October 2021
Test Results for Mobile Device Acquisition Tool:
Data Pilot Desktop v2.0.31
ii
.....................................................................................................................................
...............................................................................................................
....................................................................................................................
.......................................................................................................................
...............................................................................................................
..................................................................................................
........................................................................................
.............................................................................................................................
.................................................................................................
.........................................................
Contents
Introduction 1
How to Read This Report 1
1 Results Summary 2
2 Mobile Devices 5
3 Testing Environment 5
3.1 Execution Environment 6
3.2 Internal Memory Data Objects 6
4 Test Results 8
4.1 Android Mobile Devices 9
4.2 iPhone Operating System (iOS) Mobile Devices 14
Introduction
The Computer Forensics Tool Testing (CFTT) program is a joint project of the
Department of Homeland Security (DHS) Science and Technology Directorate (S&T),
the National Institute of Justice, and the National Institute of Standards and Technology
(NIST) Special Programs Office and Information Technology Laboratory. CFTT is
supported by other organizations, including the Federal Bureau of Investigation, the U.S.
Department of Defense’s Cyber Crime Center, U.S. Internal Revenue Service’s Criminal
Investigation Division Electronic Crimes Program, as well as the DHS Bureau of
Immigration and Customs Enforcement, U.S. Customs and Border Protection and U.S.
Secret Service. The objective of the CFTT program is to provide measurable assurance to
practitioners, researchers, and other applicable users that the tools used in computer
forensics investigations provide accurate results. Accomplishing this requires the
development of specifications and test methods for computer forensics tools and
subsequent testing of specific tools against those specifications.
Test results provide the information necessary for developers to improve tools, users to
make informed choices, and the legal community and others to understand the tools’
capabilities. The CFTT approach to testing computer forensics tools is based on well-
recognized methodologies for conformance and quality testing. Interested parties in the
computer forensics community can review and comment on the specifications and test
methods posted on the CFTT website (http://www.cftt.nist.gov/).
This document r
eports the results from testing Data Pilot Desktop v2.0.31 across
supported mobile devices and associated media e.g., smart phones and tablets.
Test results from other tools can be found on the S&T-sponsored digital forensics web
page, http://www.dhs.gov/science-and-technology/nist-cftt-reports.
How to Read This Report
This report is divided into four sections. Section 1 identifies and provides a summary of
any significant anomalies observed in the test runs. This section is sufficient for most
readers to assess the suitability of the tool for the intended use. Section 2 identifies the
mobile devices used for testing. Section 3 lists testing environment, the internal memory
data objects used to populate the mobile devices. Section 4 provides an overview of the
test case results reported by the tool.
Data Pilot Desktop v2.0.31 Page 2 of 19
Test Results for Mobile Device Acquisition Tool
Tool Tested: Data Pilot Desktop
Software Version: v2.0.31
Supplier: Susteen
Address: 18200 Von Karman Ave, Ste 780
Irvine, CA 92612
Office: 949-341-0007
Fax: 949-341-0008
WWW: www.DATAPILOT.com
1 Results Summary
Data Pilot Desktop v2.0.31 was tested for its ability to acquire active data from the
internal memory of supported mobile devices (i.e., smart phones, tablets). Except for the
following anomalies, the tool acquired all supported data objects completely and
accurately for all mobile devices tested.
The anomalies listed below are specific to the phone type and OS.
