Forums
Main Category
General (Technical,...
Extracting Samsung ...
 
Notifications
Clear all

Extracting Samsung Galaxy S8 SM-G950F (Cellebrite UFED4PC)

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by Plan_B 7 years ago
5 Posts
4 Users
0 Reactions
2,241 Views
RSS
 Dimi
(@dimi)
Active Member
Joined: 8 years ago
Posts: 13
Topic starter 09/03/2018 6:50 pm  

Hello,

I have been extracting a Samsung Galaxy S8 (SM-G950F) with our UFED4PC.

Physical extraction was not working, Physical extraction with Samsung Generic was not working.

I did a logical extraction and File system extraction. I got all the data out of it except de app-data.

In my case especially the WhatsApp and the facebook Messenger data is very important.

What can i do more to extract the app-data (WhatsApp/Facebook Messenger) out of the smartphone?

Best regards,

Dimi


   
Quote
UnallocatedClusters
 UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
10/03/2018 2:43 am  

Dimi,

Have you looked at setting up a fresh Windows computer, installing WhatsApp desktop to the Windows computer, signing in to the phone's WhatsApp account using the WhatsApp Windows desktop installation, and then forensically collecting the WhatsApp data that has now been synchronized from the phone to the Windows computer?

If you have the Facebook account login and password, you could potentially recover Facebook Messenger messages from Facebook (https://www.facebook.com/help/131112897028467) using Facebook's built-in account archiving solution.

Another thought (never tested, just brainstorming) create a rooted Android phone, install WhatsApp and Facebook messenger, synchronize both accounts with the desired accounts to download the WhatsApp and Facebook messenger content to your rooted Android phone, and then collect the desired data from your rooted Android phone.

I was able to extract email from a client's iPhone by uploading the email on the iPhone to Apple's iCloud and then downloading the email from Apple's iCloud to an Outlook client on a Windows computer as an example of "bypassing" smartphone security.


   
ReplyQuote
 randomaccess
(@randomaccess)
Reputable Member
Joined: 14 years ago
Posts: 385
10/03/2018 8:43 am  

No luck with physical using bootloader im assuming (locked bootloader; im not sure what happens if you turn that off…does it wipe the phone? never done it), but what about turning on developer mode and going ADB method for a physical?


   
ReplyQuote
 Dimi
(@dimi)
Active Member
Joined: 8 years ago
Posts: 13
Topic starter 11/03/2018 7:54 pm  

ADB in developer mode was no succes


   
ReplyQuote
 Plan_B
(@plan_b)
Eminent Member
Joined: 8 years ago
Posts: 31
20/03/2018 10:51 am  

Good suggestion UnallocatedClusters )

Without the users google account password its also possibe. Just create an fresh gmail-account, set it up on the device and backup the whatsapp databases onto the google drive.

Set this account on a rooted phone up, install whatsapp and restore the backup from the google drive account.


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: