CelleBrite iPhone ....
 
Notifications
Clear all

CelleBrite iPhone .zip and error message

9 Posts
4 Users
0 Likes
1,779 Views
(@dadatacop)
Posts: 21
Eminent Member
Topic starter
 

I did a File System Dump using CelleBrite Pro. According to the Physical analyzer, there were no images located. However, when I open the .zip file in Backup Service/Media/DCIM there are dozens of .jpg's. When I try to open them, I get the error
Compresed (Zippeed) Folders Please inser disk 1 of 3

Any thoughts? I've never seen that before.

TIA

 
Posted : 28/07/2010 3:49 am
(@agbarnet)
Posts: 75
Trusted Member
 

I have never encountered that error. If you perform the export again, do you still get the .jpg's? It's strange that it would report none and then export dozens.

Has your CellBrite been updated to the most recent firmware?

 
Posted : 28/07/2010 6:18 am
 RonS
(@rons)
Posts: 358
Reputable Member
 

When the file system dump extraction size is bigger than 2GB, UFED splits the output zip file to multiple files (based on the zip format).
Somehow you probably did not copy all the files (.zip .z01 .z02 …)

Try doing the file system dump again.
Are you using the latest UFED version?

 
Posted : 28/07/2010 10:18 am
(@trewmte)
Posts: 1877
Noble Member
 

When the file system dump extraction size is bigger than 2GB, UFED splits the output zip file to multiple files (based on the zip format).
Somehow you probably did not copy all the files (.zip .z01 .z02 …)

Try doing the file system dump again.
Are you using the latest UFED version?

How does UFED avoid splitting the content of a file in two when creating a second compression file?

How does UFED know how to re-assemble the content of the split file?

 
Posted : 28/07/2010 12:59 pm
 RonS
(@rons)
Posts: 358
Reputable Member
 

It does not avoid, since splitting zip files is part of the zip file format.
When the files are opened they are re-assembled.

The split file is a standard functionality of most compression file format (zip, rar) and is ment to allow easier transfer of the files (like burning DVD's …)

 
Posted : 28/07/2010 1:29 pm
(@trewmte)
Posts: 1877
Noble Member
 

It does not avoid, since splitting zip files is part of the zip file format.
When the files are opened they are re-assembled.

The split file is a standard functionality of most compression file format (zip, rar) and is ment to allow easier transfer of the files (like burning DVD's …)

I was thinking about dadatacop's problem and your response that .zip .z01 .z02 may not have been transferred (or it might turn out to be a combination might not have been transferred). Clearly, that suggests loss somewhere in the acquisition/delivery process. It made me wonder what if only half an image was recovered.

I understand the principle you mention but thanks for your clarification anyway.

 
Posted : 28/07/2010 2:42 pm
 RonS
(@rons)
Posts: 358
Reputable Member
 

Just to clarify again
A UFED file sytsem dump is reading all the accesible files from the examined phone and pushing them into a container file (in this case a zip file) using the store method (no compression).
Since such an extraction can be very big, the container file is being split to multiple files (based on user settings, 1GB, 2GB or less) and according to the zip container file standard.

When opening this extraction using UFED PA (or any other application that supports a zip file format), all these files needs to be present in the folder.

Once opened, UFED PA will present it as a complete file system dump.

Obviously, all these files, should be present in the result folder.

 
Posted : 28/07/2010 3:18 pm
(@dadatacop)
Posts: 21
Eminent Member
Topic starter
 

Okay, this is starting to help, bot hasn't quite reached solution. In the UFED Phone Dump folder a 4 files. The .zip file, the UFED Dump file and then a .z01 and .z02. I;m guessing that the "1 of 3" is the .zo1, but how do I "insert" that "disk"? Thanks for all your input.

 
Posted : 28/07/2010 8:55 pm
(@dadatacop)
Posts: 21
Eminent Member
Topic starter
 

CelleBrite solved it. I was given the Physical Analyzer Beta 1.9 and it solved my problems. Great Job CelleBrite. Thanks to all who helped out.

 
Posted : 29/07/2010 2:28 am
Share: