MPE+ Frequently Asked Questions & Troubleshooting
Contents
1. When using Quick Print to create a PDF report if the amount of information selected for the PDF is large PDF generation will take some time to complete If you have a lot of data PDF reports may result in an out of memory error 60097 Resolution To workaround reports that are very slow or fail try creating several smaller reports rather than one large report If you install the free CutePDF Writer which acts as a printer you can tell MPE to print its report through CutePDF to generate a PDF copy of the report You can also select to instead generate and RTF or CSV report Multiple subsequent extractions using some devices Windows Mobile Apple and Android may fail 60354 60204 Resolution Restart MPE and try extracting data again If the user inputs the incorrect model number when extracting that incorrect number will appear in the Quick Print Report 60413 Resolution Select the correct device from the MPE menus when extracting data After data carving in MPE the Export to AD1 button in the toolbar may be grayed out Resolution Use the Export to AD1 option in the Tasks menu instead On a rooted Android phone if you select the Forensic Files Only option all other extraction options are ignored and only the forensic files are pulled 60307 Resolution Perform the extraction for Forensic Files then perform a new extraction to get the remaining data 24 On some CDMA phones the File Sys2. and tell it to acquire data from a Mobile Device Select the proper manufacturer in the Manufacturer drop down Select the proper device in the Model drop down Click Connect and proceed to acquire the data you want Part way through acquiring data usually after acquiring the phone book progress will stop the phone screen may turn white and Windows will likely try to automatically install another driver Whether this installations fails or not we need to change the driver Open the Device Manager and find the iDEN Device entry Right click the iDEN Device entry and select Update Driver Software Tell Windows to browse your computer for driver software Tell Windows to let you pick from a list of drivers Click Have Disk and browse to Flash_P2K_Patriot inf in the iDENAD FlashPatriot folder and click OK and Next When prompted allow the driver to install When the installation completes Device Manager should list a device called Flash P2K Patriot under libusb win32 devices and MPE should continue and finish the extraction MPE only supports extraction of Contacts from most iDEN phones Please see the Supported Devices List for details 20 Windows Mobile Devices Q How can I collect logical data from a Windows Mobile device with MPE Devices Most Windows Mobile devices Not Windows Phone 7 Type of Capture Logical Procedure 1 Install the Windows Mobile drivers from the MPE Driver Pack 2 Power on t
3. cut a normal SIM into a micro SIM Additional Forensic SIM cards and adapters can be obtained by contacting Sales at 800 574 5199 or sales accessdata com Q What is a forensic SIM A A forensic SIM is partial clone of a SIM card that contains enough data for the phone to recognize it and turn on but will not enable the phone s radios and does not contain user data A forensic SIM only has IMSI International Mobile Subscriber Identity and ICCID Integrated Circuit Card Identifier data Q What is the process for acquiring data from a SIM card 1 Ensure the SIM card reader driver has been installed often installs automatically 2 Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager 3 Launch MPE 4 Insert the SIM card into the reader according to the picture on the reader you may see a Smart Card device in Device Manager that shows it is not working but that is fine If the phone uses a micro SIM you can pop the micro SIM into the micro SIM adapter so it fits in the SIM card reader 5 Choose to acquire data from a SIM card and proceed to acquire the data you want Q How do I create a forensic SIM Automatically 1 Ensure the SIM card reader driver has been installed often installs automatically 2 Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager 3 Launch MPE 4 Insert the original SIM card into the reade
4. Click the button next to the Temporary Data Path field to select a new location 4 Click OK Q What does MPE do during the initialization process every time it starts A The first time MPE starts it will install any available firmware updates containing additional drivers as well as download and install the files needed to perform physical extraction of Apple devices Every subsequent time that MPE is launched it will check for any available program updates and for the presence of the several key drivers and files If this process fails you will be prompted to re download and reinstall any necessary files Q Do I really need the Apple physical support files A These files are necessary only if you want to be able to extract physical images of Apple devices Q The MPE Driver installers left several shortcuts on my desktop and Start menu Do I need these A No These shortcuts are safe to delete Some of the shortcuts won t even work as unnecessary files have been removed from their accompanying programs Q Where is the shortcut to run MPE A The installation method has been changed drastically and currently only creates a Start menu shortcut to run MPE However if you d like a shortcut to MPE on your desktop you can still manually create one MPE Tablet Q What is the MPE Tablet A With the release of MPE 4 6 we are introducing a new slimmer tablet preloaded with a touch friendly version of MPE The new
5. MPE Frequently Asked Questions amp Troubleshooting MPE 4 7 0 36 2012 AccessData Group LLC Table of Contents Mobile Forensics Background Knowledge c cccccccessssssssececececsesesneaecececessesesaeseeeeecesseseaaeseeeeecesseseaasaeeeeeens 2 System REQUIEM Seira 3 MN CQNS UNS veces cca dec esas eeee cs a e Ea eaaa ee E a E a Ee a aa Paaa aaa aas E EESTE 4 Installing Running MPE iii dada 5 MPER Tablet acti 7 DAVE EEEE A O E ra rra rd neral 8 A ten cesusa sada ebennicessseeavelensenees ese savas eve guenvese guele svseecesteadelevssueesese auslessuysirese alesnsepeseveis dveleas 9 SIM CANS stats 11 Android DEVICES vtr ais 13 Apple DEVICES a dot 16 Blackberry DEVICES viccsccvssicdessctiiees seawccesedicccawssvedeezaieiosssbavecssdadecouawhaveceesitacelsshivcessandeccuaubivedsedateceusabaccesduenecde 19 IDEN DOVES aenar AA AOE EEE EAEE E E AO EE EE O TAO 20 Windows Mobile DeviceS ssssssessssssrsssrrsssrssrrssersserssesssesssessstessessstesstesstesstesstesstessteasteasteastenstenstensenaeennet 21 General Troubleshooting iii ida i 22 Known Issues MPE 4 7 0 36 cccccsscccccssssececssscececsseceeecseseeecseeeeecessesecessesecseseesecessesecseaeceeseeeeeeeseeaeess 23 Mobile Forensics Background Knowledge Q What is the difference between Computer Forensics and Mobile Phone Forensics A In computer forensics the devices that we are imaging are static storage devices this means that with we will obtain the same
6. MPE Tablet interface is also available here if you d like to install it on the old MPE Tablet Q How do I install the MPE Tablet interface A The procedure for installing either MPE or MPE Tablet is outlined in this post Q What are the specifications for the new MPE Tablet Operating System Windows 7 Embedded Standard x64 Display 10 1 Capacitive Screen CPU Dual Core 1 66 GHz Intel Atom N570 RAM 2 GB DDR2 Drive 16 GB SSD Expandable Storage microSDHC Slot Ports USB 2 0 x 2 Multi Use Port for Ethernet VGA adapter A C Port Q The Tablet s internal drive does not have much space Where should I store my data A The new MPE Tablet is meant to be a pass through device Images should not be stored on the Tablet s internal drive but on external media Your MPE TEMP folder should also be stored on external media to ensure you do not run out of space Q How do I change the location of my MPE TEMP folder A The procedure for changing the TEMP folder location in either version of MPE is outlined in this post Q How can I expand my available storage space A You can add storage space by connecting a USB thumb drive or inserting a microSDHC card External USB HDDs can also be used if desired Q Does the new MPE Tablet have WiFi connectivity A No Although the Tablet hardware includes a WiFi card we have left it disabled intentionally to protect the device Internet connectivity can be achieved via Ethernet w
7. Physical images will be saved in DD format and cannot be viewed in MPE They must be processed in FTK e Apple Deep Logical images will be saved in TAR format and can be viewed in MPE via Tasks gt Extract From gt Apple TAR or processed in FTK e MPE will name an Apple device s physical images in the format partition_name sector_size segment_number Changing these file names may result in FTK not being able to correctly read the images e The OS partition will usually require at least 1 GB of disk space on the destination PC The other partitions require at least as much space as the Apple device is rated to hold This means that selecting to acquire the OS Partition User Partition Decrypted User Partition and Full Disk from a 32 GB Apple device will result in about 96 GB worth of image files Q How do I know if an iPad 2 is Wifi only Wifi GSM or Wifi CDMA A You can check the model number under Settings gt About gt Model 16 GB Wifi only Black MC769LL A 32 GB Wifi only Black MC770LL A 64 GB Wifi only Black MC916LL A 16 GB Wifi GSM Black MC773LL A 32 GB Wifi GSM Black MC774LL A 64 GB Wifi GSM Black MC775LL A 16 GB Wifi CDMA Black MC755LL A 32 GB Wifi CDMA Black MC763LL A 64 GB Wifi CDMA Black MC764LL A 16 GB Wifi only White MC979LL A 32 GB Wifi only White MC980LL A 64 GB Wifi only White MC981LL A 16 GB Wifi GSM White MC982LL A 32 GB Wifi GSM White MC983LL A 64 GB Wifi GSM
8. White MC984LL A 16 GB Wifi CDMA White MC985LL A 32 GB Wifi CDMA White MC986LL A 64 GB Wifi CDMA White MC987LL A Q Apple Software Update asked me to upgrade iTunes Should I allow this A No If you install the new version ofiTunes after installing the MPE Smartphone Driver then MPE may cease to connect properly to Apple mobile devices To prevent the prompt to upgrade you can uninstall only the Apple Software Update program via the Control Panel If you do accidentally allow it to upgrade iTunes you will need to uninstall the MPE Smartphone Driver and iTunes and then reinstall the MPE Smartphone Driver Q How do I get my device out of DFU mode A Your device should reboot itself to get out of DFU after doing a physical acquisition Ifit does not or the device remains in DFU as the result of an error or cancelling the image process hold down the Home button and Power button together for 10 seconds to get out of DFU mode 17 Q What does error 1013 mean when acquiring a physical image from an Apple device A This means that you are using an unsupported device Q What are the IOS_KEYS files created during physical extractions A These contain the key bundles that FTK will use to decrypt the physical image s Q Why can t FTK display some files in a physical image from an Apple device A Since iOS 4 hardware based encryption is used on all Apple devices and cannot be turned off Because of this you may not be
9. able to view the contents of some files in FTK unless your images were created with MPE 4 7 or later to obtain the decryption keys and your are using a version of FTK that supports Apple physical image decryption An alternative to getting these physical DD images would be to get the deep logical TAR images which are not encrypted 18 Blackberry Devices Q How can I collect logical data from a BlackBerry with MPE Devices Most BlackBerry Phones Type of Capture Logical Procedure 9 Notes ANAM PWN Install BlackBerry Desktop via the MPE Driver Pack Power on the phone Connect the device with the proper cable Click the Select Device button in MPE or Tasks gt Select Device Select BlackBerry in the Manufacturer drop down Select the correct device in the Model drop down Click Connect When prompted in MPE enter the phone s password PIN If the device has no password PIN leave this field blank If the device is also using encryption enter the password PIN on the device itself Important A BlackBerry keyboard contains numbers and letters on the same keys Often the device password PIN is actually comprised of letters even though you might think you re entering numbers For example the password PIN 1234 is actually wers Proceed to acquire the data you want If a BlackBerry device isn t explicitly listed as supported you can often still perform the extraction by selecting BlackBerry in the Ma
10. d User Data Forensic Files from Android devices with MPE Devices Most Android devices Type of Capture Logical Procedure 1 EPIA Install the ADB Android Debug Bridge driver for your phone Some are included in the Driver Pack or on the MPE CD but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer Remove any memory cards that came with the device and insert an empty forensic SD card this is where MPE s agent will be temporarily stored On the device itself set the device to connect in Debugging Development mode this setting can be in different locations on different devices so check with the device s user manual On the device itself set the device to allow applications from Unknown Sources this setting can be in different locations on different devices so check with the device s user manual Connect the device with the proper cable Unlock the device Gain Shell Root not full root with a tool like SuperOneClick Click the Select Device button in MPE or Tasks gt Select Device Select the device s Manufacturer and Model in the drop downs 0 Click Connect and proceed to acquire the Forensic Files 13 Q How can I collect physical images from Android devices with MPE Devices Most Android devices Type of Capture Physical Procedure 1 Install the ADB Android Debug Br
11. d or run from multiple user accounts on the same PC 63843 Resolution Choose one user account with Administrator privileges under which to install and run MPE During the installation you may be prompted to reboot the PC stopping the installation prematurely 63629 Resolution If possible select to reboot the PC later and wait until MPE runs for the first time and finishes driver installation before rebooting If you are forced to reboot the PC you may need to manually resume restart your installation so everything installs completely During the installation and first run of MPE the Initializing window may cover up some of the settings and driver prompts Resolution Click and drag the Initializing window to move it out of the way During the installation and first run of MPE you may be warned that a driver is unsigned of a publisher is unknown 63163 Resolution Make sure to allow all of these drivers to install Sometimes it may be possible to check Always trust software from to reduce the number of warnings prompts During the installation and first run of MPE minimizing the MPE window may cause MPE to freeze 63163 Resolution End MPE exe is Task Manager and restart MPE During the installation and first run of MPE MPE may fail to download the Apple physical support files if your PC is behind a proxy or firewall Resolution Please contact AccessData Support at 800 658 5199 and we will fi
12. equisites must I install manually before installing MPE On Windows XP Professional you will need to manually install MSMQ Microsoft Message Queuing as per the following instructions 1 In Control Panel double click Add Remove Programs 2 On the left tab of the Add Remove Programs window click Add Remove Windows Components 3 Once the Windows Components Wizard opens click to select the Message Queuing Services item Click Next 4 This will start the MSMQ 2 0 setup process Your Windows XP installation CD ROM network share or install point must be available 5 MSMQ will display an installation dialog box You will be prompted to install either an MSMQ server ora dependent client 6 You can install MSMQ 2 0 in Workgroup mode by selecting Message Queuing Will Not Access a Directory Service If you have Windows 7 N you will need to manually install Windows Media Player via Microsoft s Media Feature Pack here Q Can I use the Home Edition of Windows XP with MPE A No MPE utilizes MSMQ Microsoft Message Queuing which is no available in XP Home Edition Licensing Q Why does MPE ask for an activation code A In earlier releases of MPE two licenses were involved in running MPE One was the license that s stored on the CodeMeter dongle or Virtual CodeMeter dongle and one was a GSM license Recent releases of MPE no longer require a GSM license and the infrastructure used for the GSM lisenses is no longer supp
13. g the contents of the different cable packs Q Can I use OEM cables with MPE A Yes Itis actually encouraged to obtain any cables chargers and accessories when seizing a phone Q Does AccessData provide cables for every supported device A We provide cables for many supported phones but are unable to provide cables for all supported devices Phones Q What phone devices are supported by MPE A You can view a list of supported devices in MPE by going to Help gt Supported Devices or viewing the online Supported Devices List Ifa devices is not listed in MPE it typically means that MPE cannot extract any data from that device with the exception of CDMA dumb phones which still might be able to have their File System extracted by selecting Other as the Manufacturer and Other CDMA as the Model in MPE On unsupported smart phones you can try selecting a similar model but there s no guarantee that it will work and if it does the reports will show the wrong phone model Q Why aren t all phones supported by MPE Why can t MPE collect all the data from every phone A Phones are full dynamic systems rather than static storage devices This means that every phone will store information differently communicate differently with the computer and require a different driver Phone providers have even been known to change the file system structure between different firmware versions on the same model phone further complicating
14. he device 3 Inthe USB to PC options on the phone enable ActiveSync and Enable faster data synchronization 4 Connect the device with the proper cable Windows Mobile Device Center should see the device but do not tell it to connect 5 Select the proper Manufacture and Model from the dropdowns in MPE 6 Click Connect 7 If prompted on the phone to install the OxygenEngine dll accept and allow the installation 8 Proceed to acquire the data you want Notes e Ifa Windows Mobile device isn t explicitly listed as supported you can often still perform the extraction by selecting Windows Mobile Phone in the Manufacturer drop down and Generic Windows Mobile Phone in the Model drop down 21 General Troubleshooting Q Why does MPE say my device is not ready or otherwise unable to connect A There could be many causes for this e Ensure the device is on and unlocked e For GSM phones make sure a SIM is inserted Use a forensic SIM if possible but do not use a foreign SIM from another phone or provider e The drivers may not be installed or may be corrupt Reinstall the drivers and ensure the device s ports show up in Device Manager e Ensure the phone is supported by MPE and you have selected the correct Manufacturer and Model e Try connecting over a different port e MPE sometimes requires that the device be connected before launching MPE e You can contact AccessData Support at 800 658 5199 if you continue
15. hone may be automatically mounting the SD card to the PC as a Mass Storage Device You ll know if it s mounted to your PC because you ll be able to browse the phone s SD Card in Windows Explorer If it is mounted you should find the option to unmount it and set the phone to Charge Only mode in the phone s Notifications pull down the Notification Bar at the top of the screen Q What is contained in the Protected User Data Forensic Files A Forensic Files refers to the full contents of an Android device s data folder This folder contains a wealth of user data including SQLITE databases full of deleted data contacts SMS app cache downloads etc that is normally hidden from the user To acquire this data either select to extract Forensic Files Only to extract only the data folder or select File System to extract the entire File System including the data folder 15 Apple Devices Q How can I collect logical data from an iPhone iPad iPod with MPE Devices iPhone all models iPod Touch all models iPad 1 2 iOS Through iOS 5 1 Type of Capture Logical Procedure 1 Uninstall any versions of iTunes that your PC has and install the drivers from MPESmartphoneDriver exe 2 Connectthe device with the normal Apple USB cable and allow Windows to install any needed drivers Click the Select Device button in MPE or Tasks gt Select Device Unlock the device Select Apple in the Manufact
16. idge driver for your phone Some are included in the Driver Pack or on the MPE CD but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer 2 Remove any memory cards that came with the device and insert an empty forensic SD card this is where MPE s agent will be temporarily stored 3 On the device itself set the device to connect in Debugging Development mode this setting can be in different locations on different devices so check with the device s user manual 4 Onthe device itself set the device to allow applications from Unknown Sources this setting can be in different locations on different devices so check with the device s user manual Connect the device with the proper cable Unlock the device Gain Shell Root not full root with a tool like SuperOneClick Click the Select Device button in MPE or Tasks gt Select Device In the Manufacturer drop down select Android 10 In the Model drop down select Android Physical 11 Click Connect and proceed to acquire the data you want OPIO Notes e When you have the proper ADB driver installed and the device is in Debugging mode Device Manager will usually list an ADB Interface Android Phone or Android USB Device and the device will not be seen as a mass storage device e If an Android device isn t explicitly listed as supported you can us
17. image every time In mobile phone forensics the devices that we are imaging are full dynamic systems this means that while we may support the phone we might only extract the contacts SMS and call logs but not the calendar or any other combination of this information This may come as a shock to many customers that have never dealt with any mobile forensic software or haven t had any type of mobile forensic training but for those customers that understand mobile phone forensics they should only see MPE as a tool that can help them fill the voids of other software they use and become their main tool Q What is CDMA A CDMA stands for Code Division Multiple Access and is a cellular technology used for communication CDMA is usually only used in the USA CDMA phones typically do not use SIM cars unless they are world phones which rely on GSM technology outside of the USA More information about CDMA can be obtained here Q What is GSM A GSM stands for Global System for Mobile Communications and is a worldwide standard for cellular communication GSM phones use SIM cards whether externally accessible or not More information about GSM can be obtained here System Requirements Q What Operating Systems are supported by MPE Windows XP Professional 32 bit only Windows 7 Home Premium 32 and 64 bit Windows 7 Professional 32 and 64 bit Windows 7 Enterprise 32 and 64 bit Windows 7 Ultimate 32 and 64 bit Q What prer
18. ith the included adapter Q Can I use the Tablet s built in SIM card slot A No Although the Tablet hardware includes a slot for a SIM card we have left it disabled intentionally to protect the device The SIM card reader in the MPE Cable Pack can still be used to analyze SIM cards Drivers Q What drivers are included on the MPE disc or on AccessData s site A Two driver packages are installed with MPE and included on our site and on the disk The AccessDataMobilePhoneExaminerDrivers package contains drivers for most of the supported phones The MPESmartphoneDriver package contains the drivers for Apple devices Q What do I do if I am unable to download the Apple Device Physical Files via MPE A Contact Support at 800 658 5199 to obtain the Apple Device Physical Files another way Q Does AccessData provide drivers for every supported phone A We try to provide as many drivers as we can Any other drivers can be found on the internet either from the phone manufacturers or their providers or through a simple Google search Cables Q Why does MPE prompt me for different cables than the ones included in my cable pack A We have gone through three revisions of the cable pack with each differing slightly However MPE is still programmed to ask for the cables from our first revision of the cable pack as more customers have the that pack than the newer packs Please see MPE Cable Numbers zip for a table comparin
19. nce Select either Install MPE or Install Tablet MPE Let the installer run all the way through installing any necessary prerequisites and all drivers Offline A WPwn Pe go 10 11 Notes Uninstall any previous versions of MPE On a PC with an internet connection go to http accessdata com MPE clickonce Expand the option for Offline Downloads Download the appropriate offline installer and firmware package If you want to be able to extract physical images from Apple devices you will also need to contact Support at 800 658 5199 to obtain the Apple physical support files Extract the offline installer and put its contents along with the firmware package s put each firmware package in its own folder and the Apple physical support files installer on media to transport to your forensic machine Ensure your CodeMeter dongle is connected and has a current MPE license Run the setup exe from the unzipped installer package Let the installer run all the way through installing any necessary prerequisites and all drivers When the installation completes install the firmware package s one at a time by going to Tools gt Mobile Device Drivers gt Import From Folder in MPE and browsing to the folder containing the firmware package After closing MPE run the Apple physical support files installer Full installation can take quite a while as there is about 1 5 GB of data for it to download and install including prerequisi
20. nd another way to get the needed files to you The iDEN drivers are missing from the latest driver installer 63623 Resolution Please contact AccessData Support at 800 658 5199 to get these drivers On Windows XP the AccessData phone drivers for older Sanyo LG Motorola and Samsung phones may not install automatically 63830 63832 Resolution Please contact AccessData Support at 800 658 5199 to get these drivers which you can then manually install as needed You will only be prompted to update MPE once on start up If you decide not to update you will not be prompted again 63369 Resolution Update manually via the offline installer on the MPE installation web page 23 MPE will only recognize the SIM Card reader if it is plugged in before starting MPE 63266 Resolution Make sure to connect the SIM Card reader before starting MPE On some CDMA phones MPE appears not extract media files 63252 Resolution Some CDMA phones do not save their media files with proper extensions You should still be able to find the media files if the extract the File System and carve for media files Some HTC phones aren t detected properly even though the HTC drivers were installed via the Mobile Phone Examiner Drivers installer 63605 63630 Resolution Sometimes the driver pack installer doesn t install all the parts of HTC drivers If this occurs you can download and install HTC Sync separately directly from HTC s website
21. nufacturer drop down and Other BlackBerry Phone in the Model drop down Prior to MPE 4 5 extraction from a password PIN locked BlackBerry is not supported and you must disable the password PIN lock in the phone s settings 19 IDEN Devices Q How can I collect logical data from an iDEN device with MPE Devices Supported iDEN devices Type of Capture Logical Procedure 1 11 12 13 14 15 16 17 18 19 20 21 Notes Install the MPE Driver Pack selecting to install the iDEN drivers they should be installed to C Program Files x86 AccessData Mobile Phone Drivers iDENAD Power on the phone Set the phone to connect as a modem typically Menu gt Settings gt Connections gt USB gt Data Modem Connect phone with the proper cable Windows will likely try to automatically install the driver Whether this installations fails or not we need to change the driver Open the Device Manager and find the iDEN Device entry may be under Modems Right click the iDEN Device entry and select Update Driver Software Tell Windows to browse your computer for driver software Tell Windows to let you pick from a list of drivers Click Have Disk and browse to iDEN_USB_Device inf in the iDENAD iDEN folder and click OK and Next When prompted allow the driver to install When the installation completes Device Manager should now list a device called iDEN USB Device under libusb win32 devices Open MPE
22. orted If MPE is asking for an activation code you must upgrade to a newer version of MPE that does not use GSM licenses Q How do I move my MPE installation to a different computer A Ifyour MPE license is stored on a physical CodeMeter dongle you can simply install MPE and the CodeMeter software on another PC and connect the dongle to that PC when you wish to run MPE If your MPE license is stored in a Virtual CodeMeter usually the case with the MPE tablet you will first need to move your MPE license to a physical CodeMeter dongle through the following steps 1 Make sure the machine with the Virtual CodeMeter is connected to the internet 2 Open AccessData License Manager 3 Under the Licenses tab select the checkbox next to the entry for FTK Mobile Phone Examiner 4 Click Remove License and click Yes when prompted On another PC make sure you are connected to the internet and insert a physical CodeMeter dongle Open AccessData License Manger Under the Licenses tab click Add Existing License On the web page that opens up select the checkbox next to the unbound Mobile license Click Bind then switch back to License Manager and click Yes when prompted m PAZO Installing Running MPE Q How do I install MPE Online wap wn Uninstall any previous versions of MPE Ensure your CodeMeter dongle is connected and has a current MPE license In a browser go to http accessdata com MPE clicko
23. ow you to view and save the results Optional If the phone uses a micro SIM you can use the micro SIM adapter as a template to cut the forensic SIM down to micro SIM size to fit in the phone 12 Android Devices Q How can I collect logical data from an Android device with MPE Devices Most Android devices Type of Capture Logical Procedure 1 0 0 N o o Install the ADB Android Debug Bridge driver for your phone Some are included in the Driver Pack or on the MPE CD but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer Remove any memory cards that came with the device and insert an empty forensic SD card this is where MPE s agent will be temporarily stored On the device itself set the device to connect in Debugging Development mode this setting can be in different locations on different devices so check with the device s user manual On the device itself set the device to allow applications from Unknown Sources this setting can be in different locations on different devices so check with the device s user manual Connect the device with the proper cable Unlock the device Click the Select Device button in MPE or Tasks gt Select Device Select the device s Manufacturer and Model in the drop downs Click Connect and proceed to acquire the data you want Q How can I collect Protecte
24. r according to the picture on the reader you may see a Smart Card device in Device Manager that shows it is not working but that is fine If the phone uses a micro SIM you can pop the micro SIM into the micro SIM adapter so it fits in the SIM card reader Click on Tools gt Create Forensic SIM gt Read SIM Once it has read the IMSI and ICCID click Continue Insert a blank forensic SIM into the reader and click OK After the values have been written to the forensic SIM MPE will allow you to view and save the results 9 Optional If the phone uses a micro SIM you can use the micro SIM adapter as a template to cut the forensic SIM down to micro SIM size to fitin the phone Manually if you already know the correct IMSI and ICCID values 1 Ensure the SIM card reader driver has been installed often installs automatically ONDON 11 POS DY Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager Launch MPE Insert a blank forensic SIM card into the reader according to the picture on the reader you may see a Smart Card device in Device Manager that shows itis not working but that is fine Click on Tools gt Create Forensic SIM gt Enter Values Enter the IMSI and ICCID either in octet form or in raw form and click Continue Insert a forensic SIM into the reader and click OK After the values have been written to the forensic SIM MPE will all
25. tem fails to extract during a Select All extraction Resolution Perform one extraction selecting only the File System then another extraction Tasks gt Extract from gt Device selecting everything else Although they are listed in MPE Palm phones running Windows Mobile OS are not currently supported Resolution Wait for a future release of MPE to support the following phones Palm Treo 500 Palm Treo 700w Palm Treo 700wx Palm Treo 750 Palm Treo 750v Palm Treo 800w Palm Treo Pro 25
26. tes driver files firmware Apple physical support files and MPE itself If you are prompted to reboot your PC during the installation please choose to restart later and then restart your PC after MPE has run for the first time Please pay attention to warnings and popups and make sure to allow any and all drivers to install Some driver prompts may be covered by the MPE progress window so you should click and drag the progress window to move it out of the way If you choose to reboot your PC or disallow any drivers to be installed you may need to manually restart resume the installation process Q What is the importance of the MPE TEMP folder and where should I put it 5 A During extraction and or analysis all extracted data is stored in the MPE TEMP folder Due to how this data is stored the TEMP folder may contain several times the amount of data as the device itself or the AD1 image You should put the TEMP folder should be placed on the drive with the most free space preferably with 100GB free space or more MPE will not work properly ifthe TEMP folder runs out of space during extraction Q How do I change the location of my MPE TEMP folder MPE 1 Click the Tasks menu 2 Click Settings 3 Open the Temp Data tab 4 Click the button next to the Data Provider Temporary Data Path field to select a new location 5 Click OK Tablet MPE 1 Click the lower right button in Tablet MPE 2 Click Settings 3
27. the issue We are constantly working to add more supported devices to our product and improve device support Q What is the general process for acquiring data from a phone 1 Ensure the proper drivers have been installed 2 For GSM devices make sure a SIM is inserted use a forensic SIM if possible but do not use a foreign SIM 3 Power on and unlock the device 4 Connect the device to the PC using the appropriate cable 5 Ensure the device is in the proper mode almost always not Mass Storage mode 6 Confirm that Windows can see the device properly usually by looking under Modems or Ports in Device Manager 7 Launch MPE and choose to acquire data from a phone 8 Selectthe appropriate Manufacturer and Model from the dropdowns 9 Selectthe proper Port usually a Serial or Modem port for CDMA phones or click Refresh Port s for GSM phones 10 Click Connect and proceed to acquire the data you want 10 SIM Cards Q What are the two black cards I received in the MPE bundle A The MPE bundle includes a blank SIM card that can be used as a forensic SIM it says MPE Forensic SIM in the back and a micro SIM adapter it looks like a SIM card but has no circuitry and has a smaller section the size of a micro SIM that can be popped out The micro SIM adapter has two purposes you can pop a micro SIM into it so that it can be read by the SIM card reader or you can use it as a template to
28. to have problems after following these points Q Why did MPE fail to collect some data from my device A This could be because this device doesn t have any of the specified types of data stored on it which you can verify by looking through the device itself It may also be due to a file system change in a specific firmware version that MPE cannot read parse yet This may also be due to the fact that the phones are full dynamic systems and can essentially choose not to allow a user to collect data Ifthis is the case other methods not involving MPE can be used to report on the missing data You can learn about these other methods in our Mobile Forensics training courses Q Why did MPE pull all the data off my device when I only selected to acquire the File System A If MPE has any difficulty in acquiring the File System of a device it will automatically try another method of acquiring the File System The second method will automatically collect all the data from the device Q I told MPE to acquire all data from my supported CDMA phone but the extraction failed A If this happens completely close and restart MPE and reboot the phone Try extracting data again but rather than selecting all data select only the File System After the File System extracts you can click the Extract Device Data button or go to Tasks gt Extract Data to extract the remaining data 22 Known Issues MPE 4 7 0 36 MPE cannot be installe
29. ually still perform the extraction by selecting Android in the Manufacturer drop down and Generic Android in the Model drop down e Android physical images will be saved in DD format and cannot be viewed in MPE They must be processed in FTK e MPE will name an Android device s physical images in the format partition_name sector_size file_system Changing these file names may result in FTK not being able to correctly read the images Q Does AccessData provide ADB Android Debug Bridge drivers for supported Android phones A Some ADB drivers are included in the Driver Packs or on the MPE disc but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer As ADB drivers are commonly used in rooting Android devices users may be able to find help setting up their ADB drivers on YouTube or on the XDA forums 14 Q How can I make sure my ADB driver is working A Usually your phone will be listed in Device Manager under something like Android or ADB Devices when the driver is installed properly Another way to make sure that it s working is to use the ADB utility from the Google Android SDK by running the command adb devices from the directory containing adb exe This will list any devices that are communicating over ADB Q I get the error No flash card in device but I know there is an SD card in it A The p
30. urer drop down Select the correct device in the Model drop down Click Connect and proceed to acquire the data you want NO ol ew Q How can I collect physical or deep unencrypted logical images from an iPhone iPad iPod with MPE MPE Version MPE 4 2 0 and later Devices iPhone all but iPhone 4S iPod Touch 3 amp 4 iPad 1 iOS Through iOS 5 1 Type of Capture Physical Procedure 1 Uninstall any versions of iTunes that your PC has and install the drivers from MPESmartphoneDriver exe Also install the Apple Physical Device Support files if prompted by MPE Connect the device with the normal Apple USB cable Click the Select Device button in MPE or Tasks gt Select Device Select Apple in the Manufacturer drop down Select the correct device with the Physical label in the Model drop down Click Connect and follow the on screen prompts to put the device in DFU mode Note that holding the buttons down for longer than prompted will result in the device not going into DFU mode and you will need to restart the process 7 Ifthe device has a password select the option to brute force the password enter the password or just extract the deep logical TAR files 8 When prompted select which partitions to acquire and proceed to acquire the data DU PWN Notes e If MPE reports that the device is not ready try unlocking the device and opening Settings then trying to connect again 16 e Apple
Download Pdf Manuals
Related Search