MOBILedit backups

MOBILedit backup XML

This is the MOBILedit Forensic native backup format which can be selected in the output format screen in MOBILedit Forensic.

When you perform an export, you can select “MOBILedit backup XML” as one of the options. Read how to create one here.

This will generate a “mobiledit_backup.xml” file that can be set to include “all data” or, data the “same as report”.

This backup can be reimported and processed using a different analysis and report configuration.

Select the “MOBILedit backup XML” option and Windows Explorer will open. Then select the backup file with an .xml file extension, this maps the files in the backup “phone_files” directory.

Once imported, the backup will load and the backup hash value will be checked. Then it will be initialised ready for processing, checked for any encryption, and after which, the process of importing it is complete.

Depending on the backup size, the import may take some time to load and you can continue working on other devices or imports while it is loading.

This shows the correct import of a decrypted MOBILedit Forensic backup.

All unpacked MOBILedit XML backups will be unencrypted. Encryption is only available with a backup package.

Once imported you can choose what to extract and analyze.

To read more about the MOBILedit backup XML options and what data it contains, please read Outputs - reports, exports and backups.

This import option is available for all the license types of MOBILedit Forensic.

MOBILedit backup package

The MOBILedit backup package contains the MOBILedit backup XML. It is created when choosing the output format option to pack the backup into one folder. It can either be encrypted by the operator or, not. If encrypted, an option to enter the password will be presented upon import.

Select “MOBILedit backup package” option and Windows Explorer will open. Then select the backup file with a “.mobiledit” file extension, this maps the files in the backup “files” directory.

Once imported, the backup will load and the backup hash value will be checked. Then it will be initialised ready for processing, checked for any encryption, and after which, the process of importing it is complete.

Depending on the backup size the import may take some time to load and you can continue working on other devices or imports while it is loading.

Importing an unencrypted packed backup will appear like this in the logging window, once the process is complete.

If the backup package is encrypted, you will see a popup window after the backup is loaded and you can enter the password that was set during export. If the correct password is entered, processing will be complete.

To read more about the MOBILedit backup XML options and what data it contains, please read Outputs - reports, exports and backups.

This import option is available for all the license types of MOBILedit Forensic.

Deep hash check

Once the backup has been imported and you select “Next”, you will see the options for “Logical extraction” and “Deep hash check”.

The “Deep hash check” performs a search to check the integrity of the back up data by reviewing every file hash value in order to support the chain of custody. When the backup is originally created, an Excel file is created with all the original individual file hash values and is saved in the report output folder.

Error messages

If errors appear when importing, you should note them and contact technical support if necessary. Common error messages are:

If the “Backup hash check: Backup header element is missing” error appears, the backup has been modified after it was exported. Usually, this is due to incorrect handling of the backup after initial export, for example, copying, pasting, compressing and extracting.

If an error occurs whilst parsing the backup, a note should be made of the file path(s), and the file manually checked. Again, this is usually due to the incorrect handling of the original backup file.