April 2023

Test Results for Mobile Device Acquisition Tool:

MD-NEXT v1.91.18.1758/MD-REDv3.10.4.2086

ii

Contents

Introduction ..................................................................................................................................... 1

How to Read This Report ............................................................................................................... 1

1 Results Summary .................................................................................................................... 2

2 Mobile Devices ....................................................................................................................... 4

3 Testing Environment ............................................................................................................... 5

Introduction

The Computer Forensics Tool Testing (CFTT) program is a joint project of the

Department of Homeland Security’s (DHS) Science and Technology Directorate, the

National Institute of Justice, and the National Institute of Standards and Technology’s

(NIST) Special Programs Office and Information Technology Laboratory. CFTT is

supported by other organizations, including the Federal Bureau of Investigation, the U.S.

Department of Defense Cyber Crime Center, U.S. Internal Revenue Service’s Criminal

Investigation Division Electronic Crimes Program, and U.S. Immigration and Customs

Enforcement, U.S. Customs and Border Protection and U.S. Secret Service. The objective

of the CFTT program is to provide measurable assurance to practitioners, researchers,

capabilities. The CFTT approach to testing computer forensics tools is based on well-

recognized methodologies for conformance and quality testing. Interested parties in the

computer forensics community can review and comment on the specifications and test

methods posted on the CFTT website (https://www.cftt.nist.gov/).

This document reports the results from testing MD-NEXT v1.91.18.1758/MD-RED

v3.10.4.2086 across supported mobile devices.

Test results from other tools can be found on DHS’s computer forensics webpage at

https://www.dhs.gov/science-and-technology/nist-cftt-reports.

This report is divided into four sections. Section 1 identifies and provides a summary of

Tool Tested: MD-NEXT/MD-RED

Software Version: v1.91.18.1758/v3.10.4.2086

Supplier: GMDSOFT

Address: Room 215, 2nd Floor, H Square N-dong

235, Pangyoyeok-ro,Bundang-gu, Seongnam-si, Gyeonggi-do

South Korea, 13494

Phone: +82-31-778-3599

supported. For instance, a physical and/or file system extraction will provide the user

with more data than a logical extraction. Each supported data extraction technique was

performed. Except for the following anomalies, the tool acquired all supported data

objects completely and accurately for all mobile devices tested.

IMEI is not reported. (Devices: Google Pixel 6, Google Pixel 6 Pro, Galaxy Z

Fold 3)

 Contacts are partially reported. (Device: Huawei P20 Pro)

 Calendar data is not reported. (Devices: Galaxy S10, Galaxy S22, Galaxy Note 10,

 Social media related data (Twitter, WhatsApp) is partially reported. (Device:

Google Pixel 4)

 Social media related data (WhatsApp, TikTok) is partially reported. (Device:

Google Pixel 6)

 Social media related data (Facebook, Twitter, LinkedIn, Instagram, Pinterest,

Snapchat) is not reported. (Device: Google Pixel 6)

 Social media related data (Facebook, Twitter, LinkedIn, Instagram, Pinterest,

Snapchat, WhatsApp, TikTok) is not reported. (Device: Google Pixel 6 Pro)

 Social media related data (LinkedIn, Instagram) is not reported. (Device: Galaxy

 Social media related data (Pinterest) is not reported. (Device: Galaxy S22)

 Social media related data (Facebook, LinkedIn, Instagram) is partially reported.

(Devices: Galaxy Note 8)

 Social media related data (WhatsApp) is not reported. (Devices: Galaxy Note 8)

 Social media related data (Facebook, Instagram, Pinterest, Snapchat) is not

reported. (Device: Galaxy Note 10)

 Social media related data (Twitter, LinkedIn, WhatsApp) is partially reported.

(Device: Galaxy Note 10)

 Social media related data (Twitter, Pinterest, Snapchat) is not reported. (Device:

One Plus 9)

 Social media related data (Facebook, Twitter, LinkedIn, Pinterest, Snapchat) is

not reported. (Device: iPhone 8)

 Social media related data (Instagram) is partially reported. (Device: iPhone 8)

 Social media related data (LinkedIn, Pinterest, Snapchat) is not reported. (Device:

iPhone X)

 Social media related data (Pinterest, TikTok) is not reported. (Device: iPhone 11)

 Social media related data (Twitter, LinkedIn, Pinterest, Snapchat) is not reported.

(Devices: iPhone XR, iPhone SE, iPhone 13, iPhone 13 Pro, iPhone 13 Pro Max,

iPhone 13 Mini)

Galaxy Note 10, One Plus 9, One Plus 10 Pro, Galaxy Z Fold 3)

For more test result details see section 4.

2 Mobile Devices

The following table lists the mobile devices used for testing MD-NEXT v1.91.18.1758

/MD-RED v3.10.4.2086.

Apple

Apple

Apple

Apple

Apple

Apple

3 Testing Environment

The tests were run in the NIST CFTT lab. This section describes the selected test

execution environment, and the data objects populated onto the internal memory of

4 Test Results

This section provides the test cases results reported by the tool. Sections 4.1 through 4.2

identify the mobile device operating system type, media type such as Android and iOS,

the tool did not acquire, or report supported data from the mobile device/UICC

successfully.

data element.

4.2 iOS Mobile Devices

The internal memory contents for iOS devices were acquired and analyzed with MD-

All test cases pertaining to the acquisition of supported iOS devices were successful

except for the following across all iOS devices.

iPhone X.

 Social media related data (Pinterest, TikTok) is not reported for the iPhone 11.

 Social media related data (Twitter, LinkedIn, Pinterest, Snapchat) is not reported

for the iPhone XR, iPhone SE, iPhone 13, iPhone 13 Pro, iPhone 13 Pro Max and

iPhone 13 Mini.

 Acquisition method used for all devices was iOS Backup. However, other

methods were available for some devices but for the following reasons they were

not successful:

13 Pro and iPhone 13 Pro Max: memos.

 Deleted data recovered for the iPhone XR: memos and stand-alone picture.

 Deleted data recovered for the iPhone SE: memos but the tool reported its status

as “active” and stand-alone graphic file.

See Table 4a, 4b below for more details.

Application Data:

Documents (txt, pdf files)

Case File/ Individual Files