Hi
I have the subjected device which has fallen from the stairs and only possible way of data extraction is chip-off forensics. Has anyone ever tried it on this phone ? i hope it doesnt have encrypted memory ? Response will be highly appreciated.
Do you want recover data yourself?
It is enough hard.
I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.
I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.
Thanks mate. I really appreciate your encouraging words. Will let you know once i follow the procedure. However my only concern was to know if the read will be encrypted or not. Thanks for the prompt.
It should load straight into FTK. Just be mindful of hidden file settings and permissions when exporting folders.
Tom,
i would definitely pick from your advice. I have UFED PA also. So i think that might also help me in reading the image. What do you say ?
I don't have the cellebrite support file to hand so can't check, the latest version may have support now when at a certain level of charge for an extraction. If you export store.vol and its associated folders you will need to repair it. Windows has this as a built in feature and you can google how to. I don't see a huge amount of windows phones if I'm honest although I have helped our r&d team with the the make up of the database. It's quite daunting to start with if there is a lot of data present. See if you can get a physical read first and we can go from there.
Allryt buddy. Thanks for all this. We are still looking for court orders to do the chip-off on this phone as they are required in this particular case. Will PM you once i get the physical image. Thanks again.