Restore userdata_xx...
 
Notifications
Clear all

Restore userdata_xxxx.backup file

4 Posts
3 Users
0 Likes
473 Views
SamBrown
(@sambrown)
Posts: 97
Trusted Member
Topic starter
 

Hello, I have an Alcatel phone locked with a pattern lock. To extract data I booted the phone into recovery, where I had the option to create a backup file. It does write a userdata_xxxx_.backup file to my SD card where xxx is the date and time. Is there any way to extract data from that file?

 
Posted : 10/09/2015 6:26 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

SB -

Have you tried running file carving utilities against the file dump you created?

There are free file carving utilities built in to Linux forensic distributions such as DEFT, or you could go the paid license route with Forensic Explorer, OSForensics, Internet Evidence Finder, EnCase, etc.

Assuming the file dump contents you made are not completely encrypted, you should be able to recover files for further analysis.

Can you see the folder and file organization in the file dump you created? You could pull the file dump into FTK Imager or Autopsy for a quick look.

 
Posted : 10/09/2015 7:26 pm
SamBrown
(@sambrown)
Posts: 97
Trusted Member
Topic starter
 

Yeah I tried carving with X-Ways - no luck. The file looks like it's encrypted in hex view.

 
Posted : 10/09/2015 7:59 pm
OxygenForensics
(@oxygenforensics)
Posts: 143
Estimable Member
 

It looks like you've probably created Nandroid backup. If yes, you can import it and parse all the user data in Oxygen Forensic Suite.

 
Posted : 14/09/2015 1:43 pm
Share: