AccessData Plus Mobile Phone Examiner User guide

PDF

Dokumentum

Hirdetés

AccessData

CCESS

ATA

EGAL AND

ONTACT

NFORMATION

EGAL

NFORMATION

AccessData Group, LLC makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData

Group, LLC reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, AccessData Group, LLC makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, LLC reserves the right to make changes to any and all parts of AccessData software, at any time, without any obligation to notify any person or entity of such changes.

You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside.

©2010 AccessData Group, LLC All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

AccessData Group, LLC.

384 South 400 West

Suite 200

Lindon, Utah 84042

U.S.A.

www.accessdata.com

AccessData Legal and Contact Information i

CCESS

ATA

RADEMARKS

• AccessData ® is a registered trademark of AccessData Group, LLC.

• Distributed Network Attack ® is a registered trademark of AccessData Group, LLC.

• DNA ® is a registered trademark of AccessData Group, LLC.

• Forensic Toolkit ® is a registered trademark of AccessData Group, LLC.

• FTK ® is a registered trademark of AccessData Group, LLC.

• Password Recovery Toolkit ® is a registered trademark of AccessData Group, LLC.

• PRTK ® is a registered trademark of AccessData Group, LLC.

• Registry Viewer ® is a registered trademark of AccessData Group, LLC.

OPYRIGHT

NFORMATION

A trademark symbol ( ® , ™, etc.) denotes an AccessData Group, LLC. trademark. With few exceptions, unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark and copyright holders.

AccessData claims no responsibility for the function or performance of third-party products.

AFF®

AND

AFFLIB®

Simson L. Garfinkel and Basis Technology Corp. All

This code is derived from software contributed by:

• Simson L. Garfinkel

• Olivier Castan

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

AccessData Mobile Phone Examiner Plus User Guide

3. All advertising materials mentioning features or use of this software must display the following acknowledgement:

This product includes software developed by Simson L. Garfinkel and Basis Technology Corp.

4. Neither the name of Simson L. Garfinkel, Basis Technology, or other contributors to this program may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY SIMSON L. GARFINKEL, BASIS

TECHNOLOGY, AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR

IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A

PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL SIMSON

L. GARFINKEL, BASIS TECHNOLOGY, OR CONTRIBUTORS BE LIABLE

FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED

AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

AFF ® and AFFLIB ® are a registered US trademarks ( US 3232830 & US 3232831 ) of Simson

Garfinkel and Basis Technology Corp.

The terms of this license can be modified by Simson L. Garfinkel or Basis Technology

Corp.

YENDE

AHIEN

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

• Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

• Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

AccessData Legal and Contact Information iii

• Neither the name of Ayende Rahien nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES,

INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR

CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR

OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,

EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

OCUMENTATION

ONVENTIONS

In AccessData documentation, a number of text variations are used to indicate meanings or actions. For example, a greater-than symbol (>) is used to separate actions within a step. Where an entry must be typed in using the keyboard, the variable data is set apart using [variable_data] format. Steps that required the user to click on a button or icon are indicated by italics.

A trademark symbol (®, ™, etc.) denotes an AccessData Group, LLC. trademark. Unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark and copyright holders. AccessData claims no responsibility for the function or performance of third-party products.

EGISTRATION

The AccessData product registration is done at AccessData after a purchase is made, and before the product is shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your purchase.

AccessData Mobile Phone Examiner Plus User Guide

UBSCRIPTIONS

AccessData provides a one-year licensing subscription with all new product purchases.

The subscription allows you to download and install the latest releases for your licensed products during the active license period. Following the initial licensing period, a subscription renewal is required annually for updating your products. You can renew your subscriptions through your AccessData Sales Representative.

Use LicenseManager to view your current registration information, to check for product updates and to download the latest product versions, where they are available for download. You can also visit our web site, www.accessdata.com

anytime to find the latest releases of our products.

For more information, see Managing Licenses in your product manual or on the

AccessData web site.

CCESS

ATA

ONTACT

NFORMATION

Your AccessData Sales Representative is your main contact with AccessData Group,

LLC. Also, listed below are the general AccessData telephone number and mailing address, and telephone numbers for contacting individual departments.

AILING

DDRESS AND

ENERAL

HONE

UMBERS

You can contact AccessData in the following ways:

TABLE C

ONTACT

NFORMATION

-1 AD Mailing Address, Hours, and Department Phone

Numbers

Corporate Headquarters:

General Corporate Hours:

State and Local

Law Enforcement Sales:

AccessData Group, LLC.

384 South 400 West

Suite 200

Lindon, UT 84042 USA

Voice: 801.377.5410

Fax: 801.377.5426

Monday through Friday, 8:00 AM – 5:00 PM (MST)

AccessData is closed on US Federal Holidays

Voice: 800.574.5199, option 1

Fax: 801.765.4370

Email: [email protected]

AccessData Legal and Contact Information v

TABLE C ONTACT I NFORMATION -1 AD Mailing Address, Hours, and Department Phone

Numbers

Federal Sales:

Corporate Sales:

Training:

Accounting:

Voice: 800.574.5199, option 2

Fax: 801.765.4370

Email: [email protected]

Voice: 801.377.5410, option 3

Fax: 801.765.4370

Email: [email protected]

Voice: 801.377.5410, option 6

Fax: 801.765.4370

Email: [email protected]

Voice: 801.377.5410, option 4

ECHNICAL

UPPORT

You can contact AccessData Customer and Technical Support in the following ways:

TABLE C

ONTACT

NFORMATION

-2 AD Customer & Technical Support Contact Information

Customer Service Hours:

Customer/Technical Support:

Free technical support is available on all AccessData products.

Monday through Friday, 7:00 AM – 6:00 PM (MST)

Voice: 801.377.5410, option 5

Voice: 800.658.5199 (Toll-free North America)

Email: [email protected]

Web site: http://www.AccessData.com/Support

The Support web site allows access to Discussion Forums, Downloads, Previous Releases, our

Knowledgebase, a way to submit and track your “trouble tickets”, and in-depth contact information.

Note: All support inquiries are typically answered within one business day. If there is an urgent need for support, contact AccessData by phone during normal business hours.

OCUMENTATION

Please email us regarding any typos, inaccuracies, or other problems you find with the documentation to: [email protected]

ROFESSIONAL

ERVICES

The AccessData Professional Services staff comes with a varied and extensive background in digital investigations including law enforcement, counter-intelligence, and

AccessData Mobile Phone Examiner Plus User Guide

corporate security. Their collective experience in working with both government and commercial entities, as well as in providing expert testimony, enables them to provide a full range of computer forensic and eDiscovery services.

At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, Enterprise, eDiscovery, Lab, and Lab Lite. They can help you resolve any questions or problems you may have regarding these products.

ONTACT

NFORMATION FOR

ROFESSIONAL

ERVICES

Contact AccessData Professional Services in the following ways:

HONE

• Washington DC : 410.703.9237

• North America: 801.377.5410

• North America Toll Free: 800-489-5199, option 7

• International: +1.801.377.5410

MAIL

[email protected]

AccessData Legal and Contact Information vii

viii AccessData Mobile Phone Examiner Plus User Guide

ABLE OF

ONTENTS

HAPTER

1 I

NTRODUCTION

The AccessData (AD) Mobile Phone Examiner Plus (MPE+) is a powerful mobile device data review tool that can be used in the field as part of a mobile field unit or in the lab. Additionally, data extracted from mobile devices using MPE+ can be easily imported into an FTK case which offers more in-depth drill-down, categorization, fulltext index searching, and all of this right along side other digital evidence collected for a case. MPE+ can extract information such as phone and address book data, media files, call logs, SMS and MMS messages, calendar, and file system data stored in the memory of a mobile device.

UDIENCE

MPE+ and its manual are written for law enforcement and corporate security professionals with the following competencies:

• Basic knowledge of and training in forensic policies and procedures.

• Basic knowledge of and experience with personal computers, mobile phones, enhanced PDA s, and SmartPhones.

• Familiarity with the fundamentals of collecting digital evidence from mobile devices.

• Understanding of forensic data images and how to acquire forensically sound images.

• Experience with case studies and reports.

• Basic competency with FTK .

• Familiarity with the Microsoft Windows environment.

ORENSIC

ASES AND

VIDENCE

ANDLING

For information on how to handle the image as evidence in a case, see the FTK User

Guide.

Chapter 1 Introduction 1

2 AccessData Mobile Phone Examiner Plus User Guide

HAPTER

2 MPE+

NSTALLATION

REREQUISITES

Before installing AccessData FTK MPE+, you need to have the following:

• The CodeMeter Runtime 4.10

b (or newer) must be installed on the computer where

MPE+ will be run.

• An GSM License Activation Key.

• Either a USB CodeMeter device, a Virtual CodeMeter (VCM), or a properly licensed

Network License Server (NLS) must be present.

ARDWARE AND

OFTWARE

EQUIREMENTS

Before using MPE+ to image and use phone images as part of an investigation, certain hardware and software requirements must be met.

Software and License Requirements

To run MPE+, in addition to the hardware requirements, you need the following:

• An additional license with separate installation.

• MPE+ operates as a standalone product on the Microsoft Windows OS platform.

• AccessData FTK must be installed if you intend to add the imaged phone data to a case for further investigation.

Images creatd by MPE+ are AccessData-proprietary AD1-type images. MPE+ images can be imported back into MPE+ , and can be added as evidence to a case in any AD

FTK -core product.

Chapter 2 MPE+ Installation 3

MPE+ requires third-party drivers to read the information on the phone and make it into

a forensic image. This is further explained in “Installing MPE+” on page 4.

Hardware Requirements

MPE+ requires the following additional hardware:

• USB ports on your machine

• WIBU-SYSTEMS C odeMeter USB or Virtual CmStick (with current licenses installed)

• A data cable specific to the mobile device. Several are shipped with MPE+ . For a list of mobile phones and the cable required to interface each phone with the investigating computer, see “Appendix A Supported Mobile Device Types” on page 33.

