK or DNA The LicenseManager program opens When starting LicenseManager License Manager reads licensing and subscription information from the installed and connected Wibu CodeMeter Stick or Keylok dongle If using a Keylok dongle and LicenseManager either does not open or displays the message Device Not Found do the following Appendix B Licensing Information 73 1 Make sure the correct dongle driver is installed on your computer 2 With the dongle connected check in Windows Device Manager to make sure the device is recognized If it has an error indicator right click on the device and choose Uninstall 8 Remove the dongle after the device has b
51. ed to have the original source device connected to import an MPE AD1 image that was previously exported To import an existing AD1 image you previously exported from AccessData Mobile Phone Examiner Plus 1 In MPE select Tasks gt Import ADI 2 Browse to the folder containing the AD1 file to import 3 Select the file A Click Open Chapter 4 User Interface 23 If any data types were not selected or were not available during extraction and thus were not added to the exported ADI image that data type will be inactive in the imported image EXPORTING T0 AN AD1 IMAGE All extracted data is exported to an MPE ADI Image If you want to include only certain types of data select only those types to extract from the device When you are satisfied that the contents of the mobile device is interesting or important to the related case you are ready to create an AD1 image of the extracted data The resulting image can be read by MPE or any FTK based product Note FTK Imager is not FTK based In other words it is a standalone product that does not use the FTK code base and thus it cannot read MPE AD1 images To export the currently extracted mobile device data to an AD1 image 1 Select Tasks gt Export to ADI 2 When prompted enter a filename and select a destination folder for the image that will be created 3 Click Save The image file is saved to the selected destination ADDING AN MPE AD1 IMAGE to A CAS
52. een uninstalled 4 Reboot your computer 5 After the reboot is complete and all startup processes have finished running connect the dongle 6 Wait for Windows to run the Add New Hardware wizard If you already have the right dongle drivers installed do not browse the internet choose No not this time 1 Click Next to continue 8 On the next options screen choose Install the software automatically Recommended 9 Click Next to continue 10 When the installation of the dongle device is complete click Finish to close the wizard 11 You still need the CodeMeter software installed but will not need a CodeMeter Stick to run LicenseManager If using a CodeMeter Stick and LicenseManager either does not open or displays the message Device Not Found do the following 1 Make sure the CodeMeter Runtime 3 30a software is installed It is available at www accessdata com support Click Downloads and browse to the product Click on the download link You can Run the product from the Website or Save the file locally and run it from your PC Once the CodeMeter Runtime software is installed and running you will see a gray icon in your system tray E 2 Make sure the CodeMeter Stick is connected to the USB port When the CmStick is then connected you will see the icon change to look like this SI If the CodeMeter Stick is not connected LicenseManager still lets you to manage licenses using a security device
53. enses tab and the VCM can now operate in a similar way to a hardware CodeMeter device ADDITIONAL INSTRUCTIONS FOR AD LAB WEBUI AND EDISCOVERY The following information will enable the Web User Interface to recognize a VCM Add the following DWORD registry string to the following key and set the value to 1 HKEY_LOCAL_MACHINE SOFTWARE AccessData Products EnableACTTest w Registry Editor 5e Et Yew Farorkes bab E My Computer Gi HKEY_CLASSES_ROOT A Gy HKEY_CURRENT_USER 2 KKEY LOCAL MACHINE HC HARDWARE Name Type Data eitera REG_SZ value not set EJEnablbACT Test REG DWOAD Ox0000000 1 Ga Sam Ga securrty E ON SOFTWARE AccessData FY Enterprise 3 I Forensic Toolkt w E Lcensemanagar 8 4 Su Tr Gc 8 83 a TE E sc Expandable String value 211 Bermissions EE SEN Copy Key Nsme E Mozila bu tie 4 tdi By Computer Name ype Datan Sg HKEV_CLASSES_ROOT ab Det sult REG SZ Quale net set 2 5 DET GERTU LITE La A REG DWORD 0 00000001 1 TD HKEY LOCAL MACHINE fe Ok one ARE ZO security Value pene Ga SOFTWARE Ar Sad Accasshata eee EEE p DO tr mrprmu Yaua data Bare PI I Forensic Toolkit mo GO Cu Licensemanager a ebate ER Prockucte wie Cu ADFS E ATI Technologies h iy fh The AccessData License Service will know to expect a VCM when Enable ACTTest is set to 1 NM AccessData Mobile Phone Examiner Plus User Guide VIRTUAL CODEMETER F A
54. er HKEY_LOCAL_MACHINE SOFTWARE AccessData Products Common NetDonglePath The IP address or DNS hostname of the system hosting the Network License Server service which is found in the following registry key on the client system HKEY_LOCAL_MACHINE SOFTWARE lt AccessData Products Common e NetDonglePort The TCP port number through which the client and server systems have been configured to use This value is located in the same key as NetDonglePath e uniqueld In order to lease a license from the server the client system must first posses a unique identification value This value is automatically generated by applications such as FTK 3 PRTK or DNA Registry Viewer and FTK 1 x cannot be used setup initial client NLS configuration at this time You can find the each client system s uniqueld by inspecting the following registry key HKEY_LOCAL_MACHINE SOFTWARE AccessData Shared e Client system must be configured to not block incoming and outgoing traffic on TCP port 6921 e The following products support the ability to lease a license from a NLS server FTK 2 2 1 and newer FTK 1 81 2 and newer Appendix B Licensing Information 9 FTK PRO 3 2 and newer PRTK 6 4 2 and newer DNA 3 4 2 and newer Registry Viewer 1 5 4 and newer AD Enterprise 3 0 3 and newer AD Lab 3 0 4 and newer AD Lab Lite 3 1 2 and previous Mobile Phone Examiner 3 0 and newer Explicit Image Detection E I D Add on Glyph Add on e Use AccessD
55. er Plus install completed successfully Click Finish to exit 1 Deactivate your old GSM license see Deactivating a GSM License on page 10 for more information on deactivating your license 2 Uninstall old version s of MPE 8 Install new MPE A Activate same license key license when prompted see Activating a GSM License on page 10 for information on how to activate your license Chapter 2 MPE Installation 1 AccessData Mobile Phone Examiner Plus User Guide CHAPTER 3 GETTING STARTED This chapter contains all the information you need to get started with MPE including licensing you software and cone ct i ng devices to your computer Once you have completed the information covered in this chapter MPE will be ready to extract and save data from devices ABOUT LICENSING MPE requires two different licenses in order to function properly e MPE License Required to launch the application e GSM License Required to communicate with any GSM device MPE LICENSE OPTIONS Choose among the following licensing options e USB CodeMeter device See AccessData Product Licenses on page 61 Virtual CodeMeter See Virtual CodeMeter Activation Guide on page 86 e Network license See Network License Server NLS Setup Guide on page 95 Note See Appendix B Licensing Information on page 61 for more information on licensing Note MPE Field Tablet does not require an MPE
56. etwork dongle Appendix B Licensing Information 95 4a Provide serial to AD Support and request to have the Network Dongle Flag applied Ah Migrate any additional licenses to the network dongle CLICK HERE for a link to the License Migration guide AC Refresh the network dongle device using AccessData License Manager 9 Launch PRTK DNA or FTK3 on the NLS client system 6 Enter the NLS server configuration information IP address or hostname of NLS server system and 6921 for the Port then click OK 1 If you encounter any problems please read the notes below for troubleshooting information NETWORK DONGLE NOTES e AccessData License Manager 2 2 6 or newer should be installed in order to manage licenses on the network dongle e Network dongles can hold up to 120 physical licenses Each License has a capacity to hold thousands of sub licenses i e Client count or worker count e Contact AccessData Technical Support to have your CodeMeter device flagged as a network dongle required for NLS NLS SERVER SYSTEM NOTES e Make sure CodeMeter device is flagged as network dongle i e License Manager will show the serial as 1181234N To have this flag set on your CodeMeter device please contact AccessData Technical Support e Server system must be configured to not block incoming and outgoing traffic on TCP port 6921 e A web interface to view and revoke licenses all licenses is accessible at http localhost 5555 th
57. evice on page 18 Chapter 3 Getting Started 18 14 AccessData Mobile Phone Examiner Plus User Guide CHAPTER 4 USER INTERFACE This chapter will make you familiar with the graphical interface of MPE It will also walk you through how to select a device in MPE how to extract data from a device how to import data into MPE and how to extract data from MPE into an ADI file ABOUT TASKS MENU Use the Tasks menu to select from the following options e Select Device e Extract Data e Import to ADI e Export to ADI e Settings e Exit How to use each of these items will be covered in detail in this section SELECTING A DEVICE To select a device Chapter 4 User Interface 17 1 From the Tasks menu select Select Device The Device Selection dialog opens FIGURE 3 1 Device Selection dialog Manufacturer LG vi Model vx5200 vi Cable 42 SDMA USB Serial Port COM5 Advanced Refresh Port s E Phone Information identify MANUFACTURER GMI LG Electronics Inc MODEL GMM VX5200 111 SERIALNUMBER Not Supported REVISION Not Supported pe Connect ze Status Identified GMM VX5200 111 2 Select Manufacturer Model and COM Port from the associated drop downs See Device Selection Options on page 19 for more information on these drop downs 3 Click Connect Note If the device model is not listed as expected the following conditions may exist the device is
58. g cut and paste the WBB file to a new location renaming the file does not suffice By default the WBB file is located at 32 bit systems C Program Files CodeMeter CmAct Appendix B Licensing Information 93 64 bit systems C Program Files x86 CodeMeter CmAct Q I have activated a VCM on my system but now I need to activate it on a different system What should I do A Since a VCM is uniquely tied to the system on which it is activated it cannot be moved to any other system If you need to activate a VCM on a different system you need to contact your sales rep Q What if I need to reinstall Windows format my drive change my system s hardware or back up my VCM in case of a disaster Will the VCM still work A The VCM can be backed up by simply copying the WBB file to a safe location It can be restored by copying the WBB file to the CmAct folder The VCM cannot be restored without a WBB file If you do not have a back up of your WBB file you will need to get a new confirmation code from your sales rep Q My AccessData product does not seem to recognize the license stored on a VCM What am I doing wrong A VCMs ate supported by the following versions of AccessData products FTK 1 81 6 and newer FTK 3 1 0 and newer PRTK 6 5 0 and newer DNA 3 5 0 and newer RV 1 6 0 and newer eDiscovery 3 1 2 and newer AD Lab 3 1 2 and newer AD Enterprise 3 1 0 and newer MPE 4 0 0 1 and newer Ensure that the ve
59. ification No security device found Appendix B Licensing Information 83 ab Click OK 36 An Open dialog box will display Highlight the pkt file and click Open dil Click on the Licenses tab 86 Mark the box for the product license you want to unassociate then click Remove License 3f When prompted to confirm the removal of the selected license from the dongle click Yes When LicenseManager does not detect a dongle or the serial number of the dongle does not match the serial number in the dongle packet file you are prompted save the update file 39 Click Yes to save the update file to the local computer The Step 1 of 2 dialog details how to use the dongle packet file to remove the license from a dongle on another computer 8h Save the update file to the local machine 4 After the update file is downloaded copy the update file to the computer where the dongle resides 9 On the computer where the dongle resides Ya Run the update file by double clicking it This runs the executable update file and copies the new information to the security device SB Run LicenseManager 96 On the Licenses tab click Re oad from Device in LicenseManager to read the security device and allow you to verify the product license is removed from the dongle vu Click Save to File to save the updated dongle packet file to the local machine 6 Copy the file to a computer with an Internet connection UPDATING PROD
60. ion are permitted provided that the following conditions are met 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution AccessData Mobile Phone Examiner Plus User Guide 8 All advertising materials mentioning features or use of this software must display the following acknowledgement This product includes software developed by Simson L Garfinkel and Basis Technology Corp 4 Neither the name of Simson L Garfinkel Basis Technology or other contributors to this program may be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY SIMSON L GARFINKEL BASIS TECHNOLOGY AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL SIMSON L GARFINKEL BASIS TECHNOLOGY OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED
61. is not available it is because that device does not allow export of those files FIGURE 3 9 MPE MMS Data View AccessData Mobile Phone Examiner Plus User Guide Type Subject To cc BCC From Received Sent a SE Phonebook MMS inbox No Subject 18012288037 TYPE 18018569832 TYPE 8 9 2010 2 23 MMS Inbox RE no subjectGot it 18012288037 TYPE 18014723719 TYPE 8 19 2010 11 33 3 Messages Mente MMS Sent 18018569832 TYPE l MMS MMS Sent MMS Send Ss Call History Name Type MME Type Size Bytes Find Attch316 smil text plain 726 Memo amr audio amr 6566 Calendar text_0002 ba text plain 100 File System 49 Hex Natural Status Viewing MMS messages The CDMA provider was unable to extract Phonebook CALL HISTORY The Call History tab displays the incoming outgoing and missed calls recorded in the device The figure below shows an example of a call history log FIGURE 3 10 MPE Call History Data View Type Date Name Number Duration a SE Phonebook Missed 6 5 2005 9 14 PM Diane Cell Outgoing 6 30 2005 8 35 PM Home 0 00 11 amp Messages Outgoing 6 30 2005 2 30 PM 0 01 19 Outgoing 7 2 2005 3 35 PM Diane Cell MMS Outgoing 7 1 2005 4 58 PM Pere Cell 0 01 31 a Outgoing 16 30 20059 33 PM Rob Attoe 0 00 36 E Outgoing 6 30 2005 8 44 PM Home 0 00 17 L ll History outgoing 91212010 1 36 PM JeffWarren Outgoing 7 3
62. is not connected 6 Click Next Dongle Driver Setup Finished Dongle Installation AccessData The dongle drivers have now been installed USB users You may now plug in your USB dongle AccessData Mobile Phone Examiner Plus User Guide 1 Click Finish 8 Connect the USB dongle Wait for the Windows Found New Hardware wizard and follow the prompts Important 1f the Windows Found New Hardware wizard appears complete the wizard Do not close without completing or the dongle driver will not be installed When you connect the dongle after installing the dongle drivers you should wait for the Windows Found New Hardware Wizard to come up It is not uncommon for users to disregard this wizard and then find that the dongle is not recognized and their AccessData software will not run When the Found New Hardware Wizard pops up do the following 1 When prompted whether to connect to Windows Update to search for software choose No not this time Found New Hardware Wizard Welcome to the Found New Hardware Wizard Windows will search for current and updated software by looking on your computer on the hardware installation CD or on the Windows Update Web site with your permission Read our privacy policy Can Windows connect to Windows Update to search for software O Yes this time only O Yes now and every time connect a device No not this time Click Next to continue k 2 Clic
63. is page can only reached from a web browser running locally on the NLS server system e A network dongle cannot be used to run AccessData products locally unless the NIS server is running locally e Some versions of windows may not find a local NLS server when the DNS hostname of the server is provided In those cases it is recommended to use a static IP address e When using the NLS across domains users must have permissions to access resources on both domains either by dual domain membership or cross domain trust 96 AccessData Mobile Phone Examiner Plus User Guide e When running NLS on Windows Server 2008 Terminal Services must be installed and accepting connections If Terminal Services is not configured it will not open the port and share out the licenses correctly e The name of the service according to Windows is AccessData Network License Service NLS CLIENT SYSTEM NOTES e When launched any NLS client application that needs to lease a license from the NLS server will automatically check for the following values within the Windows Registry 4 Registry Editor File Edit View Favorites Help Ca KFFAlertEditor amp 9 LanguageSelector w LicenseManager Products Name Type Data ab Default REG 52 value not set ab REG 52 servername ac ES NetDonglePort REG_DWORD 0x00001b09 6921 ommon a Forensic Toolkit aA PRTK6 H I RegistryViewer Shared a activePDF in ae lt My Comput
64. k Next Appendix B Licensing Information 69 8 When prompted whether to install the software automatically or to install from a list of specific locations choose Install the software automatically Recommended Found New Hardware Wizard This wizard helps you install software for USB Dongle Software Protection Device If your hardware came with an installation CD S or floppy disk insert it now What do you want the wizard to do Install the software automatically Recommended O Install from a list or specific location Advanced Click Next to continue 4 Click Next 9 Click Finish to close the wizard Found New Hardware Wizard Completing the Found New Hardware Wizard The wizard has finished installing the software for gt USB Dongle Software Protection Device Click Finish to close the wizard Once you have installed the dongle drivers and connected the dongle and verified that Windows recognizes it you can use LicenseManager to manage product licenses AccessData Mobile Phone Examiner Plus User Guide INSTALLING LICENSEMANAGER LicenseManager lets you manage product and license subscriptions using a security device or device packet file To install LicenseManager from the downloadable file 1 Go to the AccessData download page at http www accessdata com downloads htm 2 On the download page click the LicenseManager Download link 8 Save the installation file cur
65. l display Highlight the pkt file and click Open 86 Click on the Licenses tab Sf Click Add Existing License 39 Complete the process to add a product license on the Website page Sh Click Yes when the LicenseManager prompts Were you able to associate a new ger promp y product with this dongle 3i When LicenseManager does not detect a dongle or the serial number of the dongle does not match the serial number in the dongle packet file you are prompted to save the update file serial wibuCmRaU 3j Save the update file to the local machine 4 After the update file is downloaded copy the update file to the computer where the dongle resides 9 On the computer where the dongle resides Ya Run the update file by double clicking it It is an executable file SB After an update file downloads and installs click OK DC Run LicenseManager SU From the Licenses tab click Reload from Device to verify the product license has been added to the dongle REMOVE A LICENSE REMOTELY To remotely remove unassociate a product license 1 On the computer where the dongle resides Ta Run LicenseManager 1h From the Licenses tab click Reload from Device to read the dongle license information 10 Click Save to File to save the dongle packet file to the local machine 2 Copy the file to a computer with an Internet connection 3 On the computer with an Internet connection 3a Launch LicenseManager You will see a not
66. le packet file You must have already created and saved a dongle packet file to be able to browse to and open it To save a security device packet file 1 Click the Licenses tab then under License Packets click Save to Fik 2 Browse to the desired folder and accept the default name of the pkt file then click Save Note In general the best place to save the pkt files is in the AccessData LicenseManager folder The default path is C Program Files AccessData Common Files AccessData LicenseManager To open a security device packet file 1 Select the Licenses tab then under License Packets click Open Packet File Appendix B Licensing Information 19 2 Browse for a dongle packet file to open Select the file then click Open FIGURE 3 3 LicenseManager Open Packet File x OO gt AcressData w LicenseManagerPacketFiles vo KA ss 2 Organize v 23 Views v New Folder Name Favorite Links a m UpdateDN1054841 pkt 3 15 2009 4 12PM PKT File EE Desktop M Computer E Documents E Pictures D Music Jp Recently Changed B Searches p Public Folders Ata gt File name UpdsteDN1054841 pkt yi AccessData Security Packet vi ea ADDING AND REMOVING PRODUCT LICENSES On a computer with an Internet connection LicenseManager lets you add available product licenses to or remove them from a dongle To move a product license from one dongle to another dongle first remove the product
67. lect Features Please select which features you would like to install 8 Select the features you want to install 64 AccessData Mobile Phone Examiner Plus User Guide 9 Click Disk Cost to see how much space the installation CodeMeter software takes and drive space available 119GB 57GB 58MB 57GB 29GB 29GB OKE 29GB 10GB 447MB OKE 447MB 10 Click OK 11 Click Next E CodeMeter Runtime Kit v4 10b Setup Appendix B Licensing Information 65 12 When you are satisfied with the options you have selected click Next untime Kit v4 10b Setup 2 E aj x SO CodeMeter Runtime Kit v4 10b has been successfully installed Click the Finish button to exit this installation Build 217 Gancel 13 Installation will run its course When complete you will see the CodeMeter Runtime Kit v3 30a has been successfully installed screen Click Finish to exit the installation THE CODEMETER CONTROL CENTER When the CodeMeter Runtime installation is complete the CodeMeter Control Center pops up This is a great time to connect the CmStick and verify that the device is recognized and is Enabled Once verified you can close the control center and run your AccessData product s When the software is installed but the CmStick is not connected you will see a system tray icon that looks like this When the software is installed and the CmStick is connected and recognized you will see a system tray
68. lendar MEDIA FILES The Media tab contains media found on the device including image files video files and sound files Sound and video files can be played back within the MPE interface The figures below show examples of extracted mobile device media files 30 AccessData Mobile Phone Examiner Plus User Guide FIGURE 3 12 MPE Media Images Data View SK Media Name Date Modified Type Size Bytes al Name Value ra Phonebook Li Sounds pic34 jpg Images LI Images pic04 jpg Images pic37jpg Images amp Messages pic05 jpg Images pic42 jpg Images pic06 jpg Images 3 MMS pic07 jpg Images le pic29 jpg Images pic08 jpg Images p a History elisioa Images m Find Calendar ia Media Ba File System Hex Natural Status FIGURE 3 13 MPE Media Sounds Data View Showing Embedded Media Player Sk Media Name Date Modified Type Size Bytes 4 Name Value Phonebook Li Sounds pic34 jpg Images LI Images pic04 jpg Images e pic37jpg Images amp Messages pic05 jpg Images pic42 jpg Images pic06 jpg Images 3 MMS Pic07 jpg Images le pic29 jpg Images pic08 jpg Images er elvis ina Images pe Find Calendar ga Media Ba File System Or ki W Hex Natural Status Chapter 4 User Interface 31 FILE SYSTEM The File System tab displays a recreation of the device s file system based on logical file system records extracted from
