Output file information:

Forensic Image output:

When used in forensic imaging mode, the output from iXAM® is a raw disk image file in Apple’s proprietary DMG format. This image can be mounted and/or viewed as follows :

Mount DMG file on an Apple™ Macintosh computer

Mount DMG file using MacDrive™ for Windows™

Load DMG file into Access Data® FORENSIC TOOLKIT® version 2

Load DMG file into Access Data® FTK Imager Lite

Load DMG file into Guidance® Systems EnCase® Forensic version 6 or above.

Logical Download output:

When used in logical download mode, the output from iXAM is in a folder hierarchy which exactly mimics the data in the user partition of the handset. Each file is extracted from the device and the file system is reconstructed on the forensic workstation. This includes the creation, modification and last access timestamps from the files on the device - these are preserved and replicated to the workstation.

The resulting files can be viewed as follows:

SQLite Expert Personal Edition can be used to examine the information stored in databases on the device

All device configuration files are stored in Apple’s proprietary ‘PList’ format. This can be either plain XML, which can be viewed with any text editor, or a compressed binary format. iXAM ships with an explorer menu extension which will convert these binary files back to plain XML for viewing and analysis.