Android 4+ post-fac...
 
Notifications
Clear all

Android 4+ post-factory-reset carving success?

2 Posts
2 Users
0 Likes
494 Views
(@dagardc)
Posts: 3
New Member
Topic starter
 

I have a Verizon Galaxy Tab 2 10.1 that has been factory reset (Android 4.1.2). There are a couple of ways to do this per http//www.verizonwireless.com/support/knowledge-base-68327/ factory data reset through Android menus, or a key/combo that leads to a "wipe data/factory reset" option.

From talking to a Cellebrite guy, the manner in which a reset is invoked can lead to different results as far as how thorough the wipe is, even on a perceived secure phone like a Blackberry. I was just curious if anyone has had success actually carving the user's data from a recent Android 4+ device that has been "factory reset", and what tools were used.

 
Posted : 10/07/2015 4:27 am
(@v-katalov)
Posts: 52
Trusted Member
 

Have you seen this article? http//www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf

Basically, the researchers state that, in many cases, the actual data (including access to the original Google Account) can be accessible even after a factory reset. Especially so if the device originally came with an early version of ICS 4.0, and only then upgraded to 4.1.2. You can try Oxygen Forensic Suite to attempt physical acquisition of the device (which will dump the full disk image complete with unallocated space on the data partition, which you will have to carve for available evidence).

 
Posted : 13/07/2015 4:10 pm
Share: