Mobile Phone Examiner for FTK Release Notes

Transcription

1 Mobile Phone Examiner for FTK Release Notes INTRODUCTION This readme is a document listing important information necessary for the use of this release of AD Mobile Phone Examiner. NEW FEATURES The time interval used to detect devices is now read from the registry instead of being hard coded. The Registry information is as follows: PATH: HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Mobile Phone Examiner\1.0\Detection Interval\ TYPE: DWORD DESCRIPTION: Time in seconds to wait for a phone to be detected on a port. Mobile Phone Examiner for FTK Release Notes 1

2 FIXES ACS card reader running on Windows Server 2003 was hanging on initialization. This problem has been corrected. KNOWN ISSUES Mobile Phone Examiner is supported only on 32-bit operating systems (XP, Vista, 2003). The mobile phone drivers provided with this product are 32-bit drivers. NEW PHONES SUPPORTED The following table lists the makes and models newly supported with this release. TABLE 1-1 Newly Supported Phones Manufacturer Apple Model iphone (Requires itunes to be installed.) C3300 F2400 HB620T KE500 KE850 KF300 KF310 KF510 KF600 KF700 KG110 KG130 KG225 KG290 KG810 KG920 KM380 KM500 2 AccessData Mobile Phone Examiner User Guide

3 TABLE 1-1 Newly Supported Phones Manufacturer Model KP130 KP202i PKP230 KU250 KU311 KU380 KU990 MobileWatch M500 A1200 E8 EM30 U9 V535 V8 V9 Z6 ZN Classic 3600 Slide 5220 XpressMusic 5310 XpressMusic 5610 XpressMusic 6120 Classic 6121 Classic 6124 Classic 6220 Classic Mobile Phone Examiner for FTK Release Notes 3

4 TABLE 1-1 Newly Supported Phones Manufacturer Sagem Model 6500 Classic 6500 Slide 7500 Prism E51 E66 E71 N71 N72 N76 N95 8GB myc5-2 Armani GT-B2700 GT-i8510 GT-S7330 SGH-B520 SGH-D880 SGH-E251 SGH-E2510 SGH-E590 SGH-F250 SGH-F400 SGH-F480 SGH-F490 SGH-F490V SGH-G400 SGH-G800 SGH-G810 SGH-J150 SGH-J600 SGH-J700 4 AccessData Mobile Phone Examiner User Guide

5 TABLE 1-1 Newly Supported Phones Manufacturer Ubiquam Model SGH-J700V SGH-J800 SGH-L700 SGH-L770V SGH-L810V SGH-M150 SGH-M310 SGH-M310V SGH-M3200 SGH-M3510 SGH-M7500 SGH-S3600 SGH-U100 SGH-U800 SGH-U900 SGH-U900V SGH-X520 C702 C902 C905 G502 K660i V640i W350i W380i W760i W890i W980i Z555i Z770i U400 Mobile Phone Examiner for FTK Release Notes 5

6 COMMENTS? We value all feedback from our customers. Please contact us at or send documentation issues to 6 AccessData Mobile Phone Examiner User Guide

7 Mobile Phone Examiner for FTK Release Notes This document is designed to be a short reference to new features and known issues in the AccessData Forensic Toolkit (FTK ) Mobile Phone Examiner (MPE ). WARNINGS If you attempt to uninstall or upgrade MPE with no internet connectivity, the installer will fail to deactivate your existing MPE license and that license may be unrecoverable During uninstall of MPE, license deactivation can fail without warning. After uninstalling, please verify that the installation.actfile has been removed from the c:\program files\accessdata\common files\mpe\data files folder. If this file remains, DO NOT MANUALLY DELETE IT! Contact AccessData Support before continuing. If you use a third party software, such as Ghost or Virtual PC/VM Ware, etc., to restore your machine to a clean state, verify that deactivation has successfully completed before restoring your machine to a previous state. Otherwise your license may be unrecoverable. Mobile Phone Examiner for FTK Release Notes 7

