Beruflich Dokumente
Kultur Dokumente
Quick Install
| 3
Legal Information
2012 AccessData Group, LLC All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. AccessData Group, LLC makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, LLC reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, AccessData Group, LLC makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, LLC reserves the right to make changes to any and all parts of AccessData software, at any time, without any obligation to notify any person or entity of such changes. You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside.
AccessData Group, LLC. 384 South 400 West Suite 200 Lindon, Utah 84042 U.S.A. www.accessdata.com
is a registered trademark of AccessData Group, LLC. Toolkit is a registered trademark of AccessData Group, LLC. Recovery Toolkit is a registered trademark of AccessData Group, LLC.
| 4
Forensic FTK
Password
PRTK Registry
is a registered trademark of AccessData Group, LLC. Viewer is a registered trademark of AccessData Group, LLC.
A trademark symbol (, , etc.) denotes an AccessData Group, LLC. trademark. With few exceptions, and unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark and copyright holders. AccessData claims no responsibility for the function or performance of third-party products. Third party acknowledgements:
FreeBSD AFF
and AFFLIB Copyright 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology Corp. All rights reserved. 2005 - 2009 Ayende Rahien
Copyright
Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your purchase.
Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows you to access technical support, and to download and install the latest releases for your licensed products during the active license period. Following the initial licensing period, a subscription renewal is required annually for continued support and for updating your products. You can renew your subscriptions through your AccessData Sales Representative. Use LicenseManager to view your current registration information, to check for product updates and to download the latest product versions, where they are available for download. You can also visit our web site, www.accessdata.com anytime to find the latest releases of our products. For more information, see Managing Licenses in your product manual or on the AccessData web site.
| 5
General Corporate Hours: State and Local Law Enforcement Sales: Federal Sales:
Corporate Sales:
Training:
Accounting:
Technical Support
Free technical support is available on all currently licensed AccessData products. You can contact AccessData Customer and Technical Support in the following ways:
| 6
Monday through Friday, 8:00 AM 5:00 PM (UK-London), except corporate holidays. Voice: +44 207 160 2017 (United Kingdom) Email: emeasupport@accessdata.com Monday through Friday, 5:00 PM to 1:00 AM (UK/London), except corporate holidays. Voice: 801.377.5410 Option 5*. Monday through Friday, 1:00 AM to 5:00 AM (UK/London), except corporate holidays. Email: afterhours@accessdata.com
Other
Web Site:
http://www.AccessData.com/Support The Support web site allows access to Discussion Forums, Downloads, Previous Releases, our Knowledgebase, a way to submit and track your trouble tickets, and in-depth contact information.
AD SUMMATION
Americas/Asia-Pacific: 800.786.2778 (North America). 415.659.0105. Email: support@summation.com Monday through Friday, 6:00 AM 6:00 PM (PST), except corporate holidays. Monday through Friday by calling 415.659.0105. Between 12am and 4am (PST) Product Support is available only by email at afterhours@accessdata.com. 866.278.2858 Email: support@casevault.com Monday through Friday, 8:00 AM 6:00 PM (EST), except corporate holidays.
Standard Support: After Hours Support: After Hours Email-only Support: AD Summation CaseVault
866.833.5377 Email: dcsupport@accessdata.com Monday through Friday, 7:00 AM 7:00 PM (EST, except corporate holidays.
Support Hours:
Note: All support inquiries are typically responded to within one business day. If there is an urgent need for support, contact AccessData by phone during normal business hours.
Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital investigations including law enforcement, counter-intelligence, and corporate security. Their collective experience in working with both government and commercial entities, as well as in providing expert testimony, enables them to provide a full range of computer forensic and eDiscovery services.
| 7
At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, FTK Pro, Enterprise, eDiscovery, and Lab. They can help you resolve any questions or problems you may have regarding these products
Number or Address
Washington DC: 410.703.9237 North America: 801.377.5410 North America Toll Free: 800-489-5199, option 7 International: +1.801.377.5410
adservices@accessdata.com
| 8
Prerequisites
This section outlines what is required to set up a fully functional AccessData MPE+ system. The system must have:
A
current AccessData MPE+ license that meets or exceeds the minimum system requirements. .NET Framework 4.0 or newer.
Hardware/software Microsoft
For information on system requirements for extraction from Apple phones see http://support.apple.com/kb/ HT1426.
Optional Hardware
A
| 9
Note: Several cables are included with MPE+. MPE+ is also compatible with the Susteen brand cable
set. For a list of mobile phones and the cable required to interface each phone with the investigating computer, click the Supported Devices button on the desktop application toolbar.
SIM
/ USIM card reader (Most PC/SC compliant card readers are supported). Field Tablet (sold separately).
MPE+
Note: The MPE+ Tablet ships with the accelerometer feature enabled. This may cause unwanted
behavior in the list view when moving the Tablet. To normalize the behavior, disable the accelerometer feature.
Bluetooth
1.2 compliant wireless card. MPE+ supports data connections via Bluetooth for certain devices.
Installing MPE+
Important: Before you begin installing MPE+, configure your antivirus and/or malware scanner to ignore the AccessData folder (AppData\Roaming\AccessData). Antivirus and malware scanning programs can mistake AccessData exploits and delete them. If the exploits are deleted, you will not be able to use them.
