Outputs - reports, exports, and backups

We’ve dedicated a big effort to refining reports, so they are customizable, easy to read, concise, and professional. An enhanced report configurator allows you to define exactly which data will be extracted from the phone and how the report will look. Each report is divided into sections, labeled with icons, pictures, and highlighted relevant data so you can find evidence quickly. A complete, configurable, and comprehensive list of all events with a time-stamp is shown on a timeline, and messages can be filtered by conversation or by contact names.

Reports are available in PDF, XLS, or HTML formats, and you can generate data exports compatible with the other data analysis tools you use in your lab, such as UFED.

Create multiple formats of reports and exports after extracting data from a phone, each customizable to your specific needs. To continue you must select at least one format.

All the extracted files, data analysis reports and exports are in the main report output folder. By default, this folder has a name consisting of the phone name and the date and time the processing started. For example, “Samsung SM-J530F (2021-11-24 16h46m31s)”. You can change the export name and the destination folder in the relevant screens within MOBILedit Forensic.

Filtering only applies to final reports. Please, keep in mind that other outputs may have their own settings. UFDR will not be affected by filtering and data selection however, MOBILedit backup has specific settings that can influence the amount of data backed up.

All report formats are human-readable and can be opened using supported web browsers, PDF viewers, and Microsoft Office applications.

For each output format option selected additional storage space will be required.

The structure and contents of the folder depend on what is extracted and which output formats have been selected plus, there are a few files that are related to the extraction and analysis in general.

HTML Report

An HTML report format can be opened using a chromium based web browser (we recommend using Google Chrome, Mozilla Firefox, or Microsoft Edge). This format does not include a full backup of phone data - to create a full backup please use the MOBILedit Backup export format as well.

HTML reports are saved in two ways – one is the whole report stored in one file, Report_long.html, and the other is the full report divided into multiple files (one file per main report section) and the index to the whole report is Report_index.html. The reason for having an “index and a “long” version is that the reports might be too big to open in some browsers.

It is possible to choose whether to pack (compress) the HTML report or not.

All the files requested to be analysed and files used to compile the report are stored in the folder html_files. This facilitates the opening of report content for review. This folder belongs specifically to the HTML reports and if you wish to share the report, all of these folders and files should be kept together.

Selecting this option will automatically generate the two types of HTML file into the export folder.

Report_long.html

the full HTML report file with all content
please note that this file can be large (100MB and more), therefore web browsers may have problems opening or viewing the file if such a large amount of data was extracted from the phone - if you experience problems while opening the HTML file, use the Report_index.html file instead

Report_index.html

HTML report split into multiple HTML files based on sections

PDF Report

The PDF report is similar to the HTML report in structure and is named Report.pdf. In this report, all images are stored inside of the PDF in a suitable resolution and the PDF file itself can be used for sharing with other investigators to review.

The PDF report format can be opened using your PDF viewer or editor (we recommend using Adobe Acrobat or Adobe Reader).

If you experience any difficulties opening links to associated files within PDF documents, please ensure you are using Adobe before contacting support.

Within the PDF are links to files stored in the folder named pdf_files. This folder contains the extracted files including images in their original resolution.

You can choose from two types of PDF reports - Single File or Multiple Files. Your selection will be automatically generated in the export folder.

Single file

contains the full PDF report file with all extracted content
please note that this file can be large (1GB and more), if you experience problems while generating or opening the PDF file due to a large amount of data, use the Multiple files option instead

Multiple files

The PDF report is split into multiple PDF files based on sections

Where you have a device with a large amount of data and are requesting Full content analysis or, many Specific selection options, it is better to use the PDF Report – Multiple Files option, which generates one PDF per report category section. The files start with numbers are numbered according to the section number within the full report. E.G. 01_Screenshots_of_User_Settings.pdf, 02_Summary.pdf, etc. All the PDF file links point to the files in the pdf_files folder.

Please note that in case the single PDF file is about to be really big, it will be automatically split into multiple files to prevent loading issues and also to ensure the faster creation of the reports. This will typically happen when the extracted device contains a lot of photos or videos (media files in general).

MS Excel report

MS Excel report can be opened using the Microsoft Excel application (we recommend using Microsoft Excel 2010 or newer).

This report format generates multiple files, according to the phone content and are saved as .XLSX files. All of the data in this report is in the .XLSX and there is no folder containing additional files like there is with the PDF or HTML reports. If you need to locate the referenced files they should be taken from the other report folders.

File name examples are xlsReport.xlsx and xlsReport_SIM Card.xlsx.

If you wish to do a custom analysis of the results .XLSX can be a useful format, especially if you want to combine several device reports in one file.

Export & backups

All export formats are machine-readable and can be used to process extracted data in other applications or to make a full backup of any device which can be later opened and analyzed without having the device live connected again.

MOBILedit Backup

MOBILedit Backup XML contains a full phone data backup, without analysis and, can be opened, browsed, and analyzed again, as well as archived for future use. This is useful if you are not able to acquire a physical image, an unencrypted readable physical, or the device is returned to its owner or other remote storage location.

The complete filesystem structure is saved as mobiledit_backup.xml with all referenced files from the device or import stored in the backup_files folder.

When reimporting, further analysis can be done with different report setup options or with a newer version of MOBILedit Forensic. It then is possible to use the original data backup with improved analysis or newly introduced features.

You can set packing and password protection for Backup. The Hash protection is set automatically when the backup creation was selected. The default hashing method is SHA-256, which is more secure than the MD5.

The master backup hash check is done when you import the MOBILedit backup.

The hash for each file in the backup can be checked by running the deep hash check.

The backup can be packed, unpacked, encrypted or unencrypted.

It is recommended to create an “All data” MOBILedit Forensic backup as it contains all the extracted data from the device and is especially useful and can be used similarly to and in place of a Physical image.

Alternatively, you can select the report to store the same data as requested in setting up the report.

MOBILedit Export

This export format contains all analyzed information from the phone in .XML format and is designed to be used for importing anlayzed data from MOBILedit Forensic to a third party tool. In order to do so, the XML schema must be mapped.

The export file name is mobiledit_export.xml and the related folder with the necessary files is mobiledit_export_files. Within the “files” directory will be media files available to be hyperlinked and opened using the 3rd party software and MOBILedit export.

At the end of each report is displayed the result of the hash check, possible failures are included.

Cellebrite UFDR

This export file can be created by MOBILedit Forensic, exported and then imported into the Cellebrite Mobile Forensics line of products. Read more about how to import a UFDR file back in to MOBILedit Forensic.

This file format is especially useful as currently, MOBILedit Forensic does not have a reader or a viewer for reviewing extracted data to identify evidence. Natively this would have to be reviewed using a PDF or HTML format. The other option is to export to UFDR, review the data in UFED reader, highlight the evidence or required data, and then reimport a physical image or MOBILedit Forensic backup to create a specific selection report containing only the relevant data.

Additionally, the UFDR format is widely supported for import amongst other digital forensic tools.

Cellebrite CLBX

CLBX is a compressed file format file developed by Cellebrite. If created by one of the Cellebrite tools it is likely to be an export of an iPhone’s Full file system, meaning the original device was a jailbroken iOS device.

With MOBILedit Forensic and an un-jailbroken iOS device, it is possible to also export to CLBX with a file system that is not a full file system but a file system of what is accessible without elevated privilages.

CLBX can also be reimported into MOBILedit Forensic as a Cellebrite filesystem backup.

If you are analyzing the connected iOS device via "Specific selection", you need to select "All files" in the "Files" selection for the CLBX format to be present in the output format options.

Otherwise, CLBX is always available as an option when carrying out a full content logical acquisition with a connected device.

ADB and iTunes backups

MOBILedit Forensic can create and save ADB (Android) or iTunes (iOS) backups of your devices.

If the ADB backup creation freezes, simply disconnect the phone, restart it, connect it to the PC and the MOBILedit Forensic will request the ADB back up again.

Since the launch of the new iOS 16.1, you must enter your phone passcode when creating an iTunes backup. This is not required in iOS 16.0 and below.

Capture Phone Photos Package

Packaging all evidence taken from the “Camera and screen capture”.
The package can be imported in the "Logical extraction" > "Specific selection" > "Phone photo capture".
This way, you can project the data in the package into a report with additional evidence from the device.