Cellebrite UFED ext...
 
Notifications
Clear all

Cellebrite UFED extraction

6 Posts
5 Users
0 Likes
2,016 Views
(@rierie)
Posts: 5
Active Member
Topic starter
 

Hello,

Can anyone please help. I am working on a Samsung Galaxy Note 9 which has been remotely wiped or reset. Am using the cellebrite UFED touch 2 but it is unable to recover any data. it only gives me the Samsung default ringtone. No SMS, Pictures, audio, whatsapp.

Thank you.

 
Posted : 26/03/2019 12:02 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

Recovering wiped devices is not something you will be able to do with that product.

There is a slight chance for a recovery, in-lab, at NAND protocol level, and on success it would cost you a fortune.

 
Posted : 26/03/2019 1:14 pm
(@the_grinch)
Posts: 136
Estimable Member
 

Have to agree with passcodeunlock, Android stepped up their game big time with their wiping so slim chance of getting anything off of that device now.

 
Posted : 26/03/2019 1:29 pm
(@arcaine2)
Posts: 235
Estimable Member
 

I feel like this is a problem since 4.4 at least. In current version, encryption is the biggest problem and even if you managed to recoved some data prior the wipe, at NAND protocol level, it would still be encrypted, with a previous key that's unknown.

 
Posted : 26/03/2019 9:10 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

@arcaine2 What you wrote is all right. The userdata partition is almost intact after a factory reset, just the keys are destroyed. After a successful NAND recovery, the userdata partition can be decrypted in certain situations. Usually there are small chances to do it, because it depends on many factors.

 
Posted : 27/03/2019 6:55 am
(@firdy)
Posts: 3
New Member
 

Hi,

I'm kind of new to forensics. And currently doing a bachelors degree in cyber forensic.

Have you tried requesting from the user that previously used the mobile for any email address? Maybe you can get contacts or pictures from there… Or maybe i need to understand remotely wiped.

Just my humble opinion.

 
Posted : 07/05/2019 7:38 am
Share: