MOBILedit Forensic Editions – Choosing the Right Version

MOBILedit Forensic is available in multiple editions, each designed for different investigative scenarios.
The key difference between editions is not just features, but the level of data you can realistically access from a device.

It can also be delivered with online-activated, USB dongle, or network license versions.

Edition Selection

Use the following decision guide to determine the most suitable edition for your investigation scenario.

Quick Guide

• Unlocked device + basic needs → Standard

• Unlocked device + full analysis → PRO

• Locked / restricted device → ULTRA

• No device / account-based investigation → Cloud

Step 1: Do you have access to the device?

• No → ➜ Use Cloud Forensic

• Yes → Continue to Step 2

Step 2: Is the device unlocked (passcode known or accessible)?

• No (locked / unknown passcode / encrypted)
  → ➜ ULTRA required

• Yes (device accessible)
  → Continue to Step 3

Step 3: What level of data do you need?

• Basic data only (calls, SMS, contacts, media)
  → ➜ Standard

• Application data / deeper analysis required
  → ➜ PRO

Step 4: Are you dealing with any of the following?

• Sandboxed app data (e.g. WhatsApp, Signal, etc.)

• Smartwatch or wearable devices

• Advanced reporting or full analysis

→ ➜ PRO minimum

Step 5: Are there any security barriers or limitations?

• Device partially accessible

• App data not available

• Encryption limiting results

→ ➜ ULTRA recommended

Step 6: Do you need cloud data (accounts, social media, storage)?

• Yes
  → ➜ Add Cloud Forensic (standalone or with PRO/ULTRA)

• No
  → Continue with selected edition

Start Here: What are you dealing with?

• Unlocked device with known passcode? → Standard or PRO may be sufficient

• Locked or protected device? → You will likely need ULTRA

• Cloud data (no device access)? → Cloud add-on

Important: If a device is locked or protected, lower editions may not recover critical evidence.

Single Phone Edition

Designed for low-volume use or basic data access.

Best suited for:

• One-off extractions

• Devices that are already unlocked

• Basic review of user data

Typical users:

• First responders

• Small organisations

• Occasional or low-volume usage

What you get:

• Logical data extraction (where accessible)

• Basic analysis

Use cases:

• Extracting basic data from a known, unlocked device

• Quick review of contacts, messages, and media

• Demonstrations, training, or familiarisation

Limitations:

• No security bypassing

• Limited app data access (Sandboxed apps)

• No smartwatch support

• Limited import/export options

• One license = One device

Not suitable for:

• Locked devices

• App-level investigations

• Evidence-heavy or court-critical cases

Works only when the device cooperates. Not suitable for real investigative work.

Standard Edition

Built for regular use where devices are accessible.

Best suited for:

• Routine examinations of unlocked devices

• Basic investigative workflows

Typical users:

• Entry-level forensic users

• Internal investigations teams

• Organisations with routine device access

What you get:

• Core extraction and analysis features

• Support for common data types

• One license = multiple devices

Use cases:

• Processing multiple unlocked devices in a structured workflow

• Basic evidence collection for internal or administrative cases

• Reviewing common artefacts (calls, SMS, media, contacts)

Limitations:

• No security bypassing

• No physical or advanced extraction methods

• No smartwatch connectivity

• Reduced analytical depth compared to PRO (Due to sandboxed apps)

Not suitable for:

• Security bypassing

• Accessing protected or sandboxed application data

• Advanced forensic analysis

A step up in usability—but still limited when dealing with secured or complex devices.

PRO Edition

Designed for professional investigators handling real-world cases.

Best suited for:

• Most standard investigations

• Devices that are unlocked or partially accessible

Typical users:

• Digital forensic investigators

• Law enforcement units

• Corporate investigation teams

Use cases:

• Full analysis of unlocked or partially accessible devices

• Extraction of application data, including sandboxed environments (where accessible)

• Smartwatch and wearable investigations

• Building structured reports for evidential use

What you get:

• Advanced app data extraction and analysis (SPL dependent)

• Smartwatch and wearable support

• Smart Screenshots and enhanced reporting

• Selected non-regulated security bypassing methods

• Support for deeper file system access (depending on device and conditions)

Limitations:

• Advanced/decrypt-level bypassing not included

• Access to secured data still depends on device state (e.g. passcode known/SPL)

Limitations in practice:

• Access depends on device state (e.g. passcode known)

• Advanced security barriers may prevent full data access

Covers the majority of investigative scenarios—but has limits when device, OS or app security becomes a barrier.

ULTRA Edition

The most advanced edition focused on overcoming modern mobile security.

Best suited for:

• Locked or encrypted devices

• High-priority or complex investigations

• Situations where standard methods fail

Typical users:

• Specialist forensic units

• Advanced investigators handling complex cases

• Organisations dealing with high-risk or high-value evidence

What you get:

• Advanced security bypassing capabilities

• Decryption of physical images

• Chipset-based and low-level extraction methods

• Expanded device and OS support based on ongoing research

Use cases:

• Investigations involving locked or encrypted devices

• Recovering data where standard methods fail

• Decrypting and analysing physical images

• Chipset-level and low-level data acquisition

Considerations:

• Requires technical expertise

• Subject to dual-use regulations under EU law

When the device does not cooperate, ULTRA is the difference between partial data and full access.

Cloud Forensic (Add-on or Standalone)

Focused on acquiring and analysing data from cloud services, either independently or in combination with device-based extraction.

Best suited for:

• Investigations centred on user accounts and online services

• Cases where device access is limited or unavailable

• Expanding evidence using data beyond the physical device

Typical users:

• Investigators working with account-based evidence

• Cases involving social media, email, and cloud storage

What you get:

• Acquisition from services such as Google, Facebook, Instagram, and others

• Multiple acquisition methods:

  • Using account credentials (supports MFA where available)

  • Importing previously extracted authentication tokens

  • Extracting tokens or generating reports from a connected device:

    • Android (Root required)

    • iOS (Encrypted iTunes backup)

• Full reporting and analysis of acquired cloud data

Use cases:

• Acquiring data directly from online services

• Extending investigations beyond the physical device

• Using credentials, tokens, or device-assisted methods to access accounts

• Correlating cloud and device data for full timelines

Limitations:

• No MFA bypassing or account takeover methods

• Access depends on valid credentials, tokens, or lawful access

• Does not perform traditional physical device extraction

Key dependency:

• Requires appropriate legal authority and valid access methods

A powerful extension to mobile forensics—often where critical evidence lives—but dependent on lawful access to accounts or tokens.

Contact our business team to discuss your requirements.