Outputs - reports, exports, and backups
Create multiple formats of reports and exports after extracting data from a phone, each customizable to your specific needs. To continue you must select at least one format. More information about the structure of each file format can be found in the following section - Reports in detail.
Filtering only applies to final reports. Please, keep in mind that other outputs (such as UFDR), will not be affected by filtering and data selection.
In case you select MOBILedit backup, all relevant information will be present as well. For example, GPS data might be present in various other sections, such as images.
All report formats are human-readable and can be opened using supported web browsers, PDF viewers, and Microsoft Office applications.
HTML Report
An HTML report format can be opened using your web browser (we recommend using Google Chrome, Mozilla Firefox, Microsoft Edge, or Internet Explorer 11). This format does not include a full backup of phone data - to create a full backup please use the MOBILedit Backup export format as well.
This option will automatically generate two HTML files into the export folder.
Report_long.html
the full HTML report file with all content
please note that this file can be large (100MB and more), therefore web browsers may have problems opening or viewing the file if such a large amount of data was extracted from the phone - if you experience problems while opening the HTML file, use the Report_index.html file instead
Report_index.html
HTML report split into multiple HTML files based on sections
PDF Report
PDF report format can be opened using your PDF viewer or editor (we recommend using Adobe Acrobat or Adobe Reader).
If you experience any difficulties opening links to associated files within PDF documents, please ensure you first try the above recommendations before contacting support.
You can choose from two types of PDF reports - Single File or Multiple Files. Your selection will be automatically generated in the export folder:
Single file
contains the full PDF report file with all extracted content
please note that this file can be large (1GB and more), if you experience problems while generating or opening the PDF file due to a large amount of data, use the Multiple files option instead
.png?inst-v=99f8be92-e635-449f-8e9a-8f9fc96e37dc)
Multiple files
The PDF report is split into multiple PDF files based on sections
Please note that in case the single PDF file is about to be really big, it will be automatically split into multiple files to prevent loading issues and also to ensure the faster creation of the reports. This will typically happen when the extracted device contains a lot of photos or videos (media files in general).
MS Excel report
MS Excel report can be opened using the Microsoft Excel application (we recommend using Microsoft Excel 2010 or newer).
Each record and contact has its own exf_ID xxx. You can view all data related to a specific ID by searching through the desired MS Excel list.
Export & backups
All export formats are machine-readable and can be used to process extracted data in other applications or to make a full backup of any device which can be later opened and analyzed without having the device live connected again.
MOBILedit Backup
MOBILedit Backup XML contains a full phone data backup that can be opened, browsed, and analyzed again, as well as archived for further use. The complete filesystem structure is put into the mobiledit_backup.xml file and all phone data is copied into the backup_files subfolder.
You can set packing and password protection for Backup. The Hash protection is set automatically when the backup creation was selected. The default hashing method is SHA-256, which is more secure than the MD5.
The master backup hash check is done when you import the MOBILedit backup.
The hash for each file in the backup can be checked by running the deep hash check.
It is recommended to create an All data MOBILedit Forensic backup as it contains all the extracted data from the device and can be re-imported for further analysis. It is especially useful if the original device is stored remotely from the lab or the device is returned to the owner. Additionally, it can be used in place of a Physical image that was obtained and is encrypted.
MOBILedit Export
MOBILedit Export is an XML file used to export extracted and analyzed data into other applications. You can set Hash protection as well.
At the end of each report is displayed the result of the hash check, possible failures are included.
Cellebrite UFDR
This export file can be exported into and opened by the Cellebrite Mobile Forensics line of products.
Cellebrite CLBX
CLBX is a Zip file intended for export of the phone’s Full file system. This format is supported best with jailbroken iOS devices.
With MOBILedit Forensic and an un-jailbroken iOS device, it is possible to also export to CLBX with a file system that is not a full file system.
CLBX can be exported and opened by the Cellebrite Mobile Forensics line of products.
If you are analyzing the phone via "Specific selection", you need to select "All files" for the CLBX format in the "Files" selection.
Otherwise, CLBX is available when carrying out a full content logical acquisition.
ADB and iTunes backups
MOBILedit Forensic can now create and save ADB (Android) or iTunes (iOS) backups of your devices.
If the ADB backup creation freezes, simply disconnect the phone, restart it, connect it to the PC and the MOBILedit Forensic will request the ADB back up again.
Since the launch of the new iOS 16.1, you must enter your phone passcode when creating an iTunes backup. This is not required in iOS 16.0 and below.
Capture Phone Photos Package
Packaging all evidence taken from the “Camera and screen capture”.
The package can be imported in the "Logical extraction" > "Specific selection" > "Phone photo capture".
This way, you can project the data in the package into a report with additional evidence from the device.