±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 5 Overall: 36115
New Yesterday: 4 Visitors: 150

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Imaging Trouble with GT-S7560 with Android 4.0.4

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

nsumer
Newbie
 

Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 05, 19 21:51

I am trying to get physical image of GT-S7560 (Galaxy trend) running Android 4.0.4 with UFED4PC 7.18.
It fails by saying "The extraction is not supported for this specific version of the operating system". It is the same for filesystem extraction too.

What is wrong with that version of the OS?

Is there any forensically sound way to image that phone?

Regards  
 
  

dandaman_24
Senior Member
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 05, 19 22:22

Have you tried with any other piece of software, MSAB, Magnet Acquire ?  
 
  

nsumer
Newbie
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 05, 19 22:30

Yes, I have tried Magnet Axiom. It failed too.
I am thinking about to try Magnet's recovery image but I am afraid of making the phone bricked. I could not decide.  
 
  

cs1337
Senior Member
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 06, 19 04:31

Have you tried reaching out to cellebrite support? I find there support to be phenomenal.

Androids are usually finicky too with the USB cables. Have you tried the original cable or even an after market. I usually have good outputs with anker cables.

Edit: also looks like you're a bit out of date. i recommend using the newest version from the portal.  
 
  

fissa
Member
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 09, 19 19:15

Hi there,

I had the same with an s4 mini running on Android 4 or lower. Cant recall the exact firmware. I Found out that putting the phone in flightmode blocked the mtp mode. Furthermore i tried a original micro USB cable and kept wiggling until it made an connection. A Logical and file system extraction was succesful but a physical wasnt.

Hope this helps.  
 
  

passcodeunlock
Senior Member
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 09, 19 21:07

1. if allowed, root the device manually and do the physical acquisition - since the temporary rooting process from UFED 4PC works on the 4.0.0 firmware, but it was patched already in 4.0.4 Smile

2. get the original stock firmware for safety/backup reasons and then flash TWRP recovery, boot in recovery mode, fire up a shell, create the physical dump of the /dev/block/mmcblk0 to a microSD card or some OTG attached pendrive using dd, when done, import the dump in UFED Physical Analyzer doing Open Advanced and choosing your device template. After the whole process is done, flash back the original recovery to the device.

3. JTAG/ISP is a good solution, non-destructive, but some hardware is needed

4. if nothing worked, create logical acquisitions for having most of the data, then do a chip-off

Don't blame me if you brick the device Smile All the previous things should be done on a dummy device first! If you get the desired results, then repeat the working procedure on the real device.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

hommy0
Senior Member
 

Re: Imaging Trouble with GT-S7560 with Android 4.0.4

Post Posted: Oct 10, 19 13:17

Hi,

Have you tried using EnCase 8 (8.05 or above) to acquire the device.
Mobile support is included in EnCase, where installing a driver pack accessible from Opentext MySupport is a requirement.

Regards  
 

Page 1 of 2
Page 1, 2  Next