Case Profiles

Case Profiles

Case Profiles in Mobius Forensic Toolkit allow you to customize evidence processing by controlling two key aspects:

1. Processing Scope

   • users: Only scan user folders and their subfolders (faster, focused on typical user activity).
   • all: Scan all folders on the evidence source (deeper, more thorough).

2. Enabled Application Parsers
   Only the extensions listed in the profile will be executed during processing.

Profiles are stored as simple INI-style files in the data/profiles/ directory of the installation. When processing evidence, you select the desired profile from a dropdown in the processing dialog.

User Folders Case Profiles

• General: General-purpose profile for everyday investigations.
• CSAM: Child Sexual Abuse Material investigations (standard depth).
• User Files: Standard user activity focus (browsers and communication).
• User Files (Full Analysis): Comprehensive user activity analysis including P2P clients.

All Folders Case Profiles

• Peer-to-peer (P2P): Focused on peer-to-peer file-sharing activity.
• Deep Forensics: Thorough forensic examination of all supported application types.
• CSAM (Deep Analysis): Child Sexual Abuse Material investigations (maximum depth).

Choosing a Profile

• Use user-scoped profiles (scope=users) for faster processing when evidence is expected in standard user directories.
• Use full-scoped profiles (scope=all) when hidden, system, or non-standard locations must be examined (e.g., CSAM deep analysis, malware, data concealment).

Creating Custom Profiles

You can easily create your own profiles:

1. Copy an existing .profile file from data/profiles/ to a new name.
2. Edit with any text editor.
3. Modify the [general] section for name/description.
4. Set scope= to users or all.
5. List desired extensions (one per line) under [processors].

Custom profiles placed in the data/profiles/ directory will automatically appear in the profile selection dropdown.

For more advanced customization or new parsers, see Developing-Extensions.