Can a SDCard be lin...
 
Notifications
Clear all

Can a SDCard be linked to a phone?

11 Posts
7 Users
0 Likes
611 Views
(@redeyes)
Posts: 11
Active Member
Topic starter
 

I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE

 
Posted : 19/03/2014 8:55 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Possibly, but it will take some work.

Can you take at least one, identical picture with all of the cell phones?

Can you retake at least one of the pictures you collected, with all of the cell phones?

 
Posted : 20/03/2014 4:36 am
(@zergling)
Posts: 38
Eminent Member
 

I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE

It may differ (depending on the android phone) but some devices store a list of files from external(and internal) memory cards in

\data\data\com.android.providers.media\databases\external.db

So you could check the filestructure in this database and see if it matches with the one found on the memory card.

Some phones also add the volume id to the database name, which can be compared (on windows) with the commandline "vol" followed by the drive letter.

eg vol e

But beware that the volume ID is not hardware-linked. It will for example change with a new partition and so on.

furthermore you could link the card to the phone based on appdata that is stored on the card.
WhatsApp for example stores backup files on the SD which contain encrypted msgstore.db's that can be compared to the msgstore.db file on the internal memory ( /data/data/##WhatsApp##\databases… ) The method to decrypt the file is wide spread among the web. Just google something like "WhatsAppXtract".
In this case you want to compare the most recent backup file so the content should be (in case it is from that phone) almost identical.

 
Posted : 20/03/2014 11:56 am
(@redeyes)
Posts: 11
Active Member
Topic starter
 

Thank you for the replies, certainly gives me a steer of where to go. It will not be possible to take photos with the handsets at this stage, but maybe possible later - all avenues exhausted etc. I am aware of work being done to link lens aberration to digital images.

Hopefully I can get a test model of each phone and swap memory cards around and establish differences.

MRE

 
Posted : 20/03/2014 1:42 pm
(@trewmte)
Posts: 1877
Noble Member
 

When you examined the handset did you have to input a handset password?

 
Posted : 20/03/2014 2:45 pm
(@redeyes)
Posts: 11
Active Member
Topic starter
 

We have a number of likely candidates as regards handsets. Two were reset to factory defaults. Two others are resisting all attempts at a physical download… I haven't tried a logical yet.

 
Posted : 21/03/2014 11:28 am
(@bravo1800)
Posts: 11
Active Member
 

Just a quick note you may also search the file directory structure on the memory cards as this may steer you to which memory card was inserted in which device. For instance if it was a Blackberry there will be files which may give you the BB Pin number and also store backups of the apps installed on the device.
If you need verification if a picture was taken on that handset I am aware there are a few agencies that can assist you in this type of verification.

Regards

Chris

 
Posted : 27/03/2014 7:19 pm
(@rich2005)
Posts: 535
Honorable Member
 

This may not be helpful but just in case - off the top of my head I seem to remember in the past seeing firmware versions of devices also stored in images (probably the EXIF).
So whilst this wouldn't help you tie the card to a phone exactly/definitely, it might be enough to narrow down to which of the devices the card likely belonged, if a likelihood is enough for your purposes in this instance.

 
Posted : 27/03/2014 7:37 pm
(@coligulus)
Posts: 165
Estimable Member
 

This may not be helpful but just in case - off the top of my head I seem to remember in the past seeing firmware versions of devices also stored in images (probably the EXIF).
So whilst this wouldn't help you tie the card to a phone exactly/definitely, it might be enough to narrow down to which of the devices the card likely belonged, if a likelihood is enough for your purposes in this instance.

Do you not think this would merely show that the card was in that phone once?….

 
Posted : 27/03/2014 9:07 pm
(@redeyes)
Posts: 11
Active Member
Topic starter
 

Thanks for the replies people. I shall update the post with any progress and successes.

 
Posted : 28/03/2014 1:41 am
Page 1 / 2
Share: