MOBILedit Forensic Tool 

LINK 





Core Functions on Phones:

1. Data Extraction

It can collect data such as:
Call logs
Contacts
SMS/MMS messages
Photos and videos
Audio recordings
Calendar entries
Notes and reminders
Documents and files
App data (depending on device and access level)


2. Application Analysis

Analyzes data from messaging and social media apps, including supported apps like:

WhatsApp
Signal
Telegram
Viber
Skype
Facebook Messenger
WeChat

3. Deleted Data Recovery

Where technically possible, it can recover deleted:
Messages
Files
Photos
Application artifacts


4. Physical and Logical Acquisition

Logical extraction: Collects data through operating-system interfaces.
Physical acquisition: Creates a bit-for-bit image of storage on supported devices, enabling deeper forensic analysis.


5. Device Information Collection

Obtains information such as:
IMEI
Device model
Firmware version
SIM information (IMSI, ICCID)
Operating system details


6. Security Bypass Features

Some editions include methods for:

Bypassing certain Android lock screens on supported models.
Accessing data from iOS devices using trusted pairing ("lockdown") records when available.


7. Cloud and Backup Analysis

Can analyze:
iTunes/iOS backups
Android backups
Some cloud-related artifacts and account data depending on access and device state.

8. Media Intelligence

Additional modules can provide:
Face matching
Photo categorization
Camera-origin analysis
Malware detection using YARA rules
Important Limitations

Modern Android and iPhone devices use strong encryption. On newer devices, especially recent iPhones and Android 12+ devices, forensic tools often cannot access all data unless:

The device is unlocked,
A trusted pairing record exists,


A supported forensic exploit is available,
Or the examiner has the necessary credentials.