Data dump of Samsun...
 
Notifications
Clear all

Data dump of Samsung SGH-Z400 using Cellebrite UFED Physical

1 Posts
1 Users
0 Likes
413 Views
Robbo747
(@robbo747)
Posts: 37
Eminent Member
Topic starter
 

I 'm in the process of doing a 'file system' dump on a Samsung SGH-Z400 phone, using UFED Cellebrite with latest 'superfirmware' APP 1170. The LCD screen of the handset is damaged, but keys are functional & keypad tones audible. The phone has a 256Mb MicroSD card, which I've imaged before & have removed this memory card from the handset prior to commencing the file system dump.

When I go to start the file system dump, Cellebrite asks to enter Qualcomm mode- *#782872#, then continue, which I can do by pressing the keys with audio tones for recognition.

The process starts & files are read in – I point the download to a clear 16GB USB stick. I ran this over the weekend & it didn't appear to finish. I examined the files placed on the USB key- There is one zip file, about 200Mb & a series of 2GB files with extension .z01, 2, 3 to 7, written out as “Samsung GSM_SGH-Z400.z01”.
There was no UFED dump file located, ie- 'Samsung GSM_SGH-Z400.ufd' to explore with UFED Physical Analyzer.

I have read online these phones only hold 2048Kb of what's called ‘heap’ RAM. It's not like I'm doing a 8GB or 16GB iPhone, but for an older model phone piping out more then 16GB in memory seems unusual on this firmware patch. I may try pointing this file system dump to a bigger size drive.

Has anyone come across doing a similiar file system dump where it appears to grow in data size, more so then what the phone memory purports to be?

 
Posted : 15/03/2011 4:38 am
Share: