I need to extract files from a few Nokia smartphone. I think I can do the job with Nokia suite.
I am evaluating in renting Ufed or use forensic tool. So, now I am evaluating free tools for Nokia. Any suggestion?
I have yet to come across a free mobile phone forensics tool that actually works.
There may be some linux tools out there but from my experience they generally need a fairly high degree of knowledge to use, the only "point and click" tools that I'm personally aware of are the commercial ones (XRY, UFED etc..)
Not sure how you will go renting any of these tools though but I'm not sure of anything else that will do what you want reliably.
There are other tools but as your question is general ebquiry bombone, I make some general observations
You could investigate along the lines of
Developer tool
- Carbide ++ and add Symbian SDK pack (free versions)
Standard tools
- floAt's Mobile Agent etc (free)
Examination tool
- Oxygen Symbian (not free but I believe a free trial version is available)
I need to extract files from a few Nokia smartphone. I think I can do the job with Nokia suite.
I am evaluating in renting Ufed or use forensic tool. So, now I am evaluating free tools for Nokia. Any suggestion?
What is the model?
Everything depends on the model.
If it's a BB5 model then physical extraction is possible using UFED or any other flasher tools like ATF via dead USB boot or FBUS cable (very slow).
Remember that not all the BB5 models are supported for extractions, those with dual chip (APE) cannot be acquired (afaik).
older models are a pain, DCT4 especially have the worst support ever from forensics software, and forget about physical, unless you go for a chip-off solution.
examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.
physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.
I thought the OP wanted FREE apps ?
examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.
physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.
Rampage
I am trying to learn about mobile phone forensics by practice. I bought two Flasher boxes (ATF and Universal Box)
I used ATF as you suggested and Universal box on a Nokia N73 and Nokia N70. Now i am trying to read the extracted PM which is 15.7MB from N70. and 51 KB from N73.
I don't have access to UFED or any other professional tools.
Even Oxygen forensics they declined my request as i am a student!!!
Will the extracted PM file bring deleted data? (deleted SMS, MMS, phone numbers etc…)
I will be thankful if you can help me with free tools or procedure to follow so i can read the PM files?
I thank you all for your help and support
examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.
physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.
Rampage
I am trying to learn about mobile phone forensics by practice. I bought two Flasher boxes (ATF and Universal Box)
I used ATF as you suggested and Universal box on a Nokia N73 and Nokia N70. Now i am trying to read the extracted PM which is 15.7MB from N70. and 51 KB from N73.
I don't have access to UFED or any other professional tools.
Even Oxygen forensics they declined my request as i am a student!!!
Will the extracted PM file bring deleted data? (deleted SMS, MMS, phone numbers etc…)
I will be thankful if you can help me with free tools or procedure to follow so i can read the PM files?
I thank you all for your help and support
Hello,
in BB5 Models the informations you are looking for are on the filesystem and not in the PM memory, the PM memory was used for such data only on OLD devices like DCT3.
in bb5 devices the PM memory contains valuable informations tho, like OS password, SD encryption password, IMEI, life timer and so on.
with ATF and i guess also with universal box you can do a full flash dump of above said handsets, but i never had such devices to test, have you tried using the "read full flash" function and booting them into dead USB mode or using an FBUS cable?
Rampage
I thank you very very much for the quick reply.
have you tried using the "read full flash" function and booting them into dead USB mode or using an FBUS cable?
No i haven't. I will try this function.
When i extracted the PM and got 15.7 MB, i thought it's data related to Phone-book, SMSs, MMSs and other data because the file size looks big.
As i mentioned, i am learning about mobile phone forensics and thought starting by second handsets will help me building a good start point in this field.
Rampage, once again thank you
I am open to more advice from you all.
Yawl
i've done a couple of tests with BB5 phones but i don't have the said models, i've tried with a C5 and i could recover some data (also deleted) by carving across the bin.
i'm really curious about the N73 if it can be dumped or it fails, just let me know )
oh, and about the PM, try analyzing it with an hex editor, search for strings and such, maybe something is also stored in there, maybe the call log, but i'm not sure.