MPE+ Frequently Asked Questions & Troubleshooting
Contents
1. Click Have Disk and browse to iDEN_USB_Device inf in the iDENAD iDEN folder and click OK and Next When prompted allow the driver to install When the installation completes Device Manager should now list a device called iDEN USB Device under libusb win32 devices Open MPE and tell it to acquire data from a Mobile Device Select the proper manufacturer in the Manufacturer drop down Select the proper device in the Model drop down Click Connect and proceed to acquire the data you want Part way through acquiring data usually after acquiring the phone book progress will stop the phone screen may turn white and Windows will likely try to automatically install another driver Whether this installations fails or not we need to change the driver Open the Device Manager and find the iDEN Device entry Right click the iDEN Device entry and select Update Driver Software Tell Windows to browse your computer for driver software Tell Windows to let you pick from a list of drivers Click Have Disk and browse to Flash_P2K_Patriot inf in the iDENAD FlashPatriot folder and click OK and Next When prompted allow the driver to install When the installation completes Device Manager should list a device called Flash P2K Patriot under libusb win32 devices and MPE should continue and finish the extraction 19 General Troubleshooting Q Why does MPE say my device is not ready or otherwise unable to connect A2. There could be many causes for this e Ensure the device is on and unlocked e For GSM phones make sure a SIM is inserted Use a forensic SIM if possible but do not use a foreign SIM from another phone or provider e The drivers may not be installed or may be corrupt Reinstall the drivers and ensure the device s ports show up in Device Manager e Ensure the phone is supported by MPE and you have selected the correct Manufacturer and Model e Try connecting over a different port e MPE sometimes requires that the device be connected before launching MPE e You can contact AccessData Support at 800 658 5199 if you continue to have problems after following these points Q Why did MPE fail to collect some data from my device A This could be because this device doesn t have any of the specified types of data stored on it which you can verify by looking through the device itself It may also be due to a file system change ina specific firmware version that MPE cannot read parse yet This may also be due to the fact that the phones are full dynamic systems and can essentially choose not to allow a user to collect data If this is the case other methods not involving MPE can be used to report on the missing data You can learn about these other methods in our Mobile Forensics training courses Q Why did MPE pull all the data off my device when I only selected to acquire the File System A If MPE has any difficulty in acquirin
3. normal SIM into a micro SIM Q What is a forensic SIM A A forensic SIM is partial clone of a SIM card that contains enough data for the phone to recognize it and turn on but will not enable the phone s radios and does not contain user data A forensic SIM only has IMSI International Mobile Subscriber Identity and ICCID Integrated Circuit Card Identifier data Q What is the process for acquiring data from a SIM card 1 Ensure the SIM card reader driver has been installed often installs automatically 2 Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager 3 Insert the SIM card into the reader according to the picture on the reader you may see a Smart Card device in Device Manager that shows it is not working but that is fine If the phone uses a micro SIM you can pop the micro SIM into the micro SIM adapter so it fits in the SIM card reader 4 Launch MPE 5 Choose to acquire data from a SIM card and proceed to acquire the data you want Q How do I create a forensic SIM MPE 4 4 Automatically 1 Launch MPE 2 Ensure the SIM card reader driver has been installed often installs automatically 3 Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager 4 Insert the original SIM card into the reader according to the picture on the reader you may see a Smart Card device in Device Manager that shows it is not working b
4. phone manufacturers or their providers Cables Q Why does MPE prompt me for different cables than the ones included in my cable pack A We are now distributing a new cable pack which includes a different number of cables than our old pack However MPE is still programmed to ask for the cables from our old cable pack as more customers have the old pack than the new pack If you would like a like a list that matches cables from our old cable pack to cables in our new cable pack you can contact AccessData Support at 800 658 5199 Q Can I use OEM cables with MPE A Yes It is actually encouraged to obtain any cables chargers and accessories when seizing a phone Q Does AccessData provide cables for every supported device A We provide cables for many supported phones but are unable to provide cables for all supported devices 10 Phones Q What phone devices are supported by MPE A You can view a list of supported devices in MPE by going to Help gt Supported Devices Q Why aren t all phones supported by MPE Why can t MPE collect all the data from every phone A Phones are full dynamic systems rather than static storage devices This means that every phone will store information differently communicate differently with the computer and require a different driver Phone providers have even been known to change the file system structure between different firmware versions on the same model phone further complicat
5. A You can contact AccessData Support at 800 658 5199 at we will find another way to get the needed files to you Q What does MPE mean when it s Initializing every time it starts A MPE is checking for the presence of the Apple physical support files and ensuring they have not been altered or corrupted If the Initializing process fails you will be prompted to re download these files Q Do I really need the Apple physical support files A Only if you want to be able to make physical images of Apple devices Drivers Q What drivers are included on the MPE disc or on AccessData s site A Two driver packages are included on our site and on the disk The AccessDataMobilePhoneExaminerDrivers package contains drivers for most of the supported phones The MPESmartphoneDriver package contains the drivers for Apple devices There are also some additional drivers provided in the MPE Drivers folder on the MPE disc including some older and alternate versions of drivers Q What do I do if I am unable to download the Apple Device Physical Files via MPE A Contact Support at 800 658 5199 to obtain the Apple Device Physical Files another way Q Does AccessData provide drivers for every supported phone A We provide drivers for almost every phone that we support either in the driver packs or on the MPE disc Any drivers that cannot be found in these locations can be found on the internet either from the
6. DF report if the amount of information selected for the PDF is large PDF generation will take some time to complete If you have a lot of data PDF reports may result in an OUt Of MEMOTY EFrOr 60097 ceecccceessececeessececeessececeeseeececsseeeceesseeecsesaeeecsesaeeeseeseeeeeees 21 Multiple subsequent extractions using some devices Windows Mobile Apple and Android may fail 60354 60204 2 f edit ie he 2 ett bel a EG A Ae ed ee eo a Aan ties A Moe Oe Ad 21 If the user inputs the incorrect model number when extracting that incorrect number will appear in the Quick Print Report 60413 uier TAE EEE EAEE AO VAIRO ENE OEA ER 21 After data carving in MPE the Export to AD1 button in the toolbar may be grayed out 21 On a rooted Android phone if you select the Forensic Files Only option all other extraction options are ignored and only the forensic files are pulled 60307 ccccccccessccecssscececsssceeecsseseceesssseesessaaeees 21 Although they are listed in MPE Palm phones running Windows Mobile OS are not currently SUPPORLCO A AE A E E A E Svea ten 21 Mobile Forensics Background Knowledge Q What is the difference between Computer Forensics and Mobile Phone Forensics A In computer forensics the devices that we are imaging are static storage devices this means that with we will obtain the same image every time In mobile phone forensics the devices that we are imaging are full dynamic syste
7. E E a 9 Q What drivers are included on the MPE disc or on AccessData s site eesscesseeerrerressne 9 Q What do do if I am unable to download the Apple Device Physical Files via MPE cccccsseseees 9 Q Does AccessData provide drivers for every supported phone ssessssssisssssssserrrssssesrrennnsssseserreesnssee 9 O ol E E E E E E ase hatin ieee 10 Q Why does MPE prompt me for different cables than the ones included in my cable pack 10 Q Can use OEM cables with MPE eccccsssessseeeesaeeeeeeeeeseeeenaeeeeaaecaaeaesaeeeeaaecaaeseeeeeeaeessaaeseeenenaes 10 1 Q Does AccessData provide cables for every supported CEVICE cccsscccccecsssessseececeesceesesteaeeeeeeseeeees 10 PROE Sinia death aint ath acide nie Aenea nia A Aaa tee ae 11 Q What phone devices are supported by MPE cccccssccsssccsssceessececsseceseeecsseeecsaeceeseecsseeseaeeeeseeeeaes 11 Q Why aren t all phones supported by MPE Why can t MPE collect all the data from every phone dnsiaaha ancaitirs toes vaunty ant anslsbshatenatve uss S E E EA Suede sseabdestea ET TE 11 Q What is the general process for acquiring data from a PHONE cccccccecesssssssecececesessessaeeeeeeseeesees 11 SIM Cards wacceteen stich ain tae abner ede canal cance ead sce ees ee eel eee eee aa 12 Q What are the two black cards I received in the MPE bundle ceccceestecesseteecessseeeeeseeeeeeeeeeeaeens 12 Ox Whats a TOrensi
8. MPE Frequently Asked Questions amp Troubleshooting Version 7 4 5 0 45078 2011 AccessData Group LLC Table of Contents Mobile Forensics Background Knowledge c cccccccessssesssseeececesseseaeseceeecesseseaeaeeeeecssseseaaeseeeeecesseseaasaeeeesens 4 Q What is the difference between Computer Forensics and Mobile Phone Forensics sccccccsseseees 4 Qe What 1S COMA iis sitvdscavicescsactsvesss ee AE EE EEE NEEE Ea EEE AEAEE a AAEE NE AE ETE 4 Q Whatis GSM visscossasscasetectec esio e e E E E Er satiate a 4 System RegUiIremeErntS seses eidean aeaea vs fois e eee e ee eree e eee eaea DEERE 5 Q What Operating Systems are supported by MPE ccssscccccecsssesssseceeececsesesssaeeeeeeeseesesaaeeeeeessesees 5 Licensing MPE 4 3 and Carlier vecccscssceccesivcecdevs use cadssvcecaesuceenevdueces sesvedeadesveecuvevuchesevbubeeasesveceressveeeuvedseeeaeet es 6 Q Why does MPE ask for an activation code cccccccccesssssssececececessesseaececeescesseeaaesecesecessesaaeeeeeeesesaes 6 Q Whereds my GSM license located sescccesceess2 szqustea gecseesexsececcleeseus sgaseatea Bessseeaseasmen eaned baz ctenebeessenceaee 6 Q What if can t tind Mmy GSMINICENSE sci ccciceedste8 caceceseeeesdevenncoeesdebtedetayneacs sd ebeedebemncestsucnteceeasieeceuvesteters 6 Q Does my computer have to be connected to the internet to activate deactivate my GSM license 6 Q How can activate my GSM license if am not pe
9. Power on the device 3 Inthe USB to PC options on the phone enable ActiveSync and Enable faster data synchronization 4 Connect the device with the proper cable Windows Mobile Device Center should see the device but do not tell it to connect Select the proper Manufacture and Model from the dropdowns in MPE Click Connect If prompted on the phone to install the OxygenEngine dll accept and allow the installation Proceed to acquire the data you want oN OM 18 iDEN Devices Q How can I collect logical data from an iDEN device with MPE MPE Version MPE 4 4 0 and later Devices Supported iDEN devices Type of Capture Logical Procedure WO aAnNau 11 12 13 14 15 16 17 18 19 20 21 Install the MPE Driver Pack selecting to install the iDEN drivers they should be installed to C Program Files x86 AccessData Mobile Phone Drivers iDENAD Power on the phone Set the phone to connect as a modem typically Menu gt Settings gt Connections gt USB gt Data Modem Connect phone with the proper cable Windows will likely try to automatically install the driver Whether this installations fails or not we need to change the driver Open the Device Manager and find the iDEN Device entry may be under Modems Right click the iDEN Device entry and select Update Driver Software Tell Windows to browse your computer for driver software Tell Windows to let you pick from a list of drivers
10. Q What does error 1013 mean when acquiring a physical image from an Apple device 0008 16 Q Why can t FTK display some files in a physical image from an Apple device ccecsssseeeeeeeeesees 16 Blackberry DeViCeS arae hT desea tees weeds A A E A AE ho tian Gave et me cea teal vas eect eae eaten s 17 Q How can I collect logical data from a BlackBerry With MPE ccccccccccccsssessssececececsssessaeeeeeesseeeees 17 Windows Mobile Devices issiria iie area aa aie ia aT EER E aa Kaaa 18 Q How can I collect logical data from a Windows Mobile device with MPE ccccssesssseeeeeeseesees 18 NB aE E e A AT as SE E T a E E 19 Q How can I collect logical data from an iDEN device with MPE ccccsssccessssecesseeeeesseeeesseeeaeens 19 General TroubleshOOting engon a A E T E E eave ae eee EA 20 Q Why does MPE say my device is not ready or otherwise unable to CONNECt csesesseeeeeeeeeeees 20 Q Why did MPE fail to collect some data from My GeVICE cceseesesscecececessesesaeceeeescesseseeaeeeeeessessees 20 Q Why did MPE pull all the data off my device when I only selected to acquire the File System 20 Q told MPE to acquire all data from my supported CDMA phone but the extraction failed 20 Known Issues MPE 4 5 0 45078 cc cccccssssccecssssececssssececsssseeecsssseeecassesecssesececsessecseseseceesesaecsesesaeesenseaeees 21 When using Quick Print to create a P
11. c SIM ranana oani nl vhtae de conenca e veevlans tetas at da eia e aaa aR 12 Q What is the process for acquiring data from a SIM Card ccccsesssssscecececessessaececeessessesneaeeeeeesseesees 12 Q How do create a forensic SIM MPE 4 4 cccccccccsssccecssscececssssesecssesececssssecseseeececseeeeescseeaeesesseaeees 12 Android DEVICE Sreet ctucsctectds detects ctecaead et cates tecdevetactien Seustenet atte Seba cebettave A ota edksceet ape teeters 14 Q How can I collect logical data from an Android device With MPE ccecccesssssecesssneecesseneeeeseeeeens 14 Nle A A T E AT E E Gitta bd A E E ced bev geht eth cGlavteaceetiten cbtdey oh dele atn ogee 14 Q Does AccessData provide ADB Android Debug Bridge drivers for supported Android phones 14 Q Why can t Windows install the drivers for my HTC Android phone even though HTC Sync is installed aioa a a iat doe aii Aa vusavevs sidvanvssuenteds vate evetcananeveenteesss tives 14 Apple Device Saspi aa aeee aan aatar e e a aa a a Lea eae a dal au eea ekaa aa Sareh eee 15 Q How can I collect logical data from an iPhone iPad iPod with MPE csccccssccsssecssseeesteceeseeeees 15 Q How can I collect physical or deep unencrypted logical images from an iPhone iPad iPod with aa a E E A E EEE EE EEE SEE E E E E E S E 15 Nea A E T E O E A E E 16 Q How do I get my device out of DFU MOde ce ccccccessssessseeeeeceseeseaeseeeeecessesaeeeeeessessesaeaeseeeeseseees 16
12. ce Manager will usually list an ADB Interface Android Phone or Android USB Device and the device will not be seen as a mass storage device e MPE 4 4 If you use a third party tool to gain Shell Root not full root on an Android device before acquiring its data with MPE MPE will be able to acquire the device s full data folder Q Does AccessData provide ADB Android Debug Bridge drivers for supported Android phones A Some ADB drivers are included in the Driver Packs or on the MPE disc but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer As ADB drivers are commonly used in rooting Android devices users may be able to find help setting up their ADB drivers on YouTube or on the XDA forums Q Why can t Windows install the drivers for my HTC Android phone even though HTC Sync is installed A Sometimes the driver pack installer can t install all the parts of HTC drivers If this occurs you can download and install HTC Sync directly from HTC s website 14 Apple Devices Q How can I collect logical data from an iPhone iPad iPod with MPE MPE Version MPE 4 1 0 and later Devices iPhone all generations iPod Touch all generations iPad 1 amp 2 Type of Capture Logical Procedure 1 MPE 4 1 x Install the newest version of iTunes The driver needed is built into iTunes The AppleMobi
13. e for the underlying programming used to acquire data from GSM phones When MPE prompts for an activation code it is asking for the GSM license The user name should be in the format user and it is case sensitive and the activation code should be 5 groups of 5 alphanumeric characters Q Where is my GSM license located A Your GSM license should be on a sticker attached to the MPE software box or attached to the back of the MPE tablet Q What if I can t find my GSM license A You can contact AccessData Support at 800 658 5199 Many of our GSM licenses are kept on file Q Does my computer have to be connected to the internet to activate deactivate my GSM license A Preferably but there is an offline activator as well You should also be sure your computer is not behind a proxy during license activation deactivation Q How can I activate my GSM license if I am not permitted to connect my MPE computer to the internet A Please follow the Offline Activation Guide here Q Can my GSM license be concurrently activated on multiple computers A No The GSM license is good for one concurrent activation on one computer You will need to deactivate your GSM license via Tasks gt Settings gt GSM License gt Deactivate in MPE before activating it on another machine Q Can my GSM license be concurrently activated under multiple profiles accounts on the same computer A No The GSM license is good for one concurrent acti
14. ed out Resolution Use the Export to AD1 option in the Tasks menu instead On a rooted Android phone if you select the Forensic Files Only option all other extraction options are ignored and only the forensic files are pulled 60307 Resolution Perform the extraction for Forensic Files then perform a new extraction to get the remaining data Although they are listed in MPE Palm phones running Windows Mobile OS are not currently supported Resolution Wait for a future release of MPE to support the following phones Palm Treo 500 Palm Treo 700w Palm Treo 700wx Palm Treo 750 Palm Treo 750v Palm Treo 800w Palm Treo Pro 21
15. g the File System of a device it will automatically try another method of acquiring the File System The second method will automatically collect all the data from the device Q I told MPE to acquire all data from my supported CDMA phone but the extraction failed A If this happens completely close and restart MPE and reboot the phone Try extracting data again but rather than selecting all data select only the File System After the File System extracts you can click the Extract Device Data button or go to Tasks gt Extract Data to extract the remaining data 20 Known Issues MPE 4 5 0 45078 When using Quick Print to create a PDF report if the amount of information selected for the PDF is large PDF generation will take some time to complete If you have a lot of data PDF reports may result in an out of memory error 60097 Resolution To workaround reports that are very slow or fail try creating several smaller reports rather than one large report Multiple subsequent extractions using some devices Windows Mobile Apple and Android may fail 60354 60204 Resolution Restart MPE and try extracting data again If the user inputs the incorrect model number when extracting that incorrect number will appear in the Quick Print Report 60413 Resolution Select the correct device from the MPE menus when extracting data After data carving in MPE the Export to AD1 button in the toolbar may be gray
16. ing the issue We are constantly working to add more supported devices to our product and improve device support Q What is the general process for acquiring data from a phone 1 2 OS Ye oN Ensure the proper drivers have been installed For GSM devices make sure a SIM is inserted use a forensic SIM if possible but do not use a foreign SIM Power on and unlock the device Connect the device to the PC using the appropriate cable Ensure the device is in the proper mode almost always not Mass Storage mode Confirm that Windows can see the device properly usually by looking under Ports in Device Manager Launch MPE and choose to acquire data from a phone Select the appropriate Manufacturer and Model from the dropdowns Select the proper Port usually a Serial or Modem port for CDMA phones or click Refresh Port s for GSM phones 10 Click Connect and proceed to acquire the data you want 11 SIM Cards Q What are the two black cards I received in the MPE bundle A The MPE bundle includes a blank SIM card that can be used as a forensic SIM it says MPE Forensic SIM in the back and a micro SIM adapter it looks like a SIM card but has no circuitry and has a smaller section the size of a micro SIM that can be popped out The micro SIM adapter has two purposes you can pop a micro SIM into it so that it can be read by the SIM card reader or you can use it as a template to cut a
17. leDeviceHelper exe and AppleMobileDeviceService exe processes should be running in the background if iTunes is correctly installed MPE 4 2 x Uninstall any versions of iTunes that your PC has and install the Apple drivers from AccessDataMobilePhoneExaminerDrivers exe MPE 4 3 x and later Uninstall any versions of iTunes that your PC has and install the drivers from MPESmartphoneDriver exe 2 Connect the device with the normal Apple USB cable and allow Windows to install any needed drivers Click the Select Device button in MPE or Tasks gt Select Device Select Apple in the Manufacturer drop down Select the correct device in the Model drop down MPE 4 1 x Click Refresh Port s The COM Port field should then say Apple Device Port Click Connect and proceed to acquire the data you want The AppleMobileBackup exe process will start in the background when it starts extracting data If it doesn t restart MPE NOU Pw Q How can I collect physical or deep unencrypted logical images from an iPhone iPad iPod with MPE MPE Version MPE 4 2 0 and later Devices iPhone all generations iPod Touch 3 amp 4 iPad 1 Type of Capture Physical Procedure 1 MPE 4 2 x Uninstall any versions of iTunes that your PC has and install the Apple drivers from AccessDataMobilePhoneExaminerDrivers exe Also install the Apple Physical Device Support files if prompted by MPE MPE 4 3 x and later Uninstall any ve
18. ll usually require at least 1 GB of disk space on the destination PC The other partitions require at least as much space as the Apple device is rated to hold This means that selecting to acquire the OS Partition User Partition Decrypted User Partition and Full Disk from a 32 GB Apple device will result in about 96 GB worth of image files Q How do I get my device out of DFU mode A Your device should reboot itself to get out of DFU after doing a physical acquisition If it does not or the device remains in DFU as the result of an error or cancelling the image process hold down the Home button and Power button together for 10 seconds to get out of DFU mode Q What does error 1013 mean when acquiring a physical image from an Apple device A This means that you are using an unsupported device MPE does not support physical acquisition from 1 and 2 generation iPod Touches or the iPad 2 yet MPE can still do logical acquisitions from these devices Q Why can t FTK display some files in a physical image from an Apple device A Since the iOS 4 hardware based encryption is used on all Apple devices and cannot be turned off MPE has the option to acquire a Decrypted User Partition as it is in our development plan to be able to decrypt these files but this feature is not fully implemented Because of this you may not be able to view the contents of some files in FTK even if you have chosen to acquire the Decrypted User Partition unles
19. ms this means that while we may support the phone we might only extract the contacts SMS and call logs but not the calendar or any other combination of this information This may come as a shock to many customers that have never dealt with any mobile forensic software or haven t had any type of mobile forensic training but for those customers that understand mobile phone forensics they should only see MPE as a tool that can help them fill the voids of other software they use and become their main tool Q What is CDMA A CDMA stands for Code Division Multiple Access and is a cellular technology used for communication CDMA is usually only used in the USA CDMA phones typically do not use SIM cars unless they are world phones which rely on GSM technology outside of the USA More information about CDMA can be obtained here Q What is GSM A GSM stands for Global System for Mobile Communications and is a worldwide standard for cellular communication GSM phones use SIM cards whether externally accessible or not More information about GSM can be obtained here System Requirements Q What Operating Systems are supported by MPE A Windows XP 32 bit Windows 7 32 bit and Windows 7 64 bit are supported Licensing MPE 4 3 and earlier Q Why does MPE ask for an activation code A Two licenses are involved in MPE One is the license that s stored on the CodeMeter dongle or Virtual CodeMeter dongle and one is a GSM licens
20. o cut the forensic SIM down to micro SIM size to fit in the phone 13 Android Devices Q How can I collect logical data from an Android device with MPE MPE Version MPE 4 2 0 and later Devices Supported Android devices Type of Capture Logical Procedure 1 Install the ADB Android Debug Bridge driver for your phone Some are included in the Driver Pack or on the MPE CD but ADB drivers are specific to device model and carrier so we cannot provide them all These should be obtained through the device carrier not the device manufacturer 2 Remove any memory cards that came with the device and insert an empty forensic SD card this is where MPE s agent will be temporarily stored 3 On the device itself set the device to connect in Debugging Development mode this setting can be in different locations on different devices so check with the device s user manual 4 Onthe device itself set the device to allow applications from Unknown Sources this setting can be in different locations on different devices so check with the device s user manual 5 Connect the device with a normal Micro or Mini USB cable depending on the device 6 Click the Select Device button in MPE or Tasks gt Select Device 7 Select the device s Manufacturer and Model in the drop downs 8 Click Connect and proceed to acquire the data you want Notes e When you have the proper ADB driver installed and the device is in Debugging mode Devi
21. rmitted to connect my MPE computer to the W OTIM be ects teeecauceccnstcec ss sates tua tote mus vaceaadisectesysauestud 2 ote nay EE E OEE 6 Q Can my GSM license be concurrently activated on multiple computers ccccccecesessessteeeeeeeeeeesees 6 Q Can my GSM license be concurrently activated under multiple profiles accounts on the same COMPUTE Nee ccc eesti iecccceesin ee hcacs E E a E EEEE E E Eea Eee ttideee add oa a a a a ai 6 Q How do I move my MPE installation to a different computer cc cccecessesssseeeeeeeseesestaeeeeeesseeeees 6 Q What if forget to deactivate my GSM license before uninstalling MPE of formatting my COMPUTE re eee ee E E EE E EEE EE AE EEEE E EEE 7 RUNNING MPEP eccccdedacccactsncddesesacctintancecetedececastancddesibucecantance da Eed aaeoa d oreado de OESE EAEE dE aae SES EEE 8 Q Why does MPE say that further setup is required for Apple physical support c sssccceeeeeeeeees 8 Q What if MPE fails to download the Apple physical support files or am otherwise unable to connect my MPE machine to the internet ccccccccccccssssssssececececessesseaececececesseseuseseceeesesseseeaeeeeeeseessees 8 Q What does MPE mean when it s Initializing every time it starts osesssessnsssseserennnssesesrrensnssee 8 Q Do I really need the Apple physical support files ccccscccccecsssessssececeeecessesneaeeeeeeeseeseseaeeeeeeeseeeegs 8 DIVO enna na a a E E
22. rsions of iTunes that your PC has and install the drivers from MPESmartphoneDriver exe Also install the Apple Physical Device Support files if prompted by MPE Connect the device with the normal Apple USB cable Click the Select Device button in MPE or Tasks gt Select Device Select Apple in the Manufacturer drop down Select the correct device with the Physical label in the Model drop down Click Connect and follow the on screen prompts to put the device in DFU mode Note that holding the buttons down for longer than prompted will result in the device not going into DFU mode and you will need to restart the process OY Gre 0 I 15 7 When prompted select which partitions to acquire and proceed to acquire the data Notes e The iPhone 4S and iOS 5 on any device are not currently supported Please do not attempt to use MPE with these products e Apple Physical images will be saved in DD format and cannot be viewed in MPE They must be processed in FTK 3 3 or later e Apple Deep Logical images will be saved in TAR format and can be viewed in MPE via File gt Extract From gt Apple TAR or processed in FTK 3 3 or later e MPE will name an Apple device s physical image in the format partition_name sector_size segment_number The only part of the file name that should ever be changed is partition_name Changing more than that will result in FTK not being able to correctly read the image e The OS partition wi
