±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35535
New Yesterday: 1 Visitors: 147

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Alcatel onetouch 2045x

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

dandaman_24
Senior Member
 

Alcatel onetouch 2045x

Post Posted: Sep 11, 18 14:16

Anybody examined a Onetouch 2045x handset ?

I have been able to obtain a 64mb .bin of the handset, however when parsed in UFED PA only images and contacts have been parsed. File system and logical extractions have produced the same result. Manually viewing the device content, i can see that there are incoming and outgoing calls and SMS as well as notes, however none of these have been parsed.

XRY doesnt have a profile for this device, similar devices are not able to used to dump the device.

Thanks  
 
  

TobiasJ
Member
 

Re: Alcatel onetouch 2045x

Post Posted: Sep 12, 18 13:00

XRY should have both Logical and Physical support for this model since 7.4 as well as the ability to import and decode the dump, if this for some reason does not work please sent the log to support @ msab.com and we'd be glad to help you further!  
 
  

passcodeunlock
Senior Member
 

Re: Alcatel onetouch 2045x

Post Posted: Sep 12, 18 18:15

UFED partial filesystem will contain the files available over the MTP protocol. Logical extraction would contain only the AB backup content.

Parsing the physical dump would reveal all the data available in not encrypted form. For full analysis you would need a physical dump with on-the-fly decryption or a userdata partition decrypted.

From what you wrote my conclusion is that your userdata partition is encrypted in your dump and it is not parsed by PA.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 1