Exponent MobileMedia^TM

API Forensics^TM is proud to announce the release of Exponent MobileMedia^TM, the next product in a series of offerings belonging to the Exponent^TM library of DFIR add-on X-Tensions for X-Ways Forensics (XWF).

Exponent MobileMedia^TM is designed to import pictures and videos into X-Ways Forensics from Android and iOS devices that have been acquired by 3rd party mobile forensic software tools. In addition, standalone iTunes Backups are also supported. Select third party mobile forensic software products are currently supported with plans for others being supported in the very near future.

Supported mobile device forensic tools are widely popular with forensic practitioners who need to investigate smartphone devices. Exponent MobileMedia^TM leverages the pre-processing they perform by reading, decoding and importing data made available through or reported by the tools.

Advantages for Forensic Investigators

In the relentless fight to prevent and solve crimes involving CASM materials, law enforcement investigators usually collect evidence to supports the facts in issue for these types of cases, from computers and mobile devices. The challenge they face is that there is no one tool that makes it easy to comb through media based evidence all at the same time.

In most cases, investigators use one tool to perform examinations of computers (desktop, notebooks, hard drives) and another tool to examine mobile devices (cell phones, tablets). Unfortunately, this requires twice the amount of time needed to complete the analysis because the evidence cannot be combined into one investigative platform.

That is….until now!

Power Analysis with X-Ways Forensics (XWF)

Exponent MobileMedia^TM does not re-invent the wheel when it comes to embedded objects extraction such as Exif metadata, video frames and timestamps. Instead, Exponent MobileMedia^TM imports decoded data (and files) from third party tools, directly into an X-Ways Forensics Case file. From there, investigators can leverage the power of XWF built-in features and functionalities using Refine Volume Snapshot to automatically extract Exif metadata, embedded objects, conduct file signature analysis, and event create frame stills for videos.

One thing examiners will appreciate is how Exponent MobileMedia^TM recreates the original source file folder structure for each media file that is imported. This is prominently displayed in the Case Data pane within XWF and is loaded as its own Evidence Object. This not only makes it intuitive for investigators to explore, but it mirrors the full path for each artifact, where it was originally located on the source device.

IMPORTANT: Exponent MobileMedia^TM identifies and preserves vital metadata during the importation process ensuring that continuity of evidence is adhered to throughout the investigative process. This not only includes the file original path on the device, but includes embedded or decoded timestamps for each media file (e.g., Created, Modified, Written) if available.

Download Your Free Trial

Get started today and realize the full potential of Exponent MobileMedia^TM in your X-Ways Forensics investigations. Simply fill out the download request form and we’ll send you an Exponent^TM 30-day trial license by email.