Acquisition:
Disruption of device’s connectivity doesn’t result in error. (Devices: Motorola
Droid Turbo 2, HTC 10, Samsung Galaxy S7 Edge, Samsung J3, Motorola G5
Plus, Google Pixel 2)
Personal Information Management (PIM) data:
Notes/Memos are not reported. (Devices: Galaxy S5, LG G4, Motorola Droid
Turbo 2, HTC 10, Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force,
Motorola G5 Plus, Sony Experia, HTC U11, Samsung Galaxy Note 8, Ellipsis,
Google Pixel 2, iPhone 5S, iPhone 6S Plus, iPad Air v7.1)
Notes/Memos are partially reported. (Devices: iPhone 7, iPhone 8 Plus, iPhone
X, iPad Mini 2 v11.3.1, iPad Air v11.2.1)
Short Message Service (SMS) Messages:
SMS via FireChat application are not reported. (Device: Ellipsis)
SMS not reported. (Devices: iPhone 5S, iPad Air v7.1)
Multimedia Messaging Service (MMS)Messages:
MMS audio partially reported. Attachments are not associated with the text
portion of the message. (Devices: LG G4, Motorola Droid Turbo 2, HTC 10,
Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Motorola G5 Plus,
Sony Experia, Samsung Galaxy Note 8, Google Pixel 2)
MMS via FireChat application are not reported. (Device: Ellipsis)
Data Pilot Desktop v2.0.31 Page 3 of 19
MMS containing graphic and video attachments are partially reported. (Devices:
HTC U11, iPhone 5S)
MMS with audio attachment is not reported. (Device: iPhone 5S)
Outgoing audio MMS is not reported. (Devices: iPad Mini 2 v11.3.1, iPad
v11.2.1)
MMS not reported. (Device: iPad Air v7.1)
Stand-alone files:
Document files are not reported. (Devices: Galaxy S5, LG G4, HTC 10, Samsung
Galaxy S7 Edge, Samsung J3, Motorola Z Force, Motorola G5 Plus, Sony
Experia, HTC U11, Samsung Galaxy Note 8, Ellipsis, Google Pixel 2, iPhone 7,
iPad Air v7.1)
Document files are partially reported (i.e., files can’t be accessed/opened).
(Device: iPhone 6S Plus)
Stand-alone files (i.e., audio) are not reported. (Devices: iPhone 5S, iPad Air
v7.1)
Social media Data:
Social media related data (i.e., Facebook, Twitter, LinkedIn, Instagram) is not
reported. (Devices: Motorola Droid Turbo 2, Motorola Z Force)
Social media related data (i.e., Facebook, LinkedIn, Pinterest, SnapChat) are not
reported. (Devices: Motorola G5 Plus, Sony Experia, Google Pixel 2)
Social media related data (i.e., WhatsApp) is not reported. (Device: Motorola G5
Plus)
Social media related data (i.e., Twitter, Instagram) is partially reported i.e. only a
picture was reported. (Devices: Motorola G5 Plus, Sony Experia)
Social media related data (i.e., WhatsApp) is partially reported i.e., pictures
reported but can’t be opened. (Device: Sony Experia)
Social media related data (i.e., Facebook, LinkedIn, Instagram, Pinterest,
SnapChat) is not reported. (Device: Samsung Galaxy Note 8)
Social media related data (i.e., Facebook, LinkedIn) is not reported. (Devices:
HTC 10, Samsung Galaxy J3)
Social media related data (i.e., Twitter) is partially reported i.e., only pictures.
(Devices: Galaxy S5, LG G4, Samsung Galaxy S7 Edge, HTC 10, Samsung J3,
HTC U11, Samsung Galaxy Note 8, Ellipsis)
Social media related data (i.e., WhatsApp) is partially reported (i.e., videos
reported but can’t be played). (Device: Samsung Galaxy Note 8)
Social media related data (i.e., Facebook, LinkedIn, Instagram) is not reported.
(Devices: HTC 10, Samsung Galaxy S7 Edge, Ellipsis)
Social media related data (i.e., Facebook) is not reported. (Device: Galaxy S5)
Social media related data (i.e., Facebook, Twitter, LinkedIn, Instagram, Pinterest,
SnapChat) is partially reported (account, profile related information). (Device:
iPhone X)
Social media related data (i.e., Facebook, Twitter, LinkedIn) is not reported.
(Devices: iPhone 5S, iPad Air v7.1)
Social media related data (i.e., Facebook, Twitter, Instagram, Pinterest, SnapChat)
is partially reported (account, profile related information). (Device: iPhone 8
Plus)
Data Pilot Desktop v2.0.31 Page 4 of 19
Social media related data (i.e., Facebook, Twitter, Instagram) is not reported.
(Devices: LG G4, iPhone 6S Plus, iPhone 7)
Social media related data (i.e., Facebook, Twitter, LinkedIn, Pinterest) is partially
reported. (Device: iPad Mini 2 v11.3.1)
Social media related data (i.e., Facebook, Twitter, LinkedIn, Pinterest) is not
reported. (Device: iPad Air v11.2.1)
Social media related data (i.e., Facebook, LinkedIn, Instagram, Pinterest) is not
reported. (Device: HTC U11)
Social media related data (i.e., Twitter, Instagram, WhatsApp) is partially
reported. (Device: Google Pixel 2)
Internet Related Data:
Bookmarks, Browser and email related data are not reported. (Devices: HTC 10,
Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Sony Experia, HTC
U11, Samsung Galaxy G5 Plus, Samsung Galaxy Note 8, Google Pixel 2)
Email data is not reported. (Devices: Galaxy S5, LG G4, Motorola Droid Turbo
2, Ellipsis)
Browser/History data is not reported. (Devices: LG G4, iPad Mini 2 v11.3.1)
GPS Related Data:
GPS related data (i.e., longitude, latitude coordinates) is not reported. (Devices:
LG G4, Motorola Droid Turbo 2, HTC 10, Samsung Galaxy S7 Edge, Samsung
J3, Motorola Z Force, Motorola G5 Plus, Sony Experia, HTC U11, Google
Pixel 2, iPhone 5S, iPhone 6S Plus, iPhone 7, iPhone 8 Plus, iPhone X, iPad
Mini 2 v11.3.1, iPad v11.2.1, iPad Air v7.1)
GPS related data (i.e., longitude, latitude coordinates) are partially reported.
(Device: Samsung Galaxy Note 8)
For more test result details see section 4.
Data Pilot Desktop v2.0.31 Page 5 of 19
2 Mobile Devices
The following table lists the mobile devices used for testing Data Pilot Desktop v2.0.31.
Make
Model
OS
Firmware
Network
Apple
iPhone
iOS 7.1
(11D167)
2.18.02
CDMA
Apple
iPhone
iOS 9.2.1
(13C75)
1.23.00
CDMA
Apple
iPhone
iOS 10.2
(14C92)
1.33.00
CDMA
Apple
iPhone
iOS 11.4.1
(15G77)
1.89.00
CDMA
Apple
iPhone
iOS 11.3.1
(15E302)
1.89.00
CDMA
Apple iPad
iOS 11.2.1
(11D167)
2.18.02
CDMA
Apple iPad
iOS 11.3.1
(15E302)
4.52.00
CDMA
Apple iPad
iOS 7.1
blank
CDMA
Samsung
Galaxy
Android 4.2.2
G900V.05
CDMA
LG G4
Android 5.1
LMY47D
CDMA
Motorola
Droid
Android 5.1.1
LCK23.130-23
CDMA
HTC 10
Android 6.0.1
1.85.605.8.8.0
_g CL774095
CDMA
Samsung
GS7 Edge
G935V
Android 6.0.1
MMB29M.G9
35VVRS4AP
H1
CDMA
Samsung J3
Android 6.0.1
MMB29M.J32
0VVRU2AP12
CDMA
Motorola
Android 7.0
NCLS25.86-
11-4
CDMA
Moto
Android 7.0
NPNS2513792
4
CDMA
Sony
Android 8.0.0
471A2324
CDMA
HTC U11
Android 7.1.1
12861730
CDMA
Samsung
Galaxy
Android 7.1.1
G960U1UEU1
ARB7
CDMA
Ellipsis 8
Android 4.4.2
KOT49H
CDMA
Google
Android 8.1.0
OPM
171019.029
CDMA
Table 1: Mobile Devices
3 Testing Environment
The tests were run in the NIST CFTT lab. This section describes the selected test
execution environment, and the data objects populated onto the internal memory of
mobile devices.
