Data from Folder/ZIP & Import file system
Data from folder
Importing a folder into MOBILedit Forensic will analyse the folder for media files and related data, such as photos and videos and all associated metadata such as GPS locations displayed in maps, timestamps, camera models, etc.
A wide range of media formats is supported besides standard JPG, PNG, GIF, AVI, MP4, MKV as we also analyse RAW and HEIF/HEIC with H.265.
Also, audio files and documents can be analysed.
MOBILedit Forensic also analyses videos and can create storyboards of videos, meaning an investigator can include this in the report and readers can see an overview of the video content without the need for playback.
A timeline of all media files can be created.
If Camera Ballisticsis installed and integrated with MOBILedit Forensic, you will obtain information about whether the photo was taken using a particular device’s camera.
For importing folders containing file systems, please see below.
This import option is NOT available for the Single Phone license of MOBILedit Forensic and is only for the Unlimited license editions of MOBILedit Forensic.
Data from ZIP file
Importing a Zip file into MOBILedit Forensic will analyse the folder for media files and related data, such as photos and videos and all associated metadata such as GPS locations displayed in maps, timestamps, camera models, etc.
A wide range of media formats is supported besides standard JPG, PNG, GIF, AVI, MP4, MKV as we also analyse RAW and HEIF/HEIC with H.265.
Also, audio files and documents can be analysed.
MOBILedit Forensic also analyses videos and can create storyboards of videos, meaning an investigator can include this in the report and readers can see an overview of the video content without the need for playback.
A timeline of all media files can be created.
If Camera Ballisticsis installed and integrated with MOBILedit Forensic, you will obtain information about whether the photo was taken using a particular device’s camera.
For importing folders containing file systems, please see below.
This import option is NOT available for the Single Phone license of MOBILedit Forensic and is only for the Unlimited license editions of MOBILedit Forensic.
File system / Full-file system
If a folder or Zip file contains a full-file system or a file system from a mobile device, it is possible to use the import method for folder or Zip.
File system format is a supported output by other digital forensic software tools and the RAW0 directory in the MOBILedit Forensic report output folder also contains the file system.
To read about the difference between a full-file system, file system and iOS/Android file system structures, please visit this page Full-file system vs. File system (mobiledit.com).
The file system can be imported into MOBILedit Forensic to perform additional analysis using our advanced application support and machine learning modules unique to MOBILedit Forensic.
The file system MUST have the Root data directory and original structure to be analyzed correctly and if not, will only be analyzed for media and associated data.
Once the File system has been imported, it can be analysed using Logical extraction. If you wish to browse the content of the file system or, check the structure before performing an extraction, you can select “Finish” once it is loaded and return to the connection screen, then select “Browse content”.
When importing a file system from Zip you will need to ensure that the root directory is the next level down from the main zip file and that it is not contained within any other zip files.
If the file system is in .tar format, it will have to be unpacked and imported as a folder.
If importing a .zip file that contains a full file system, be aware that Cellebrite CLBX files have .zip extension and CLBX should be imported using the dedicated import CLBX function.
If a CLBX file is imported and analyzed using ZIP file import, the extraction and analysis will not be possible and the report will be empty.