±Your Account
Membership:
New Today: 0
New Yesterday: 2
Overall: 24168
Visitors: 35±Latest Webinar
±Latest Articles
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Go to page 1, 2, 3 Next
BlackBerry physical
BlackBerry physical
Posted: Tue Mar 20, 2012 11:46 pm
I read the new XRY version update details today and saw:
What's New in this Update?
>> iOS up to 4 x faster dumping & decryption solution
>> iOS Passcode & Physical Dumping & Decryption
>> Android Automatic Rooting & Swipe Code detection
>> Chinese Clone Physical for over 70 new devices
>> Blackberry Physical – user partition decoding
>> CDMA & iDEN Physical Support
>> Palm & HP Physical Support
can somebody confirm if XRY is capable of BlackBerry Physical extractions, as I do not have a XRY currently?
Thanks
What's New in this Update?
>> iOS up to 4 x faster dumping & decryption solution
>> iOS Passcode & Physical Dumping & Decryption
>> Android Automatic Rooting & Swipe Code detection
>> Chinese Clone Physical for over 70 new devices
>> Blackberry Physical – user partition decoding
>> CDMA & iDEN Physical Support
>> Palm & HP Physical Support
can somebody confirm if XRY is capable of BlackBerry Physical extractions, as I do not have a XRY currently?
Thanks
-

Biedubbeljoe - Member
Re: BlackBerry physical
Posted: Thu Mar 22, 2012 5:26 am
In the pdf release notes it says;
"Blackberry Physical
Physical Dump of User Partition Memory"
So it isnt the complete memory, just the user partition (media, and files)
"Blackberry Physical
Physical Dump of User Partition Memory"
So it isnt the complete memory, just the user partition (media, and files)
-

cyrus - Member
Re: BlackBerry physical
Posted: Thu Mar 22, 2012 5:28 am
further to that, it also says;
"you can now recover deleted pictures and information from the user partition area of the handset memory on many Blackberry devices in this version. support is limited but getting back that essential deleted picture is now a possibility"
"you can now recover deleted pictures and information from the user partition area of the handset memory on many Blackberry devices in this version. support is limited but getting back that essential deleted picture is now a possibility"
-

cyrus - Member
Re: BlackBerry physical
Posted: Thu Mar 22, 2012 10:23 am
I am also extremely interested in this feature. I just emailed them regarding this specific announcement.
-
ForensicGold - Newbie
Re: BlackBerry physical
Posted: Thu Mar 22, 2012 2:55 pm
Thanks for that. Maybe MSAB can step in and answer the question and tell what the excact story is?
-

Biedubbeljoe - Member
Re: BlackBerry physical
Posted: Sat Mar 24, 2012 6:06 am
I have tested this and surprisingly all it does is create an image of the BB mass storage device (which is the Blackberry memory card).
Something you can do with FTK Imager.
I call this, aggressive marketing.
Something you can do with FTK Imager.
I call this, aggressive marketing.
-

MobileForensic - Newbie
Re: BlackBerry physical
Posted: Mon Mar 26, 2012 3:11 am
Hello All,
First of all thanks for your interest. You asked for a response from MSAB so here it is...
With BlackBerry Devices, our new physical extraction support in v6.2 works on the media card and also on the internal user partition if the BlackBerry device being examined allows access to it. This is not the case for all devices (in which case only the media card can be physically imaged), but on devices where this internal USER memory is available, we can now image that as well.
As we have stated clearly in the release notes, this support is limited, but it can help you recover both live and deleted files from both the memory card and, where possible, the user partition of BlackBerry devices.
Typically this can result in you getting back deleted images and media files. Which is both an improvement and a benefit to users compared to previous support levels offered.
We have tried to be responsible in our presentation of the facts and I think using the term "Support is limited" in our marketing material is both proportional and balanced in the circumstances.
Thanks for your input MobileForensic, it is always nice to understand where people are coming from when they leave comments like that. I note with great interest that you have only ever posted 2 comments.
Our developers were even more interested to discover that you edited your first post to just say "error" one minute before posting your comment above. Prior to that it seems that your post from 2009 read “In case the phone you want to test is not supported by XACT (supports about 230 models), try using UFED Physical that has about 400 models supported.“
It's better for everyone to be open and honest for the good of customers...
First of all thanks for your interest. You asked for a response from MSAB so here it is...
With BlackBerry Devices, our new physical extraction support in v6.2 works on the media card and also on the internal user partition if the BlackBerry device being examined allows access to it. This is not the case for all devices (in which case only the media card can be physically imaged), but on devices where this internal USER memory is available, we can now image that as well.
As we have stated clearly in the release notes, this support is limited, but it can help you recover both live and deleted files from both the memory card and, where possible, the user partition of BlackBerry devices.
Typically this can result in you getting back deleted images and media files. Which is both an improvement and a benefit to users compared to previous support levels offered.
We have tried to be responsible in our presentation of the facts and I think using the term "Support is limited" in our marketing material is both proportional and balanced in the circumstances.
- MobileForensicI call this, aggressive marketing.
Thanks for your input MobileForensic, it is always nice to understand where people are coming from when they leave comments like that. I note with great interest that you have only ever posted 2 comments.
Our developers were even more interested to discover that you edited your first post to just say "error" one minute before posting your comment above. Prior to that it seems that your post from 2009 read “In case the phone you want to test is not supported by XACT (supports about 230 models), try using UFED Physical that has about 400 models supported.“
It's better for everyone to be open and honest for the good of customers...
-

XRY_Mike - Member
















