If the device data was tampered, the device is void for forensics analysis.
Well, from the OP report - besides whether the data has been tampered with - there is no proper chain of custody and - besides reportedly *everything* and the contrary of *everything* has been done on that phone, largely by not qualified (or not qualified enough) personnel without any proper documentation, so - even if in reality not a single byte was modified - it would be not acceptable as evidence from a procedural viewpoint in *any* actual legal proceeding.
If I may, the OP story is a bit "strange" (no offense intended) , I am failing to see some connections between the "mom and pop lab" initial choice, the sudden decision to retrieve the device as soon as the lab asked for more time, the attempt to drain the battery (why?), and the suspect that the lab technician has been payed for hiding something.
I mean, IF the lab technician was paid for hiding something, he would have most probably worked all night (if needed) and not attempted to delay the deadline for the report.
On the other hand, a "high priority" or "relevant" case would have excluded from the beginning asking to the "mom and pop" lab, and anyway it is to say the least unusual that the lab on one hand admitted having made a "full physical image" and on the other refused to provide it.
If I get this right, the whole thing was started by the suspect that a "former employer" managed to *somehow* install spying software on a personal device, as P_R_H stated that would be in most countries a criminal offence and something that should have been reported to the Police or however handled professionally after having consulted a lawyer.
jaclaz
I understand its a very strange sounding story to those who haven't been in my shoes.
Although my first choice was a smaller operation, the examiners do have the proper certifications and the lab was featured on the CBC here in Canada for their chip-off forensics work.
No one is, however, immune to being paid off. The employer in question is a multi-national corp and will pay anything to prevent evidence from being obtained.
As far as I can tell there is no difference in the operation of the phone before and after the device was out of my possession so I am fairly confident nothing has been tampered with.
I'm going to have to let the "heat" die down for now and post pone the investigation.
I share the view of 'passcodeunlock' as indicators of using Odin seem strong
In the UK for example business assests such as phones, computers etc Businesses have the right to monitor these devices for missue without the need of installing spyware. (Depending on the IT Policy with regards to personal use)
Then BYOD comes along and ruins the day.
Then BYOD comes along and ruins the day.
Yep D , unless some aggressive MDM is implemented (OT, but somehow related)
http//www.forensicfocus.com/Forums/viewtopic/t=10567/
@Nexus21
I understand that your issues are serious, but - again no offence intended - as seen from here (and I do know how it is easy to comment from the outside and without having walked a mile in someone else's shoes ) there is not an apparent correlation between the gravity/seriousness of your suspects/allegations/presumptions and the "lightness" with which you attempted to prove/document them.
jaclaz
I share the view of 'passcodeunlock' as indicators of using Odin seem strong
Isn't there a way to read the exact installation date of the currently installed firmware ?! That would answer some questions.
I share the view of 'passcodeunlock' as indicators of using Odin seem strong
Isn't there a way to read the exact installation date of the currently installed firmware ?! That would answer some questions.
The million dollar question.
I share the view of 'passcodeunlock' as indicators of using Odin seem strong
Isn't there a way to read the exact installation date of the currently installed firmware ?! That would answer some questions.
The million dollar question.
From the previous posts, I presume you got a Samsung device there. A Samsung technician said that it is possible on some models and firmwares using the official Samsung diagnostics service programs. You should go to an official Samsung service with your device and get more details.
If you succeed getting results, give us feedback on this!
From the previous posts, I presume you got a Samsung device there. A Samsung technician said that it is possible on some models and firmwares using the official Samsung diagnostics service programs. You should go to an official Samsung service with your device and get more details.
Where OP will be probably told
The phone is a Nexus 4 so not so easy to simply remove the battery.
to go to a LG official service ….
https://
jaclaz