Case Studies

Explore our confidential case studies where Xpert Forensics uncovered digital fraud, insider threats, data leaks, and cyber misconduct using advanced forensic tools and investigative techniques. Each case reflects our commitment to precision, discretion, and delivering actionable insights that drive resolution.

How MOBILedit Forensic Ultra Helped Acquire Evidence After Rooting Failure

Introduction

Mobile forensic investigations often encounter devices protected by modern Android security mechanisms that restrict access to critical system areas. While advanced acquisition methods such as rooting can sometimes provide deeper access to device data, they are not always successful due to manufacturer protections, Android security controls, and device-specific limitations.

This case study demonstrates how MOBILedit Forensic Ultra enabled investigators to successfully acquire and preserve evidentiary data from a Motorola Edge 50 Pro after root-based acquisition methods failed.

Case Background

A Motorola Edge 50 Pro was submitted for forensic examination as part of a digital investigation. The primary objective was to collect available user data, device information, communication records, and other relevant artifacts for further analysis. As part of the examination process, investigators initially attempted to obtain enhanced access through rooting. However, the rooting procedure was unsuccessful due to security restrictions implemented on the device.

Rather than ending the investigation, an alternative acquisition strategy was adopted using MOBILedit Forensic Ultra’s logical extraction capabilities.

Evidence Filtering Before Extraction

Before beginning the extraction process, MOBILedit provided several filtering options that allowed investigators to focus on potentially relevant evidence.

These filtering capabilities included:

Time-Based Filtering

Investigators can define specific date ranges to focus on activity occurring during a particular incident period. This is especially useful in employee misconduct investigations, fraud examinations, data theft cases, and internal corporate investigations.

Contact-Based Filtering

The software allows filtering of records associated with specific individuals, phone numbers, or contact identifiers, helping investigators isolate communications relevant to the investigation.

Keyword-Based Filtering

MOBILedit supports filtering based on keywords or phrases, enabling investigators to identify records related to specific projects, organizations, individuals, or events.

Filter Modes

The platform offers multiple approaches for handling filtered results:

No Filtering
Display Only Matching Records
Highlight Matching Records Within Reports

These features can significantly reduce review time when dealing with large data sets.

Extraction Profile Selection

After reviewing the available acquisition options, investigators selected the Full Content extraction profile.

MOBILedit offers several acquisition profiles including:

Full Content
Application Analysis
Device Information Only
Parental Check
Specific Selection

The Full Content profile was chosen because it provides the most comprehensive logical acquisition available without requiring root access.

Logical Acquisition Process

The extraction was performed using MOBILedit’s logical acquisition methodology through the established ADB connection.

Unlike file system or physical acquisitions, logical extraction focuses on data that is accessible through the operating system and available user-level interfaces.

The acquisition successfully collected available artifacts including:

Device information
Installed application inventory
Contacts
Call logs
SMS records where accessible
Images
Videos
Audio files
Documents
Downloaded files
User-accessible storage contents
Application metadata

The extraction was completed without modifying user data and maintained the integrity of the evidence source.

Understanding the Limitations

One of the most important aspects of mobile forensics is accurately documenting acquisition limitations. Because root access was not obtained, certain protected areas of the device remained inaccessible.

The logical acquisition did not provide access to:

Saved passwords
Email account credentials
Authentication tokens
Android Keystore information
Protected application databases
Encrypted application containers
System-level protected artifacts
Physical storage sectors
Full file system data

These limitations are consistent with Android security architecture and should be expected when performing logical extractions on non-rooted devices.

Report Generation and Data Preservation

Upon completion of the extraction, MOBILedit generated multiple output formats to support forensic review, evidence preservation, and future analysis.

HTML Report

An interactive HTML report was generated to facilitate evidence review and navigation.

PDF Report

A PDF report was created for documentation, presentation, and legal purposes.

MOBILedit Backup

A forensic backup of the acquired data was generated, allowing investigators to revisit the extraction without reconnecting the original device.

Cellebrite UFDR Export

The extracted data was also exported in UFDR format, enabling further examination using Cellebrite Physical Analyzer and other compatible forensic workflows. This capability allows investigators to validate findings across multiple forensic platforms and perform advanced analysis when required.

Results

Although the rooting process was unsuccessful, the investigation still achieved a successful outcome through logical acquisition.

The examination produced:

Comprehensive logical extraction
Device metadata
Communication records
Multimedia evidence
Application inventory information
HTML forensic reports
PDF forensic reports
MOBILedit backup files
Cellebrite UFDR exports

The acquired evidence provided investigators with valuable information for review, reporting, and further forensic analysis.

Conclusion

This case demonstrates that a failed rooting attempt does not necessarily prevent a successful forensic investigation. Modern Android security controls may restrict advanced acquisition techniques, but logical extraction remains a highly effective method for collecting evidentiary data from supported devices. Using MOBILedit Forensic Ultra, investigators were able to acquire, preserve, document, and export critical data from a Motorola Edge 50 Pro despite the inability to obtain root access.

The combination of flexible acquisition profiles, advanced filtering capabilities, comprehensive reporting, and UFDR export functionality makes MOBILedit Forensic Ultra a valuable tool for mobile forensic investigations where advanced extraction methods are unavailable or unsuccessful.