Mobile Phone Forensics

Ⅰ. Product Summary

Forensic Express mobile phone forensics software is a mobile phone forensics tool that integrates functions such as extracting, analyzing mobile phone data and generating reports, This powerful 64-bit application uses a combination of physical and logical data acquisition methods, which can support mobile APP analysis and restore deleted data. The generated report is clear and clear, and can process multiple phones at the same time, supporting multiple latest mobile data Extraction, the user interface is simple and easy to use.

Forensic Express forensic mobile phone data recovery can provide more practical functions than other tools, and is cost-effective. It can be the only tool in the laboratory, and its data compatibility can also be used to help enhance the functionality of other tools. If connected to Camera Ballistics, Forensic Express can even analyze the source of the photos in the camera.

Ⅱ. Functional features

l Multi-function integration is used to extract mobile phone data

With Forensic Express, you can extract all data from phone with just a few clicks. Including deleted data, call logs, address book, text messages, multimedia messages, files, events, notes, wireless networks, account passwords, memos and application data, such as Skype, Dropbox, Evernote, Facebook, WhatsApp, Viber , Signal, etc.

Forensic Express automatically uses multiple communication protocols and advanced technologies to obtain maximum data from each mobile phone and operating system. Then it combines all the data it finds, deletes duplicates, and presents them all in a complete, easy-to-read report.

l Physical data collection and analysis

In addition to advanced logical extraction, Forensic Express can also provide physical data collection for the Android system, allowing you to extract physical images of suspected phones and clone them accurately. Physical analysis allows you to open the image file created by this process, or use JTAG, chip-off or other tools to recover deleted files and all other deleted data.

l Advanced APP analysis function

The use of APP to communicate and share is rapidly developing. Many apps are released or updated every day. Obviously, APP analysis is crucial to recover as much evidence as possible. This is the most powerful point of Forensic Express. We have a strong research team for APP analysis functions. Make sure that you can recover the data of each APP as much as possible, especially the deleted data. The meaning of the data will be analyzed, and they will appear in the form of time-on-line memos, photos, videos or information, no matter which APP has been used or sent them.

l Recovery of deleted data

The deleted data is usually the most valuable information in the phone. It is often hidden in the APP. Our special algorithm digs deep into any data found in databases, invalid pages, and cached files that are still on the phone. Forensic Express can retrieve the deleted data and put it in the report.

l Detailed and orderly report

A large amount of data content is reflected in refined reports, which are customizable, easy to read, concise and professional. An upgraded report configurator allows you to precisely define the data extracted from the phone and the appearance of the report. Each report will be divided into several parts, marked with icons, pictures, and highlighted relevant data, so that you can quickly locate the evidence. A complete, configurable and complete list of all events with time stamps is displayed on the timeline, and messages can be filtered by the name of the conversation or contact.

The report is compatible with PDF, XLS or HTML format, and you can generate a report format compatible with other data analysis tools used in your laboratory, such as UFED.

l Password cracker with GPU accelerator

By using our password and PIN code cracker, you can gain access to the backup data locked in your phone. The password can be cracked by dictionary attack using our built-in dictionary, or you can use your own dictionary for other languages. The password cracker uses GPU acceleration and multi-threaded operations to achieve the fastest speed. Although the hardware encryption running on the iOS system makes it have a good data protection function, Forensic Express can penetrate this protection through the locking method, thereby recovering the data.

l Parallel data extraction from multiple mobile phones and 64-bit operating system

The new 64-bit operating system makes it more stable and has the ability to analyze massive amounts of data. It can analyze apps with thousands of messages, photos, and other content, and can retrieve several mobile phones at the same time. Speed up your investigation process by extracting multiple phones at the same time, and generate multiple output formats for each phone. All you need to perform this job is a USB hub, cable, and a sufficiently powerful computer. In this way, you can complete a week's work overnight, greatly improving your work efficiency!

l Easy-to-use user interface

Forensic Express uses a straightforward and clear user interface, each step is very simple, and there are clear instructions.

l Use lock file method to bypass IOS password

Although iOS has well protected running data through hardware encryption, Forensic can retrieve data through this layer of protection. It supports importing locked files found on the suspect’s computer. When your iOS device is connected to the computer and authorized by entering the password, the computer will generate these files. Forensic will guide you how to obtain these files, if you import them to your forensic computer, then you can retrieve all the data from the phone, even if the phone has been locked with a password.

l Real-time visual data

This new feature allows you to browse and retrieve the contents of the mobile phone in real time before the batch data extraction starts.

l Bypass the PIN code through the SIM card cloning tool

This function does not require the PIN code of the original SIM card of the suspect mobile phone. Now you can clone the SIM card, create a new SIM card with any ICCID, and then format the new SIM card for next use.

l Filter results to find data quickly

You can use keywords, contacts, time, etc. to filter the collected data to speed up data discovery and make the report more concise and effective.

l Real-time update of data

Every 2 to 3 months, the manufacturer will update the software analysis program to apply the analysis of new APPs on the market.

l Generate multilingual reports

You can customize the reports according to your own preferences, or translate them into your common language to meet the standards set by the law

l Supported phone types

Support various brands on the market equipped with common operating systems such as iOS, Android, Blackberry, windows, Symbian (Symbian) and other mobile phones, the software can also handle many feature phones without operating systems.

l Message analysis and timeline

Forensic Express can collect messages, even deleted messages, and present them in the form of a timeline according to the time when the phone was sent, and list the sender of the message, what program was used to send it, and what attachments are there

l Mobile phone base station identification

The data of the base station to which the analyzed mobile phone is connected can be obtained. The obtained location of the tower can be viewed separately on the map via the provided link.

l Can be integrated with other tools

The software can be integrated with other tools. For example, MBILedit imports and analyzes the data in UFED and Oxygen, or exports the data to UFED for analysis to help the investigation.

l Android phone password bypass function

For a variety of Android devices, the phone unlock function allows physical image capture, even if the device has a password or gesture protection, it can also bypass the lock screen of many mobile phone models.

l Face matcher

Face Matcher can quickly analyze a large number of photos in the phone. Let the human face matcher find the correct photo on your phone or computer.

l Photo recognition

The module automatically locates and recognizes suspicious content in photos, such as weapons, drugs, nudity, currency, and documents. The photo recognizer uses artificial intelligence and mechanical algorithms to quickly analyze an unlimited number of photos. This feature will save you a lot of time by manually searching for key evidence in a huge photo database. Each photo is placed in its own specific category, and suspicious content is easily presented in a precise report.

l Camera ballistics-scientific image analysis

After combining Forensic Express and Camera Ballistics, you can tell whether the image file in the analyzed mobile phone was taken by the camera of this mobile phone. This process provides a new understanding of the image, such as production, model, GPS, camera settings, mean square error, fingerprint existence results, probability and correlation will be organized into a well-designed PDF report, suitable for submission as evidence.

l Cloud Analyzer

Can analyze iOS device backups stored in iCloud. The cloud analyzer will locate all iOS backups in the cloud, and let you choose which data you want to extract, analyze and generate reports. More directly discover key hidden information from the device cloud, such as deleted data and APP data. Forensic Express can support all versions of iOS, including two-factor authentication.