±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 32897
New Yesterday: 3 Visitors: 175

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Forensic Focus - HTC Mozart Acquisition - Digital Forensics Forums Mobile Phone Forensics - HTC Mozart Acquisition

Forensic Focus

Mobile Phone Forensics

HTC Mozart Acquisition

HTC Mozart Acquisition

Posted: Tue Mar 27, 2012 11:18 pm
Author: randomaccess Location: Australia
Hi all,
I have an HTC Mozart running Windows Phone 7 (unsure which version) that I would like to recover deleted content from.

At the moment all the tools I have at my disposal only do a file system recovery.
I've been told I have a chance at getting data after jailbreaking the device, but has anyone had any success with this?

or even has anyone managed to successfully recover deleted content off an HTC Mozart?

Thanks

Re: HTC Mozart Acquisition

Posted: Wed Mar 28, 2012 3:55 am
Author: sideshow018 Location: Canada
If you can't find the tools to support this device at the phsycial level, then look into the JTAG process. This make/model is very well documented on the net as being supported, with a little research on the controller chip and type of flash, you will be able to find a tool(s) that will allow you access to the physical flash dump to find your deleted items.

Here is a Youtube video that shows the use of a pre configured JTAG Jig to repair the firmware, this same connection can be used to provide the JTAG tool access to the TAP's on the mainboard for you data dump.

www.youtube.com/watch?v=z5-Psh4yD7Y

Happy JTAG'ing!

Re: HTC Mozart Acquisition

Posted: Thu Mar 29, 2012 12:30 am
Author: randomaccess Location: Australia
Thanks for that
During my research I found that the phone doesn't actually have onboard memory. Instead there's a Microsd card that's hidden under the screen.
So with a little bit of effort I was able to remove the 8gb card from the phone

Then of course the sd card is locked to the phone. Which means I haven't been able to get it mount.

Does anyone have any experience with locked Microsd? Other than reading the chips directly

After that the data will most probably also be encrypted with the key. So that's the next problem.

Thanks for anyone's help

Re: HTC Mozart Acquisition

Posted: Thu Mar 29, 2012 7:21 am
Author: agolding Location: Leicester
Theres also 512mb of onboard memory in addition to the 8gb SD card, these are then joined together, newer phones have gone away with sd cards altogether in favour of built in storage. Due to the SD card being effectively in some form of RAID configuration reading isnt straight forward. Theres also alot of encryption in place on the phone which is another issue.

WP7 Root tools v0.9 was released yesterday and a program is almost finished to give a full dump of windows phone file system by rafael rivera which works with interop unlock which would be superb. You could then analyse the Vol files as theres the possibility of deleted data and the CommsBackup.xml file which backs up all SMS messages older than a day may contain additional data if you're lucky.

WP7 Root Tools Information

Re: HTC Mozart Acquisition

Posted: Wed Apr 25, 2012 6:29 am
Author: triran Location: England
To support what you said - the "RAID" is a Command42 File structure, so it can spread the data over the flash and the 8GB MicroSD.

Interesting tool too - will test it out and report back.

Re: HTC Mozart Acquisition

Posted: Tue May 29, 2012 11:52 pm
Author: randomaccess Location: Australia
thanks guys

so far have pulled the SD card and am working with another analyst to try read the data from it directly. Does anyone have any ideas about unlocking a microSD card from a device?

trian, where did you find information about the Command42 raiding? I havent been able to find anything so far
Tried to contact HTC but tech support wont really be able to give me much information....

Re: HTC Mozart Acquisition

Posted: Wed May 30, 2012 6:44 am
Author: triran Location: England
- randomaccess
thanks guys

so far have pulled the SD card and am working with another analyst to try read the data from it directly. Does anyone have any ideas about unlocking a microSD card from a device?

trian, where did you find information about the Command42 raiding? I havent been able to find anything so far
Tried to contact HTC but tech support wont really be able to give me much information....


The SD card can't be read on its own due to the "RAID". The information about the setup came directly through Microsoft and HTC.

If you ever managed to read the card - the information would be fragmented.

All times are GMT - 6 Hours
Page 1 of 1
https://www.forensicfocus.com/