Hello,
I was given a Samsung phone's physical image. It has Bada 1.2 OS and i have never dealed with Bada OS.

Ufed PA decodes some artefacts, but there is no SMS or browser artefacts.
When i performed search on the image i found some words look like part of Sms and some URL addresses.

Is there any manual method to decode SMS and browser visits?
Thank for any info in advance.  

Check if DB2 viewer available in Mobile Revelator can open those database files. You should be able to at least view SMS.  

- arcaine2

Check if DB2 viewer available in Mobile Revelator can open those database files. You should be able to at least view SMS.

Thanks for the info. I could not find any db2 database file. But I could get some sms messages when I open lifelog.db with Sqlite viewer.

Regards.  

It's been a long while since I saw a Bada phone, so I can't be sure if the following is true for your phone:

• The first few (50?) characters of SMS messages are stored in the lifelog SQLite database: /User/OspSys/Lifelog/Database/lifelog.db.
• SMS messages are stored in PDU format in /User/Msg/SMS/{RCVD,SENT,FAILED}. Being standard SMS PDUs, these can be carved from a flash dump as well.
• SMS templates are stored in /User/Msg/Preset/Preset.dat.

_________________
Arun Prasannan
CCL-Forensics Ltd. 

- nsumer

- arcaine2

Check if DB2 viewer available in Mobile Revelator can open those database files. You should be able to at least view SMS.

Thanks for the info. I could not find any db2 database file. But I could get some sms messages when I open lifelog.db with Sqlite viewer.

I only have dump from Bada 2.0 phone, but you're not looking for files with .db2 extention. Instead you should look at the OS partition, DB2 directory and then phonedb_data.00 as well as DB2/unlimitdb/phonedb_vol2.00.

I don't see lifelog.db or a directory structure like @polar mention on my dump, but there were some changes done between Bada 1.4 and 2.0.  

Thank you very much for the informations.