8 ATTENTION If you have Mobile Phone Examiner (MPE) installed with FTK 2.0.2, and are upgrading to FTK 2.1 or FTK 2.1.1, do not manually delete the \Forensic Toolkit\2.0.2\ directory structure until after you have once run the MPE 2.1 upgrade. It contains the license file (installation.actfile) required to upgrade and run MPE 2.1. The correct MPE upgrade procedure (overview) is to: 1. Uninstall FTK (do not manually remove any files or folders) 2. Follow the FTK 2.1 upgrade procedures 3. Run the MPE and follow instructions. If you ran the Mobile Phone Examiner Uninstall, please call Technical Support to make sure your license is properly transferred to the upgraded MPE installation. If you manually deleted the Forensic Toolkit\2.0.2\ directory structure or the installation.actfile, please call Technical Support for instructions. FYI A phone that appears on the Supported Phone Types list indicates that when that phone is connected, it will be detected, (assuming the correct drivers and activation information are in place), and some information will be found. The driver for that phone and its underlying code determine the information that will be found and displayed. NEW FEATURES AND FIXES MPE LicenseManager can now be run from the Start Menu. The first time it is run, you must be connected to the Internet. This runs the online license activator. See the related bulleted item regarding Activation Information, under Known Issues for more information. MPE License Manager now includes a Deactivate button. FTKno longer needs to be closed before a phone is connected, then restarted, for detection to take place. 8 AccessData Mobile Phone Examiner User Guide

9 KNOWN ISSUES In order to access iphones you must install itunes. Accessing your phone this way may modify artifacts on the iphone Some mobile phones are identified as a different phone type or model than what is attached to the cable. The content is correct, however. The SIM card reader is not supported on Windows Server The SIM card reader generates an entry of its own as a selectable source of data, as in the following figure. To import the SIM card data, select only the SIM card itself, as the entry for the SIM card reader contains no data. MPE does not always see nor read the ACS Smart Card Reader (ACR38) with the shipped drivers. Note: The SIM card detects only when the card is fully inserted into the reader. Figure 1-1 Select Mobile Phones Dialog SIM Card Reader Counts and data are different between a SIM image created by MPE and the same SIM imaged via a SIM reader. A card reader interface is able to extract more information from a SIM than when the SIM information is extracted from any phone interface. Example: Fixed Dialing numbers, Last Dialed Numbers, etc. In addition, the card reader can extract deleted SMS. Hence, it is expected that one can get different images for the same SIM when extracted via MPE and a card reader. Mobile Phone Examiner for FTK Release Notes 9

10 For example, last dialed and fixed dialing numbers should be available when acquiring a SIM image from the MPE. If the data is not in the image, it was not in the phone. Same with the content of that SMS message. If the activation information is entered incorrectly during the install of MPE and the MPE LicenseManager, you will not be able to run MPE until the information is corrected in the registry. The activation key is case sensitive, and must be put in accurately. Online activation requires that each five-character alpha-numeric key be entered in a separate box, and no hyphens are required. It will look like this example: xxxxx xxxxx xxxxx xxxxx xxxxx The username is also case sensitive, and must be entered exactly the same as the one you received from AccessData. It will be in the format of user in whatever case you received it, <space>, nnnn (the four-digit number provided by AccessData). It will look like this example: user 1234 The Company Name MUST be entered as AccessData, and is case sensitive. The OEM Name MUST be entered as AccessData, and is case sensitive. Verify this information before continuing. If any of this information is entered incorrectly and saved, and the MPE installation is completed, you will not be able to go back through the installation and correct it. To correct the problem you must run the Registry Editor and make the corrections there. The path to the information is: HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Mobile Phone Examiner\1.0] COMMENTS? We value all feedback from our customers. Please contact us at support@accessdata.com, or send documentation issues to documentation@accessdata.com. 10 AccessData Mobile Phone Examiner User Guide