Empty or incomplete reports
Understanding Empty or Incomplete Reports
When working with MOBILedit Forensic, you may encounter situations where your report appears empty, incomplete, or contains blank pages. This document explains the common causes and solutions for these issues.
Blank Pages in Reports
When a blank page appears in your report, it indicates that MOBILedit couldn’t find any data to recover in the selected category. The reason for this is that MOBILedit needs to differentiate between data that was not present and situations where a malfunction prevented MOBILedit from extracting it.
Memory and Performance Issues
The PDF report generator requires a lot of RAM, especially when processing a large number of photos or videos. It is recommended to have at least 16GB of RAM and at least 32GB of free space on the system disc for temporary data swapping. If you find that this is still not enough, we recommend the following solutions:
Choose ‘PDF Report - Multiple files’ so the final PDF is not too large, and the generation process doesn’t require as much memory. It will split the report into multiple PDFs by data categories.
Generate HTML, Excel, or UFED formats.
If there is a large number of images, we recommend turning them off for the first round of exporting and selecting the MOBILedit Backup together with PDF Report - Multiple files. In the second round, you can open the MOBILedit Backup file without needing the phone and run only the media analysis. By generating the MOBILedit Backup format, you can repeat data parsing without having the phone itself.
Please find more info on all the possible report formats here.
iPhone-Specific Issues
For iPhones, empty sections in the report are often related to the creation of the iTunes backup. The important thing is to enter the iTunes backup password so the iTunes backup can be created, either the user-set password or MOBILedit Forensic will set it to 123. When a password has been set, it means the backup is encrypted and will hold more data.
If this fails, is cancelled, or you don’t know the password, and the iTunes backup is unencrypted, there will be less information in the final report.
This also relates to SMS, MMS, and iMessages. To retrieve deleted messages, it is necessary to have the iTunes backup properly obtained with the correct password.
Password toolbox capability in MOBILedit Forensic PRO is explained here.
If you don’t know the password, you would need to use MOBILedit Forensic ULTRA and the Password toolbox. Password breaking on iTunes backups is slow, as it utilises the CPU and one password per second per CPU thread. E.G. 4 threads equals 4 attempts per second.
Application Analysis Empty
If the application analysis is empty, it may be that the application will be sandboxed. You will have to use Security bypassing or advanced methods to extract data.