In Control Panel, double-click Add/Remove Programs. On the left tab of the Add/Remove Programs window, click Add/Remove Windows Components. Once the Windows Components Wizard opens, click to select the Message Queuing Services item. Click Next. This will start the MSMQ 2.0 setup process. Your Windows XP installation CD-ROM, network share, or install point must be available. MSMQ will display an installation dialog box. You will be prompted to install either an MSMQ server or a dependent client. You can install MSMQ 2.0 in Workgroup mode by selecting Message Queuing Will Not Access a Directory Service.
Installing MPE+
| 10
To install MPE+
1. 2. 3. 4. 5. 6.
Plug your codemeter stick into your computer. Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. On the web page, click Install MPE+. Click Run. Click Run. In the MPE Setup pop-up, click Install if you want to install the listed components of MPE+.
Note: If you do not have the latest version of iTunes installed on your system, MPE+ will prompt you to update your iTunes. If you update iTunes and restart your machine, you will have to restart the MPE+ install.
the MPE+ application from the ClickOnce website and save it to a flashdrive or burn it to a
disk.
Use
Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Expand the option for Offline Downloads. Download the appropriate offline installer and firmware package. Extract the offline installer and put its contents, along with the firmware package and the Apple physical support files installer, on media to transport to your forensic machine. Ensure your CodeMeter USB is connected and has a current MPE+ license. Insert the MPE+ installation media into the machine. (If the autorun.exe does not launch automatically, explore the disk drive and run it manually.) Follow the instructions in Installing the MPE+ Application Using ClickOnce (page 10).
Note: If you want to be able to extract physical images from Apple devices, you will also need to contact Support at 800-658-5199 to obtain the Apple physical support files
Insert the codemeter into the machine. Insert the MPE+ original dvd into the machine. (If the autorun.exe does not launch automatically, explore the disk drive and run it manually.) Select to install either MPE+ Install or MPE+ Tablet install (for Touch screen PC tablets). Follow the instructions in Installing the MPE+ Application Using ClickOnce (page 10).
Installing MPE+
| 11
Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Download one of the following firmware options:
Windows Windows Windows
Save the download file somewhere on your computer where you can browse to the location. Open MPE+. Select Manage > Import Drivers.
Browse to the directory where you saved the firmware file (just the folder, not the file name is needed). Click OK and the firmware will begin the update.
Uninstall old version(s) of MPE. (This step is now optional. As of MPE+ 4.3, over-the-top upgrades are supported.) Install new version of MPE+. See Installing MPE+ on page 10. Activate using the new license key license when prompted.
Open MPE+. Under the Product Information pane, click the Physical Acquisition Support tab.
Installing MPE+
| 12
2.
Click Download to download the file for the device that you want. MPE+ has files for the following devices:
iPad1 iPad1C 1Phone2G iPhone3G iPhone
3GS
3.
Installing MPE+
| 13
You can also install drivers manually. See Manually Installing Drivers on page 15.
Open MPE+. Under the Product Information pane, click the Driver Management tab.
2.
a group of drivers that you want to download, and click Download All. an individual driver, expand the OS group, and click Download.
Drivers
Acer Alcatel Asus Dell Google HTC Huawei Kyocera LG Motorola Pantech Samsung Vizio ZTE
Installing MPE+
| 14
Drivers
Drivers for older devices. If you are unsure whether your device is considered a legacy device or not, download drivers from both Android and Legacy sections. Acer EMGETON FTDI iDen Lenovo LG Older Phones Motorola Nokia Prolific Samsung SonyEricsson SIMReader
WindowsMobile
3. 4.
WindowsMobile
After the driver(s) have been downloaded, you will need to install them. Click Install All/Install.
Verify the device manufacturer and model is listed in the Supported Device list. View the list by clicking the Supported Devices button under the Manage tab.
2. 3.
Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Locate and download the driver that you want to install.
Installing MPE+
| 15
4. 5. 6. 7. 8.
Save the download file somewhere on your computer where you can browse to the location. Open MPE+. Select Manage > Import Drivers.
Browse to the directory where you saved the driver. Click OK and the driver will install.
Verify the device manufacturer and model is listed in the Supported Device list. View the list by clicking the Supported Devices button under the Manage tab.
2. 3.
Locate the correct USB cable and connect the phone to the computer through the USB cable. Upon connecting the device, Windows will automatically attempt to locate the appropriate driver. You will likely be prompted to provide the path to the appropriate driver; if so, browse to the path of the driver based on the name of the manufacturer found in the device drivers folder. Once you have selected a driver, Windows will provide feedback as to whether or not the driver was successfully installed. If the selected driver fails to install, you may need to repeat the process starting from Step 1. If Windows indicates that the driver did install successfully, however, proceed to the next step. Once the driver has been successfully installed, you may be prompted to locate additional drivers, this is normal and you should continue to repeat the process for as many drivers as Windows detects that it needs. Verify the device is properly listed in the Windows Device Manager.
4.
5.
6.
Note: Only currently connected devices will be listed in Windows Device Manager. Device drivers you have installed previously will not be listed unless the device is connected. Note: IIf you choose to skip this step, all other features will still function, but this prompt will appear each time you open MPE+ until you allow the files to download.
Installing MPE+
| 16