±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35657
New Yesterday: 3 Visitors: 258

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

CelleBrite iPhone .zip and error message

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

DaDataCop
Member
 

CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 03:49

I did a File System Dump using CelleBrite Pro. According to the Physical analyzer, there were no images located. However, when I open the .zip file in Backup Service/Media/DCIM there are dozens of .jpg's. When I try to open them, I get the error:
Compresed (Zippeed) Folders: Please inser disk 1 of 3

Any thoughts? I've never seen that before.

TIA  
 
  

agbarnet
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 06:18

I have never encountered that error. If you perform the export again, do you still get the .jpg's? It's strange that it would report none and then export dozens.

Has your CellBrite been updated to the most recent firmware?
_________________
alexbarnett.com 
 
  

RonS
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 10:18

When the file system dump extraction size is bigger than 2GB, UFED splits the output zip file to multiple files (based on the zip format).
Somehow you probably did not copy all the files (.zip .z01 .z02 ...)

Try doing the file system dump again.
Are you using the latest UFED version?  
 
  

trewmte
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 12:59

- RonS
When the file system dump extraction size is bigger than 2GB, UFED splits the output zip file to multiple files (based on the zip format).
Somehow you probably did not copy all the files (.zip .z01 .z02 ...)

Try doing the file system dump again.
Are you using the latest UFED version?



How does UFED avoid splitting the content of a file in two when creating a second compression file?

How does UFED know how to re-assemble the content of the split file?
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

RonS
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 13:29

It does not avoid, since splitting zip files is part of the zip file format.
When the files are opened they are re-assembled.

The split file is a standard functionality of most compression file format (zip, rar) and is ment to allow easier transfer of the files (like burning DVD's ...)  
 
  

trewmte
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 14:42

- RonS
It does not avoid, since splitting zip files is part of the zip file format.
When the files are opened they are re-assembled.

The split file is a standard functionality of most compression file format (zip, rar) and is ment to allow easier transfer of the files (like burning DVD's ...)



I was thinking about dadatacop's problem and your response that .zip .z01 .z02 may not have been transferred (or it might turn out to be a combination might not have been transferred). Clearly, that suggests loss somewhere in the acquisition/delivery process. It made me wonder what if only half an image was recovered.

I understand the principle you mention but thanks for your clarification anyway.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

RonS
Senior Member
 

Re: CelleBrite iPhone .zip and error message

Post Posted: Jul 28, 10 15:18

Just to clarify again:
A UFED file sytsem dump is reading all the accesible files from the examined phone and pushing them into a container file (in this case a zip file) using the store method (no compression).
Since such an extraction can be very big, the container file is being split to multiple files (based on user settings, 1GB, 2GB or less) and according to the zip container file standard.

When opening this extraction using UFED PA (or any other application that supports a zip file format), all these files needs to be present in the folder.

Once opened, UFED PA will present it as a complete file system dump.

Obviously, all these files, should be present in the result folder.  
 

Page 1 of 2
Page 1, 2  Next