FINALMobile Forensics offers the most advanced data-carving tool for our forensic community. With our extensive knowledge of file systems and data patterns, FINALMobile can turn raw data into easy-to-understand data with a few simple clicks.
Mobile devices store data in specific formats, and in many cases, the data is not erased. By searching for specific patterns, these hidden gems, “deleted entries,” are recoverable, along with the full scope of the “live” data. Moreover, since many devices share the same pattern, we may already have a solution for tomorrow’s phones as well.
If the file system fails to populate, we can still analyze data by searching each sector for specific data. The data can be organized in a variety of ways to make it easier for the user. It can be exported to Excel or PDF reports.
Features FINALMobile Forensics:
Capture and/or analyze data from mobile devices through logical or physical acquisitions.
FINALMobile Forensics uses a database wizard to streamline the acquisition procedure.
The Main purpose of FINALMobile Forensics is to create an accurate and detailed parsing of the data within the file system.
The program is able to read our own generated phone images (MEFs), along with files generated by other means.
Once data is loaded, the program will apply the appropriate parsing rules (CDF scripts) to the designated files and folders based on the model number of the mobile device.
If the desired model is not listed, users can run all scripts against the files to appropriate the parsing.
Results are displayed in an easy-to-read and exportable spreadsheet format.
The engine is built to reconstruct the file system and then parse the data.
Users can verify their results by simply looking over the results for irregular formats. Double-clicking any part of the entry will display the file, or part of the file, in the Hexviewer. Also, by using the [Display File Path] option, users can confirm that each file was parsed.
Results can be exported in HTML, PDF, or Excel formats.
- Operating System: Windows 2000 / XP / 2003 Server / Vista / 7 / 8 / 10
- CPU: Pentium4 / 2GHz or better / Athlon or better
- RAM: 512 MB or more
- HDD: 10 GB or more
- Graphic Card: 1024 x 768 resolution or better
- Supporting Data Types:
- EFS 1, EFS 2, FAT 16/32, ExFAT, TFS4
- EXT2/3/4, YAFFS2