MOBILedit Forensic Express performs mobile phone content extractions and is used by professionals in law enforcement, military as well as in the corporate and private sectors. By connecting a phone via USB cable, Wi-Fi or Bluetooth you can perform individual examinations of most of the mobile devices and generate reports in multiple formats (PDF, HTML, Excel, etc.) for a variety of needs.
MOBILedit Forensic Express can retrieve messages, call logs, pictures, contacts, apps, calendar events, emails, passwords, media, file systems, deleted data, and much more. You can even select specific data which you want to extract from the device.
Before you begin
For the best possible experience, we recommend taking a look at the minimum system requirements.
The digital key version of MOBILedit Forensic Express is not compatible with the dongle. For the dongle version please contact our technical support.
The step by step installation guide is available in the video below:
Before connecting the phone, be sure you have installed the necessary device drivers on your PC. You can download our Complete Driver Pack.
When connecting an Android device with the 64-bit version of MOBILedit Forensic Express, the device driver provided by the manufacturer of the phone might not allow a proper connection between the device and the software. You might need to replace it with the universal ADB (Android) driver.
Getting maximum including deleted data
While MOBILedit Forensic Express is a very powerful extraction tool and extracts practically all information available, advanced users looking to get even more information from the phone should first 'root' or 'jailbreak' the phone.
Android rooting is an important step that will allow maximum data and deleted data acquisition. If you cannot or do not want to root the phone, you can alternatively use the Application Downgrade feature to find hidden data and deleted data in certain supported apps.
For iPhone or iOS devices supply the iTunes backup password. Jailbreaking an iPhone can bypass several types of Apple prohibitions for the end-user, including modifying the operating system (enforced by a "locked bootloader"), installing non-officially approved applications via side loading, and granting the user elevated administration-level privileges (rooting). You can also try to bypass the passcode on locked iOS devices with the Lockdown Files Method.
Password and PIN breaking
Additional data can be found in either the iTunes or ADB backups. In case the backup is password-protected, you can use the Password Breaker to bypass the protection.