±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 2
Overall: 27631
Visitors: 65

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Cellebrite PA Hex Dump searching question

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Cellebrite PA Hex Dump searching question

Post Posted: Tue Jan 08, 2013 11:09 am

I have already posted the below in the relevant linkedin group but am trying to widen the audience.

I am looking at a binary dump from a Nokia 3120C. I can see telephone numbers stored as unicode Little Endian within the dump. When I use the Find facility in Physical Analyzer 3.6 searching for Strings and selecting Unicode it does not find the numbers I have already seen in the dump (The Values decoder decodes the numbers I have seen as Little Endain unicode).

Please does anyone know whether the unicode search is big endian only or is there a configuration setting somewhere to find strings stored Little Endian?

Regards,  

dc1743
Senior Member
 
 
  

Re: Cellebrite PA Hex Dump searching question

Post Posted: Tue Jan 08, 2013 11:32 am

What did the folks at Cellebrite say when you called and asked them?  

keydet89
Senior Member
 
 
  

Re: Cellebrite PA Hex Dump searching question

Post Posted: Tue Jan 08, 2013 11:55 am

- dc1743

Please does anyone know whether the unicode search is big endian only or is there a configuration setting somewhere to find strings stored Little Endian?


Out of interest, have you tried searching for the middle numbers (shave off the first and last characters) as, for ASCII range characters, that part of the raw data will look the same.  

AlexC
Senior Member
 
 
  

Re: Cellebrite PA Hex Dump searching question

Post Posted: Wed Jan 09, 2013 5:51 am

Thanks for the replies.

Having revisited this issue this morning to follow up Alex's suggestion the search now works!

As it turns out the numbers I had seen (which could be represented as ASCII) are stored big endian and the search tool highlights the numbers (\x00\x30\x00\x37 etc etc). Tired eyes and brain yesterday afternoon saw that the number was followed by \x00 and hence thought the number was stored little endian unicode.

To answer the original question posed I have tested a "binary dump" comprising of some text encoded little endian unicode. PA Find function appears only to find BE encoded unicode.

What I still don't understand is why the search works today and didn't yesterday. I think I did the same thing but user error is suspected!

Regards,  

dc1743
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1