Export facebook messenger messages without root

@Plan_B
ZTE Blade A452 Android 5.1

Looking it up on Digital Forensic Compass, I see it's supported with the Cellebrite Ultimate; I take it you dont have access to that?

But yeah, otherwise legal authority and cloud download of suspects facebook account would be useful. Either legal request through facebook, consent+facebook takeout extraction, or using a social media capture tool with the credentials off the device.

ZTE Blade A452 Android 5.1

You should be able to make full dump of that phone directly, without rooting or even fully booting the device. Old MTK, not a secure device, no forced enctyption etc.

@randomaccess
I dont have access to that

@arcaine2
With rooted device I was using DD or software to make physical image.
How to do that without root ? The bootloader is locked.

In MobilEdit Forensic Express there is option "Get physical dump from MTK phone" but the phone must have unlocked bootloader to do that.

It's an MTK based phone. You can often make full backup even with free SPFlashTool only using it's "read memory" feature if you have correct DA (and sometimes preloader and auth file from a firmware file) and unlocked bootloader is not required.

I'm 100% confident that 3rd party tools like Infinity CM2MTK, Volcano etc can dump it without unlocking bootloader with their stock download agents so this shouldn't be a problem for MobileEDIT as well as long as it has a correct DA. You should just try it. Worst case scenario, it won't make a dump.

I tried Mobil Edit Forensic Express option "Get physical dump from MTK phone".

It stuck at this ibb.co/ccYLuH screen.. and nothing happens ..I was waiting approx. 5 minutes.
In mobiledit support website it is said that this screen shouldnt take longer than 2 minutes.

Uhm, so maybe it doesn't have correct DA. I'd check just with SPFlashTool.

To do so, first get a firmware for your model. You may try with this one. Get latest SPFlashTool. In Download tab load a scatter file from downloaded firmware, make sure preloader loaded is marked, then switch to Memory Test tab, select any test (can be RAM test only), click start and connect the device. If everything is fine, a test should start and you can just stop it now. It's only used to determine full memory chip size, like here.

Bottom left side, EMMC Flash tab, UA Size. Once you get this, switch to Readback tab, then add and double click on added entry. Select where the dump should be saved, and enter value you copied from UA Size in Length, like here.

Then simply click Read Back and it should just work and make you a full eMMC chip dump. You can analyze the dump with any tool later.

Cellebrite UFED, latest version (7.3.0.809) offers a physical extraction with lockcode bypass over bootloader for this phone model.

greez
Pb

@Plan_B
unfortunately i dont have access to Cellebrite UFED

@arcaine2
Thanks for your instruction. I appreciate your help.
I didnt use it but I'll keep it in my mind for the future cases )

The passcodeunlock user helped me through PM.
I have to install correctly MTK drivers manually and then I successfully created physical image using MTK Hack.

Thank you all for your help.

gz and hf D

Good job