±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 2
New Yesterday: 3
Overall: 28045
Visitors: 56

±Forensic Focus Partner Links

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Nokia Lumia 800 [WP7]

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3  Next 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Thu Feb 07, 2013 3:55 pm

- agolding
Yeah Zune allows for backups to be made but unfortunately they're encrypted. Zune does allow you to get Media from wp7 devices in the same way as XRY gets them normally.


Firstly, i didn't say above but thanks for your responses and your willingness to help.

Secondly, obviously I must be missing something here as to the part (that is still not clear) why Nokia/Microsoft would prevent download of personal/business data in the clear to the PC?

I understand backup, but due to the 'fact' the directions I posted above from Nokia's own materials states Zune can populate data into existing Ovi or Nokia Suite Folders, which that data is viewable, why does this present problems of access to the data?

I see the issue of data not being accessed if the Lumia is already backed up to another computer, but that assumption is based upon the target handset having actually backed up previously, which is a 50/50 bet.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Fri Feb 08, 2013 5:52 am

Thats ok.

It's not a case of not wanting the implementation, more of a case of not having time to develop a solution in time for release. Windows Phone 7 was built brand new from the ground up so they had to select what features to include so they included backup for media but nothing else. They have incorporated cloud backup of messages, contacts etc in windows phone 8 but not in windows phone 7 (theyre running on completely different Operating systems, just look the same.

I havent tested OVI suite importation of zune data but I dont imagine it will work as zune doesnt offer the backup of that data to begin with.

The zune backups are 4mb encrypted blocks from when I remember researching them.

Windows phone is incredibly frustrating forensically at the moment.  

agolding
Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Mon Feb 18, 2013 12:42 pm

Looking at a range of tools for Mobile WIN7 tools to see whether they are suitable for examiners. Here is one I have been reviewing last week

www.resco.net/develope...mples.aspx
www.resco.net/mobilefo...ew.aspx#wm
www.resco.net/mobilefo...nload.aspx
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Tue Feb 19, 2013 4:49 am

- trewmte
Looking at a range of tools for Mobile WIN7 tools to see whether they are suitable for examiners. Here is one I have been reviewing last week

www.resco.net/develope...mples.aspx
www.resco.net/mobilefo...ew.aspx#wm
www.resco.net/mobilefo...nload.aspx


What do you hope to do with those controls?  

polar
Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Mon Feb 02, 2015 12:13 pm

Hello,
sorry for the gravedigging of this thread but i thought it was better then starting a new one.

I'll have to deal with this handset soon,
does anyone know if any progress hase been made for analyzing a lumia 800?

i'm looking at the UFED compatibility list as of now, for ufed ultimate it says it supports "filesystem extraction".

but everything else is missing, like it's unable to decode anything in the physical analyzer.

any JTAG method supported or anything?

the evidence i'll have to extract are most likely whatsapp related, so i absolutely need to extract whatsapp history from the mobile.

i wonder if UFED or oxygen is capable of such a task.

I eventually have a flasher box that can be connected to the test points, but honestly i don't trust it too much and would keep it as a last resort just in case they ask me "ok do it no matter what"  

Rampage
Senior Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Sat Feb 07, 2015 11:20 am

We've done a few of those now. If you are able to obtain a physical extraction, you'll be able to analyse WhatsApp easily as it uses SQLite.
_________________
Arun Prasannan
CCL-Forensics Ltd. 

polar
Member
 
 
  

Re: Nokia Lumia 800 [WP7]

Post Posted: Sat Feb 07, 2015 1:05 pm

Polar,
thank you for your reply Smile

the problem is exactly that.. getting a physical dump.

i cant do a chip off but i have an ATF Box.

The phone has the DLOAD bootloader, so i'm trying to figure out which are the viable ways.

i can try to use the test point on the phone to read the flash, but i don't know if ATF can do that.. there is a function (custom read write) which allows me to specify the memory range to read to a file, so i think that if i know the exact flash chip size i can manage to dump its whole content.

second approach: flash a qualcom unlocked bootloader and access the partitions using dd.
This one is easier to perform in terms of technical skills required and tools you need to do that, BUT considering i'm WRITING something on the device i have to make sure that replacing the bootloader doesn't screw up with the actual data.

do you have any experience with this equipment?

In the meanwhile i'm waiting for solderless cables for this specific model, which might compensate my lack in soldering skill


EDIT: I managed to extract the partitions from the internal flash of the device.. one is approximately 15GB, which i think is the OS partitions, others are boot and stuff..

the question now is.. do you know of any tool that can interpret the filesystems?
it doesn't look like any familiar well-known filesystem.
i've tried opening the dd image using ftk imager but it cant recognize it so i cant browse files or directories in an attempt to extract data.  

Rampage
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 3
Go to page Previous  1, 2, 3  Next