Kevin Emmanuel

MPE+ Access Data

MPE+ stands for Mobile Phone Examiner Plus. It is a mobile forensics solution that runs on over 7000 devices including Apple IOS, Blackberry, and Android operating systems. It can also work on devices with Chinese Chipset. Mobile Phone Examiner can be purchased with phone cables and also a SIM reader. MPE+ includes a visualization tool in which you can see different relationships of communication dealing with contacts on a phone or mobile device. It then is able to create graphical data timelines from this information. There is no need for a passcode either to obtain the information.

Mobile Phone Examiner Plus allows mobile forensic investigators to perform in-debt investigations without expensive extra hardware. There is broad support for multiple devices and different filtering options to make specific reports. It has an integration with FT and touch tablet options, which means investigators can upgrade their functionality. If you add a program called Velocitor, it enhances MPE Plus in which it supports even more cheap Chinese Devices. It makes the program compatible with generic phones, tablets, and Chinese phones which can be very helpful inside of an investigation. It provides logical and physical extraction of data information from 95% of Chinese chipsets, such as full flash data extraction.

The devices that Mobile Phone Examiner Plus runs on are Blackberry, IOS, Chinese devices, Windows Mobile, and Android. Some Chinese supported devices may include Spreadtrum, MediaTek, Philips, TI, MSTAR, Coolsand and others. It works on any IOS device up to iOS7, starting from iPhone 4 and iPad 1. Full data can be extracted from rooted Android devices. Legacy phones are included such as LG, Nokia, Motorola, ZTE, Sony Ericsson, Samsung and others. The software is compatible on both cell phones and mobile devices. The process of using the device is you first connect it to the supported phone or mobile device. Then you select the data types to extract, which may be text messages sms, call history, email, etc. Then you click extract. The next thing you do is Review the collected data in MPE+. There I a visualization feature which shows you a timeline from the data collected. After all of this, the next step is to save and go. You save the data collected. The files are saved as an AD1 File. You then import the AD1 case file into a summation in which the file can be read in a particular platform or program that accepts AD1 files, such as AD eDiscovery.

MPE Plus has an automatic one click recovery feature. It can extract data from various social media programs. These programs include Google Voice, Twitter, Facebook, LinkedIn, We Chat, Skype, QQ and more. Also if USB debugging is not enable don Android devices, it can still enable physical imaging of those devices and allow the bypass of any passcodes. There is an extraction Wizard when used with the Samsung Galaxy SII and Galaxy SIII. There is also support for Galaxy S4. There is physical image support for Android RFS file system and more. On both GSM and CDMA IOS devices, jail breaking is not required for MPE to work. ITunes is not required to retrieve data. The Operating System gets decrypted on the IOS devices from 1.0 to v.7. ITunes data such as folders and backups can also be accessed.

MPE Plus is a great device for mobile Forensic investigators. Many files can be extracted, even with passwords enabled or USB debugging not enabled. SMS can be viewed in conversation mode. Emails, videos, sms, photos, and more can all be retrieved with this tool. Specific keywords can be searched and flagged when the software is looking through the device being researched using an advanced alert manager. These information can be critical in piecing together a major investigation of a suspect. MPE Plus works on a Windows based PC, specifically Windows 7 64-bit (all versions). It needs dedicated video memory of 128MB or higher and disk space of at least 500GB. More may be needed for physical Apple device data.

Source:

TimeLine Visualization:

Filter columns:

iPhone 4s/iPhone 5 with IOS 6.0 to IOS 6.1.2 Root Instructions

The Evasi0n tool is an open source software that is free to retrieve online. It jailbreaks specific Apple devices and allows users to enter the file system and alter it. It is compatible with iOS 6.1.2, 6.1, 6.0.2, 6.0.1, and 6.0. To view the settings on your iPhone to see which version you have, you go to settings > About > Version to make sure you have the compatible iOS version.

To get the latest version of Evasion, you would go to their website which is The team behind evasi0n are known as Evad3rs Dev team. The type of jailbreak that evasi0n is would be untethered which means if the phone is restarted, the phone would not lose its jailbreak. These are the steps to jailbreak the iPhone:

  1. Download the evasion from the download link on their website at
  2. Double click the evasi0n zip file and extract the application to the evasi0n folder on your pc.
  3. Launch or run the application from the folder that it is stored in on your c.
  4. A prompt will then show to connect your iPhone to your pc. It is recommended to disable the passcode on your phone so that the jailbreak process does not fail.
  5. Evasi0n program will then detect your iPhone automatically and state the firmware that it is running on.
  6. Click the jailbreak button
  7. The progress of the jailbreak will then appear and you will also see a bar to accommodate how far until the jailbreak has been finished.
  8. Once the process is complete, you will get a message telling you to unlock your iPhone
  9. Unlock your iPhone and then an app will be on the iPhone that says jailbreak. Tap on that app to start it.
  10. Once it is done, it will give a message stating that the jailbreak is complete, and the device will restart a few times as it completes the process.
  11. You should then see a Cydia icon as one of your new apps one the jailbreak has been finished.

When Cydia is downloaded, this opens up the iPhone, allowing the user to freely customize and explore the file system. Cydia allows cracked apps to get downloaded to the iPhone. You can get an app such as iFile through Cydia which puts you into the root of your iPhone. To set up Cydia, you open the Cydia application > go to manage>sources>edit>add. Add this source where it says add: Once you do that, you can start using Cydia and add different sources to it to get access to different apps.

IFile would be in a source called There are other sources that may have the IFile app if you do a google search.

Nexus 4 Root Instructions using AccessData MPE+

1. Enable developer debugging settings by going to settings

2. Go to about phone

3. Go to the bottom where it says build number and double tap it 7 times (now you will have unlocked

developer options)

4. Go back to settings > Developer Options > Then check the box that says USB debugging (this will put

the phone in debug mode when it is connected via USB)

5. The pc should now recognize the Nexus 4 once it is in debugging mode.

6. On your PC, open the program AccessData MPE+ with the Nexus 4 connected.

7. Select the icon that shows a SIM Card and a list will come up that says “select data for extraction”. You can select phonebook, call history, SMS, file system, deep file system or all of them to view the items.

8. You then get a mini screen that says extracting data from the device. You are now able to see call logs with date and time, contacts, and also SMS that shows that it was read, delivered, or deleted to or from specified recipients. You can also identify and locate SMS messages from the File System/USIM. Data can also be exported into PDF or an investigation report.

Market Share for iPhone 4s and 5

The US market share is dominated by both the iOS and Android. The iPhone’s market share was at 39.3% in September 2013. A year ago before that it was at 35.7% when the iPhone 4s was current and was before the iPhone 5 was available. It then rose to 53.3% in November of 2012 surveys. This showed that an iPhone new launch can have a big impact on the market share.

Source:

The Nexus 4 Market Share

The nexus 4 is under the LG brand. As of July 2013, the Nexus 4 is part of 60% of the market share out of all of the Android device market share. Samsung has taken over all top 10 spots and is dominating the android market.

Source: