Free tool nokia (sy...
 
Notifications
Clear all

Free tool nokia (symbian) forensic

19 Posts
8 Users
2 Reactions
5,805 Views
(@bombone)
Trusted Member
Joined: 13 years ago
Posts: 62
Topic starter  

I need to extract files from a few Nokia smartphone. I think I can do the job with Nokia suite.
I am evaluating in renting Ufed or use forensic tool. So, now I am evaluating free tools for Nokia. Any suggestion?


   
Quote
Adam10541
(@adam10541)
Honorable Member
Joined: 13 years ago
Posts: 550
 

I have yet to come across a free mobile phone forensics tool that actually works.

There may be some linux tools out there but from my experience they generally need a fairly high degree of knowledge to use, the only "point and click" tools that I'm personally aware of are the commercial ones (XRY, UFED etc..)

Not sure how you will go renting any of these tools though but I'm not sure of anything else that will do what you want reliably.


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
 

There are other tools but as your question is general ebquiry bombone, I make some general observations

You could investigate along the lines of

Developer tool
- Carbide ++ and add Symbian SDK pack (free versions)

Standard tools
- floAt's Mobile Agent etc (free)

Examination tool
- Oxygen Symbian (not free but I believe a free trial version is available)


   
ReplyQuote
jhup
 jhup
(@jhup)
Noble Member
Joined: 16 years ago
Posts: 1442
 

I need to extract files from a few Nokia smartphone. I think I can do the job with Nokia suite.
I am evaluating in renting Ufed or use forensic tool. So, now I am evaluating free tools for Nokia. Any suggestion?

What is the model?


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

Everything depends on the model.

If it's a BB5 model then physical extraction is possible using UFED or any other flasher tools like ATF via dead USB boot or FBUS cable (very slow).
Remember that not all the BB5 models are supported for extractions, those with dual chip (APE) cannot be acquired (afaik).

older models are a pain, DCT4 especially have the worst support ever from forensics software, and forget about physical, unless you go for a chip-off solution.

examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.

physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
 

I thought the OP wanted FREE apps ?


   
ReplyQuote
Yawl
 Yawl
(@yawl)
Active Member
Joined: 14 years ago
Posts: 13
 

examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.

physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.

Rampage

I am trying to learn about mobile phone forensics by practice. I bought two Flasher boxes (ATF and Universal Box)

I used ATF as you suggested and Universal box on a Nokia N73 and Nokia N70. Now i am trying to read the extracted PM which is 15.7MB from N70. and 51 KB from N73.

I don't have access to UFED or any other professional tools.

Even Oxygen forensics they declined my request as i am a student!!!

Will the extracted PM file bring deleted data? (deleted SMS, MMS, phone numbers etc…)

I will be thankful if you can help me with free tools or procedure to follow so i can read the PM files?

I thank you all for your help and support


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

examination of logical extracted data can be done with oxygen forensics, it's not bad when it comes to nokia examination.

physical dumps can be processed manually or using UFED PA for recovering deleted data, but as said only a restricted number of handsets can be dumped without a chip-off.

Rampage

I am trying to learn about mobile phone forensics by practice. I bought two Flasher boxes (ATF and Universal Box)

I used ATF as you suggested and Universal box on a Nokia N73 and Nokia N70. Now i am trying to read the extracted PM which is 15.7MB from N70. and 51 KB from N73.

I don't have access to UFED or any other professional tools.

Even Oxygen forensics they declined my request as i am a student!!!

Will the extracted PM file bring deleted data? (deleted SMS, MMS, phone numbers etc…)

I will be thankful if you can help me with free tools or procedure to follow so i can read the PM files?

I thank you all for your help and support

Hello,
in BB5 Models the informations you are looking for are on the filesystem and not in the PM memory, the PM memory was used for such data only on OLD devices like DCT3.

in bb5 devices the PM memory contains valuable informations tho, like OS password, SD encryption password, IMEI, life timer and so on.

with ATF and i guess also with universal box you can do a full flash dump of above said handsets, but i never had such devices to test, have you tried using the "read full flash" function and booting them into dead USB mode or using an FBUS cable?


   
ReplyQuote
Yawl
 Yawl
(@yawl)
Active Member
Joined: 14 years ago
Posts: 13
 

Rampage

I thank you very very much for the quick reply.

have you tried using the "read full flash" function and booting them into dead USB mode or using an FBUS cable?

No i haven't. I will try this function.

When i extracted the PM and got 15.7 MB, i thought it's data related to Phone-book, SMSs, MMSs and other data because the file size looks big.

As i mentioned, i am learning about mobile phone forensics and thought starting by second handsets will help me building a good start point in this field.

Rampage, once again thank you

I am open to more advice from you all.

Yawl


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

i've done a couple of tests with BB5 phones but i don't have the said models, i've tried with a C5 and i could recover some data (also deleted) by carving across the bin.

i'm really curious about the N73 if it can be dumped or it fails, just let me know )

oh, and about the PM, try analyzing it with an hex editor, search for strings and such, maybe something is also stored in there, maybe the call log, but i'm not sure.


   
ReplyQuote
Page 1 / 2
Share: