Files & Acquired data folder structure
Report output folder
Within every report output folder there are a number of files and directories depending on what report output formats were chosen. This list does not cover everything but is shown as an indication of the most popular export formats:
summary_short.txt - Overview of extracted file
summary_full.txt - Full detail of all the actions and processing of files during extraction
report_configuration.cfg - how the report was setup and what was requested
cloud_credentials.json - contains cloud tokens
mobiledit_export.xml
mobiledit_export_files
mobiledit_backup.xml
mobiledit_backup_files
report.ufdr
Report_long.html
Report_index.html
html_files
(All might be compressed to one archive file)
Report.PDF
pdf_files
(All might be compressed to one archive file)
Report_excel
excel_files
(All might be compressed to one archive file)
adb_backup
apple_backup
files - MOBILedit Forensic files and device or import files
acquired data - files extracted from the device
wizard_screenshots - screenshots of MOBILedit Forensic
icon.png - phone picture or import icon
investigator_logo.png - user imported image
The acquired data folder can potentially contain a large amount of data and also a number of sub-directories. These are outlined below:
Name - In report output folder (with corresponding report category for files) | Content |
applications0 (Applications) | Applications and their data, not user-shared galleries |
applications1 (Extra) | Special content, logs from apps or content providers |
raw0 (Internal) | The accessible phone file system or full file system |
raw3 (External) | File system which is shared with apps, for example, images, music, downloads, user galleries |
raw4 (Multi root) | Access to various storage locations in file manager apps. |
misc | Temporary files, icons, thumbnails, contacts pictures, message attachments |
mtpraw0 (MTP) | Internal storage and SD card. |
You might need this information in case you want to browse the extracted data (image, audio, and video files) without opening the report. It also might include little differences based on the phone you were extracting (Android or iOS).
Files and long folder paths
All the files in the report subfolders are stored in a tree structure that is based on the original data in the phone, so advanced users might be able to get any files for additional analysis or any other purpose.
When copying the subfolders (or the whole report folder) please be aware that the full paths might be longer than the usual limit of 260 characters still present in the Windows shell. It means that while the file system supports paths as long as 32000 characters (and this is true for many older versions of MS Windows), the standard copy/paste or drag and drop file operation will not work well with these folders. In Windows 10 it seems to be finally addressed, and in other cases, you might use either the MOBILedit Forensic File manager, a third-party file manager (such as Total Commander 64), or a zip/archive file manager that can handle these long paths.