Data Pilot Desktop v2.0.31 Page 6 of 19
3.1 Execution Environment
Data Pilot Desktop v2.0.31 was installed on Windows 10 Pro version 20H2.
3.2 Internal Memory Data Objects
Data Pilot Desktop v2.0.31 was measured by analyzing acquired data from the internal
memory of pre-populated mobile devices. Table 2 defines the data objects and elements
used for populating mobile devices provided the mobile device supports the data element.
Data Objects
Data Elements
Address Book Entries
Regular Length
Maximum Length
Special Character
Blank Name
Regular Length, Email
Regular Length, Graphic
Regular Length, Address
Deleted Entry
Non-Latin Entry
Contact Groups
PIM Data: Datebook/Calendar; Memos
Regular Length
Maximum Length
Deleted Entry
Special Character
Blank Entry
Call Logs
Incoming
Outgoing
Missed
Incoming – Deleted
Outgoing – Deleted
Missed – Deleted
Text Messages
Incoming SMS – Read
Incoming SMS – Unread
Outgoing SMS
Incoming EMS – Read
Incoming EMS – Unread
Outgoing EMS
Incoming SMS – Deleted
Outgoing SMS – Deleted
Incoming EMS – Deleted
Outgoing EMS – Deleted
Non-Latin SMS/EMS
Data Pilot Desktop v2.0.31 Page 7 of 19
Data Objects Data Elements
MMS Messages Incoming Audio
Incoming Graphic
Incoming Video
Outgoing Audio
Outgoing Graphic
Outgoing V
ideo
Application Data Device Specific App Data
Stand-alone Data Files Audio
Graphic
Video
Audio – Deleted
Graphic – Deleted
Video – Deleted
Internet Data Visited Sites
Bookmarks
E-mail
Location Data GPS Coordinates
Geo-tagged Data
Social Media Data Facebook
Twitter
LinkedIn
Instagram
Pinterest
SnapChat
WhatsApp
Table 2: Internal Memory Data Objects
Data Pilot Desktop v2.0.31 Page 8 of 19
4 Test Results
This section provides the test cases results reported by the tool. Sections 4.1 – 4.2
identify the mobile device operating system type, media (e.g., Android, iPhone Operating
Sy
stem) and the make and model of mobile devices used for testing Data Pilot Desktop
v2.0.31.
Th
e Test Cases column (internal memory acquisition) in sections 4.1 - 4.2 are comprised
of two sub-columns that define a particular test category and individual sub-categories
that are verified when acquiring the internal memory for supported mobile devices and
Universal Integrated Circuit Cards (UICCs) within each test case. Each individual sub-
category row results for each mobile device/UICC tested. The results are as follows:
As Expected: the mobile forensic application returned expected test results – the tool
acquired and reported data from the mobile device/UICC successfully.
Partial: the mobile forensic application returned some of data from the mobile
device/UICC.
Not As Expected: the mobile forensic application failed to return expected test results –
the tool did not acquire or report supported data from the mobile device/UICC
successfully.
NA: Not Applicable – the tool does not provide support for the acquisition for a particular
data element.
Data Pilot Desktop v2.0.31 Page 9 of 19
4.1 Android Mobile Devices
The internal memory contents for Android devices were acquired and analyzed with Data
Pilot Desktop v2.0.31. All te
st cases pertaining to the acquisition of supported Android
devices were successful with the exception of the following:
Disru
ption of device’s connectivity doesn’t result in errors. The tool keeps
attempting acquisition resulting in an empty report for the Motorola Droid 2, HTC
10, Samsung Galaxy S7 Edge, Samsung J3, Motorola G5 Plus, and Google Pixel
2.
Notes/Memos are not reported for the Galaxy S5, LG G4, Motorola Droid Turbo
2, HTC 10, Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Motorola
G5 Plus, Sony Experia, HTC U11, Samsung Galaxy Note 8, Ellipsis, and Google
Pixel 2.
Incoming and Outgoing SMS via FireChat are not reported for the Ellipsis.
Incoming and Outgoing audio MMS attachments are found under the “Audio
Files” category and not associated with the text portion of the message for the LG
G4, Motorola Droid Turbo 2, HTC 10, Samsung Galaxy S7 Edge, Samsung J3,
Motorola Z Force, Motorola G5 Plus, Sony Experia, Samsung Galaxy Note 8, and
Google Pixel 2.
Incoming and Outgoing MMS via FireChat application are not reported for the
Ellipsis.
The textual portion of MMS messages are not reported for the HTC U11. Note:
Audio file attachments are not reported, graphic and video attachments are
reported.
Document files (i.e. pdf) are not reported within the GUI. They are found in a File
System folder saved to Desktop (DPD/File System/…) for the Galaxy S5, LG G4,
HTC 10, Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Motorola G5
Plus, Sony Experia, HTC U11, Samsung Galaxy Note 8, Ellipsis, and Google
Pixel 2.
Social media related data (i.e., Facebook) is not reported for the Galaxy S5.
Social media related data (i.e., Facebook, LinkedIn, Instagram) is not reported for
the LG G4.
Social media related data (i.e., Facebook, Twitter, LinkedIn, Instagram) is not
reported for the Motorola Droid Turbo 2 and Motorola Z Force.
Social media related data (i.e., Facebook, LinkedIn, Pinterest, SnapChat) is not
reported for the Motorola G5 Plus, Sony Experia, and Google Pixel 2.
Social media related data (i.e., WhatsApp) is not reported for the Motorola G5
Plus.
Social media related data (i.e., Twitter, Instagram) is partially reported, only a
picture was reported for the Motorola G5 Plus, Sony Experia, and Google Pixel 2.
Social media related data (i.e., WhatsApp) is partially reported, pictures reported
but can’t be opened for the Sony Experia.
Social media related data (i.e., WhatsApp) is partially reported. Text portion of
the messages are not reported, only graphic files are for the Google Pixel 2.
Social media related data (i.e., Facebook, LinkedIn, Instagram, Pinterest,
SnapChat) is not reported for the Samsung Galaxy Note 8.
Social media related data (i.e., Facebook, LinkedIn, Instagram) is not reported for
the HTC 10, Samsung Galaxy S7 Edge, and Ellipsis.
Data Pilot Desktop v2.0.31 Page 10 of 19
Social media related data (i.e., Facebook, LinkedIn) is not reported for the HTC
10 and Samsung J3.
Social media related data (i.e., Twitter) is partially reported i.e., only pictures for
the Galaxy S5, LG G4, Samsung Galaxy S7 Edge, HTC 10, Samsung J3, HTC
U11, Samsung Galaxy Note 8, and Ellipsis.
Social media related data (i.e., Facebook, LinkedIn, Instagram, Pinterest) are not
reported for the HTC U11.
Social media related data (i.e., WhatsApp) is partially reported (i.e., videos
reported can’t be played) for the Samsung Galaxy Note 8.
Social media related data (i.e., Twitter, Instagram, WhatsApp) is partially
reported for the Google Pixel 2.
Internet Related Data (i.e., Bookmarks, Browser, and Email) is not reported for
the HTC 10, Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Sony
Experia, HTC U11, Motorola G5 Plus, Samsung Galaxy Note 8, and Google Pixel
2.
Internet Related Data (i.e., Email) is not reported for the Galaxy S5, LG G4,
Motorola Droid Turbo 2, and Ellipsis.
Browser/History data is not reported for the LG G4.
GPS related data is not reported for the LG G4, Motorola Droid Turbo 2, HTC 10,
Samsung Galaxy S7 Edge, Samsung J3, Motorola Z Force, Motorola G5 Plus,
Sony Experia, HTC U11, and Google Pixel 2.
GPS related data is reported as a graphic file for the Samsung Galaxy Note 8.
See Tables 3a, 3b below for more details.
Notes:
o Deleted data (i.e., SMS Stand-alone graphic file) was reported for the
Motorola Z Force.
o Only the 1
st
contact listed in a group MMS was reported for the Sony
Experia.
o Memos database has to be opened with a 3
rd
party tool to be able to read
the memos for the Motorola G5 Plus.
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: Android
Galaxy S5
LG G4
Motorola
Droid
Turbo 2
HTC 10
Samsung
GS7 Edge
Samsung
J3
Motorola Z
Force
Acquisition
Acquire All
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Disrupted
As
Expected
As
Expected
Not As
Ex
pected
Not As
Expected
Not As
Expected
Not As
Expected
As
Expect
ed
Reporting
Preview-
Pane
As
Expected
As
Expected
As
Expec
ted
As
Expected
As
Expected
As
Expected
As
Expected
Generated
Reports
As
Expected
As
Expected
As
Expec
ted
As
Expected
As
Expected
As
Expected
As
Expect
ed
Data Pilot Desktop v2.0.31 Page 11 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: Android
Galaxy S5
LG G4
Motorola
Droid
Turbo 2
HTC 10
Samsung
GS7 Edge
Samsung
J3
Motorola Z
Force
Equipment/
User Data
IMEI/
MEID/ESN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MSISDN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data
Contacts
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Calendar
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Memos/
Notes
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Call Logs
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Missed
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SMS
Messages
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS
Messages
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Audio
As
Expected
Partial Partial Partial Partial Partial Partial
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone
Files
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Audio
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Application
Data
Documents
(txt, pdf
files)
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Data Pilot Desktop v2.0.31 Page 12 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: Android
Galaxy S5
LG G4
Motorola
Droid
Turbo 2
HTC 10
Samsung
GS7 Edge
Samsung
J3
Motorola Z
Force
Social Media
Data
Facebook
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Twitter
Partial Partial Not As
Expected
Partial Partial Partial Not As
Expected
LinkedIn
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Instagram
NA Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
NA Not As
Expected
Pinterest
NA NA NA NA NA NA NA
SnapChat
NA NA NA NA NA NA NA
WhatsApp
NA NA NA NA NA NA NA
Internet
Data
Bookmarks
As
Expected
As
Expected
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
History
As
Expected
Not As
Expected
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Email
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
GPS Data
Coordinates
/Geo-tagged
As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Non-Latin
Character
Reported in
native
format
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Hashing
Case File/
Individual
Files
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Case File
Data
Protection
Mo
dify
Case Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data
Report
Active Data
NA NA NA NA NA NA NA
Run SQLite
Commands
NA NA NA NA NA NA NA
Table 3a: Android Devices
Data Pilot Desktop v2.0.31 Page 13 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: Android
Motorola
G5 Plus
Sony
Experia
HTC U11
Samsung
Galaxy
Note 8
Ellipsis
Google
Pixel 2
Acquisition
Acquire All
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Disrupted
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
Reporting
Preview-
Pane
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Generated
Reports
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Equipment/
User Data
IMEI/
MEID/ESN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MSISDN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data
Contacts
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Calendar
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Memos/
Notes
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Call Logs
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
NA As
Expected
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
NA As
Expected
Missed
As
Expected
As
Expected
As
Expected
As
Expected
NA As
Expected
SMS
Messages
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
As
Expected
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
As
Expected
MMS
Messages
Graphic
As
Expected
As
Expected
Partial As
Expected
Not As
Expected
As
Expected
Audio
Partial Partial Not As
Expected
Partial Not As
Expected
Partial
Video
As
Expected
As
Expected
Partial As
Expected
Not As
Expected
As
Expected
Stand-alone
Files
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Audio
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Application
Data
Documents
(txt, pdf
files)
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Data Pilot Desktop v2.0.31 Page 14 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: Android
Motorola
G5 Plus
Sony
Experia
HTC U11
Samsung
Galaxy
Note 8
Ellipsis
Google
Pixel 2
Social Media
Data
Facebook
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Twitter
Partial Partial Partial Partial Partial Partial
LinkedIn
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Instagram
Partial Partial Not As
Expected
Not As
Expected
Not As
Expected
Partial
Pinterest
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
NA Not As
Expected
SnapChat
Not As
Expected
Not As
Expected
NA Not As
Expected
NA Not As
Expected
WhatsApp
Not As
Expected
Partial NA Partial NA Partial
Internet
Data
Bookmarks
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
History
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
As
Expected
Not As
Expected
Email
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
GPS Data
Coordinates
/Geo-tagged
Not As
Expected
Not As
Expected
Not As
Expected
Partial As
Expected
Not As
Expected
Non-Latin
Character
Reported in
Native
Format
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Hashing
Case File/
Individual
Files
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Case File
Data
Protection
Modify
Case Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite Data
Report
Active Data
NA NA NA NA NA NA
Run SQLite
Commands
NA NA NA NA NA NA
Table 3b: Android Devices
4.2 iPhone Operating System (iOS) Mobile Devices
The internal memory contents for iOS devices were acquired and analyzed with Data
Pilot Desktop v2.0.31.
Data Pilot Desktop v2.0.31 Page 15 of 19
All test cases pertaining to the acquisition of supported iOS devices were successful with
the exception of the following across all iOS devices.
Notes/Memos are not reported for the iPhone 5S, iPhone 6S Plus, and iPad Air
v7.1.
Notes/Memos are partially reported. Long notes/memos are truncated for the
iPhone 7, iPhone 8 Plus, iPhone X, iPad Mini 2 v 11.3.1, and iPad Air v11.2.1.
SMS are not reported for the iPhone 5S and iPad Air v7.1.
MMS Image and Video are partially reported (i.e. attachments are not associated
with the text portion of the message. Attachments found under the Image Files
and Audio Files categories) for the iPhone 5S.
MMS Audio messages are not reported for the iPhone 5S.
Outgoing Audio MMS is not reported for the iPad Mini 2 v11.3.1 and iPad
v11.2.1.
MMS are not reported for the iPad Air v7.1
Document files (i.e., can’t be accessed/opened) are partially reported for the
iPhone 6S Plus.
Document files (i.e., pdf files) are not reported for the iPhone 7 and iPad Air v7.1.
Stand-alone files (i.e., audio) are not reported for the iPhone 5S and iPad Air 7.1.
Social media related data (i.e., Facebook, Twitter, LinkedIn) is not reported for
the iPhone 5S and iPad Air v7.1.
Social media related data (i.e., Facebook, Twitter, Instagram) is not reported for
the iPhone 6S Plus and iPhone 7.
Social media related data (i.e., Facebook, Twitter, Instagram, Pinterest, SnapChat)
is partially reported, only account and profile information reported for the iPhone
8 Plus.
Social media related data (i.e., Facebook, Twitter, LinkedIn, Instagram, Pinterest,
SnapChat) is partially reported (account, profile related information) for the
iPhone X.
Social media related data (i.e., Facebook, Twitter, LinkedIn, Pinterest) is partially
reported (account, profile related information) for the iPad Mini 2 v11.3.1.
Social media related data (i.e., Facebook, Twitter, LinkedIn, Pinterest) is not
reported for the iPad Air v11.2.1.
Internet Related Data (i.e., Browser/History data) is not reported for the iPad Mini
2 v11.3.1.
GPS related data (i.e., longitude, latitude coordinates) is not reported for the
iPhone 5S, iPhone 6S Plus, iPhone 7, iPhone 8 Plus, iPhone X, iPad Mini 2
v11.3.1, iPad v11.2.1, and iPad Air v7.1.
See Tables 4a, 4b below for more details.
Data Pilot Desktop v2.0.31 Page 16 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: iOS
iPhone 5S
iPhone 6S
Plus
iPhone 7
iPhone 8
Plus
iPhone X
iPad Mini
v11.3.1
iPad Air
v11.2.1
Acquisition
Acquire All
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Disrupted
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Reporting
Preview-Pane
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Generated
Reports
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Equipment/
User Data
IMEI/MEID/
ESN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MSISDN
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
PIM Data
Contacts
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Calendar
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Memos/Notes
Not As
Expected
Not As
Expected
Partial Partial Partial Partial Partial
Call Logs
Incoming
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
NA NA
Outgoing
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
NA NA
Missed
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
NA NA
SMS
Messages
Incoming
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Outgoing
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
MMS
Messages
Graphic
Partial As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Audio
Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Partial Partial
Video
Partial As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Stand-alone
Files
Graphic
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Audio
Not As
Expected
NA NA As
Expected
As
Expected
As
Expected
As
Expected
Video
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Application
Data
Documents
(txt, pdf files)
As
Expected
Partial Not As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Data Pilot Desktop v2.0.31 Page 17 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device Platform: iOS
iPhone 5S
iPhone 6S
Plus
iPhone 7
iPhone 8
Plus
iPhone X
iPad Mini
v11.3.1
iPad Air
v11.2.1
Social
Media Data
Facebook
Not As
Expected
Not As
Expected
Not As
Expected
Partial Partial Partial Not As
Expected
Twitter
Not As
Expected
Not As
Expected
Not As
Expected
Partial Partial Partial Not As
Expected
LinkedIn
Not As
Expected
As
Expected
As
Expected
As
Expected
Partial Partial Not As
Expected
Instagram
NA Not As
Expected
Not As
Expected
Partial Partial NA NA
Pinterest
NA NA NA Partial Partial Partial Not As
Expected
SnapChat
NA NA NA Partial Partial NA NA
WhatsApp
NA NA NA As
Expected
As
Expected
NA NA
Internet
Data
Bookmarks
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
History
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Not As
Expected
As
Expected
Email
NA NA NA NA NA NA NA
GPS Data
Coordinates/
Geo-tagged
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Not As
Expected
Non-Latin
Character
Reported in
Native
Format
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Hashing
Case File/
Individual
Files
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
Case File
Data
Protection
Modify Case
Data
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
As
Expected
SQLite
Data
Report Active
Data
NA NA NA NA NA NA NA
Run SQLite
Commands
NA NA NA NA NA NA NA
Table 4a: iOS Devices
Data Pilot Desktop v2.0.31 Page 18 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device
Platform: iOS
iPad Air
v7.1
Acquisition
Acquire All
As Expected
Disrupted
As Expected
Reporting
Preview-Pane
As Expected
Generated
Reports
As Expected
Equipment/
User Data
IMEI/MEID/
ESN
As Expected
MSISDN
As Expected
PIM Data
Contacts
As Expected
Calendar
As Expected
Memos/Notes
Not As Expected
Call Logs
Incoming
NA
Outgoing
NA
Missed
NA
SMS
Messages
Incoming
Not As Expected
Outgoing
Not As Expected
MMS
Messages
Graphic
Not As Expected
Audio
Not As Expected
Video
Not As Expected
Stand-alone
Files
Graphic
As Expected
Audio
Not As Expected
Video
As Expected
Application
Data
Documents
(txt, pdf files)
Not As Expected
Data Pilot Desktop v2.0.31 Page 19 of 19
Data Pilot Desktop v2.0.31
Test Cases – Internal
Memory Acquisition
Mobile Device
Platform: iOS
iPad Air
v7.1
Social
Media Data
Facebook
Not As Expected
Twitter
Not As Expected
LinkedIn
Not As Expected
Instagram
NA
Pinterest
NA
SnapChat
NA
WhatsApp
NA
Internet
Data
Bookmarks
As Expected
History
As Expected
Email
NA
GPS Data
Coordinates/
Geo-tagged
Not As Expected
Non-Latin
Character
Reported in
Native
Format
As Expected
Hashing
Case File/
Individual
Files
As Expected
Case File
Data
Protection
Modify Case
Data
As Expected
SQLite
Data
Report Active
Data
NA
Run SQLite
Commands
NA
Table 4b: iOS Devices