23. s the user has disabled encryption on the device Until we are able to fully implement physical decryption of Apple devices Apple has been known to be cooperative with law enforcement in decrypting the files if you contact them directly 16 Blackberry Devices Q How can I collect logical data from a BlackBerry with MPE MPE Version MPE 4 1 0 and later Devices Supported BlackBerry Devices Type of Capture Logical Procedure SO PS a co Download and install BlackBerry Desktop from the MPE disc or ISO Power on the phone Connect the device with the proper cable Click the Select Device button in MPE or Tasks gt Select Device Select BlackBerry in the Manufacturer drop down Select the correct device in the Model drop down MPE 4 2 x and prior Click Refresh Port s The COM Port field should then say BlackBerry Smartphone Click Connect When prompted in MPE enter the phone s password PIN If the device has no password PIN leave this field blank If the device is also using encryption enter the password PIN on the device itself 10 Proceed to acquire the data you want 17 Windows Mobile Devices Q How can I collect logical data from a Windows Mobile device with MPE MPE Version MPE 4 3 0 and later Devices Supported Windows Mobile devices Type of Capture Logical Procedure 1 Install the Windows Mobile drivers from the AccessDataMobilePhoneExaminerDrivers package 2
24. ut that is fine If the phone uses a micro SIM you can pop the micro SIM into the micro SIM adapter so it fits in the SIM card reader Click on Tools gt Create Forensic SIM gt Read SIM Once it has read the IMSI and ICCID click Continue Insert a blank forensic SIM into the reader and click OK After the values have been written to the forensic SIM MPE will allow you to view and save the results 9 Optional If the phone uses a micro SIM you can use the micro SIM adapter as a template to cut the forensic SIM down to micro SIM size to fit in the phone Manually if you already know the correct IMSI and ICCID values 1 Launch MPE 2 Ensure the SIM card reader driver has been installed often installs automatically oN aM 12 CO s ON U Connect the SIM card reader to your computer usually appears as a Smart Card Reader in Device Manager Insert a blank forensic SIM card into the reader according to the picture on the reader you may see a Smart Card device in Device Manager that shows it is not working but that is fine Click on Tools gt Create Forensic SIM gt Enter Values Enter the IMSI and ICCID either in octet form or in raw form and click Continue Insert a forensic SIM into the reader and click OK After the values have been written to the forensic SIM MPE will allow you to view and save the results Optional If the phone uses a micro SIM you can use the micro SIM adapter as a template t
25. vation on one computer You will need to deactivate your GSM license via Tasks gt Settings gt GSM License gt Deactivate in MPE before activating it on under another profile account Q How do I move my MPE installation to a different computer A You first need to deactivate your GSM license via Tasks gt Settings gt GSM License gt Deactivate in MPE You can then move the dongle with your MPE license to another computer where you can then install and activate MPE again If your MPE license is located on a virtual dongle in the case of an MPE tablet you can migrate your license from your virtual dongle to a physical dongle by following the instructions here Q What if I forget to deactivate my GSM license before uninstalling MPE of formatting my computer A You can contact AccessData Support at 800 658 5199 to have your GSM license manually deactivated Please have your GSM license user name and activation key ready when you call Running MPE Q Why does MPE say that further setup is required for Apple physical support A The files needed to acquire physical images from Apple devices are not included in our driver packs By clicking Yes when prompted MPE will automatically download these needed files Please make sure your computer is connected to the internet to complete this step Q What if MPE fails to download the Apple physical support files or I am otherwise unable to connect my MPE machine to the internet
Download Pdf Manuals
Related Search