Knowledgebase: E3
About E3 Mobile Data Case Evidence
Posted by Jack H. Ward on 05 January 2017 11:11 AM

Acquired/imported mobile data is saved as an E3 mobile data case, which is a file with the .ds extension stored in the same folder as the Electronic Evidence Examiner case to which the data was acquired or imported. The E3 mobile data case file name has the following structure:

<Name of Electronic Evidence Examiner Case>_<Type of data acquisition (Acquisition, Import, or Cloud Import)>_<Date of acquisition/import/cloud import>_<Time of acquisition/import/cloud import>

For example, an E3 mobile data case attached to an Electronic Evidence Examiner case named Case (1).e3 will have the following name: Case_(1)_Acquisition_07-25-2016_13-34-37.ds

A new E3 mobile data case is created at the end of each acquisition/import/cloud import procedure. Thus, an Electronic Evidence Examiner case can have multiple E3 mobile data cases attached to it.

To view an E3 mobile data case, you need to open an Electronic Evidence Examiner case to which it is attached. You can also add E3 mobile data cases created in Electronic Evidence Examiner or Paraben's DS as evidence.

If you want to move the case along with E3 mobile data case evidence to another location, it is recommended to save it as an archive.

To investigate E3 mobile data case evidence, you need one of the following packages:

  • E3: Universal (acquisition and parsing)
  • E3: P2C (parsing)
  • E3: DS (acquisition and parsing)
  • E3: Viewer (parsing)
(0 vote(s))
Helpful
Not helpful

Comments (0)