Hi, how is it going?
I don't have a fully fledged mobile forensic tool that I can use to try this, so please help me with. Can mobile forensics tools acquire full images of a small scale digital device–say for example an android smartphone–that is connected to a computer residing on the subnet of the forensic tool host computer?
What I mean is this
Let's say I have oxygen or cellebrite or others (haven't used any) installed on machine A, and I have a galaxy smartphone connected to machine B that is in the same network as machine A (same subnet). Of course machine B can fully see the galaxy phone, and I as I said machine B is networked (physically) to machine A. Now, can oxygen or cellebrite at machine A acquire a forensic image of the galaxy phone at machine B???
I would say a logical image is certainly feasible, but I'm not sure about a physical image or physical acquisition. But, I would also say that it is technically possible. Whether it has been done or considered or if a tool was designed for it, I'm not sure. I need some networking experience to answer this. But, I know one thing. Machine B can fully see the phone, thus is can physically acquire it. If it is not possible in some other ways, maybe machine B can acquire and pass data to machine A via the network???
Did I make it clear?
Why would I do this? Maybe the machine the phone is connected to is compromised and I don't want to use it?
Thanks in advance…
I'd give this a try http//
It's software that allows for a USB device to be virtually mounted on a remote machine. There's no guarantee it'll work for any specific device/software as it might not have the same direct access it needs, but it's worth trying.
Hmm. Nice, one step in the right direction. Thanks!
I'm greedy for more nice answers ^_^
From all the search I did, it seems that it is not possible at all. You can't acquire a physical image of a device unless this device is actually directly connected to the host the forensic software is installed on.
If somebody can confirm this, I'll be grateful. I don't think it is doable. However, there is one Doctor who said it is possible. I think he just doesn't know.
Thanks.
Cellebrite Technical Support gave me an answer on this
As for your earlier question "Can UFED 4PC handle devices with USB over TCP at all", the answer is no. UFED 4PC requires a direct connection to the phone being examined.
Cellebrite Technical Support gave me an answer on this
As for your earlier question "Can UFED 4PC handle devices with USB over TCP at all", the answer is no. UFED 4PC requires a direct connection to the phone being examined.
Thank you. It is not possible like I said. If Cellebrite hasn't done it that is
That was Cellebrite. There are other good mobile forensic vendors as well, it is worth asking them this question before stating a 100% no answer.
To avoid braking FF advertising rules, I sent you a PM about some possibilities )
That was Cellebrite. There are other good mobile forensic vendors as well, it is worth asking them this question before stating a 100% no answer.
To avoid braking FF advertising rules, I sent you a PM about some possibilities )
Hmmmm. Okay. I appreciate your help buddy. You were really informative. I will check out the PM and come back to you when I'm free. Again, thanks.