Files & Acquired data folder structure

Report output folder

Within every report output folder there are a number of files and directories depending on what report output formats were chosen. This list does not cover everything but is shown as an indication of the most popular export formats:

• summary_short.txt - Overview of extracted file

• summary_full.txt - Full detail of all the actions and processing of files during extraction

• report_configuration.cfg - how the report was setup and what was requested

• cloud_credentials.json - contains cloud tokens

• mobiledit_export.xml

  • mobiledit_export_files

• mobiledit_backup.xml

  • mobiledit_backup_files

• report.ufdr

• Report_long.html

  • Report_index.html

  • html_files

  • (All might be compressed to one archive file)

• Report.PDF

  • pdf_files

  • (All might be compressed to one archive file)

• Report_excel

  • excel_files

  • (All might be compressed to one archive file)

• adb_backup

• apple_backup

• files - MOBILedit Forensic files and device or import files

  • acquired data - files extracted from the device

  • wizard_screenshots - screenshots of MOBILedit Forensic

  • icon.png - phone picture or import icon

  • investigator_logo.png - user imported image

The acquired data folder can potentially contain a large amount of data and also a number of sub-directories. These are outlined below:

You might need this information in case you want to browse the extracted data (image, audio, and video files) without opening the report. It also might include little differences based on the phone you were extracting (Android or iOS).

Files and long folder paths

All the files in the report subfolders are stored in a tree structure that is based on the original data in the phone, so advanced users might be able to get any files for additional analysis or any other purpose.

When copying the subfolders (or the whole report folder) please be aware that the full paths might be longer than the usual limit of 260 characters still present in the Windows shell. It means that while the file system supports paths as long as 32000 characters (and this is true for many older versions of MS Windows), the standard copy/paste or drag and drop file operation will not work well with these folders. In Windows 10 it seems to be finally addressed, and in other cases, you might use either the MOBILedit Forensic File manager, a third-party file manager (such as Total Commander 64), or a zip/archive file manager that can handle these long paths.

Impact of Changes in the Acquired Data Directory

The acquired_data directory contains extracted files from the device and serves as the foundation for reports and backups. Any modifications to this directory after extraction can affect reports and backups in the following ways:

1. Backup Integrity: MOBILedit backups reference files within acquired_data. If files are altered, removed, or replaced, the backup may not import correctly due to mismatches between the backup index and the actual file structure.

2. Report Discrepancies: Reports are generated based on the state of the acquired_data directory at the time of extraction. If changes occur after report generation (such as opening a SQLite database and merging WAL files), the report may no longer accurately reflect the extracted data.

3. Modified Timestamps: Opening or modifying files within acquired_data may change their timestamps, making forensic verification more difficult.

4. File Dependencies: Some files referenced in reports, such as logs, databases, and extracted application data, may behave differently if opened in external tools. SQLite databases are a key example where the WAL file may be merged into the main database, affecting subsequent analysis.

To maintain forensic integrity, it is recommended to work with a copy of the extracted data instead of modifying files directly within acquired_data.

For more details on MOBILedit output structures, refer to the Outputs, Reports, Exports, and Backups section