Nokia Lumia 930 - C...
 
Notifications
Clear all

Nokia Lumia 930 - Chip Off forensics

8 Posts
3 Users
0 Likes
400 Views
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Hi
I have the subjected device which has fallen from the stairs and only possible way of data extraction is chip-off forensics. Has anyone ever tried it on this phone ? i hope it doesnt have encrypted memory ? Response will be highly appreciated.

 
Posted : 30/07/2015 1:13 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Do you want recover data yourself?
It is enough hard.

 
Posted : 30/07/2015 3:33 pm
TomP
 TomP
(@tomp)
Posts: 36
Eminent Member
 

I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.

 
Posted : 04/08/2015 5:22 pm
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.

Thanks mate. I really appreciate your encouraging words. Will let you know once i follow the procedure. However my only concern was to know if the read will be encrypted or not. Thanks for the prompt.

 
Posted : 04/08/2015 11:11 pm
TomP
 TomP
(@tomp)
Posts: 36
Eminent Member
 

It should load straight into FTK. Just be mindful of hidden file settings and permissions when exporting folders.

 
Posted : 04/08/2015 11:21 pm
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Tom,
i would definitely pick from your advice. I have UFED PA also. So i think that might also help me in reading the image. What do you say ?

 
Posted : 05/08/2015 1:35 am
TomP
 TomP
(@tomp)
Posts: 36
Eminent Member
 

I don't have the cellebrite support file to hand so can't check, the latest version may have support now when at a certain level of charge for an extraction. If you export store.vol and its associated folders you will need to repair it. Windows has this as a built in feature and you can google how to. I don't see a huge amount of windows phones if I'm honest although I have helped our r&d team with the the make up of the database. It's quite daunting to start with if there is a lot of data present. See if you can get a physical read first and we can go from there.

 
Posted : 05/08/2015 3:20 am
(@harshbehl)
Posts: 67
Trusted Member
Topic starter
 

Allryt buddy. Thanks for all this. We are still looking for court orders to do the chip-off on this phone as they are required in this particular case. Will PM you once i get the physical image. Thanks again.

 
Posted : 05/08/2015 11:50 am
Share: