Test Results for Mobile Device Acquisition Tool: Mobile Phone Examiner Plus (MPE+) 4.6.0.2

• NCJ Number: 238996
• Date Published: September 2012
• Length: 139 pages
• Grant Number(s): 2003-IJ-R-029
• Agencies: NIJ
• Publication Type: Test/Measurement

Annotation

This document reports the results from testing Mobile Phone Examiner Plus, version 4.6.0.2, against the Smart Phone Tool Test Assertions and Test Plan.

Abstract

Test results provide the information needed for developers to improve tools, users to make informed choices, and the legal community and others to understand the tools' capabilities. Mobile Phone Examiner Plus is designed for logical and physical acquisitions, data analysis, and report management from mobile phones, Smart phones, and Subscriber Identity Modules (SIMs). The tool was tested for its ability to acquire active and deleted data from the internal memory of mobile devices and SIMs. Except for the anomalies identified in the testing, the tool acquired all supported data objects completely and accurately for all six mobile devices tested. The anomalies pertained to device connectivity, subscriber-related and equipment-related information reported, personal information management (PIM) data, call logs, abbreviated dialing numbers, non-ASCII characters, the acquisition of internal memory data elements, and device acquisition disruption. After summarizing the results of the test runs, the remaining sections of the report describe how the tests were conducted, discuss any anomalies that were encountered, and provide documentation of test-case run details that support the report summary. One of the sections provides justification for the selection of test cases from the set of possible cases defined in the test plan for Smart phone forensic tools. Generally, the test cases are selected based on features of the tool. Hardware and software used to run the test cases are described in another section. The concluding section describes each test-case run. These descriptions list all test assertions used in the test case, the expected result, and the actual results. Extensive tables