69. license it is already built in GSM LICENSE The GSM Licensing information includes the following items that came with your software Chapter 3 Getting Started 9 e Activation Key User Name Note The Activation Key can be deactivated at any time see Deactivating a GSM License on page 10 for information on how to do this ACTIVATING A GSM LICENSE ACTIVATING ON AN ONLINE COMPUTER To activate an online computer 1 Launch MPE 2 If you do not have your GSM provider license it will prompt you to enter it Enter the Activation Key and User Name 8 Click Activate If you have a failure during activation you can follow the steps in Activating on an Offline Computer on page 10 The process for activating on an online computer is the same as with an offline computer except that you only do steps 1 7 13 15 and 16 of the offline activation ACTIVATING ON AN OFFLINE COMPUTER To activate the GSM license on an system without an internet connection refer to the Offline Activation guide located at http support accessdata com downloads ActivatingGSM_OfflineGuide pdf DEACTIVATING A GSM LICENSE The deactivate function allows the license to be removed from one machine and placed on another To deactivate the Mobile Phone Examiner license 1 Click the Settings button The Settings dialog appears FIGURE 4 1 Settings dialog 10 AccessData Mobile Phone Examiner Plus User Guide Settings
70. m reading the dongle attached to your machine much like Windows Safely Remove Hardware feature Click this button before removing a dongle This option is disabled for the CodeMeter Stick Opens Windows Explorer allowing you to navigate to a pkt file containing your license information Opens Windows Explorer allowing you to save a pkt file containing your license information The default location is My Documents Finishes the removal of licenses in the unbound state Licenses must be unbound from the CmStick or dongle before this button takes effect Displays an HTML page with your CodeMeter Stick number and other license information Allows you to bind an existing unbound license to your CodeMeter Stick through an internet connection to the AccessData License Server Brings up the AccessData product page from which you can learn more about AccessData products 18 AccessData Mobile Phone Examiner Plus User Guide TABLE 3 4 License Management Options Button Function About Displays the About LicenseManager screen Provides version copyright and trademark information for LicenseManager Done Closes LicenseManager OPENING AND SAVING DONGLE PACKET FILES You can open or save dongle packet files using LicenseManager When started LicenseManager attempts to read licensing and subscription information from the dongle If you do not have a dongle installed LicenseManager lets you browse to open a dong
71. n LGE CDMA USB Modem COM5 LGE CDMA USB Serial Port 3 2 Name RegType Value Capabilities DWord 00000094 HardwarelD MultiString USB VID_1004 amp PID_6000_MODEMinterface ContaineriD String 565fd2e9 b7a4 11df bcae D0064151a4a9 ConfigFlags DWord 00000000 ClassGUID _ String 4d36e96d e325 1 1ce bfc1 08002be 10318 Driver String 4d36e96d e325 1 1ce bfc1 08002be 10318 0002 FriendiyName String LGE CDMA USB Modem LowerFilters MultiString USBModem Service String Modem Class String Modem Mfg String oem22 inf gsi LG Electronics Inc DeviceDese String oem22 inf lgsi modem desc LGE CDMA USB Modem Refresh Cancel Port Selected COM6 LGE CDMA USB Modem EXTRACTING DATA Once MPE has successfully connected to a device data can then be extracted for review Important During the extraction of data from a device using the MPE 4 0 Tablet devices with a high storage capacity including any expansion cards may cause the memory usage to spike thus causing the extraction to slow 20 AccessData Mobile Phone Examiner Plus User Guide down significantly It is recommended that you eject any expansion slot memory cards and image them using FTK Imager or use MPE Desktop for devices with large capacity internal storage chips To extract data from a device 1 Connect the device to the computer using the appropriate cable To see a list of supported devices and cables see Supported Mobile De
72. o install the CodeMeter Runtime software from the CD you can browse to the setup file or select it from the Autorun menu To download the CodeMeter Runtime software go to www accessdata com and do the following 1 Click Support gt Downloads 2 Find 2a CodeMeter Runtime 3 30a 32 bit MD5 9F299EC832152E593D9E8D76F199C723 MD5 hash applies only to this version OR 2h CodeMeter Runtime 3 30a 64 bit MD5 1140085cbbd0f15ade393f632b56d00c MD5 hash applies only to this version 8 Click the Download link 4 Save the file to your PC and run after the download is complete AccessData Mobile Phone Examiner Plus User Guide When the download is complete double click on the CodeMeterRuntime32 4 10b exe ot the CodeMeterRuntime64 4 10b exe RUNNING THE CODEMETER RUNTIME SETUP Whichever way you choose to access the CodeMeter Runtime setup file when you run it you will see the following 1 Click Run 7 CodeMeter Runtime Kit v4 10b Setup PA fe x Welcome to the CodeMeter Runtime Kit v4 10b Installation Wizard Itis strongly recommended that you exit all Windows programs before running this setup program Click Cancel to quit the setup program then close any programs you have running Click Next to continue the A installation N WARNING This program is protected by copyright law and x international treaties Unauthorized reproduction or distribution of this program or any portion of it may resul
73. ofield Jacob Jacob Matt Bates Matt Bates Moti Segal Moti Segal Zac McBride Zac McBride Alan Hansen Alan Hansen Alex Francis Alex Francis Anderson Anderson Aunt Memo Aunt Memo Biehahn Biehahn Bill Wells fargo Bill Wells fargo Bishop stan Fitts Bishop stan Fitts Bj Holder Bj Holder Bob Woskow Bob Woskow Brad Schofield Brad Schofield Brad Schofield Brad Schofield Bradley Reener Bradley Reener Brent Baker Brent Baker Brett Anderson Brett Anderson Brieanna Dance Brieanna Dance Brieanna Dance Breanna Dance Bruce Bunderson Bruce Bunderson Buckingham Buckingham Bumingham Bumingham Cole Edmundson Cole Edmundson Courtney Spiker Courtney Spiker Crissman Crissman Customer Wells fargo Customer Wells Dad cell Dad cell Dale Bond Dale Bond GENERAL 646 Street Street 2 City bai SA Type Company State Country drea The CDMA provider was unable to extract Phonebook Important Once you have selected a device and extracted the data before selecting another device you must export the data in order to save the infomation Do not attempt to open a second MPE window to select another device this will cause conflicts in the program IMPORTING AN AD1 IMAGE You can import into MPE only those AD1 images that were created in Mobile Phone Examiner This accommodates the need to revisit an image prior to adding it to an FTK case You do not ne
74. olbars on page 33 Note MPE supports more than 2500 phones because the underlying code enables the viewing and acquisition of file systems on 80 of all CDMA handsets as well as the ability to locate lock codes and EXIF on those CDMA handsets The acquired file systems can then be parsed within FTK TABLE A 1 Manfacturer Model Alcate One Touch 526 Alcate One Touch 535 Alcate One Touch 700 Alcate One Touch 715 Alcate One Touch 735 Alcate One Touch 331 Appendix A MPE Supported Mobile Devices 35 TABLE A 1 Alcate One Touch 332 Alcate One Touch 500 Alcate One Touch 511 Alcate One Touch 512 Alcate One Touch 525 Ericsson A2618s Ericsson IA2628s Ericsson IR310s Ericsson IR320s Ericsson R520m Ericsson R600 Ericsson T20s Ericsson T28s Ericsson 139m Ericsson T65 Ericsson 168 IKyocera SE44 LG LG CX9200 Keybo 2 LG LG VX11000 enV Touch LG LG VX5500 LG ILG VX8575 Chocolate Touch LG ILG VX8610 Decoy LG ILG VX9100 enV 2 LG ILG VX9200 enV 3 LG LG VX9600 Versa LG ILG VX9700 Dare LG LG VX4500 LG LG VX4600 36 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 LG G5200 LG G5300 LG G5310 LG G5400 LG G5500 LG IHB620T LG KE500 LG KE800
75. otorola 17201 Motorola Timeport 280 Motorola V120t Motorola V300 Motorola IV500 Motorola V505 Motorola V525 Motorola V525M 42 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Motorola V535 Motorola V547 Motorola V551 Motorola IV 60 Motorola V600 Motorola NOIR Motorola V6Ot Motorola V620 Motorola V635 Motorola V66 Motorola IV66i Motorola V70 Motorola V710 Motorola V710 Motorola V710m Motorola V80 Motorola V975 Nokia 5300 XpressMusic Nokia 6110 Nokia 6110 Navigator Nokia 6120 classic Nokia 6121 classic Nokia 6124 classic Nokia 6267 Nokia 6290 Nokia 6300 Nokia 6510 Nokia 6600 Nokia 8310 Appendix A MPE Supported Mobile Devices 43 TABLE A 1 INokia E51 Nokia EOI INokia IN76 INokia N95 Nokia N95 8GB Nokia N Gage Nokia N Gage QD Nokia 3600 slide Nokia 5220 XpressMusic Nokia 5310 XpressMusic Nokia 5610 XpressMusic Nokia 6500 classic Nokia 6500 slide Nokia 8800 INokia 8810 Nokia E66 INokia E71 Nokia 6085 Nokia 6230 Nokia 6230i Nokia 6102 Nokia 6555 INokia 6610 Nokia 66101 INokia 7390 INokia 5140 Nokia 5500 Sport Nokia 6111 AccessData Mobile Phone Examiner Plus User Guide TABLE A 1
76. packet file if you have exported and saved the file previously To open LicenseManager without a CodeMeter Stick installed 1 Click Tools gt LicenseManager LicenseManager displays the message Device not Found 2 Click OK then browse for a security device packet file to open AccessData Mobile Phone Examiner Plus User Guide Note Although you can run LicenseManager using a packet file FTK 2 2 will not run with a packet file alone You must have the CmStick connected to the computer to run FTK 2 2 THE LICENSEMANAGER INTERFACE The LicenseManager interface consists of two tabs that organize the options in the LicenseManager window the Installed Components tab and the Licenses tab THE INSTALLED COMPONENTS TAB The Installed Components tab lists the AccessData programs installed on the machine The Installed Components tab is displayed in the following figure FIGURE 3 1 LicenceManager Installed Components x Installed Components Licenses Product Notes O LicenseManager O FK Not Installed D FTkv2 22 e Support for Network Licenses D FTK Pro Not Installed e Several bug fixes D AD Lab Not Installed O AD Lab Lite Not Installed LA LicenseManager 2 2 3 DI AD eDiscovery Not Installed O AD Enterprise Not Installed LA 64 bit support DI FTK imager Not Installed 5 e Several bug fixes and D Park Not Installed troubleshooting help DI ona 3 4 0 O Resistry Viewer Not Installed LicenseManager 2 2 4 O Port Not Inst
77. ported Devices See Supported Mobile Devices on page 35 for more information on this e User Manual this User Guide Chapter 4 User Interface 25 e About Displays information about your software including the version number ABOUT REVIEW PANES DATA TYPE TABS Use the buttons in the Data Type tabs on the left side of the main window to browse the available mobile device data The following table describes the buttons in the Data Type tabs TABLE 3 2 Data Type Tabs 2 Phonebook IKO Call History D EE Calendar LO Media re File System a Click the Phonebook button to view the phone book that was extracted or imported Click the Messages button to view texts that were extractd or imported Click the MMS button to view multi media texts that were extracted or imported Click the Ca History button to view the call history that was extracted of imported Click the Calendar button to view the calendar that was extracted or imported Click the Media button to view all the media including pictures video sound ect that was extracted or imported Click the File System button to view the file tree and files that were extracted or imported 26 AccessData Mobile Phone Examiner Plus User Guide The buttons in the Data Types tabs are only activated if the device from which the information was extracted had the capability The Phonebook data lists the information it finds according to th
78. rently Im license_manager 2 2 4 exe to a temporary directory on your drive 4 To launch the installation program go to the temporary directory and double click the installation file you downloaded in step 3 9 Click Next on the Welcome screen AccessData LicenseManager InstallShield Wizard xj ccessData AccessData LicenseManager The InstallShield Wizard will install AccessData LicenseManager on your computer To continue click Next Appendix B Licensing Information n 6 Click Yes to accept the license agreement AccessData LicenseManager InstallShield Wizard xl License Agreement Please read the following license agreement carefully AccessData Corp End User License Agreement THIS IS A LEGAL AGREEMENT between you the end user of AccessData Corp brand software and AccessData Corp AccessData Use of the software you have downloaded or are about to install indicates your acceptance of these terms As used in this Agreement the capitalized term Software means the AccessData software together with any and all enhancements upgrades and updates that may be provided to you in the future by AccessData IF YOU DO NOT AGREE TO THESE TERMS AND CONDITIONS YOU SHOULD SO INDICATE AT THE APPROPRIATE SCREEN AND PROMPTLY DISCONTINUE THE INSTALLATION AND DOWNLOAD PROCESS vi ei ims of the license agreement Bin do not accept the terms of the license agreement InstallShield 1
79. rsion of the product you are running support VCMs If the version you are running is listed as supported verify that according to License Manager the release date of the version you are running falls before the expiration date of the license AccessData Mobile Phone Examiner Plus User Guide NETWORK LICENSE SERVER NLS SETUP GUIDE INTRODUCTION This section discusses the installation steps and configuration notes needed to successfully setup an AccessData Network License Server NLS Note Click on this link to access the latest version of this guide Network License Server NLS Setup Guide PREPARATION NOTES e CodeMeter Runtime 3 30a or newer must be installed on all Client and Server systems e AccessData License Manager must be used to prepare the network dongle The system running License Manager must have internet access and have CodeMeter Runtime installed e The current release of NLS supports the following versions of Windows e Windows XP 32 64 bit Windows Server 2003 32 64 bit Windows Vista 32 64 bit Windows Server 2008 R1 32 64 bit Windows 7 32 64 bit Windows Server 2008 R2 64 bit SETUP OVERVIEW Use the following steps to setup NLS 1 Download the latest release of NLS located in the utilities section of the AccessData download page 2 Extract contents of ZIP to a folder of your choice 8 On the NLS server system run through the NLS Installation MSI and accept all defaults 4 Prepare n
80. son W900i W910i Sony Ericsson W980i AccessData Mobile Phone Examiner Plus User Guide TABLE A 1 Sony Ericsson Z310i Sony Ericsson IZ520i Sony Ericsson Z530i Sony Ericsson Z550i Sony Ericsson Z555i Sony Ericsson Z610i Sony Ericsson Z710i Sony Ericsson IZ770i Toshiba IVM4050 Ubiquam U400 ZTC TE558 Appendix A MPE Supported Mobile Devices AccessData Mobile Phone Examiner Plus User Guide APPENDIX B LICENSING INFORMATION This chapter expands on the licensing information needed to run MPE including AccessData product licenses virtual codemeter activation and network license server configuration ACCESSDATA PRODUCT LICENSES This section acquaints you with the managing AccessData product licenses Here you will find details regarding the LicenseManager interface and how to manage licenses and update products using LicenseManager INSTALLING AND MANAGING SECURITY DEVICES Before you can manage licenses with LicenseManager you must install the proper security device software and or drivers This section explains installing and using the Wibu CodeMeter Runtime software and USB CmStick as well as the Keylok USB dongle drivers and dongle device INSTALLING THE SECURITY DEVICE As discussed previously AccessData products require a licensing security device that communicates with the program to verify the existence of a current license The device can be
81. t in severe civil and criminal penalties and will be prosecuted to the maximum extent possible under law Build 217 2 On the Welcome screen click Next 1 CodeMeter Runtime Kit v4 10b Setup License Agreement You must agree with the license agreement below to proceed WIBU SYSTEMS AG Karlsruhe Germany and WIBU SYSTEMS USA Inc Seattle USA Software License Agreement Single Use License CodeMeter Software PLEASE READ THIS SOFTWARE LICENSE AGREEMENT LICENSE BEFORE USING THE SOFTWARE BY USING THE SOFTWARE YOU ARE AGREEING TO BE BOUND BY THE TERMS OF THIS LICENSE IF YOU ARE ACCESSING THE SOFTWARE ELECTRONICALLY SIGNIFY YOUR AGREEMENT TO BE BOUND BY THE TERMS OF THIS LICENSE BY CLICKING THE AGREE ACCEPT BUTTON IF YOU DO NOT AGREE TO THE TERMS OF THIS LICENSE RETURN THE WIBU SYSTEMS SOFTWARE TO THE PLACE WHERE YOU OBTAINED IT vi accept the icense agreement I do not accept the license agreement te Jane 8 Accept the License Agreement Wise Installation Wizard Appendix B Licensing Information 63 4 Click Next 5 Enter User Information E CodeMeter Runtime Kit v4 10b Setup User Information Enter the following information to personalize your installation 6 Specify whether this application should be available only when you log in or for anyone who uses this computer 1 Click Next E CodeMeter Runtime Kit v4 10b Setup Se
82. talling the update on a remote computer copy the product update file to another computer 6 Install the product update For information about installing the product update refer to the installation information for the product You may need to restart your computer after the update is installed PURCHASE PRODUCT LICENSES Use LicenseManager to link to the AccessData Web site to find information about all our products Purchase product licenses through your AccessData Sales Representative Call 801 377 5410 and follow the prompt for Sales or send an email to sales accessdata com Note Once a product has been purchased and appears in the AccessData License Server add the product license to a CodeMeter Stick dongle or security device packet file by clicking Refresh Device SEND A DONGLE PACKET FILE TO SUPPORT Send a security device packet file on y when specifically directed to do so by AccessData suppott To create a dongle packet file do the following Appendix B Licensing Information 85 1 Run LicenseManager 2 Click on the Licenses tab 8 Click Load from Device 4 Click Refresh Device if you need to get the latest info from AD s license server 9 Click Save to File and note or specify the location for the saved file 6 Attach the dongle packet file to an e mail and send it to support accessdata com VIRTUAL CODEMETER ACTIVATION GUIDE INTRODUCTION A Virtual CodeMeter VCM allows the user to run li
83. the older Keylok dongle or the newer Wibu CmStick Both are USB devices and both require specific software to be installed prior to connecting the devices and running your AccessData products You will need e The Wibu CodeMeter Runtime software with a Wibu CodeMeter CmStick Appendix B Licensing Information 61 e The Wibu CodeMeter Runtime software and the AccessData Dongle Drivers with a Keylok dongle Note The Codemeter Runtime software and either a silver Wibu CmStick or a green Keylok dongle are required to run PRTK or DNA Without them you can run PRTK or DNA in Demo mode only The CmStick or dongle should be stored in a secure location when not in use You can install PRTK and the CodeMeter software from the shipping CD or from downloadable files available on the AccessData website at www accessdata com Click Support gt Downloads and browse to the product to download Click the download link and save the file locally prior to running the installation files INSTALLING THE CODEMETER RUNTIME SOFTWARE When you purchase the full PRTK package AccessData provides a USB CmStick with the product package The green Keylok dongles are no longer provided but can be purchased separately through your AccessData Sales Representative To use the CmStick you must first install the CodeMeter Runtime software either from the shipping CD or from the setup file downloaded from the AccessData Web site LOCATING THE SETUP FILE T
84. the product license is not currently owned Days Left displays when less than 31 days remain on the license e Never the license is permanently owned This generally applies to Hash Tables and Portable Office Rainbow Tables Appendix B Licensing Information n TABLE 3 3 LicenseManager Licenses Tab Features Column Name Value Show Unlicensed Description Shows the name of additional parameters or information a product requires for its license Shows the values of additional parameters or information a product contained in or required for its license When checked the License window displays all products whether licensed or not The following license management actions can be performed using buttons found on the License tab TABLE 3 4 License Management Options Button Remove License Refresh Device Reload from Device Release Device Open Packet File Save to File Finalize Removal View Registration Info Add Existing License Purchase License Function Removes a selected license from the Licenses window and from the CodeMeter Stick or dongle Opens the AccessData License Server web page to confirm success Connects to the AccessData License Server Downloads and overwrites the info on the CodeMeter Stick or dongle with the latest information on the server Begins or restarts the service to read the licenses stored on the CodeMeter Stick or dongle Click to stop the progra
85. tus Bar to see the status of the current command activity for the device FIGURE 3 16 The Status Bar Status Viewing embedded file system ABOUT TOOLBARS The toolbar has seven items to choose from A Q T B ZP Each is listed in the following table TABLE 3 4 MPE Toolbar Buttons ToolBar Button Description Click the Se ect Device button to open theDevice Selection dialog See Selecting Li a Device on page 17 for more information Click the Extract Data button when the correct drivers are installed and the GO device is connected and has been recognized and selected to extract selected data from the phone or other mobile device The extracted data can be viewed using the buttons on the Navigation Bar on the left side of the screen See Extracting Data on page 20 for more information Click the ADT Export button to export the extracted data to an ADI custom al content image that can be added to a case in FTK or imported back into MPE later without the device connected to view the extracted data The extracted data can be viewed in MPE using the buttons on the Navigation Bar on the left side of the screen Export data from a mobile device in an available format See Exporting To an AD1 Image on page 24 for more details Click the Import AD1 button on the toolbar if the mobile device is no longer E available but you have created an image of the device using MPE and you want to view the devi
86. vices on page 35 For more information on connecting devices see Establishing a Data Connection to a Mobile Device on page 12 2 Access the Device Selection dialog using one of the following methods If you have not already selected a device select Tasks gt Select Device from the menu bar to open the Device Selection dialog If you have selected a device select Tasks gt Extract Data and skip to step 7 8 Click the Identify button See Identifying a Device on page 19 for information on how to identify a device 4 Using the information from the Device Identify group box select the correct information for the connected device from the Manufacturer and Model dropdowns 5 Using the information you found in the Advanced Port Selection dialog select the correct port from the COM Port dropdown See Using the Advanced Dialog on page 20 6 Click Connect The Select Data for Extraction dialog appears Note It is recommened that a device have more than 50 battery charge before extracting data to avoid errors during extraction Chapter 4 User Interface 21 Note If you are unable to connect to the device see Resetting Mobile Device Connection Procedure on page 13 for more information FIGURE 3 3 Select Data for Extraction dialog eta tea EEA l Phonebook T Messages IT MMS Messages T Call History T Calendar T Media File System NOTE Devices with media cards may take a long time

AccessData - Amazon Web Services

Contents

Download Pdf Manuals

Related Search

Related Contents