Live Update Packages

Below is a list of packages that can be updated in the Updates section from the main “Home” screen menu. All the following packages give you the most up-to-date advanced options and are essential for extracting as much data as possible. We are continuously working on updates for MOBILedit Forensic, so whenever you receive an update notification install all the newly released packages.

Program update

Many features come pre-installed with MOBILedit Forensic and when you first start the program up and it is connected to the internet, it will connect with our server to see if there are any updates

If there is a new version of MOBILedit Forensic you will be notified on startup, either a release version or, a beta version if you are registered as a tester.

App downgrade

Some application manufacturers restrict what data can be acquired from their apps. This is especially relevant for non-rooted phones.

To bypass this restriction you can use the App downgrade feature in MOBILedit Forensic, which will downgrade the app to a version in which it was possible to obtain the data directly from the app.

You can read more about App downgrade here.

The App downgrade feature must be activated in the specific selection.

Bluetooth

The Bluetooth package is specifically for connecting to some Smartwatches and uses the Bluetooth LE protocol.

Cell towers

Data about cell towers the subject phone was connected to can be obtained. However, this is only possible with rooted Android phones and has further limitations. Cell tower locations can be viewed on on an interactive map that can be accessed through the provided link in the report.

When the Cell tower package is installed, Cell tower analysis is automatically included as an analysis category in the full content or, can be chosen as a category in specific selection.

Clouds

Downloading and installing the Cloud package installs new cloud services and updates for existing cloud services.

A subscription for MOBILedit Cloud Forensic must be linked to the license key to see and update this option.

EDL

EDL package consists of programmers that are essential for EDL hack. In future releases, this package will be removed and replaced by one that will be the same for all of these hacks.

File exclude list 

This feature allows the user to filter regular and unnecessary files. The filtering is based on hashes that the software gathers from NIST as a part of NSLR packages for Android and iOS.

Image processing

The image processing package includes all the functionality needed to run analysis modules such “Face matcher” and “Photo recognizer”

Read more about Face Matcher or Photo Recognizer 

iOS screenshot support

This package facilitates communication with iOS devices and captured phone photos enable you to take a screenshot of the iPhone's display.

Android OS devices do not require an additional driver as they are supported within the main MOBILedit Forensic program for Camera and screen capture.

Malware Detection 

Malware detection lets you scan the extracted application APK files for malware and the process is based on the Yara project.

MTK

Live updates to offer support for security bypassing improvements and additional devices that use MTK.

Recovery images

Recovery images support the function of the “Connect recovery” option in Security bypassing. This feature allows you to flash a custom recovery like TWRP, allowing further modifications towards rooting a device.

To read more about recovery, click here.

Rooting

Within MOBILedit Forensic there is a temporary rooting option and it is essential to have the latest update version installed to get access to more devices.

Scripts

Scripts provide essential updates for APK analysis and other functionalities within MEF. These updates ensure that the scripts used are up-to-date, enhancing the accuracy and efficiency of data analysis.

Security bypassing

The security bypassing live update is the foundation on which all other security bypassing methods depend. It must be installed to install other security bypassing live updates.

Spreadtrum

A special boot for devices with Spreadtrum chipset. The possibility of creating a physical dump of internal memory.

Security bypassing dependencies
Installing the Spreadtrum package without selecting or ensuring that the Security Bypassing package is installed and updated, MOBILedit Forensic will alert you there are required dependencies.

It will not install.

If you have additional updates selected for installation that do not require dependencies, they will be installed, just not those that require dependencies.