We have a locked BB Bold 9650. Former employee put password on it before turning it back in. Given other stuff he was let go for, would like to take a look at what is on BB. 6 of 10 attempts at pword have been made. I can't access or backup phone, etc, etc
It WAS part of BB Administration Service, but another admin deleted the device from there. I don't seem to be able to re-add device. I have PIN.
Do I have any options?
My experience with Blackberries is that there really are next to impossible to crack on purpose. I had a couple cases (one from private practice and one from my government job) where we went to RIM's Legal department and were told that there was nothing they could do. We ended up closing both cases without the phones, but it would have been nice to have gotten in. Also keep in mind that once you enter a wrong password too many times, its game over.
Time to get out the $5 wrench. 
In all seriousness, unless you guess it in the next four tries, there really is nothing you can do. I don't think you can force a device back on a BES without access to the device. Depending on how it is configured, the BES may have what you're looking for. It can keep all the stuff you would expect plus things you wouldn't expect, like SMS messages–if it's configured that way. Also, look for .ipd files on the computer. Perhaps the phone was backed up.
It may be the the only good that can come of this is better procedures for future departing employees. For instance, not disconnecting it from the BES unless you have to.
The phone can be accessed using the Chipoff process, the process is destructive to the device. Once the chipoff process is complete, you can use a tool like Cellebrite P.A. and in some cases, XRY Complete to recover the file system. Manual data carving will also reap some more information. Do not do the last password attempt, once the last one is tried, the device will wipe itself and all the user data is gone.
If you need help with getting a Chipoff done, please PM me.
B
Thanks, all. Chipoff, not really an option since they want to redeploy phone. Employee is gone and this was more for my own forensic experimentation. No dice on .ipd files.
Have you done a chip-off on an encrypted BB Bold 9650, and recovered the encrypted data from it?
The phone can be accessed using the Chipoff process, the process is destructive to the device. Once the chipoff process is complete, you can use a tool like Cellebrite P.A. and in some cases, XRY Complete to recover the file system. Manual data carving will also reap some more information. Do not do the last password attempt, once the last one is tried, the device will wipe itself and all the user data is gone.
If you need help with getting a Chipoff done, please PM me.
B
It depends on the source of the encryption, if it is from the user interface, then in a lot fo cases, yes. If it is pushed through from the BES, then no……so far (-
How do you deal with the epoxy?
It depends on the source of the encryption, if it is from the user interface, then in a lot fo cases, yes. If it is pushed through from the BES, then no……so far (-