AccessData MPE+

Quick Install

| 3

AccessData Legal and Contact Information

Document date: April 5, 2013

Legal Information
2012 AccessData Group, LLC All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher. AccessData Group, LLC makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, LLC reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, AccessData Group, LLC makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, AccessData Group, LLC reserves the right to make changes to any and all parts of AccessData software, at any time, without any obligation to notify any person or entity of such changes. You may not export or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside.

AccessData Group, LLC. 384 South 400 West Suite 200 Lindon, Utah 84042 U.S.A. www.accessdata.com

AccessData Trademarks and Copyright Information

AccessData Distributed DNA

is a registered trademark of AccessData Group, LLC.

Network Attack is a registered trademark of AccessData Group, LLC.

is a registered trademark of AccessData Group, LLC. Toolkit is a registered trademark of AccessData Group, LLC. Recovery Toolkit is a registered trademark of AccessData Group, LLC.
| 4

Forensic FTK

is a registered trademark of AccessData Group, LLC.

Password

PRTK Registry

is a registered trademark of AccessData Group, LLC. Viewer is a registered trademark of AccessData Group, LLC.

A trademark symbol (, , etc.) denotes an AccessData Group, LLC. trademark. With few exceptions, and unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark and copyright holders. AccessData claims no responsibility for the function or performance of third-party products. Third party acknowledgements:
FreeBSD AFF

Copyright 1992-2011. The FreeBSD Project.

and AFFLIB Copyright 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology Corp. All rights reserved. 2005 - 2009 Ayende Rahien

Copyright

Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your purchase.

Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows you to access technical support, and to download and install the latest releases for your licensed products during the active license period. Following the initial licensing period, a subscription renewal is required annually for continued support and for updating your products. You can renew your subscriptions through your AccessData Sales Representative. Use LicenseManager to view your current registration information, to check for product updates and to download the latest product versions, where they are available for download. You can also visit our web site, www.accessdata.com anytime to find the latest releases of our products. For more information, see Managing Licenses in your product manual or on the AccessData web site.

AccessData Contact Information

Your AccessData Sales Representative is your main contact with AccessData Group, LLC. Also, listed below are the general AccessData telephone number and mailing address, and telephone numbers for contacting individual departments.

| 5

Mailing Address and General Phone Numbers

You can contact AccessData in the following ways:

AD Mailing Address, Hours, and Department Phone Numbers

Corporate Headquarters: AccessData Group, LLC. 384 South 400 West Suite 200 Lindon, UT 84042 USA Voice: 801.377.5410 Fax: 801.377.5426 Monday through Friday, 8:00 AM 5:00 PM (MST) AccessData is closed on US Federal Holidays
Voice: 800.574.5199, option 1 Fax: 801.765.4370 Email: Sales@AccessData.com Voice: 800.574.5199, option 2 Fax: 801.765.4370 Email: Sales@AccessData.com Voice: 801.377.5410, option 3 Fax: 801.765.4370 Email: Sales@AccessData.com Voice: 801.377.5410, option 6 Fax: 801.765.4370 Email: Training@AccessData.com Voice: 801.377.5410, option 4

General Corporate Hours: State and Local Law Enforcement Sales: Federal Sales:

Corporate Sales:

Training:

Accounting:

Technical Support
Free technical support is available on all currently licensed AccessData products. You can contact AccessData Customer and Technical Support in the following ways:

AD Customer & Technical Support Contact Information

Standard Support: Monday through Friday, 5:00 AM 6:00 PM (MST), except corporate holidays. Voice: 801.377.5410, option 5 Voice: 800.658.5199 (Toll-free North America) Email: Support@AccessData.com Monday through Friday 6:00 PM to 1:00 AM (MST), except corporate holidays. Voice: 801.377.5410, option 5 Monday through Friday 1:00 AM to 5:00 AM (MST), except corporate holidays. Email: afterhours@accessdata.com

After Hours Phone Support:

After Hours Email-only Support:

International Support Europe/Middle East/Africa

| 6

AD Customer & Technical Support Contact Information (Continued)

Standard Support:

Monday through Friday, 8:00 AM 5:00 PM (UK-London), except corporate holidays. Voice: +44 207 160 2017 (United Kingdom) Email: emeasupport@accessdata.com Monday through Friday, 5:00 PM to 1:00 AM (UK/London), except corporate holidays. Voice: 801.377.5410 Option 5*. Monday through Friday, 1:00 AM to 5:00 AM (UK/London), except corporate holidays. Email: afterhours@accessdata.com

After Hours Support:

After Hours Email-only Support:

Other
Web Site:

http://www.AccessData.com/Support The Support web site allows access to Discussion Forums, Downloads, Previous Releases, our Knowledgebase, a way to submit and track your trouble tickets, and in-depth contact information.

AD SUMMATION

Americas/Asia-Pacific: 800.786.2778 (North America). 415.659.0105. Email: support@summation.com Monday through Friday, 6:00 AM 6:00 PM (PST), except corporate holidays. Monday through Friday by calling 415.659.0105. Between 12am and 4am (PST) Product Support is available only by email at afterhours@accessdata.com. 866.278.2858 Email: support@casevault.com Monday through Friday, 8:00 AM 6:00 PM (EST), except corporate holidays.

Standard Support: After Hours Support: After Hours Email-only Support: AD Summation CaseVault

AD Summation Discovery Cracker

866.833.5377 Email: dcsupport@accessdata.com Monday through Friday, 7:00 AM 7:00 PM (EST, except corporate holidays.

Support Hours:

Note: All support inquiries are typically responded to within one business day. If there is an urgent need for support, contact AccessData by phone during normal business hours.

Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital investigations including law enforcement, counter-intelligence, and corporate security. Their collective experience in working with both government and commercial entities, as well as in providing expert testimony, enables them to provide a full range of computer forensic and eDiscovery services.

| 7

At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, FTK Pro, Enterprise, eDiscovery, and Lab. They can help you resolve any questions or problems you may have regarding these products

Contact Information for Professional Services

Contact AccessData Professional Services in the following ways:

AccessData Professional Services Contact Information Contact Method

Phone

Number or Address
Washington DC: 410.703.9237 North America: 801.377.5410 North America Toll Free: 800-489-5199, option 7 International: +1.801.377.5410

Email

adservices@accessdata.com

| 8

MPE+ Quick Install

Prerequisites
This section outlines what is required to set up a fully functional AccessData MPE+ system. The system must have:
A

current AccessData MPE+ license that meets or exceeds the minimum system requirements. .NET Framework 4.0 or newer.

Hardware/software Microsoft

MPE+ System Requirements

Before using MPE+ to acquire or analyze mobile device data, certain hardware and software requirements must be met.

Hardware and Software Specifications Desktop Minimum Spec

OS Processor RAM Disk Space Windows 7 32-bit or 64-bit Windows XP Professional 32-bit Core2 Duo 2GHz (or equivalent) 2GB 250GB (Additional storage may be needed for physical Apple device acquisitions) QTY x4 USB 2.0 ports 32MB or higher

Desktop Ideal Spec

Windows 7 64-bit Core2 Duo 2GHz+ (or equivalent) 4GB 500GB (Additional storage may be needed for physical Apple device acquisitions) QTY x4 USB 3.0 ports 128MB or higher

Expansion Ports Dedicated Video Memory

For information on system requirements for extraction from Apple phones see http://support.apple.com/kb/ HT1426.

Optional Hardware
A

data synchronization cable that is compatible for the mobile device.

| 9

Note: Several cables are included with MPE+. MPE+ is also compatible with the Susteen brand cable

set. For a list of mobile phones and the cable required to interface each phone with the investigating computer, click the Supported Devices button on the desktop application toolbar.
SIM

/ USIM card reader (Most PC/SC compliant card readers are supported). Field Tablet (sold separately).

MPE+

Note: The MPE+ Tablet ships with the accelerometer feature enabled. This may cause unwanted

behavior in the list view when moving the Tablet. To normalize the behavior, disable the accelerometer feature.
Bluetooth

1.2 compliant wireless card. MPE+ supports data connections via Bluetooth for certain devices.

Installing MPE+
Important: Before you begin installing MPE+, configure your antivirus and/or malware scanner to ignore the AccessData folder (AppData\Roaming\AccessData). Antivirus and malware scanning programs can mistake AccessData exploits and delete them. If the exploits are deleted, you will not be able to use them.

Installing Windows Components

On Windows XP, MPE+ requires a Windows Component called MSMQ (Microsoft Message Queuing) to be installed prior to installing MPE+.

To install MSMQ on Windows XP

1. 2. 3. 4. 5. 6.

In Control Panel, double-click Add/Remove Programs. On the left tab of the Add/Remove Programs window, click Add/Remove Windows Components. Once the Windows Components Wizard opens, click to select the Message Queuing Services item. Click Next. This will start the MSMQ 2.0 setup process. Your Windows XP installation CD-ROM, network share, or install point must be available. MSMQ will display an installation dialog box. You will be prompted to install either an MSMQ server or a dependent client. You can install MSMQ 2.0 in Workgroup mode by selecting Message Queuing Will Not Access a Directory Service.

Installing the MPE+ Application Using ClickOnce

The MPE+ installer automatically configures MPE+ to run as an administrator. In order to function properly, MPE+ requires local administrator rights to the system, and, therefore, it must also be installed by a user with local administrator privileges. MPE+ is installed using ClickOnce from a website.

Installing MPE+

| 10

To install MPE+
1. 2. 3. 4. 5. 6.

Plug your codemeter stick into your computer. Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. On the web page, click Install MPE+. Click Run. Click Run. In the MPE Setup pop-up, click Install if you want to install the listed components of MPE+.

Note: If you do not have the latest version of iTunes installed on your system, MPE+ will prompt you to update your iTunes. If you update iTunes and restart your machine, you will have to restart the MPE+ install.

Installing the MPE+ Application Offline

In order to install MPE+ on a machine that does not have access to the internet, you must do one of the following things:
Download

the MPE+ application from the ClickOnce website and save it to a flashdrive or burn it to a

disk.
Use

the MPE+ disk shipped with your product.

To install MPE+ using ClickOnce

1. 2. 3. 4. 5. 6. 7.

Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Expand the option for Offline Downloads. Download the appropriate offline installer and firmware package. Extract the offline installer and put its contents, along with the firmware package and the Apple physical support files installer, on media to transport to your forensic machine. Ensure your CodeMeter USB is connected and has a current MPE+ license. Insert the MPE+ installation media into the machine. (If the autorun.exe does not launch automatically, explore the disk drive and run it manually.) Follow the instructions in Installing the MPE+ Application Using ClickOnce (page 10).

Note: If you want to be able to extract physical images from Apple devices, you will also need to contact Support at 800-658-5199 to obtain the Apple physical support files

To install using the disk shipped with your product

1. 2. 3. 4.

Insert the codemeter into the machine. Insert the MPE+ original dvd into the machine. (If the autorun.exe does not launch automatically, explore the disk drive and run it manually.) Select to install either MPE+ Install or MPE+ Tablet install (for Touch screen PC tablets). Follow the instructions in Installing the MPE+ Application Using ClickOnce (page 10).

Installing MPE+

| 11

Manually Importing Firmware

To manually import firmware
1. 2.

Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Download one of the following firmware options:
Windows Windows Windows

7 x64 Version 1 7 x86 Version 1

XP x86 Version 1 Each link downloads a file named MPEFirmware_1.zip

3. 4. 5. 6. 7.

Save the download file somewhere on your computer where you can browse to the location. Open MPE+. Select Manage > Import Drivers.

Browse to the directory where you saved the firmware file (just the folder, not the file name is needed). Click OK and the firmware will begin the update.

Upgrading from a Previous Version

If you are upgrading from a previous version of MPE, follow these instructions. If you need more information about installing, see Installing MPE+ (page 10).

To upgrade from a previous version of MPE

1. 2. 3.

Uninstall old version(s) of MPE. (This step is now optional. As of MPE+ 4.3, over-the-top upgrades are supported.) Install new version of MPE+. See Installing MPE+ on page 10. Activate using the new license key license when prompted.

Installing Files for iOS Physical Acquisition

If you are extracting data from an iOS device, you need to download the files for the device(s) that you want to investigate. You can download them from the Physical Acquisition Support tab in MPE+. Note: Restart MPE+ after you have downloaded the files.

To install files for iOS Physical Extraction

1.

Open MPE+. Under the Product Information pane, click the Physical Acquisition Support tab.

Installing MPE+

| 12

Physical Acquisition Support Tab

2.

Click Download to download the file for the device that you want. MPE+ has files for the following devices:
iPad1 iPad1C 1Phone2G iPhone3G iPhone

3GS

iPhone3GSC iPhone4 iPhone4C iPhone4CDMA iPhone4CDMAC iPod3 iPod3C iPod4 iPod4C

3.

When you have downloaded the files, restart MPE+.

Installing Mobile Device Drivers

Once MPE+ launches, you need to download the drivers for the devices you want to examine. Each supported mobile device that you plan to examine must have the correct driver installed before the device is connected.You can find the driver packages to download under the Driver Management tab in the Product Information pane. The driver packages are grouped by OS, where you can download a set of drivers. Or you can download individual drivers for the device you want to examine. You can only download and install drivers once from the MPE+ interface (per user). Once you have downloaded and installed, if you want install them again, you will need to download the driver packages from the ClickOnce website.

Installing MPE+

| 13

You can also install drivers manually. See Manually Installing Drivers on page 15.

To install mobile device drivers

1.

Open MPE+. Under the Product Information pane, click the Driver Management tab.

Driver Management Tab

2.

You can download driver(s) in two ways:

Select Select

a group of drivers that you want to download, and click Download All. an individual driver, expand the OS group, and click Download.

Drivers Available to Download Operating System

Android

Drivers

Acer Alcatel Asus Dell Google HTC Huawei Kyocera LG Motorola Pantech Samsung Vizio ZTE

Installing MPE+

| 14

Drivers Available to Download Operating System

Blackberry International Legacy

Drivers

Blackberry Google MTK

Drivers for older devices. If you are unsure whether your device is considered a legacy device or not, download drivers from both Android and Legacy sections. Acer EMGETON FTDI iDen Lenovo LG Older Phones Motorola Nokia Prolific Samsung SonyEricsson SIMReader

WindowsMobile
3. 4.

WindowsMobile

After the driver(s) have been downloaded, you will need to install them. Click Install All/Install.

Manually Installing Drivers

Each supported mobile device that you plan to examine must have the correct driver installed before the device is connected. For any device to be detected by MPE+, the manufacturers device driver must first be properly installed. The MPE+ console will not automatically update drivers when new device drivers are released by manufacturers. To update drivers, you can either install the updates via MPE+ download page or by using Windows to locate the drivers. Note: AccessData recommends using Windows XP or Windows 7 systems for use with MPE+. You may encounter driver issues when running MPE+ on Vista. Note: Users of the MPE+ Field Tablet will find that many of the most common drivers have been pre-installed on their system.

To locate an updated driver from MPE+ Download page

1.

Verify the device manufacturer and model is listed in the Supported Device list. View the list by clicking the Supported Devices button under the Manage tab.

2. 3.

Open an internet browser and enter http://accessdata.com/mpe-clickonce in the address bar. Locate and download the driver that you want to install.

Installing MPE+

| 15

4. 5. 6. 7. 8.

Save the download file somewhere on your computer where you can browse to the location. Open MPE+. Select Manage > Import Drivers.

Browse to the directory where you saved the driver. Click OK and the driver will install.

To install a manufacturer device driver

1.

Verify the device manufacturer and model is listed in the Supported Device list. View the list by clicking the Supported Devices button under the Manage tab.

2. 3.

Locate the correct USB cable and connect the phone to the computer through the USB cable. Upon connecting the device, Windows will automatically attempt to locate the appropriate driver. You will likely be prompted to provide the path to the appropriate driver; if so, browse to the path of the driver based on the name of the manufacturer found in the device drivers folder. Once you have selected a driver, Windows will provide feedback as to whether or not the driver was successfully installed. If the selected driver fails to install, you may need to repeat the process starting from Step 1. If Windows indicates that the driver did install successfully, however, proceed to the next step. Once the driver has been successfully installed, you may be prompted to locate additional drivers, this is normal and you should continue to repeat the process for as many drivers as Windows detects that it needs. Verify the device is properly listed in the Windows Device Manager.

4.

5.

6.

Note: Only currently connected devices will be listed in Windows Device Manager. Device drivers you have installed previously will not be listed unless the device is connected. Note: IIf you choose to skip this step, all other features will still function, but this prompt will appear each time you open MPE+ until you allow the files to download.

Installing MPE+

| 16