O PTIONAL H ARDWARE

AccessData MPE+ can be purchased together with an optional portable imaging unit currently referred to as a “MPE+ field Tablet.”

NSTALLING

MPE+

Note: The MPE+ installer automatically configures MPE to run as an administrator. In order to function properly, MPE+ 4.0 requires local administrator rights to the system, and therefore it must also be installed by a user with local administrator privileges.

To install MPE+ :

1. Insert the MPE+ installation media into the CD/DVD drive.

4 AccessData Mobile Phone Examiner Plus User Guide

Autorun launches Setup.exe.

2. Click Next to begin the installation.

Chapter 2 MPE+ Installation 5

3. Read the License Agreement, then click Agree to continue..

4. Select a destination folder and click Next to continue.

5. Click Install to begin the installation process.

AccessData Mobile Phone Examiner Plus User Guide

6. Click Finish to close the Wizard when installation is complete.

PGRADING FROM A

REVIOUS

ERSION

Deactivate your old GSM license (see “Deactivating a GSM License” on page 10 for

more information on deactivating your license).

2. Uninstall old version(s) of MPE.

3. Install new MPE+.

Activate same license key license when prompted (see “Activating a GSM License” on page 10 for information on how to activate your license).

Chapter 2 MPE+ Installation 7

8 AccessData Mobile Phone Examiner Plus User Guide

HAPTER

3 G

ETTING

TARTED

This chapter contains all the information you need to get started with MPE+, including licensing you software and cone ct i ng devices to your computer. Once you have completed the information covered in this chapter, MPE+ will be ready to extract and save data from devices.

ICENSING

BOUT

ICENSING

MPE+ requires two different licenses in order to function properly.

• MPE License: Required to launch the application.

• GSM License: Required to communicate with any GSM device.

MPE L

ICENSE

PTIONS

Choose among the following licensing options:

• USB CodeMeter device: See “AccessData Product Licenses” on page 61.

• Virtual CodeMeter: See “Virtual CodeMeter Activation Guide” on page 86.

• Network license: See “Network License Server (NLS) Setup Guide” on page 95.

Note: See “Appendix B Licensing Information” on page 61 for more information on licensing.

Note: MPE+ Field Tablet does not require an MPE license, it is already built in.

GSM L

ICENSE

The GSM Licensing information includes the following items that came with your software:

Chapter 3 Getting Started 9

• Activation Key

• User Name

Note: The Activation Key can be deactivated at any time see “Deactivating a GSM License” on page 10 for information on how to do this.

CTIVATING A

GSM L

ICENSE

CTIVATING ON AN

NLINE

OMPUTER

To activate an online computer:

1. Launch MPE+.

2. If you do not have your GSM provider license, it will prompt you to enter it. Enter the

Activation Key and User Name.

3. Click Activate.

If you have a failure during activation, you can follow the steps in “Activating on an

Offline Computer” on page 10. The process for activating on an online computer is the

same as with an offline computer except that you only do steps 1-7, 13, 15, and 16 of the offline activation.

CTIVATING ON AN

FFLINE

OMPUTER

To activate the GSM license on an system without an internet connection, refer to the

Offline Activation guide located at: http://support.accessdata.com/downloads/ActivatingGSM_OfflineGuide.pdf

EACTIVATING A

GSM L

ICENSE

The deactivate function allows the license to be removed from one machine and placed on another. To deactivate the Mobile Phone Examiner license:

1. Click the Settings button.

The Settings dialog appears.

F IGURE 4-1 Settings dialog

AccessData Mobile Phone Examiner Plus User Guide

2. Click Deactivate.

The Activation Key and User Name deactivates and the Deactivate button becomes the Activate button.

To reactive your software, enter the Activation Key and User Name that came with your software and click Activate.

Note: For help on deactivating the GSM license on an offline computer, please contact an

AccessData technical support representative.

ONNECTING

EVICES

The process of connecting a device to the system for the purpose of examination is made up of two basic tasks, installing device drivers and establishing a data connection to the device.

NSTALLING

EVICE

RIVERS

Each supported mobile device that you plan to examine must have the correct driver installed before the device is connected. For any device to be detected by MPE+ , the manufacturer’s device driver must first be properly installed.

Note: Mobile device drivers can be found on the MPE+ installation disk as well as in the ZIP archive of the MPE+ download. Users of the MPE+ Field Tablet will find that many of the most common drivers have been pre-installed on their system.

To install a manufacturer device driver, perform the following steps:

Verify the device manufacturer and model is listed in the Supported Device list. See

“Appendix A MPE+ Supported Mobile Devices” on page 35.

Chapter 3 Getting Started 11

2. Locate the correct USB cable and connect the phone to the computer through the USB cable.

3. Upon connecting the devcie, Windows will automatically attempt to locate the appropriate driver. You will likely be prompted to provide the path to the appropriate driver, if so, browse to the path of the driver based on the name of the manufacturer found in the device drivers folder.

4. Once you have selected a driver, Windows will provide feedback as to whether or not the driver was successfully installed.

If the selected driver fails to install, you may need to repeat the process starting from

Step 1.

If Windows indicates that the driver did install successfully, however, proceed to the next step.

5. Once the driver has been successfully installed, you may be prompted to locate additional drivers, this is normal and you should continue to repeat the process for as many drivers as Windows detects that it needs.

6. Verify the device is properly listed in the Windows Device Manager.

Note: Only currently connected devices will be listed in Windows Device Manager. Device drivers you have installed previously will not be listed unless the device is connected.

STABLISHING A

ATA

ONNECTION TO A

OBILE

EVICE

To connect a mobile device for the first time:

1. Power up the device (wait until the device is fully powered on before proceeding to the next step).

2. Plug in the device data cable.

3. Check Windows Device Manager to ensure that the device is being detected correctly.

If the device is not listed in the Windows Device Manager, double check that the

appropriate driver is properly installed. For mor information, See “Installing Device

Drivers” on page 11.

4. Once a data connection has been established, you are now ready to select the device in

MPE+. See “Selecting a Device” on page 18.

Note: If you unable to connect your device, follow the steps in “Resetting Mobile Device

Connection Procedure” on page 13.

AccessData Mobile Phone Examiner Plus User Guide

ESETTING

OBILE

EVICE

ONNECTION

ROCEDURE

To connect a mobile device:

1. Exit the MPE+ application.

2. Unplug the device data cable.

3. Remove the battery cover on the device.

4. Remove the battery from the device.

5. Remove the SIM card (if applicable).

6. Properly clean all battery and SIM card contacts.

7. Reassemble the device.

8. Power up the device (wait until the device is fully powered on before proceeding to the next step).

9. Plug in the device data cable.

10. Check Windows Device Manager to ensure that the device is being detected correctly.

If the device is not listed in the Windows Device Manager, double check that the

appropriate driver is properly installed. For mor information, See “Installing Device

Drivers” on page 11.

11. Launch MPE+.

12. Once a data connection has been established, you are now ready to select the device

in MPE+. See “Selecting a Device” on page 18.

Chapter 3 Getting Started 13

14 AccessData Mobile Phone Examiner Plus User Guide

HAPTER

4 U

SER

NTERFACE

This chapter will make you familiar with the graphical interface of MPE+. It will also walk you through how to select a device in MPE+, how to extract data from a device, how to import data into MPE+, and how to extract data from MPE+ into an AD1 file.

BOUT

ASKS

ENU

Use the Tasks menu to select from the following options:

• Select Device

• Extract Data

• Import to AD1

• Export to AD1

• Settings

• Exit

How to use each of these items will be covered in detail in this section.

ELECTING A

EVICE

To select a device:

Chapter 4 User Interface

1. From the Tasks menu, select Select Device. The Device Selection dialog opens.

F IGURE 3-1 Device Selection dialog

2. Select Manufacturer, Model, and COM Port from the associated drop-downs. See

“Device Selection Options” on page 19 for more information on these drop-downs.

3. Click Connect.

Note: If the device model is not listed as expected the following conditions may exist: the device is not supported; the GSM License is not properly activated, and/or MPE+ and all associated processes need to be restarted. Contact technical support for more information.

AccessData Mobile Phone Examiner Plus User Guide

Use the following table to understand the options in the Device Selection dialog.

TABLE 3-1 Device Selection Options

Manufacturer

Model

COM Port

Cable #

Advanced

Refresh Ports

Identify

Device Identify

Reset

Connect

Cancel

Status

Select the manufacturer of the connected device.

You can find the manufacturer underneath the battery of the device or by clicking the button.

Identify

Select the model of the connected device. You can find the model underneath the battery of the device or by clicking the Identify button.

Select the port that the device is connected to. Click the Advanced button to identify the correct port.

Displays the cable number for the selected device after the manufacturer and model are selected. For

more information on cables, see “Supported Mobile

Devices” on page 35.

Click to open the Advanced Port Selection dialog.

From here, you can see the port being used by the connected device.

Click to refresh the COM Port dropdown.

Click to populate the Device Identify group box.

Displays information about the connected device, including manufacturer and model. Populated by clicking the Identify button.

Removes all selected information from the Device

Selection dialog.

Connects to the connected device. This button is only active after a manufacturer, model, and port are selected.

Closes the Device Selection dialog

Displays the status of the device selection process.

DENTIFYING A

EVICE

If the device is already connected, and the drivers are correctly installed, the Identify button is active in the Device Selection dialog. Click the Identify button to populate the

Device Identify group box. This group box gives you the details that you need to add the Manufacturer and Model dropdown information.

Note: Successfully identifying a device relies on the appropriate COM port to be selected.

Chapter 4 User Interface

SING THE

DVANCED

IALOG

Click the Advanced button in the Device Seleciton dialog to open the Advanced Port

Selection dialog. This dialog shows you the port information you need to make the correct selection from the COM Port dropdown of the Device Selection dialog.

Note: Each device is different, so it may take some trial-and-error to get the device into the correct mode for detection and extraction. If your device is set to "Mass Storage" (according to the device or according to Windows Device Manager), try setting the device to "Modem" mode

(sometimes also listed as "USB" or "PC Sync" mode) instead.

F IGURE 3-2 Advanced Port Selection

XTRACTING

ATA

Once MPE+ has successfully connected to a device, data can then be extracted for review.

Important: During the extraction of data from a device using the MPE+ 4.0

Tablet, devices with a high storage capacity (including any expansion cards) may cause the memory usage to spike thus causing the extraction to slow

AccessData Mobile Phone Examiner Plus User Guide

down significantly. It is recommended that you eject any expansion slot memory cards and image them using FTK Imager, or

use MPE+ Desktop for devices with large capacity internal storage chips.

To extract data from a device:

1. Connect the device to the computer using the appropriate cable. To see a list of

supported devices and cables, see “Supported Mobile Devices” on page 35. For more

information on connecting devices, see “Establishing a Data Connection to a Mobile

Device” on page 12.

2. Access the Device Selection dialog using one of the following methods:

• If you have not already selected a device, select Tasks > Select Device from the menu bar to open the Device Selection dialog.

• If you have selected a device, select Tasks > Extract Data and skip to step 7.

Click the Identify button. See “Identifying a Device” on page 19 for information on

how to identify a device.

4. Using the information from the Device Identify group box, select the correct information for the connected device from the Manufacturer and Model dropdowns.

5. Using the information you found in the Advanced Port Selection dialog, select the

correct port from the COM Port dropdown. See “Using the Advanced Dialog” on page 20.

6. Click Connect.

The Select Data for Extraction dialog appears.

Note: It is recommened that a device have more than 50% battery charge before extracting data to avoid errors during extraction.

Chapter 4 User Interface

Note: If you are unable to connect to the device, see “Resetting Mobile Device Connection

Procedure” on page 13 for more information.

F IGURE 3-3 Select Data for Extraction dialog

7. Check the options that you want to extract from the connected device and click

Extract.

The files are extracted and the data is displayed in the main MPE+ window. Use the

Data Type tabs to review the data. For more information on the how to review the

data, see “Data Type Tabs” on page 26.

Note: Not all devicess carry the same information, and not all device drivers will allow the extraction of all the data the device holds. The Select Data for Extraction dialog only gives you the options appropriate for the device and driver combination you have connected. If a data type is not supported on the device, you will not be able to select it in this dialog and it will not be activated in the main MPE+ window.

F IGURE 3-4 MPE+ Window

AccessData Mobile Phone Examiner Plus User Guide

Important: Once you have selected a device and extracted the data, before selecting another device, you must export the data in order to save the infomation. Do not attempt to open a second MPE+ window to select another device, this will cause conflicts in the program.

MPORTING AN

AD1 I

MAGE

You can import into MPE + only those AD1 images that were created in Mobile Phone

Examiner. This accommodates the need to revisit an image prior to adding it to an FTK case.

You do not need to have the original source device connected to import an MPE+ AD1 image that was previously exported.

To import an existing AD1 image you previously exported from AccessData Mobile

Phone Examiner Plus:

1. In MPE +, select Tasks > Import AD1.

2. Browse to the folder containing the AD1 file to import.

3. Select the file.

4. Click Open.

Chapter 4 User Interface

If any data types were not selected, or were not available during extraction, and thus were not added to the exported AD1 image, that data type will be inactive in the imported image.

XPORTING

O AN

AD1 I

MAGE

All extracted data is exported to an MPE + AD1 Image. If you want to include only certain types of data, select only those types to extract from the device.

When you are satisfied that the contents of the mobile device is interesting or important to the related case, you are ready to create an AD1 image of the extracted data.

The resulting image can be read by MPE+, or any FTK -based product.

Note: FTK Imager is not FTK-based. In other words, it is a standalone product that does not use the FTK code-base, and thus it cannot read MPE+ AD1 images.

To export the currently extracted mobile device data to an AD1 image:

1. Select Tasks > Export to AD1.

2. When prompted, enter a filename and select a destination folder for the image that will be created.

3. Click Save.

The image file is saved to the selected destination.

DDING AN

MPE+ AD1 I

MAGE TO A

ASE IN

FTK

An MPE+ AD1 image is added as evidence in FTK the same way any other AD1 image is added. Simply select Acquired Image(s) as the Evidence Type. For more information, see the AccessData FTK User Guide.

ANAGING

ETTINGS

The Settings button on the toolbar opens the Settings dialog, which shows you your

Activation Key, User Name, License Host, and License Port.

AccessData Mobile Phone Examiner Plus User Guide

On the GSM License tab, you can view the Activation Key and User Name that you used when you activated your software. You can deactivate your license from this dialog if you want to reactivate your software with a different key or user name.

F IGURE 3-5 Settings: GSM License tab

The MPE License tab displays the License Host that is providing the GSM Activation information (this can be either localhost, or the computer name or IP Address of a remote network computer), and the License Port (the port number being used for transmitting activation information). The default port is 6921, but if this is in use, you can change it.

F IGURE 3-6 Settings: MPE License tab

BOUT

ELP

ENU

Use the Help menu to select from the following options:

• Supported Devices: See “Supported Mobile Devices” on page 35 for more

information on this.

• User Manual (this User Guide).

Chapter 4 User Interface

• About: Displays information about your software including the version number.

BOUT

EVIEW

ANES

ATA

YPE

ABS

Use the buttons in the Data Type tabs on the left side of the main window to browse the available mobile device data. The following table describes the buttons in the Data Type tabs.

TABLE 3-2 Data Type Tabs

Click the Phonebook button to view the phone book that was extracted or imported.

Click the Messages button to view texts that were extractd or imported.

‘

Click the MMS button to view multi-media texts that were extracted or imported.

Click the Call History or imported.

button to view the call history that was extracted

Click the imported.

Calendar button to view the calendar that was extracted or

Click the Media button to view all the media, including pictures, video, sound, ect. that was extracted or imported.

Click the File System button to view the file tree and files that were extracted or imported.

AccessData Mobile Phone Examiner Plus User Guide

The buttons in the Data Types tabs are only activated if the device from which the information was extracted had the capability.

HONEBOOK

The Phonebook data lists the information it finds according to the driver capabilities.

The figure below shows only name information for each Phonebook entry because the user did not add any more in-depth information than that.

F IGURE 3-7 MPE+ Phonebook Data View

ESSAGES

The Messages data view provides information such as those listed in the following table .

TABLE 3-3 Potential Device Message Data

• Message Type • Date Received

• Phone Number of Originating Message • Phone Number of Recipient

• Subject

• Priority

• Message Text

Chapter 4 User Interface

F IGURE 3-8 MPE+ Messages Data View

MMS

MMS files are text messages that include media.

Note: MPE+ does not currently extract MMS messages from CDMA phones. If you have a device that contains media text messages, but the MMS option is not available, it is because that device does not allow export of those files.

F IGURE 3-9 MPE+ MMS Data View

AccessData Mobile Phone Examiner Plus User Guide

ALL

ISTORY

The Call History tab displays the incoming, outgoing, and missed calls recorded in the device. The figure below shows an example of a call history log.

F IGURE 3-10 MPE+ Call History Data View

Chapter 4 User Interface

ALENDAR

ATA

The Calendar tab displays the items found in the device's calendar, including start and end times, descriptions, locations, priority, alarms, notes, ect... The figure below shows an example of extracted calendar data.

F IGURE 3-11 MPE+ Calendar Data View

EDIA

ILES

The Media tab contains media found on the device, including image files, video files, and sound files. Sound and video files can be played back within the MPE+ interface. The figures below show examples of extracted mobile device media files.

AccessData Mobile Phone Examiner Plus User Guide

F IGURE 3-12 MPE+ Media / Images Data View

F IGURE 3-13 MPE+ Media / Sounds Data View Showing Embedded Media Player

Chapter 4 User Interface

ILE

YSTEM

The File System tab displays a recreation of the device’s file system based on logical file system records extracted from the device. In this pane the examiner is able to drill-down into the file system and view the extracted data using either the Hex view, or the naturual view.

Additionally, the examiner can click the “Find...” button (or use CTRL+F) to search for either text or hex string within the extracted data. The figure below shows an example of an extracted mobile device file system.

F IGURE 3-14 MPE+ File System Data View

BOUT

TATUS

ARS

HONE

ATA

AR

The Phone Data bar is below the toolbar. It shows the following information:

• Phone: The name of the currently connected and recognized device.

AccessData Mobile Phone Examiner Plus User Guide

• Port: The port number on which the currently connected device is configured to communicate.

F IGURE 3-15 Phone Data Bar

TATUS

AR

The Status Bar is at the bottom of the main window. Use the Status Bar to see the status of the current command activity for the device.

F IGURE 3-16 The Status Bar

BOUT

OOLBARS

The toolbar has seven items to choose from. the following table.

. Each is listed in

TABLE 3-4 MPE+ Toolbar Buttons

ToolBar Button Description

Click the Select Device

button to open theDevice Selection dialog. See “Selecting a Device” on page 17 for more information.

Click the Extract Data button when the correct drivers are installed and the device is connected and has been recognized and selected, to extract selected data from the phone or other mobile device.

The extracted data can be viewed using the buttons on the Navigation Bar on the left side of the screen.

See “Extracting Data” on page 20 for more information.

Click the AD1 Export button to export the extracted data to an AD1 custom content image that can be added to a case in FTK , or imported back into MPE+ later, without the device connected, to view the extracted data. The extracted data can be viewed in MPE+ using the buttons on the Navigation Bar on the left side of the screen. Export data from a mobile device in an available format. See

“Exporting To an AD1 Image” on page 24 for more details.

Click the Import AD1 button on the toolbar if the mobile device is no longer available, but you have created an image of the device using MPE+ , and you

want to view the device’s data. See “Importing an AD1 Image” on page 23 for

details.

Chapter 4 User Interface

TABLE 3-4 MPE+ Toolbar Buttons

ToolBar Button Description

Click the Display Current Device Info button on the toolbar to view basic information about the device that is currently connected to MPE+. This information includes the IMEI, Phone Number, Comments, Model,

Manufacturer, Serial Number, and Revision.

Click the Supported Devices button to see the full list of MPE+ Supported Devices and the cables associated with those devices. The Supported Mobile Devices

List can be exported from the list view, and is also included in this user guide.

See “Supported Mobile Devices” on page 35.

Click Settings to see GSM Activation and License Source information. See

“Managing Settings” on page 24.

AccessData Mobile Phone Examiner Plus User Guide

PPENDIX

A MPE+

UPPORTED

OBILE

EVICES

The following table contains a list of all currently supported mobile phone manufacturers, and models. The specific information that is available for any phone is dependent on the type of phone or device, and the device driver provided by the manufacturer.

UPPORTED

OBILE

EVICES

The following table lists mobile devices that are supported in Mobile Phone Examiner

Plus.

Note: To see a list of supported phones and the cables associated with those phones, click the

Display and Export Supported Device List

button in MPE+. See “About Toolbars” on page 33.

Note: MPE+ supports more than 2500 phones, because the underlying code enables the viewing and acquisition of file systems on 80% of all CDMA handsets, as well as the ability to locate lock codes and EXIF on those CDMA handsets. The acquired file systems can then be parsed within FTK.

TABLE A-1

Manfacturer Model

Alcatel One Touch 526

Alcatel

One Touch 535

One Touch 700

Alcatel

One Touch 715

One Touch 735

One Touch 331

Appendix A MPE+ Supported Mobile Devices 35

TABLE A-1

Ericsson

Kyocera

Alcatel

Ericsson

One Touch 332

One Touch 500

One Touch 511

One Touch 512

One Touch 525

A2618s

A2628s

R310s

R320s

R520m

R600

T20s

T28s

T39m

T65

T68

SE44

LG-CX9200 (Keybo 2)

LG-VX11000 (enV Touch)

LG-VX5500

LG-VX8575 (Chocolate Touch)

LG-VX8610 (Decoy)

LG-VX9100 (enV 2)

LG-VX9200 (enV 3)

LG-VX9600 (Versa)

LG-VX9700 (Dare)

LG-VX4500

LG-VX4600

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

KE820

KE850

KE970

KF300

KF310

KF510

KF600

KF700

G5200

G5300

G5310

G5400

G5500

HB620T

KE500

KE800

KG320

KG328

KG800

KG810

KM380

KM500

KU250

KU311

KU380

KU990

LG-AX8600

LG-LX570 (Muziq)

LG-VX10000 (Voyager)

Appendix A MPE+ Supported Mobile Devices 37

TABLE A-1

LG-PM225

LG-PM325

LG-UX5000

LG-VI125

LG-VX3200

LG-VX4650

LG-VX5200

LG-VX5300

LG-VX6100

LG-VX7000

LG-VX5400

LG-VX8350

LG-VX8500 (Chocolate)

LG-VX8550 (Chocolate 2)

LG-VX8560 (Chocolate 3)

LG-VX8600

LG-VX8700

LG-VX8800 (Venus)

LG-VX9400

LG-VX9900 (enV)

LX1200

M6100

S5200

LG-LG6190

LG-LG6200

LG-LG8100

LG-LX5450

LG-LX5550

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

G7050

KG110

KG120

KG130

KG225

KG290

KG920

KP130

KP202

KP202i

KP230

L343i

LG-C2000

C1200

C3300

C3320

F2400

G3000

G7000

G7020

G7030

LG-VX8000

LG-VX8100

LG-VX8300

LG-VX9800

G7100

LG-VX4400

510w

B2100

Appendix A MPE+ Supported Mobile Devices 39

TABLE A-1

Motorola

Mivvy

Motorola

E770

E770v

K1m

K1v

L7e

Chat

Dual

A1200

C250

C385

C450

C550

C650

LG-G4015

LG-TM520

LG-VI5225

LG-VX10

LG-VX6000

VI5225

W3000

W5200

W7000

W7020

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Motorola

V3xv

V3xx

V3xxv

W490

W510

V3cm

V3i

V3iv

V3m

V3m (Sprint)

V3mM

V3x

V235

V325

V325M

V360

V360v

V3c

L7v

V1075

V1100

V180

V186

V220

Appendix A MPE+ Supported Mobile Devices 41

TABLE A-1

Motorola

E1000

E1070

E398

E550

E815

E815m

T190

EM30

ZN5

A1000

A835

T720

T720c

T720i

Timeport 280

V120t

V300

V500

V505

V525

V525M

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Nokia

Motorola

Nokia

Motorola

V635

V66

V66i

V70

V710

V710m

V80

V535

V547

V551

V60

V600

V60i

V60t

V620

6267

6290

6300

6510

6600

8310

V975

5300 XpressMusic

6110

6110 Navigator

6120 classic

6121 classic

6124 classic

Appendix A MPE+ Supported Mobile Devices 43

TABLE A-1

Nokia

6230

6230i

6102

6555

6610

6610i

7390

5140

5500 Sport

6111

E51

E90

N76

N95

N95 8GB

N-Gage

N-Gage QD

3600 slide

5220 XpressMusic

5310 XpressMusic

8810

E66

E71

6085

5610 XpressMusic

6500 classic

6500 slide

8800

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Nokia

6070

6080

6100

6101

6101b

6103

N73

N80

N90

3105

5140i

6020

6021

E65

N70

N71

N72

7373

9300i

E61

E61i

6233

6280

6288

7370

6125

6131

6150

6151

Appendix A MPE+ Supported Mobile Devices 45

TABLE A-1

Nokia

3410

3510

3510i

5210

8210

8250

8850

5110

6210

6250

6310

6310i

6820

6822

7260

7360

7650

2610

6030

6060

3109 classic

3110 classic

3500 classic

5200

7500 Prism

2100

3310

3330

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Nokia

E50

3100

3120

3200

3210

3220

7600

7610

7710

8910

8910i

9300

9500

6681

7270

7280

7380

6270

6630

6670

6680

3660

6170

6234

6260

7110

7210

3230

3650

Appendix A MPE+ Supported Mobile Devices 47

TABLE A-1

Philips

Sagem

Nokia

Panasonic

Philips

Nokia

650

755

535

Fisio 620

Fisio 625 my400V myC-2 myC2-3 myC-3b myC-4

3360

X700

GD67

530

630

Fisio 820

Fisio 822

Fisio 825

5070

5100

6220

6220 classic

6225

6800

6810

7200

7250

7250i

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Samsung

Sagem

Samsung

SGH-X200

SGH-X210

SGH-X450

SGH-X480

SGH-X510

SGH-X520

SGH-X650

SGH-E100

SGH-E330

SGH-E330N

SGH-E335

SGH-E630

SGH-E700 myC5-2 my411V myV-65 myX2-2 myX-7 myZ-55

GT-i8510

SGH-G810

SGH-D410

SGH-E300

SGH-E600

SGH-E710

SGH-P400

SGH-S300

SGH-S300M

SGH-V200

Appendix A MPE+ Supported Mobile Devices 49

TABLE A-1

Samsung

SGH-E800

SGH-E820

SGH-M3200

SGH-S500

SGH-S730i

SGH-U800

SGH-X100

SGH-X460

SGH-X600

SGH-X640

Armani

GT-B2700

GT-S7330

SCH-U420

SCH-U740

SGH-B520

SGH-D800

SGH-D820

SGH-D830

SGH-D880

SGH-D900

SGH-E250

SGH-E251

SGH-E2510

SGH-E340

SGH-E570

SGH-E570V

SGH-E590

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Samsung

SGH-M7500

SGH-P300

SGH-S3600

SGH-U100

SGH-U300

SGH-U600

SGH-X820

SGH-X830

SGH-Z300

SGH-Z320i

SGH-Z400

SGH-Z400V

SGH-Z500V

SGH-E780

SGH-E840

SGH-E900

SGH-E950

SGH-F200

SGH-F210

SGH-F250

SGH-F300

SGH-G800

SGH-J150

SGH-J600

SGH-J800

SGH-M150

SGH-M310

SGH-M310V

SGH-M3510

Appendix A MPE+ Supported Mobile Devices 51

TABLE A-1

Samsung

SGH-Z540

SGH-Z540V

SGH-Z560

SGH-Z560V

SGH-Z650i

SGH-Z720

SGH-ZV10

SGH-ZV30

SGH-ZV40

SGH-D500

SGH-D500E

SGH-D600

SGH-D600E

SGH-E350

SGH-E360

SGH-E390

SGH-E760

SGH-E770

SGH-X660

SGH-X660V

SGH-X680V

SGH-X700

SCH-A310

SCH-A650

SCH-A670

SCH-A870

SCH-A930

SCH-A950

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Samsung

SGH-A800

SGH-S400i

SGH-S401i

SPH-A620 (VGA1000)

SPH-A660

SPH-A660 (VI660)

SPH-A680

SPH-A740

SPH-A840

SPH-A840 (Telus)

SPH-A900

SGH-E530

SGH-C100

SPH-A460

SPH-N200

SPH-N400

SGH-P730

SGH-S100

SCH-U470

SCH-U750 (Alias 2)

SGH-F400

SGH-F480

SGH-F490

SGH-F490V

SGH-G400

SGH-G600

SGH-J700

SGH-J700V

SGH-L700

Appendix A MPE+ Supported Mobile Devices 53

TABLE A-1

Sanyo

Samsung

MM-5600

MM-7400

MM-7500

MM-8300

PM-8200

RL-4920

RL-4930

SCP-200

SGH-L770V

SGH-L810V

SGH-S720i

SGH-U700

SGH-U900

SGH-U900V

SPH-M300MEDIA

SPH-M300PIM

SGH-E715

SGH-E720

SCP-2400

SCP-3100

SCP-3200

SCP-4900

SCP-5300

SCP-5400

SCP-5500

SCP-6600 (Katana)

SCP-6650 (Katana-II)

SCP-7050

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Siemens

Sharp

Siemens

Sanyo

Sharp

SL45

SL45i

S55

A65

A75

AX75

C45

M35i

M50

ME45

MT50

S35i

S45

770SH

903SH

GX17

GX29

GX33

GX40

C35

C35i

SCP-7200

SCP-7300

SCP-8100

SCP-8100 (Bell)

SCP-8400

VI-2300

550SH

703SH

Appendix A MPE+ Supported Mobile Devices 55

TABLE A-1

Siemens

Sony Ericsson

SL55

SL65

SX1

6100

J300i

K300i

K500i

K600i

K700i

CXT65

M55

M65

M75

MC60

ME75

S45i

S65

C55

C60

C65

C72

C75

CF62

CF75

CX65

CX70

CX75

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Sony Ericsson

C905

D750i

G502

K310i

K320i

K510i

K530i

K550i

K610i

K610im

K660i

K750i

K770i

T610

T61c

T630

T68i

Z1010

Z600

C702

C902

P800

P900

P910i

T200

T230

T290i

T300

T310

Appendix A MPE+ Supported Mobile Devices 57

TABLE A-1

Sony Ericsson

W710i

W760i

W800i

W810i

W850i

W880i

W890i

W900i

W910i

W980i

W300i

W350i

W380i

W550i

W580i

W610i

W660i

W700i

K790i

K800i

K810i

K850i

S500i

S700i

T650i

V630i

V640i

W200i

AccessData Mobile Phone Examiner Plus User Guide

TABLE A-1

Sony Ericsson

Toshiba

Ubiquam

ZTC

Z310i

Z520i

Z530i

Z550i

Z555i

Z610i

Z710i

Z770i

VM4050

U400

TE558

Appendix A MPE+ Supported Mobile Devices 59

60 AccessData Mobile Phone Examiner Plus User Guide

PPENDIX

B L

ICENSING

NFORMATION

This chapter expands on the licensing information needed to run MPE+, including

AccessData product licenses, virtual codemeter activation, and network license server configuration.

CCESS

ATA

RODUCT

ICENSES

This section acquaints you with the managing AccessData product licenses. Here you will find details regarding the LicenseManager interface and how to manage licenses and update products using LicenseManager.

NSTALLING AND

ANAGING

ECURITY

EVICES

Before you can manage licenses with LicenseManager, you must install the proper security device software and/or drivers. This section explains installing and using the

Wibu CodeMeter Runtime software and USB CmStick, as well as the Keylok USB dongle drivers and dongle device.

NSTALLING THE

ECURITY

EVICE

As discussed previously, AccessData products require a licensing security device that communicates with the program to verify the existence of a current license. The device can be the older Keylok dongle, or the newer Wibu CmStick. Both are USB devices, and both require specific software to be installed prior to connecting the devices and running your AccessData products. You will need:

• The Wibu CodeMeter Runtime software with a Wibu CodeMeter (CmStick)

Appendix B Licensing Information 61

• The Wibu CodeMeter Runtime software, and the AccessData Dongle Drivers with a

Keylok dongle

Note: The Codemeter Runtime software and either a silver Wibu CmStick or a green

Keylok dongle are required to run PRTK or DNA.

Without them, you can run PRTK or

DNA in Demo mode only.

The CmStick or dongle should be stored in a secure location when not in use.

You can install PRTK and the CodeMeter software from the shipping CD or from downloadable files available on the AccessData website at www.accessdata.com

. Click

Support > Downloads, and browse to the product to download. Click the download link and save the file locally prior to running the installation files.

I NSTALLING THE C ODE M ETER R UNTIME S OFTWARE

When you purchase the full PRTK package, AccessData provides a USB CmStick with the product package. The green Keylok dongles are no longer provided, but can be purchased separately through your AccessData Sales Representative.

To use the CmStick, you must first install the CodeMeter Runtime software, either from the shipping CD, or from the setup file downloaded from the AccessData Web site.

L OCATING THE S ETUP F ILE

To install the CodeMeter Runtime software from the CD, you can browse to the setup file, or select it from the Autorun menu.

To download the CodeMeter Runtime software, go to www.accessdata.com

and do the following:

1. Click Support > Downloads.

2. Find

2a. CodeMeter Runtime 3.30a (32 bit)

MD5: 9F299EC832152E593D9E8D76F199C723

(MD5 hash applies only to this version)

2b. CodeMeter Runtime 3.30a (64 bit)

MD5: 1140085cbbd0f15ade393f632b56d00c

(MD5 hash applies only to this version)

3. Click the Download link.

4. Save the file to your PC and run after the download is complete.

AccessData Mobile Phone Examiner Plus User Guide

When the download is complete, double-click on the CodeMeterRuntime32-4.10b.exe or the CodeMeterRuntime64-4.10b.exe.

R UNNING THE C ODE M ETER R UNTIME S ETUP

Whichever way you choose to access the CodeMeter Runtime setup file, when you run it you will see the following:

1. Click Run.

2. On the Welcome screen, click Next.

3. Accept the License Agreement.

Appendix B Licensing Information 63

4. Click Next.

5. Enter User Information.

6. Specify whether this application should be available only when you log in, or for anyone who uses this computer.

7. Click Next.

8. Select the features you want to install.

AccessData Mobile Phone Examiner Plus User Guide

9. Click Disk Cost to see how much space the installation CodeMeter software takes, and drive space available

10. Click OK .

11. Click Next.

Appendix B Licensing Information 65

12. When you are satisfied with the options you have selected, click Next.

13. Installation will run its course. When complete, you will see the “CodeMeter Runtime

Kit v3.30a has been successfully installed” screen. Click Finish to exit the installation.

T HE C ODE M ETER C ONTROL C ENTER

When the CodeMeter Runtime installation is complete, the CodeMeter Control Center pops up. This is a great time to connect the CmStick and verify that the device is recognized and is Enabled. Once verified, you can close the control center and run your

AccessData product(s).

When the software is installed, but the CmStick is not connected, you will see a system tray icon that looks like this:

When the software is installed, and the CmStick is connected and recognized, you will see a system tray icon that looks like this:

For the most part there is nothing you need to do with this control center, and you need make no changes using this tool with very few exceptions. If you have problems with your CmStick, contact AccessData Support and an agent will walk you through any troubleshooting steps that may need to be performed.

AccessData Mobile Phone Examiner Plus User Guide

I NSTALLING K EYLOK D ONGLE D RIVERS

To install the Keylok USB dongle drivers do the following:

1. If installing from CD , insert the CD into the CD-ROM drive and click Install the Dongle

Drivers.

If auto-run is not enabled, select Start > Run. Browse to the CD-ROM drive and select

Autorun.exe

If installing from a file downloaded from the AccessData Web site, locate the

Dongle_driver_1.6.exe setup file, and double-click it.

Appendix B Licensing Information 67

2. Click Next.

3. Select the type of dongle to install the drivers for.

4. Click Next.

5. If you have a USB dongle, verify that it is not connected.

6. Click Next.

68 AccessData Mobile Phone Examiner Plus User Guide

7. Click Finish.

8. Connect the USB dongle. Wait for the Windows Found New Hardware wizard, and follow the prompts.

Important:

If the Windows Found New Hardware wizard appears, complete the wizard. Do not close without completing, or the dongle driver will not be installed.

W INDOWS F OUND N EW H ARDWARE W IZARD

When you connect the dongle after installing the dongle drivers, you should wait for the

Windows Found New Hardware Wizard to come up. It is not uncommon for users to disregard this wizard, and then find that the dongle is not recognized and their

AccessData software will not run.

When the Found New Hardware Wizard pops up, do the following:

1. When prompted whether to connect to Windows Update to search for software, choose, “No, not this time”.

2. Click Next.

Appendix B Licensing Information 69

3. When prompted whether to install the software automatically or to install from a list of specific locations, choose, “Install the software automatically (Recommended)”.

4. Click Next.

5. Click Finish to close the wizard.

Once you have installed the dongle drivers and connected the dongle and verified that

Windows recognizes it, you can use LicenseManager to manage product licenses.

AccessData Mobile Phone Examiner Plus User Guide

NSTALLING

ICENSE

ANAGER

LicenseManager lets you manage product and license subscriptions using a security device or device packet file.

To install LicenseManager from the downloadable file:

1. Go to the AccessData download page at http://www.accessdata.com/downloads.htm

2. On the download page, click the LicenseManager Download link.

3. Save the installation file (currently lm-license_manager-2.2.4.exe) to a temporary directory on your drive.

4. To launch the installation program, go to the temporary directory and double-click the installation file you downloaded in step 3.

5. Click Next on the Welcome screen.

Appendix B Licensing Information 71

6. Click Yes to accept the license agreement.

7. Wait while the installation completes.

8. If you want to launch LicenseManager after completing the installation, select

Run LicenseManager.

Run LicenseManager later by selecting

Start >Programs > AccessData > LicenseManager > LicenseManager or by double-clicking the LicenseManager icon on your desktop .

AccessData Mobile Phone Examiner Plus User Guide

SING

ICENSE

ANAGER

LicenseManager manages AccessData product licenses on a Keylok dongle or WIBU-

SYSTEMS CodeMeter Stick security device, or in a security device packet file.

LicenseManager and the CodeMeter Stick installation are no longer integrated with FTK installation.

LicenseManager displays license information, allows you to add or remove existing licenses to a dongle or CmStick. LicenseManager can also be used to export a security device packet file. Packet files can be saved and reloaded onto the dongle or CmStick, or sent via email to AccessData support.

In addition, you can use LicenseManager to check for product updates and download the latest product versions.

LicenseManager displays CodeMeter Stick information (including packet version and serial number) and licensing information for all AccessData products. The Purchase

Licenses button connects directly to the AccessData website and allows you to browse the site for information about products you may wish to purchase. Contact AccessData by phone to speak with a Sales Representative for answers to product questions, and to purchase products and renew licenses and subscriptions.

TARTING

ICENSE

ANAGER

LicenseManager.exe

is located in C:\Program Files\AccessData\Common

Files\AccessData LicenseManager\.

You can execute the program from this location if you wish.

Click Start > All Programs > AccessData > LicenseManager > LicenseManager,

Click or double-click (depending on your Windows settings) the LicenseManager icon on your desktop .

From some AccessData programs, you can run LicenseManager from the Tools > Other

Applications menu. This option is not available in PRTK or DNA .

The LicenseManager program opens.

When starting LicenseManager, License Manager reads licensing and subscription information from the installed and connected Wibu CodeMeter Stick, or Keylok dongle.

If using a Keylok dongle, and LicenseManager either does not open or displays the message, “Device Not Found”, do the following:

Appendix B Licensing Information 73

1. Make sure the correct dongle driver is installed on your computer.

2. With the dongle connected, check in Windows Device Manager to make sure the device is recognized. If it has an error indicator, right click on the device and choose

Uninstall.

3. Remove the dongle after the device has been uninstalled.

4. Reboot your computer.

5. After the reboot is complete, and all startup processes have finished running, connect the dongle.

6. Wait for Windows to run the Add New Hardware wizard. If you already have the right dongle drivers installed, do not browse the internet, choose, “No, not this time.”

7. Click Next to continue.

8. On the next options screen, choose, “Install the software automatically

(Recommended)

9. Click Next to continue.

10. When the installation of the dongle device is complete, click Finish to close the wizard.

11. You still need the CodeMeter software installed, but will not need a CodeMeter Stick to run LicenseManager.

If using a CodeMeter Stick, and LicenseManager either does not open or displays the message, “Device Not Found”, do the following:

1. Make sure the CodeMeter Runtime 3.30a software is installed. It is available at www.accessdata.com/support . Click Downloads and browse to the product. Click on the download link. You can Run the product from the Website, or Save the file locally and run it from your PC. Once the CodeMeter Runtime software is installed and running, you will see a gray icon in your system tray: .

2. Make sure the CodeMeter Stick is connected to the USB port. When the CmStick is then connected, you will see the icon change to look like this: .

If the CodeMeter Stick is not connected, LicenseManager still lets you to manage licenses using a security device packet file if you have exported and saved the file previously.

To open LicenseManager without a CodeMeter Stick installed:

1. Click Tools > LicenseManager.

LicenseManager displays the message, “Device not Found”.

2. Click OK , then browse for a security device packet file to open.

AccessData Mobile Phone Examiner Plus User Guide

Note: Although you can run LicenseManager using a packet file, FTK 2.2 will not run with a packet file alone. You must have the CmStick connected to the computer to run

FTK 2.2.

HE

ICENSE

ANAGER

NTERFACE

The LicenseManager interface consists of two tabs that organize the options in the

LicenseManager window: the Installed Components tab and the Licenses tab.

T HE I NSTALLED C OMPONENTS T AB

The Installed Components tab lists the AccessData programs installed on the machine.

The Installed Components tab is displayed in the following figure.

F IGURE 3-1 LicenceManager Installed Components

The following information is displayed on the Installed Components tab:

TABLE 3-1 LicenseManager Installed Components Tab Features

Item

Program

Description

Lists all AccessData products installed on the host.

Appendix B Licensing Information 75

TABLE 3-1 LicenseManager Installed Components Tab Features

Item Description

Installed Version

Newest Version

Product Notes

AccessData Link

Displays the version of each AccessData product installed on the host.

Displays the latest version available of each AccessData product installed on the host. Click Newest to refresh this list.

Displays notes and information about the product selected in the program list.

Links to the AccessData product page where you can learn more about

AccessData products.

The following buttons provide additional functionality from the Installed Components tab:

TABLE 3-2 LicenseManager Installed Components Buttons

Button

Help

Install Newest

Newest

About

Done

Function

Opens the LicenseManager Help web page.

Installs the newest version of the programs checked in the product window, if that program is available for download. You can also get the latest versions from our website using your Internet browser.

Updates the latest version information for your installed products.

Displays the About LicenseManager screen. Provides version, copyright, and trademark information for LicenseManager.

Closes LicenseManager.

Use the Installed Components tab to manage your AccessData products and stay up to date on new releases.

76 AccessData Mobile Phone Examiner Plus User Guide

T HE L ICENSES T AB

The Licenses tab displays CodeMeter Stick information for the current security device packet file and licensing information for AccessData products available to the owner of the CodeMeter Stick, as displayed in the following figure.

F IGURE 3-2 LicenseManager Licenses Tab

The Licenses tab provides the following information:

TABLE 3-3 LicenseManager Licenses Tab Features

Column

Program

Expiration Date

Status

Description

Shows the owned licenses for AccessData products.

Shows the date on which your current license expires.

Shows these status of that product’s license:

• None: the product license is not currently owned

• Days Left: displays when less than 31 days remain on the license.

• Never: the license is permanently owned. This generally applies to Hash Tables and Portable Office Rainbow Tables.

Appendix B Licensing Information 77

TABLE 3-3 LicenseManager Licenses Tab Features

Column

Name

Value

Show Unlicensed

Description

Shows the name of additional parameters or information a product requires for its license.

Shows the values of additional parameters or information a product contained in or required for its license.

When checked, the License window displays all products, whether licensed or not.

The following license management actions can be performed using buttons found on the

License tab:

TABLE 3-4 License Management Options

Button Function

Remove License

Refresh Device

Reload from Device

Release Device

Open Packet File

Removes a selected license from the Licenses window and from the CodeMeter Stick or dongle. Opens the AccessData License

Server web page to confirm success.

Connects to the AccessData License Server. Downloads and overwrites the info on the CodeMeter Stick or dongle with the latest information on the server..

Begins or restarts the service to read the licenses stored on the

CodeMeter Stick or dongle.

Click to stop the program reading the dongle attached to your machine, much like Windows’ Safely Remove Hardware feature.

Click this button before removing a dongle.

This option is disabled for the CodeMeter Stick.

Opens Windows Explorer, allowing you to navigate to a .pkt file containing your license information.

Save to File

Finalize Removal

Opens Windows Explorer, allowing you to save a .pkt file containing your license information. The default location is My

Documents.

Finishes the removal of licenses in the unbound state. Licenses must be unbound from the CmStick or dongle before this button takes effect.

View Registration Info Displays an HTML page with your CodeMeter Stick number and other license information.

Add Existing License Allows you to bind an existing unbound license to your CodeMeter

Stick, through an internet connection to the AccessData License

Server.

Purchase License Brings up the AccessData product page from which you can learn more about AccessData products.

AccessData Mobile Phone Examiner Plus User Guide

TABLE 3-4 License Management Options

Button

About

Done

Function

Displays the About LicenseManager screen. Provides version, copyright, and trademark information for LicenseManager.

Closes LicenseManager.

PENING AND

AVING

ONGLE

ACKET

ILES

You can open or save dongle packet files using LicenseManager. When started,

LicenseManager attempts to read licensing and subscription information from the dongle. If you do not have a dongle installed, LicenseManager lets you browse to open a dongle packet file. You must have already created and saved a dongle packet file to be able to browse to and open it.

To save a security device packet file:

1. Click the Licenses tab, then under License Packets, click Save to File.

2. Browse to the desired folder and accept the default name of the .pkt file; then click

Save.

Note: In general, the best place to save the .pkt files is in the AccessData LicenseManager folder. The default path is

C:\Program Files\AccessData\Common Files\AccessData

LicenseManager\.

To open a security device packet file:

1. Select the Licenses tab, then under License Packets, click Open Packet File.

Appendix B Licensing Information 79

2. Browse for a dongle packet file to open. Select the file, then click Open.

F IGURE 3-3 LicenseManager Open Packet File

DDING AND

EMOVING

RODUCT

ICENSES

On a computer with an Internet connection, LicenseManager lets you add available product licenses to, or remove them from, a dongle.

To move a product license from one dongle to another dongle, first remove the product license from the first dongle. You must release that dongle, and connect the second dongle before continuing. When the second dongle is connected and recognized by

Windows and LicenseManager, click on the Licenses tab to add the product license to the second dongle.

EMOVE A

ICENSE

To remove (unassociate) a product license:

1. From the Licenses tab, mark the program license to remove. This action activates the

Remove License button below the Program list box.

2. Click Remove License. This connects your machine to the AccessData License Server through the Internet.

AccessData Mobile Phone Examiner Plus User Guide

3. You will be prompted to confirm the removal of the selected license(s) from the device.

Click Yes to continue, or No to cancel.

4. You will see some screens indicating the connection and activity on the License Server, and when the license removal is complete, you will see the following screenl

5. Click OK to close the message box. You will then see an Internet browser screen from

LicenseManager with a message that says, “The removal of your license(s) from

Security Device was successful!” You may close this box at any time.

DD A

ICENSE

To add a new or released license:

1. From the Licenses tab, under Browser Options, click Add Existing License.

The AccessData LicenseManager Web page opens, listing the licenses currently bound to the connected security device, and below that list, you will see the licenses that currently are not bound to any security device. Mark the box in the Bind column for the product you wish to add to the connected device, then click Submit.

2. An AccessData LicenseManager Web page will open, displaying the following message, “The AccessData product(s) that you selected has been bound to the record for Security Device nnnnnnn within the Security Device Database.

Appendix B Licensing Information 81

“Please run LicenseManager’s “Refresh Device” feature in order to complete the process of binding these product license(s) to this Security Device.” You may close this window at any time.

3. Click Yes if LicenseManager prompts, “Were you able to associate a new product with this device?”

4. Click Refresh Device in the Licenses tab of LicenseManager. Click Yes when prompted.

You will see the newly added license in the License Options list.

