After months of hard work, we are pleased to announce the release of MOBILedit Forensic Express 3.6 with important new features.
New features
- Added support for iOS 10.2 including the new iTunes Backup encryption
- Interactive Map View for geolocation data
- MOBILedit Backup and MOBILedit Export formats can be zipped and encrypted
- Added hashes to MOBILedit Backups and MOBILedit Exports (choice of MD5 or SHA256)
- Photos of the actual phone and the investigator’s logo can be included in the reports
- New global filter for highlighting selected information in a new section at the start of the report
- Enhanced recovery of deleted data on Android, including deleted SMS and MMS messages, deleted calls, deleted contacts, and deleted events
- Now linked to an all-new detailed User Guide and What's new information (3.6.1)
Main improvements
- Password breaker reworked, now includes support for GPU acceleration, multi-threaded operation, and iOS 10.0 and iOS 10.2 (beta) iTunes Backup
- Dates and times internally use a unified time zone, which can now be configured for the reports
- Photo and image metadata can be reduced in reports
- Media are sorted by their creation date, not by the file modification date
- Geolocation data is extracted from WiFi networks and GPS times and dates from images
- Birthdays and holidays are filtered into a new section, wherever possible
- Calendar accounts are now reported
New application analyzers
- Shazam
- Find My iPhone
- Talkray
- Allo
- Cloud Mail.Ru
- Call Recorder
- Alcatel To Do
Updated application analyzers
- Text Free Ultra
- Evernote
- Vine
- Viber
- Facebook Messenger
- Badoo
- LINE
- Kik
- ICQ
Bug fixes and other enhancements
- Improved compatibility of Connector app with old Androids (3.6.1)
- Fixed some problems where large numbers of messages (primarily phone messages or WhatsApp messages) resulted in empty reports
- Improved analysis of data from folders and memory cards
- Analysis of data coming from a folder or memory card improved
- SIM card readers now report an error if the extraction process is interrupted