All results of the data extraction and analysis are contained in one folder, which is the base folder of all the reports and exports. By default, this folder has a name consisting of the phone name, the date and time when the processing started, such as Samsung Galaxy S7 (2020-03-03 10h36m23s). You can change the export name and the destination folder if you need to.
Contents of the folder mainly depend on which output formats have been selected, plus there are a few files that are related to the extraction and analysis in general.
HTML reports are saved in two ways – one is the whole report stored in one file, Report_long.html, and the other one is the full report divided into multiple files (one file per main report section) and the index to the whole report is Report_index.html. The reason for this distinction is that the reports might be too big to open in some browsers.
All of the images and linked files (which also means all files extracted from the phone, for a given report) are stored in the folder html_files. This his folder belongs to the HTML reports and, if copied, all of these folders and files should be kept together. It will help you in case you need to make a copy of the specific report.
The PDF report is similar to the HTML report – in fact, it is generated from a special version of the HTML file – and the name of the report is Report.pdf. In this report, all images are stored inside of the PDF, in a suitable resolution so the PDF file itself can be used for distribution of the report, but there are links from the PDF to additional content stored in the folder named pdf_files, such as all the extracted files (application databases and the like) and also the images in their original resolution.
When the resulting pdf report file might be too large causing the pdf generation phase could fail, it is better to use the PDF Report – Multiple Files options, which generates multiple PDF files, one per each report section. The files start with numbers such as 01_Screenshots_of_User_Settings.pdf, 02_Summary.pdf, etc., and all the pdf files are again linked to the pdf_files folder.
MS Excel Report
This report format generates multiple files divided by the content of the phone, saved as a .XLSX document (for this you need to have MS Excel installed on your PC). There is no folder related to this format as no additional files are saved during the report, and if you need the related files they have to be taken from the other report folders.
The file names have the format such as xlsReport.xlsx and xlsReport_SIM Card.xlsx.
MOBILedit Backup is the format that stores all the information that has been extracted from the phone, and that can be opened later to create additional reports, either with different options and parameters or in a newer version of Forensic Express with improved features such as enhanced recovery of deleted data. The file name is backup.mobiledit, all related files are stored in the folder backup_files, and to open the backup use the option Open file in the main window (when you press Start after launching the application.)
This export format contains all analyzed information from the phone, including data from applications and the recovered deleted data, its file name is export.mobiledit and the related folder with files is mobiledit_export_files.
Report subfolder "Phone"
This subfolder is similar for the mentioned folders above and it contains subfolders:
applications and their data, not user shared galleries
special content, logs from apps or content providers
the whole phone file system
file system which is shared with apps, for example, images, music, downloads, user galleries
temporary files, icons, thumbnails, contacts pictures, message attachments
You might need this information in case you want to browse the extracted data (image, audio, and video files) without opening the report. It also might include little differences based on the phone you were extracting (Android or iOS).
Additional backup folders – iTunes, ADB, and iCloud
If you specify that you want an Android (ADB) backup or iTunes backup, then these additional phone backups are stored in the output folder as well, in subfolders named adb_backup and apple_backup, respectively. These separate backups can be opened too, using the Open file option. ADB backup is also typically created when any application data are needed, and iTunes backup (which contains lots of useful information) is used for most of the operations with an iPhone or an iPad.
If you are using the iCloud analyzer, then downloaded iCloud backups are stored in a subfolder named icloud_backups.
Logs and other files
There are three specific files in the report folder.
File log_full.txt contains all information that was presented on the screen in the white log window, together with all files copied from the phone, and if the password breaker has been used then it contains the resultant password as well.
In the log_short.txt there is summary info of the extraction phase, together with a list of failed items indicating what might be missing in the report, such as skipped folders. The contents of this file are also included in the HTML and pdf reports in the Data Extraction Log section.
File report_configuration.cfg contains all parameters of the whole report, and if you need to create the same report from a different phone you can load this configuration file using the Load report configuration at the start of the report.
Files and long folder paths
All the files in the report subfolders are stored in a tree structure that is based on the original data in the phone, so advanced users might be able to get any files for additional analysis or any other purpose.
When copying the subfolders (or the whole report folder) please be aware that the full paths might be longer than the usual limit of 255 characters still present in the Windows shell. It means that while the file system supports paths as long as 32000 characters (and this is true for many older versions of MS Windows), the standard copy/paste or drag and drop file operation will not work well with these folders. In Windows 10 it seems to be finally addressed, and in other cases, you might use either a third-party file manager (such as Total Commander), or a zip/archive file manager that can handle these long paths.