Samsung Tocco Lite ...
 
Notifications
Clear all

Samsung Tocco Lite Decode

8 Posts
7 Users
0 Likes
437 Views
 DazM
(@dazm)
Posts: 4
New Member
Topic starter
 

Just wondering if anyone has any experience of decoding a physical read from this phone.

We've been trying to locate SMS and call logs from the read we have however, the SMS don't seem to be encoded in the normal 7 bit format.

I've tried to use Cellebrite PA which is where we got the physical read from, however this does not support and decode.

Any advice would help

 
Posted : 06/03/2013 8:11 pm
(@ebwahlberg)
Posts: 34
Eminent Member
 

Not sure about that model but I have had good luck with Final Mobile. I have used Cellebrite physical downloads before and have been able to decode them with FM. They also do a good job getting physicals from Samsung CDMA handsets.

 
Posted : 06/03/2013 11:44 pm
(@polar)
Posts: 48
Eminent Member
 

We've been trying to locate SMS and call logs from the read we have however, the SMS don't seem to be encoded in the normal 7 bit format.

You should be able to find messages in the PDU format. Have you tried UCS-2?

Calls are a bit trickier.

 
Posted : 07/03/2013 3:32 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

I have done a tone of these and find often the file system recovers far more

The nand memory dumps are very broken and split alot of texts down the middle with page'ing of the memory

 
Posted : 07/03/2013 3:53 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

I addition, I noted some sent SMS are saved in ASCII format. You will be able to find the SMS date/time in an epoch just before the persons name and number. If you need me to find the exact offsets etc. I could try and find it in my knowledge base

 
Posted : 07/03/2013 3:54 pm
 ixam
(@ixam)
Posts: 21
Eminent Member
 

We can assist with your request & have previously decoded memory images from this model of phone, recovering the data types specified.

The data recovery does not reply on any commercially available decoding tools.

Send an e-mail to our enquiries e-mail (marked for my attention) which can be found on our website & I will provide further information.

John Barwood
Forensic Telecommunication Services
www.forensicts.co.uk

 
Posted : 07/03/2013 5:16 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Why not share your findings with the rest of the community?

We can assist with your request & have previously decoded memory images from this model of phone, recovering the data types specified.

The data recovery does not reply on any commercially available decoding tools.

Send an e-mail to our enquiries e-mail (marked for my attention) which can be found on our website & I will provide further information.

John Barwood
Forensic Telecommunication Services
www.forensicts.co.uk

 
Posted : 07/03/2013 8:55 pm
 RonS
(@rons)
Posts: 358
Reputable Member
 

This specific model physical extraction is without the NAND flash spare area.
This means that a file system cannot be reconstructed and you can only use carving to get data out of this model physical extraction.

There is no solution (beside chip-off and possibly JTAG) to get a physical with the flash spare area.

There are only about 2 other models that we use that specific extraction method that cannot produce a file system decoding.

Hope this helps.

Ron

 
Posted : 07/03/2013 11:43 pm
Share: