Whenever to access the evidence phone at the crime scene, you may always suffer from insufficient time and its complicated steps to use the mobile forensic tool.
MD-LIVE has armed itself with various useful features to save the investigation time and to meet these needs for smartphone forensics.
Go check the features and find out how you can empower your investigation with MD-LIVE.

Check our YouTube channel and catch up with our latest product videos!

We’ve been keeping up with the research on the globally rising social media apps, today we’ll introduce MeWe and Threema. MD-RED is supporting data analysis of MeWe Android from MD-RED v3.7.29 and Threema Android, MD-RED v3.7.31. Follow the below article and find out major features and how MD-RED displays the analysis results. 

1. MeWe 

• What’s MeWe?

MeWe is the uplifting social network service app with awesome social features people love along with no ads, no targeting, and no newsfeed manipulation.  It has a timeline, groups, pages you can join, friends can make, a built-in messaging tool, and a profile page for users to customize.

• Major features of MeWe and Analysis results of MD-RED

2. Threema

• What’s Threema?

Threema is a paid open-source end-to-end encrypted instant messaging application for iOS and Android. The software is based on privacy by design principles as it does not require a phone number or any other personally identifiable information. Data is stored in an encrypted DB, and more security settings can be added to the settings. Users can do text messaging, make voice, and video calls, send multimedia, locations, voice messages, and files.

• Major features of Threema and Analysis results of MD-RED

If you want to read the full article, please download the PDF file.

Today, Zepeto and Clubhouse are the rising apps, the app user is growing fast, and it’s recognized as a new generation of social media. MD-RED is supporting the data analysis of Zepeto (Android) from v3.7.26, Zepeto (iOS) from v3.7.31, and Clubhouse (iOS) from v3.7.20.  Through this article, you may learn the basic features of Zepeto, Clubhouse, and how MD-RED can analyze and display the data.

• What’s Zepeto

The Zepeto app is a metaverse (virtual platform) of a creative studio developed by Naver Z Corporation. The friends in Zepeto can share a common room and have fun activities by creating 3D avatars with displayed items available in this environment. The pictures and videos taken in the various maps in Zepeto world can be shared through the feed.

– Account information

Account information is displayed in ‘Account’ and you can find out the user’s name, Inner ID, and creation date and time.

– Chat data: Message

Click the speech bubble on the screen to display the chat list. Conversation supports 1:1, group chat and is analyzed as follows. Chat data such as chat room name, chat room ID, group chat status, chat room creation date, participant, chat room creator are analyzed.

In chat rooms, users can send text, images, and video files. MD-RED analyzes and displays those contents as message type, creation date, content, attachment, sender, message ID, chat room.

• What’s Clubhouse

Clubhouse is social audio app which is a voice networking app developed by Alpha Exploration. It’s designed to have audio/voice communication in real-time in the chat room. MD-RED supports Clubhouse (iOS) analysis from v3.7.20, supported targets are the account, contact, and notification message. And a text-based chat room ‘Backchannel’ feature will be supported by MD-RED soon.

 – Account Information

Supports to analyze the Account name, ID, Inner ID, and Profile image.

– Contacts

The information of the chat room participants in the list is displayed in the contact analysis result.

– Alarm message

An alarm message is analyzed and displayed in the message analysis result. This allows us to infer the user’s activity.

If you want to read the whole article, download the PDF.

The Number Plate Analysis is a feature that is machine-learned from low-quality of number (0 to 9) images and predicts the number when a low-quality image is added. An existing enhancement feature in MD-VIDEO also can help you to identify numbers from the low-quality images by applying various enhancement options such as Super Resolution and Motion Deblurring feature.

However, this smart feature can support you to get the data without any complicated steps, it’s much easier, time-saving and you’ll get the most reliable results!

How to Analyze Blurred License Plates                                                            

On the frame, drag the area you want to crop on the canvas then right-click in the [Number Plate] area. Click [Add new bounding box] to specify the area for each number then click Analyze.

You can also check why MD-VIDEO got the result via [Show Detail], it shows you the probabilities of each number analyzed by the number plate analysis model.

Review the Image Enhancement results

You can check the analyzed result from ‘Image Enhancement Results’, it shows Image, Probability, and Attribute.

1. Image is the number plate file you select to analyze.
2. Probability shows each number’s numerical probability determined by the number plate analysis model.
3. Attribute shows the name, source file path, location, resolution of the improved image, history and user can add comment.

To read the full article, please download the PDF.

Why forensic investigators must keep their eye on the Samsung Secure Folder? Like the word ‘Secure Folder’, Samsung Secure Folder is separated from the normal storage space and encrypted based on Samsung’s security technology ‘Knox’. PIN/pattern/password or biometric verification is required to access the secure folder. The data in the secure folder is not accessible from outside and is not visible even when the device is connected to the PC. This means, personal or confidential data can be stored in Samsung Secure Folder, and this can be the core data for your forensic investigation. Today we introduce how MD-NEXT can help you to approach Samsung Secure Folder with various methods by models, MD-NEXT will support Android version 11 soon, and you’ll get more meaningful data!

*’The ‘Knox’ space manages the entire space variably just like many apps manage data in their DB. And when data is deleted from the Knox, it is returned to the non-allocated area of the basic storage space, therefore, ‘Logical Extraction’ is carried out in file unit.

MD-NEXT Extraction methods by Models

• Galaxy A5/S7/S8/S9/Note8/Note9 Series (Exynos & Qualcomm)

If the Android security patch level is before August 2019, you can obtain the security folder using the ADB Pro T4 method. The USERDATA partition is acquired as a physical image, and additionally, the files stored in the secure folder are decrypted and acquired as a separate logical image.

• Galaxy A6/A7/S9/J6/Note9 Series (Exynos)

If the Android OS version is 10, you can obtain the secure folder using the Bootloader Pro method. Like the ADB Pro T4 method, the USERDATA partition is acquired as a physical image, and additionally, the files stored in the secure folder are decrypted and acquired as a separate logical image.

• Galaxy A30/A40/A50/S10/Note10 Series + Galaxy Tab A 10.1 Series (Exynos)

Samsung Galaxy S10 and Note 10 series of devices and some A series of devices, you can obtain a secure folder by using the Full Filesystem (Bootloader Pro2) method (Supports both Android 9,10 and 11). When acquiring the active files of the USERDATA partition, the files stored in the secure folder are decrypted and acquired as a single logical image.

How to Review Data?

The data in the secure folder is acquired as a separate logical image from the physical image of the USERDATA partition. The file naming scheme for logical images has been changed in MD-NEXT version 1.89.5(Released date Jul.15, 2020), so the file name may differ depending on the version. Information on the file name and extension of the acquired images can be checked in the acquisition report.

Download PDF_MD-NEXT – Samsung Secure Folder

‘MD-LIVE’ New features to Save your Onsite Investigation Time

Whenever to access the evidence phone at the crime scene, you may always suffer from insufficient time and its complicated steps to use the mobile forensic tool. The search on the apps to watch and the pinpoint of the keywords from the piles of text messages are getting crucial for the first responders. MD-LIVE has armed itself with two useful features to save the investigation time and to meet these needs for smartphone forensics.

1. ‘Keyword’

The keywords that are frequently searched such as drug, sexual assault, murder cases can be grouped and registered by category. Users can select a category that matches the case, it can save much time from repetitive searching keyword routine and prevent missing important search terms. Moreover, user can continuously update the keyword list and share with their colleagues by Import/Export feature.

–                How to register keywords?

Click the ‘Keyword’ icon in the upper right corner of MD-LIVE. Enter the keyword group name in ‘Name’ and list the search terms to be included in the ‘keyword’, separated by ‘;’, and click the ‘Add keyword’ button.

 –                How to search with keywords?

Select the target you want to search from the list of registered keywords and click the ‘Search by selected keyword’. Then MD-LIVE performs a multi-search on the targets registered in the keyword group.

2. ‘Watch List’

If there are apps to be scanned every time or need to quickly scan a specific list of apps according to your institution’s needs, ‘Watch List’ is a preferentially considerable feature. This supports you to easily determine whether a specific app is installed in the device in advance. By selecting a forensic target at a time, it saves you a lot of time from searching multiple apps each time and selecting them as targets. And once app scanning is completed you can quickly determine whether an in-depth forensic investigation is needed on the specific target.

–                How to use Watch List feature?

Connect the device and operate Watch List feature on the [Select Data] step. Target apps can be added by right-clicking on the desired app and the list of apps can be managed by ‘Manage Watch List’ at the top right of MD-LIVE. Select ‘Manage Watch List’ and add the package name of the app you want to specify.

An eye-shaped badge will be displayed next to the app, and you can easily review all the listed apps through the ‘Watch List’ filter and select them as an extraction target at once.