Data - Applications

Applications

Application data – retrieves and processes data of applications. Results of the app analysis are shown in the reports, and the raw application data are also stored in the export folder, which makes additional processing and analysis possible.
All applications – will process all available application data from the phone.

Let me choose – if selected then when you press 'Next' to continue, it will show a list of all apps and you will be able to select only the ones that you want to process.

Deleted data – turns on a recovery of the deleted application data.

Download referenced files - download the referenced files from the chat message stored online.

Advanced data extraction

Advanced data extraction is a method that runs an exploit to bypass application sandboxes and extract data. It works on many apps, is safe and depends on security patch levels lower than October 2024.

To find more about the Advanced data extraction methods, read here.

App downgrade feature

"App downgrade" will downgrade the installed app to a previous version where the app is exporting data to the ADB backup. Once the app data is extracted, the original app is reinstalled on the device.

This procedure carries some risk.

To find more about the App downgrade feature here.

Example of applications report:

iOS applications

In the applications section of the report, it is possible to see which screen on the device the application icon appears. It is indicated by a number with the leftmost screen being “Screen Index 1”.

Additionally, in the head of the report section for a particular application, the permissions granted by the operating system for that app are shown. The permissions are as “allowed since” or “denied since” and the timestamp.

Hidden or Password-Protected Apps (iOS)

Since iOS version [insert version number], Apple has introduced the ability to hide or password-protect apps. Where applicable, MOBILedit Forensic detects and reports this status for each relevant app, clearly indicating in the report if an app was hidden or protected at the time of extraction.

Android applications

In the head of the report section for a particular application, the permissions granted by the operating system for that app are shown.