DDING AND

EMOVING

RODUCT

ICENSES

EMOTELY

While LicenseManager requires an Internet connection to use some features, you can add or remove licenses from a dongle packet file for a dongle that resides on a computer, such as a forensic lab computer, that does not have an Internet connection.

If you cannot connect to the Internet, the easiest way to move licenses from one dongle to another is to physically move the dongle to a computer with an Internet connection, add or remove product licenses as necessary using LicenseManager, and then physically move the dongle back to the original computer. However, if you cannot move the dongle—due to organization policies or a need for forensic soundness—then transfer the packet files and update files remotely.

A DD A L ICENSE R EMOTELY

To remotely add (associate) a product license:

1. On the computer where the security device resides:

1a. Run LicenseManager.

1b. From the Licenses tab, click Reload from Device to read the dongle license information.

AccessData Mobile Phone Examiner Plus User Guide

1c. Click Save to File to save the dongle packet file to the local machine.

2. Copy the dongle packet file to a computer with an Internet connection.

3. On the computer with an Internet connection:

3a. Remove any attached security device.

3b. Launch LicenseManager. You will see a notification, “No security device found”.

3c. Click OK .

3d. An “Open” dialog box will display. Highlight the .pkt file, and click Open.

3e. Click on the Licenses tab.

3f. Click Add Existing License.

3g. Complete the process to add a product license on the Website page.

3h. Click Yes when the LicenseManager prompts, “Were you able to associate a new product with this dongle?”

3i. When LicenseManager does not detect a dongle or the serial number of the dongle does not match the serial number in the dongle packet file, you are prompted to save the update file, [serial#].wibuCmRaU.

3j. Save the update file to the local machine.

4. After the update file is downloaded, copy the update file to the computer where the dongle resides:

5. On the computer where the dongle resides:

5a. Run the update file by double-clicking it. (It is an executable file.)

5b. After an update file downloads and installs, click OK.

5c. Run LicenseManager.

5d. From the Licenses tab, click Reload from Device to verify the product license has been added to the dongle.

R EMOVE A L ICENSE R EMOTELY

To remotely remove (unassociate) a product license:

1. On the computer where the dongle resides:

1a. Run LicenseManager.

1b. From the Licenses tab, click Reload from Device to read the dongle license information.

1c. Click Save to File to save the dongle packet file to the local machine.

2. Copy the file to a computer with an Internet connection.

3. On the computer with an Internet connection:

3a. Launch LicenseManager. You will see a notification, “No security device found”.

Appendix B Licensing Information 83

3b. Click OK .

3c. An “Open” dialog box will display. Highlight the .pkt file, and click Open.

3d. Click on the Licenses tab.

3e. Mark the box for the product license you want to unassociate; then click Remove

License.

3f. When prompted to confirm the removal of the selected license from the dongle, click Yes.

When LicenseManager does not detect a dongle or the serial number of the dongle does not match the serial number in the dongle packet file, you are prompted save the update file.

3g. Click Yes to save the update file to the local computer.

The Step 1 of 2 dialog details how to use the dongle packet file to remove the license from a dongle on another computer.

3h. Save the update file to the local machine.

4. After the update file is downloaded, copy the update file to the computer where the dongle resides.

5. On the computer where the dongle resides:

5a. Run the update file by double-clicking it. This runs the executable update file and copies the new information to the security device.

5b. Run LicenseManager

5c. On the Licenses tab, click Reload from Device in LicenseManager to read the security device and allow you to verify the product license is removed from the dongle.

5d. Click Save to File to save the updated dongle packet file to the local machine.

6. Copy the file to a computer with an Internet connection.

PDATING

RODUCTS

You can use LicenseManager to check for product updates and download the latest product versions.

For more information on the general features of the subscription service, see the

AccessData Website at http://www.accessdata.com/subscription_renewal.htm

HECK FOR

RODUCT

PDATES

To check for product updates, on the Installed Components tab, click Newest. This refreshes the list to display what version you have installed, and the newest version available.

AccessData Mobile Phone Examiner Plus User Guide

OWNLOAD

RODUCT

PDATES

To install the newest version, mark the box next to the product to install, then click

Install Newest.

Note: Some products, such as FTK 2.x, Enterprise, and others, are too large to download, and are not available. A notification displays if this is the case.

To download a product update:

1. Ensure that LicenseManager displays the latest product information by clicking the

Installed Components tab. Click Newest to refresh the list showing the latest releases, then compare your installed version to the latest release.

If the latest release is newer than your installed version, you may be able to install the latest release from our Website.

2. Ensure that the program you want to install is not running.

3. Mark the box next to the program you want to download; then click Install Newest.

4. When prompted, click Yes to download and install the latest install version of the product.

5. If installing the update on a remote computer, copy the product update file to another computer.

6. Install the product update.

For information about installing the product update, refer to the installation information for the product. You may need to restart your computer after the update is installed.

URCHASE

RODUCT

ICENSES

Use LicenseManager to link to the AccessData Web site to find information about all our products.

Purchase product licenses through your AccessData Sales Representative. Call 801-377-

5410 and follow the prompt for Sales, or send an email to [email protected].

Note: Once a product has been purchased and appears in the AccessData License Server, add the product license to a CodeMeter Stick, dongle, or security device packet file by clicking Refresh Device .

END A

ONGLE

ACKET

ILE TO

UPPORT

Send a security device packet file only when specifically directed to do so by AccessData support.

To create a dongle packet file, do the following:

Appendix B Licensing Information 85

1. Run LicenseManager

2. Click on the Licenses tab.

3. Click Load from Device.

4. Click Refresh Device if you need to get the latest info from AD’s license server.

5. Click Save to File, and note or specify the location for the saved file.

6. Attach the dongle packet file to an e-mail and send it to: [email protected]

IRTUAL

ODE

ETER

CTIVATION

UIDE

NTRODUCTION

A Virtual CodeMeter (VCM) allows the user to run licensed AccessData products without a physical CodeMeter device. A VCM can be created using AccessData License

Manager, but requires the user to enter a "Confirmation Code" during the creation process.

The latest revision of this guide can be found at: http://support.accessdata.com/downloads/VCM_Activation_Guide.pdf

REPARATION

• Contact your AccessData sales rep to order a VCM confirmation code.

• Install CodeMeter Runtime 4.10b or newer (available on the AccessData download page).

• Install the latest release of License Manager (available on the AccessData download page).

• The following steps are to be run on the system where you want to "permanently attach" the VCM.

Note: Once created, the VCM cannot be moved to any other system.

• AD LAB WebUI and eDiscovery administrators, please also follow steps outlined

under in “Additional Instructions for AD LAB WebUI and eDiscovery:” on page 92

in order to enable VCM licensing on the AccessData License Service.

AccessData Mobile Phone Examiner Plus User Guide

ETUP FOR

NLINE

YSTEMS

1. Unplug any AccessData dongles you currently have connected.

2. Launch License Manager.

Note: When creating a VCM on Windows Server 2003 or 2008, please refer to the special set of

steps written for those platforms. See “Creating a Virtual CM-Stick with Server 2003/2008

Enterprise Editions” on page 90.

3. Select Create A Local Virtual CMStick.

4. Click OK.

The Confirmation Code Required dialog appears.

5. Enter your confirmation code.

6. Click OK, AccessData License Manager will automatically synchronize with the

License Server over the Internet.

7. Click OK when the update completes. License Manager will then create the VCM on your system.

8. At this point, AccessData License Manager now displays a serial number for the VCM on the "Licenses" tab and the VCM can now operate in a similar way to a hardware

CodeMeter device.

Appendix B Licensing Information 87

ETUP FOR

FFLINE

YSTEMS

P ERFORM THESE STEPS ON THE O FFLINE SYSTEM :

1. Unplug any AccessData dongles you currently have connected.

2. Launch License Manager.

Note: When creating a VCM on Windows Server 2003 or 2008 Enterprise Edition, please refer to

the special set of steps written for those platforms. See “Creating a Virtual CM-Stick with

Server 2003/2008 Enterprise Editions” on page 90.

3. Select Create Empty Virtual CMStick (offline).

4. Click OK.

5. The resulting dialog prompts you to save the *.wibucmrau file. Enter a name and path for the file, then click Save.

6. Transfer the *.wibucmrau to the Online system.

P ERFORM THESE STEPS ON THE O NLINE SYSTEM :

7. Unplug any AccessData dongles you currently have connected.

8. Launch License Manager.

9. Select Create Activation File (online).

AccessData Mobile Phone Examiner Plus User Guide

10. Click OK.

The Confirmation Code Required dialog appears.

11. Enter your confirmation code and click OK.

12. AccessData License Manager will automatically synchronize with the License Server over the internet. Data synchronized from the server will be written to the

*.wibucmrau file. Click OK when the update completes.

13. Transfer *.wibucmrau back to the offline system.

P ERFORM THESE STEPS ON THE O FFLINE SYSTEM :

14. Unplug any AccessData dongles you currently have connected.

15. Launch License Manager.

16. Select Create Activate Virtual CMStick (offline).

Appendix B Licensing Information 89

17. Click OK.

18. The resulting dialog prompts you to browse to the location of the newly updated

*.wibucmrau file. Locate the file, then click Open. License Manager creates the VCM on your system.

19. 19.At this point, AccessData License Manager should now display a serial number for the VCM on the "Licenses" tab and the VCM can now operate in a similar way to a hardware CodeMeter device.

REATING A

IRTUAL

CM-S

TICK WITH

ERVER

2003/2008 E

NTERPRISE

DITIONS

REATE AN EMPTY

ODE

ETER

ICENSE

ONTAINER

1. On the Server 2003/2008 machine, unplug any CodeMeter devices.

2. Open the CodeMeter Control Center. Make sure the window on the License tab is, empty indicating that no licenses are currently loaded.

3. Select File > Import License…

4. Browse to the License Manager program files directory.

• 32 bit systems: C:\Program Files\AccessData\LicenseManager\

• 64 bit systems: C:\Program Files (x86)\ AccessData\LicenseManager \

5. Highlight the TemplateDisc5010.wbb file, then click Import.

6. Click the Activate License button.

7. When the CmFAS Assistant opens, click Next.

AccessData Mobile Phone Examiner Plus User Guide

8. Select Create license request, and click Next.

9. Confirm the desired directory and filename to save .WibuCmRaC. (Example:

Test1.WibuCmRaC)

10. Click Commit.

11. Click Finish.

C OPY TO ANOTHER MACHINE :

12. Copy the new .WibuCmRaC to another machine that is not running Windows Server

2003/2008 Enterprise.

Note: The destination system must have an active internet connection.

13. Unplug any AccessData dongles you currently have connected.

14. Launch License Manager.

15. Select Create Activation File (online).

16. Click OK.

The Confirmation Code Required dialog appears.

17. Enter your confirmation code and click OK.

18. AccessData License Manager will automatically synchronize with the License Server over the internet. Data synchronized from the server will be written to the

*.wibucmrau file. Click OK when the update completes.

F INISH THE ACTIVATION ON THE W INDOWS S ERVER 2003/2008 E NTERPRISE SYSTEM :

19. Copy the activated .WibuCmRaC file to the Server 2003/2008 machine.

20. On the Server 2003/2008 machine, unplug any CodeMeter devices.

Appendix B Licensing Information 91

21. Open the CodeMeter Control Center. Make sure the window on the License tab empty indicating that no licenses are currently loaded.

22. Select File > Import License…

23. Browse to the location where the activated .WibuCmRaC is stored. Click Import.

24. At this point, AccessData License Manager now displays a serial number for the

VCM on the "Licenses" tab and the VCM can now operate in a similar way to a hardware CodeMeter device.

DDITIONAL

NSTRUCTIONS FOR

AD LAB W

EB

AND E

ISCOVERY

The following information will enable the Web User Interface to recognize a VCM.

Add the following DWORD registry string to the following key and set the value to 1:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products | EnableACTTest

The AccessData License Service will know to expect a VCM when EnableACTTest is set to "1."

AccessData Mobile Phone Examiner Plus User Guide

IRTUAL

ODE

ETER

F.A.Q.

S

Q: How do I get a Virtual CodeMeter (VCM)?

A: Contact your AccessData product sales representative. They will provide you with a

VCM confirmation code.

Q: How do VCMs work?

A: A VCM operates in almost exactly the same way as a hardware CodeMeter device, except that they exist as a file stored on the hard disk. During activation, the VCM file

(named with a WBB extension) is tied to the hardware of the system using unique hardware identifiers. Those unique identifiers make VCMs non-portable. When

AccessData License Manager is launched, it will automatically load the VCM and display its license information. From there, you can refresh, remove, add existing licenses, etc just the same you would with a hardware security device.

Q: Are VCMs supported on virtual machines (VM)?

A: No. Due to the fact that virtual machines are portable and VCMs are not, VCMs are not supported on virtual machines. Currently it is recommended to use AccessData

Network License Service (NLS) to license systems running as virtual machines. CLICK

HERE for more information.

Q: Does the AccessData Network License Service (NLS) support VCMs?

A: The current release of NLS does not support using VCM as a network dongle.

AccessData is considering this support for a future release.

Q: How can I "unplug" a VCM?

A: If you want to prevent License Manager from automatically loading the VCM you can

"unplug" it by stopping the CodeMeter Runtime Service server and then moving (cut and paste) the WBB file to a new location (renaming the file does not suffice). By default the WBB file is located at:

32 bit systems:

C:\Program Files\CodeMeter\CmAct\

Appendix B Licensing Information 93

64 bit systems:

C:\Program Files (x86)\CodeMeter\CmAct\

Q: I have activated a VCM on my system, but now I need to activate it on a different system. What should I do?

A: Since a VCM is uniquely tied to the system on which it is activated, it cannot be moved to any other system. If you need to activate a VCM on a different system, you need to contact your sales rep.

Q: What if I need to reinstall Windows, format my drive, change my system's hardware, or back up my VCM in case of a disaster? Will the VCM still work?

A: The VCM can be backed up by simply copying the WBB file to a safe location. It can be restored by copying the WBB file to the CmAct folder. The VCM cannot be restored without a WBB file. If you do not have a back up of your WBB file, you will need to get a new confirmation code from your sales rep.

Q: My AccessData product does not seem to recognize the license stored on a VCM.

What am I doing wrong?

A: VCMs are supported by the following versions of AccessData products:

FTK 1.81.6 and newer

FTK 3.1.0 and newer

PRTK 6.5.0 and newer

DNA 3.5.0 and newer

RV 1.6.0 and newer eDiscovery 3.1.2 and newer

AD Lab 3.1.2 and newer

AD Enterprise 3.1.0 and newer

MPE+ 4.0.0.1 and newer

Ensure that the version of the product you are running support VCMs. If the version you are running is listed as supported, verify that according to License Manager, the release date of the version you are running falls before the expiration date of the license.

AccessData Mobile Phone Examiner Plus User Guide

ETWORK

ICENSE

ERVER

(NLS) S

ETUP

UIDE

NTRODUCTION

This section discusses the installation steps and configuration notes needed to successfully setup an AccessData Network License Server (NLS).

Note: Click on this link to access the latest version of this guide: Network License Server

(NLS) Setup Guide .

REPARATION

OTES

• CodeMeter Runtime 3.30a or newer must be installed on all Client and Server systems

• AccessData License Manager must be used to prepare the network dongle. The system running License Manager must have internet access and have CodeMeter

Runtime installed.

• The current release of NLS supports the following versions of Windows:

• Windows XP 32/64 bit

• Windows Server 2003 32/64 bit

• Windows Vista 32/64 bit

• Windows Server 2008 R1 32/64 bit

• Windows 7 32/64 bit

• Windows Server 2008 R2 64 bit

ETUP

VERVIEW

Use the following steps to setup NLS:

1. Download the latest release of NLS located in the utilities section of the AccessData download page.

2. Extract contents of ZIP to a folder of your choice.

3. On the NLS server system, run through the NLS Installation MSI and accept all defaults.

4. Prepare network dongle:

Appendix B Licensing Information 95

4a. Provide serial # to AD Support and request to have the "Network Dongle Flag" applied.

4b. Migrate any additional licenses to the network dongle (CLICK HERE for a link to the License Migration guide.)

4c. Refresh the network dongle device using AccessData License Manager.

5. Launch PRTK, DNA, or FTK3 on the NLS client system.

6. Enter the NLS server configuration information (IP address or hostname of NLS server system and 6921 for the Port) then click, OK.

7. If you encounter any problems, please read the notes below for troubleshooting information.

ETWORK

ONGLE

OTES

• AccessData License Manager 2.2.6 or newer should be installed in order to manage licenses on the network dongle.

• Network dongles can hold up to 120 physical licenses. Each License has a capacity to hold thousands of sub licenses (i.e. Client count or worker count).

• Contact AccessData Technical Support to have your CodeMeter device flagged as a

"network dongle" (required for NLS).

NLS S

ERVER

YSTEM

OTES

• Make sure CodeMeter device is flagged as "network dongle" (i.e. License Manager will show the serial as "1181234N". To have this flag set on your CodeMeter device, please contact AccessData Technical Support).

• Server system must be configured to not block incoming and outgoing traffic on TCP port 6921.

• A web interface to view and revoke licenses all licenses is accessible at http:// localhost:5555 (this page can only reached from a web browser running locally on the

NLS server system).

• A "network dongle" cannot be used to run AccessData products locally unless the

NLS server is running locally.

• Some versions of windows may not find a local NLS server when the DNS hostname of the server is provided. In those cases, it is recommended to use a static IP address.

• When using the NLS across domains, users must have permissions to access resources on both domains (either by dual-domain membership or cross-domain trust).

AccessData Mobile Phone Examiner Plus User Guide

• When running NLS on Windows Server 2008, Terminal Services must be installed and accepting connections. If Terminal Services is not configured it will not open the port and share out the licenses correctly.

• The name of the service according to Windows is "AccessData Network License

Service."

NLS C

LIENT

YSTEM

OTES

• When launched, any NLS client application that needs to lease a license from the NLS server will automatically check for the following values within the Windows Registry.

• NetDonglePath: The IP address or DNS hostname of the system hosting the

Network License Server service which is found in the following registry key on the client system:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Common

• NetDonglePort: The TCP port number through which the client and server systems have been configured to use. This value is located in the same key as

NetDonglePath.

• uniqueId: In order to lease a license from the server, the client system must first posses a unique identification value. This value is automatically generated by applications such as FTK 3, PRTK, or DNA. (Registry Viewer and FTK 1.x cannot be used setup initial client NLS configuration at this time.)

You can find the each client system's uniqueId by inspecting the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Shared

• Client system must be configured to not block incoming and outgoing traffic on TCP port 6921.

• The following products support the ability to lease a license from a NLS server:

• FTK 2.2.1 and newer

• FTK 1.81.2 and newer

Appendix B Licensing Information 97

• FTK PRO 3.2 and newer

• PRTK 6.4.2 and newer

• DNA 3.4.2 and newer

• Registry Viewer 1.5.4 and newer

• AD Enterprise 3.0.3 and newer

• AD Lab 3.0.4 and newer

• AD Lab Lite 3.1.2 and previous

• Mobile Phone Examiner 3.0 and newer

• Explicit Image Detection (E.I.D.) Add-on

• Glyph Add-on

• Use "AccessData License Manager" (ver. 2.2.4 or newer) to migrate licenses off other devices and onto a network device.

• AccessData products running on Windows Vista, 7, or Server 2008 must be "Run as administrator" at least once in order to lease a license from a NLS server.

• If the NLS client application is having trouble leasing a license either from the NLS server, it is recommended to delete and recreate the NLS registry key located at:

HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Common in order to reset the licensing configuration to default.

98 AccessData Mobile Phone Examiner Plus User Guide

Hirdetés