About Our Software

Import text messages into X-Ways Forensics using
 
Exponent MobileMessagingTM

Exponent MobileMessagingTM is a powerful utility that imports mobile device SMS, MMS and iMessages, including any attachments, directly into your X-Ways Forensics case files.




Features at a Glance

The best feature by far is Exponent MobileMessaging's ability to create visually compelling conversation-view reports.
Feature Description
Android Device Support Import SMS and MMS messages from Android devices acquired using * version 7.0.0.35443 or above.
iOS Device Support Import SMS, MMS and iMessages from Apple devices acquired using XRY by MSAB and * version 7.0.0.35443 or above. Messages can also be imported directly from a standalone iTunes Backup folder. Artifacts supported also include Instagram Profiles and Instagram Direct Messages (for iOS devices and iTunes Backups).

Additional support included for WhatsApp using XRY.
Import as .EML A single text message is really not all that different from an email in that it comprises of (a) a message, and (b) one or more potential attachments. As a result, Exponent MobileMessagingTM takes a unique and clever approach by importing messages into X-Ways Forensics as common .EML format. This makes it possible to embed any attachments such as sent pictures or videos.

During the message importation process, messages and their metadata are store in .EML format so that X-Ways Forensics can process them further using Refine Volume Snapshot.

By taking this approach, it makes it possible to combine conventional email and text messages for a much simpler, consolidated and faster analysis of communication based evidence.
Emoji Support

Exponent MobileMessagingTM provides updated support for emoji graphics encoded within text messages. Applications that don't stay current on Unicode updates will fall short of acurately displaying emojis in text messages. Some emoji encoding solutions omit to consider Unicode codepoint modifiers for enhanced emojis (e.g., varying skin tone emojies) when decoding UTF-8 data.


With Exponent MobileMessagingTM, you will typically see this 👨🏼‍🔧 instead of this 👱🔧.


To ensure proper interpretation and rendering of emoji graphics in text messages, Exponent MobileMessagingTM goes beyond this limitation by providing full support for the most current extended Unicode Technical Standard Version 15.1, which was made available on 2023-09-05. Exponent MobileMessagingTM implements an exclusive encrypted decoding feature that provides support for full colour emojis. This capability makes it possible accurately render emojis in text messages when using the Preview feature in X-Ways Forensics.

System Requirements

There are a few things you need to know in order to make your message collection and analysis successful.
Requirement Description
X-Ways Forensics Version 19.3 or above is required to run Exponent MobileMessagingTM.
* You will need to have a licensed version of * installed on your computer. A minimum version of 7.0.0.35443 is recommended. This is not required if you choose to import messages from a standalone iTunes Backup folder.
Disk Space Make sure you have ample disk space when importing large volumes of text messages and their attachments. While text messages alone typically do not take up much disk space, the size and quantity of attachments is a different story.
Chrome Browser Any and all Exponent APITM reporting features are configured and tested with the latest version of the Google Chrome browser. Please note that reports may not render the same in Microsoft Edge or Mozilla Firefox.

Product FAQs

Here are some of the more common questions and answers that we have received.

Can messages be imported from devices that have been acquired using *?

Yes, absolutely.

Are other 3rd party mobile forensic software tools supported?

While only * is supported at this time, development is underway to provide support for other vendor products. If you are using a different product for your mobile device examinations, we would like to hear from you.

What information does Exponent MobileMessaging capture?

Exponent MobileMessaging will rely on the data that has already been decoded and captured by a 3rd party mobile forensic tool. Alternatively, Exponent MobileMessaging will perform its own decoding of the native messages database file (e.g., sms.db) that has been manually extracted from a device. Details about where any data was imported (e.g., per message) are captured and stored inside of X-Ways Forensics using the Comments field for continuity purposes.

How are imported message timestamps reported in X-Ways Forensics?

Messages that are imported from a 3rd party mobile forensic product will adopt any timestamps that were decoded by the tool. These are represented in X-Ways Forensics as any one or more of the following available fields: Created, Modified, Accessed and Content Created.

Messages that are imported directly from an iTunes Backup (e.g., a folder on your local disk or collected by a 3rd party mobile forensic software tool) will utilize the Modified timestamp column in X-Ways Forensics. This column maps directly to the message LastModified metadata stored by the Manifest.db file in binary PList format.

* Magnet Forensics and Magnet Axiom are the trademarks and copyright of Magnet Forensics

© API Forensics 2024. All rights reserved.
X-Ways Forensics is the trademark and copyright of X-Ways Software Technology AG