AccessData Announces Mobile Phone Examiner Plus™ (MPE+™) Support of iOS® 7 Devices

Global News

25
Sep
2013

Editor

Newest MPE+ Software Release Features Enhanced iDevice Support to Perform Logical Acquisition of any iOS Device

AccessData Group, the leading provider of digital forensics, cyber security and e-discovery software, today announced the Mobile Phone Examiner Plus® (MPE+) v.5.4 software release. With this release, AccessData’s market-leading mobile forensics solution adds iOS 7 devices to its extensive list of supported devices.

In addition, this MPE+ release introduces several new advances in iOS device handling. Mobile forensics examiners can now unlock devices using keys that can be found in any computer where the device was previously synced, and examiners can enter known passwords directly into the MPE+ interface to decrypt data on the fly. Furthermore, if an iTunes® password is not known, MPE+ can still obtain and extract application data, all caches related to each App Store application installed on the device, MMS, SMS, Contacts and more.

MPE+ v.5.4 also introduces new iLogical™ Enhanced iDevice Support for all Apple iOS devices. The iLogical support facilitates the acquisition of any compatible iOS device, ranging from iOS v1.0 to the most recent iOS devices, allowing examiners to acquire many extended sources of data beyond what most logical products are able to deliver. This support is now obtained with or without iTunes® installed on the forensic machine.

In addition to acquiring standard user data from an iOS device, the iLogical Enhanced Support communicates with a number of other services running on the device, including those preloaded from Apple, but also third-party services installed by jailbreak and other hacking tools. As a result, iLogical support can acquire a significant amount of data up to and sometimes including the entire raw file system. It can even acquire some data when backup encryption has been enabled by the device’s owner, but the backup password is not known.

“This new MPE+ software release provides forensic investigators the tool to bypass most challenges faced when recovering evidence from iOS devices,” stated Lee Reiber, Vice President of Mobile Forensics for AccessData Group. “With the improved support of our iLogical capability, no other tool on the market can extract more logical data from these devices than the MPE+ solution.”

Depending on the iOS® version running on the device, MPE+ software will auto-detect the different capabilities that may be available and present investigators with a list of data types that can be extracted. This list can include:

• Apple Backup Service: The Apple Backup Service capability extracts much of the device’s user data by creating a backup of the device, in a similar way that iTunes® creates a backup. The Apple Backup Service capability is the ONLY capability that requires a backup password.
• Application Network Usage and Diagnostics: This capability provides a diagnostic dump of applications installed on the device, and a day-by-day breakdown of network bandwidth usage in kilobytes.
• Device Diagnostics: This capability will provide battery cycle information, WiFi, HDMI, IO Registry and more.
• Entire File System: If the target device has had a jailbreak installed, this capability may be available if the jailbreak tool that was used created this service.
• Extended Third-Party Application Data: This includes downloaded page caches, user credentials, databases of friends, accounts, and more. This capability is available even if backup encryption is enabled and the password is not known.
• Extended User and System Databases: This includes user information such as SMS, MMS, Contacts, Voicemail and more. When used, this capability delivers information unencrypted, even if the backup password of the device is not known.
• User Media Folder: This can include iTunes music, photo reel and album, iBook downloads, purchase information, and personal recordings. This capability is available even if backup encryption is enabled and the password is not known.