Follow

How can I collect logical data from an Android device with MPE+?

Created by: Brendan Bone
Created date:
Last Updated date:

Devices: Most Android devices
Type of Capture: Logical

Connecting via MPE+:

  1. Install the ADB (Android Debug Bridge) driver for your device. Most Android drivers can be installed via the "Driver Management" tab on MPE+'s Home screen.
  2. On the device itself, enable USB Debugging.
  3. On the device itself, enable app installations from Unknown Sources.
  4. On the device itself, disable App Verification.
  5. Connect the device with the proper cable.
  6. Unlock the device.
  7. Ensure the device is in "Charge Only" mode, or any mode that does not mount the device as an external drive.
  8. Click the "Select Device" button on the Main toolbar in MPE+.
  9. Select the device's Manufacturer and Model in the drop-downs.
  10. Click "Connect".
  11. If prompted on the device itself, "Trust" the connection.
  12. Proceed to acquire the data you want.


Stand-alone (dSOLO):

  1. Insert a blank, FAT32 formatted, SD card in your PC.
  2. Click the "Configue dSOLO Mode" button on the Tools toolbar.
  3. Select the data types you'd like to acquire.
  4. Under "Device Selection", select the drive corresponding to your SD card.
  5. Click "Create Apk".
  6. On the device itself, enable USB Debugging.
  7. On the device itself, enable app installations from Unknown Sources.
  8. Insert the prepared dSOLO card in your device.
  9. Using a file manager on the device, navigate to and install the MPE.apk from your SD card. Some devices may also let you access the APK via the Browser/Internet app with a URL like "file:///sdcard/mpe.apk".
  10. Run the newly installed "AccessData MPE+" app (the app will automatically uninstall itself after running).
  11. Insert the SD card in your PC.
  12. Click to "Read dSOLO Files" button on the Tools toolbar.
  13. Navigate to and open the .dSOLO file from your SD card

Notes:

  • dSOLO cards/apps can be used on multiple devices, as long as there is sufficient space on the card, before retrieving the collected data with MPE+. Each collection will be saved in its own .dSOLO file and named with a timestamp corresponding with the extraction time.
  • When you have the proper ADB driver installed and the device is in Debugging mode, Device Manager will usually list an ADB Interface, Android Phone, or Android USB Device, and the device will not be seen as a mass storage device.
  • If an Android device isn't explicitly listed as supported, you can usually still perform the extraction by selecting "Android" in the Manufacturer drop-down and "dLogical" in the Model drop-down.
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk