Mobile Phone Examiner 1.0.4 for FTK 2.1.1 Release Notes

INTRODUCTION

This readme is a document listing important information necessary for the use of this release of AD Mobile Phone Examiner.

NEW FEATURES

The time interval used to detect devices is now read from the registry instead of
being hard coded. The Registry information is as follows:

PATH:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\MobilePhone Examiner\1.0\DetectionInterval\

TYPE:

DESCRIPTION:
Time in seconds to wait for a phone to be detected on a port.
ACS card reader running on Windows Server 2003 was hanging on initialization.
This problem has been corrected.

KNOWN ISSUES

Mobile Phone Examiner is supported only on 32-bit operating systems (XP, Vista,
2003). The mobile phone drivers provided with this product are 32-bit drivers.

NEW PHONES SUPPORTED

The following table lists the makes and models newly supported with this release.

TABLE 1-1

Newly Supported Phones
Model iPhone (Requires iTunes to be installed.) C3300 F2400 HB620T KE500 KE850 KF300 KF310 KF510 KF600 KF700 KG110 KG130 KG225 KG290 KG810 KG920 KM380 KM500
Manufacturer Apple LG LG LG LG LG LG LG LG LG LG LG LG LG LG LG LG LG LG
AccessData Mobile Phone Examiner User Guide
Model KP130 KP202i PKP230 KU250 KU311 KU380 KU990 M500 A1200 E8 EM30 U9 V535 V8 V9 Z6 ZN3500 Classic 3600 Slide 5220 XpressMusic 5310 XpressMusic 5610 XpressMusic 6120 Classic 6121 Classic 6124 Classic 6220 Classic
Manufacturer LG LG LG LG LG LG LG MobileWatch Motorola Motorola Motorola Motorola Motorola Motorola Motorola Motorola Motorola Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia
Model 6500 Classic 6500 Slide 7500 Prism E51 E66 E71 N71 N72 N76 N95 8GB myC5-2 Armani GT-B2700 GT-i8510 GT-S7330 SGH-B520 SGH-D880 SGH-E251 SGH-E2510 SGH-E590 SGH-F250 SGH-F400 SGH-F480 SGH-F490 SGH-F490V SGH-G400 SGH-G800 SGH-G810 SGH-J150 SGH-J600 SGH-J700
Manufacturer Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Nokia Sagem Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung
Model SGH-J700V SGH-J800 SGH-L700 SGH-L770V SGH-L810V SGH-M150 SGH-M310 SGH-M310V SGH-M3200 SGH-M3510 SGH-M7500 SGH-S3600 SGH-U100 SGH-U800 SGH-U900 SGH-U900V SGH-X520 C702 C902 C905 G502 K660i V640i W350i W380i W760i W890i W980i Z555i Z770i U400
Manufacturer Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Samsung Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Sony Ericsson Ubiquam

COMMENTS?

We value all feedback from our customers. Please contact us at support@accessdata.com, or send documentation issues to documentation@accessdata.com.
Mobile Phone Examiner 1.0.3 for FTK 2.1.1 Release Notes
This document is designed to be a short reference to new features and known issues in the AccessData Forensic Toolkit (FTK) Mobile Phone Examiner (MPE).

WARNINGS

If you attempt to uninstall or upgrade MPE with no internet connectivity, the
installer will fail to deactivate your existing MPE license and that license may be unrecoverable
During uninstall of MPE, license deactivation can fail without warning. After
uninstalling, please verify that theinstallation.actfile has been removed from the c:\programfiles\accessdata\commonfiles\MPE\datafiles folder. If this file remains, DO NOT MANUALLY DELETE IT! Contact AccessData Support before continuing.
If you use a third party software, such as Ghost or Virtual PC/VM Ware, etc., to
restore your machine to a clean state, verify that deactivation has successfully completed before restoring your machine to a previous state. Otherwise your license may be unrecoverable.

ATTENTION

If you have Mobile Phone Examiner (MPE) installed with FTK 2.0.2, and are upgrading to FTK 2.1 or FTK 2.1.1, do not manually delete the \Forensic Toolkit\2.0.2\ directory structure until after you have once run the MPE 2.1 upgrade. It contains the license file (installation.actfile) required to upgrade and run MPE 2.1. The correct MPE upgrade procedure (overview) is to:

1. Uninstall FTK 2.0.2 (do not manually remove any files or folders) 2. Follow the FTK 2.1 upgrade procedures 3. Run the MPE 1.0.3 and follow instructions.
If you ran the Mobile Phone Examiner 2.0.2 Uninstall, please call Technical Support to make sure your license is properly transferred to the upgraded MPE installation. If you manually deleted the Forensic Toolkit\2.0.2\ directory structure or the installation.actfile, please call Technical Support for instructions.
A phone that appears on the Supported Phone Types list indicates that when that phone is connected, it will be detected, (assuming the correct drivers and activation information are in place), and some information will be found. The driver for that phone and its underlying code determine the information that will be found and displayed.

NEW FEATURES AND FIXES

MPE LicenseManager can now be run from the Start Menu. The first time it is
run, you must be connected to the Internet. This runs the online license activator. See the related bulleted item regarding Activation Information, under Known Issues for more information.
MPE License Manager now includes a Deactivate button. FTKno longer needs to be closed before a phone is connected, then restarted, for

detection to take place.

In order to access iPhones you must install iTunes. Accessing your phone this way
may modify artifacts on the iPhone
Some mobile phones are identified as a different phone type or model than what is
attached to the cable. The content is correct, however.
The SIM card reader is not supported on Windows Server 2003. The SIM card reader generates an entry of its own as a selectable source of data, as
in the following figure. To import the SIM card data, select only the SIM card itself, as the entry for the SIM card reader contains no data.
MPE does not always see nor read the ACS Smart Card Reader (ACR38) with the

shipped drivers.

Note: The SIM card detects only when the card is fully inserted into the reader.

Figure 1-1 Select Mobile Phones Dialog SIM Card Reader
Counts and data are different between a SIM image created by MPE and the same
SIM imaged via a SIM reader. A card reader interface is able to extract more information from a SIM than when the SIM information is extracted from any phone interface. Example: Fixed Dialing numbers, Last Dialed Numbers, etc. In addition, the card reader can extract deleted SMS. Hence, it is expected that one can get different images for the same SIM when extracted via MPE and a card reader.
For example, last dialed and fixed dialing numbers should be available when acquiring a SIM image from the MPE. If the data is not in the image, it was not in the phone. Same with the content of that SMS message.
If the activation information is entered incorrectly during the install of MPE and
the MPE LicenseManager, you will not be able to run MPE until the information is corrected in the registry.
The activation key is case sensitive, and must be put in accurately. Online
activation requires that each five-character alpha-numeric key be entered in a separate box, and no hyphens are required. It will look like this example: xxxxx xxxxx xxxxx xxxxx xxxxx
The username is also case sensitive, and must be entered exactly the same as the
one you received from AccessData. It will be in the format of user in whatever case you received it, <space>, nnnn (the four-digit number provided by AccessData). It will look like this example: user1234
The Company Name MUST be entered as AccessData, and is case sensitive. The OEM Name MUST be entered as AccessData, and is case sensitive.
Verify this information before continuing. If any of this information is entered incorrectly and saved, and the MPE installation is completed, you will not be able to go back through the installation and correct it. To correct the problem you must run the Registry Editor and make the corrections there. The path to the information is: HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\MobilePhone Examiner\1.0]