Settings
In settings, you can customize and edit various useful details such as "Global Settings", "Investigator Details" and "Logging".
To save changes and exit, click the “Tick” next to “OK” or to exit without saving changes click the “Cross” next to “Cancel”
Global Settings
Under “Global Settings”, you can change the language of the user interface, set whether to display the MOBILedit Forensic product logo in the reports, and set the preferred path to the Temporary folder.
For the user interface, we currently support Czech, English, Spanish, Portuguese, Slovak, Japanese, and Chinese.
The Temporary folder is used for saving files in advance preparation of the output analysis report and the folder location should be on an SSD rather than an HDD for quicker write speeds. It is also better to have the temporary folder located on the system disk and use a separate SSD for extracted data.
Regardless of which drive the temporary folder is located in, you will need to ensure that you have as much space available as there is actual data used on the connected device or imported file. For example, if the temporary and report output folders are located on the same drive as you only have one drive and, the device you are examining has 60GB of used data, then it is recommended you have at least 120GB on the workstation drive. Therefore, where possible, it is recommended to have separate system and data drives on your workstation.
Keep in mind that the language setting in "Global Settings" does not affect the report language.
Investigator details
In the "Investigator details" section, you can fill in the investigator details that will be displayed by default in each report created.
There is also an option to upload a logo for your organisation.
Logging
MOBILedit Forensic includes options to log information that can help in resolving potential software issues.
We call it logging, and currently have four levels of logging. Each of these can help to understand the situation in different scenarios that you may encounter, whilst using the software:
Off - Logging is disabled, no data is stored.
Basic - Contains device identifiers without personal data.
Detailed - Contains Basic log-level data and device communication data. These may contain some personal data.
Debug - Contains Detailed log-level data and status information within MOBILedit Forensic. These may contain some personal data.
Automatically created Crash Dump files are also available.
Crash Dump - Contains crash status information only, without personal data. Crash Dump files are created automatically.
The default directory location for the saving of logs is “C:\Users\[username]\Documents\MOBILedit Forensic”.
The user can set one of the four log levels via Settings in MOBILedit Forensic:
Within the same folder where you find the log files, you will also see the following files:
Summary_full.txt
File summary_full.txt contains all information that was presented on the screen in the log window on the left-hand side of the MOBILedit Forensic user interface whilst extraction or analysis is in progress. This includes all processes and includes file paths from files copied from the phone.
Summary_short.txt
In the summary_short.txt there is the overview info of the extraction phase, together with a list of items that might be missing in the report, such as skipped or inaccesible folders. The contents of this file are also included in the HTML and PDF reports in the Data Extraction Log section.
Time_profiling
This can help us determine how long the MOBILedit Forensic program has been working on a particular process. This is particularly useful if the extraction seems to be stuck.
MainDrvMan.log
Contains all information about communications with devices from the driver communication.
At Compelson we believe it is imperative to protect our customers' privacy regarding the potentially sensitive content obtained from mobile device data. We are aware that the user may share personal information with us by sharing log files. Our processes are strict when it comes to handling shared customer data, and we keep it confidential at all times. The data is only used for the purpose agreed with the customer and is immediately destroyed once the reason for the use of the data has expired. Likewise, we can arrange a mutually signed NDA if necessary.