Help Out The Nokia ...
 
Notifications
Clear all

Help Out The Nokia 1116 Physical Extraction Range

5 Posts
4 Users
0 Reactions
653 Views
(@dr-wonder)
Eminent Member
Joined: 9 years ago
Posts: 49
Topic starter  

Hello experts
Today i have a nokia 1116 (RH-93) to investigate.
When i use cellebrite'UFED I select mode 1112 to done physical extraction,
it display "Read PM absolute" and i choose "manual select"…
and display this ?


so what is the Start address?
and what is End address?

Hope someone or experts can help me out.

Thanks in advance.

Regards wonder


   
Quote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

please share same screen shorts with ufed technical support they will help you.


   
ReplyQuote
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
 

The range they are giving you is what they have derived from testing as (what I think) they believe to be a full range of accessible data. The manual selection window is for you to try your own offsets if you have a sub build they may not have been aware of during testing.

Nokia PM absolute dumps are dumps of all accessible handset areas, if you attempt to dump a 'reserved' area Nokia does not allow access to, the dumping process will crash / fail.

Try going back before sector 17F0000 with 17F0000 as the end sector reading back few bytes at a time until you hit an area that won't allow you to dump, you have now found your start offset.

Then go from 17FFFFF reading forward a few bytes until it crashes and you have found the end.

This is a very labor intensive process and the results have been ruled by a court as IP (of sorts) or at least the process of deriving them.

People have been badly stung in the past sharing these if they weren't the party who derviced them see

https://www.brownejacobson.com/about-us/news-and-media/published-articles/2012/01/case-summary-fts-v-west-yorkshire-police

I would say odds are cellebrites pre programmed offsets are probably getting you a fair compliment of the data. Reading just before and just after will confirm that for you.


   
ReplyQuote
(@dr-wonder)
Eminent Member
Joined: 9 years ago
Posts: 49
Topic starter  

Hello mobileforensicswales

Yesterday I got email from technical support,it says

"Regarding the question on the Physical dump PM methods, please see to the information below
…….
2) PM Absolute - physical dump that is not supported for all Nokia models since Nokia blocked this method (this is for devices from end of 2007)
3) Automatic method - detects if physical extraction is supported and will skip if not, without an error."
…….
…….
…….
but unfortunately, I find this mode is made by the end of 2007,
and I have try many location and address,and can't dump any any dada?
I don't know…may be it's true.

So what to do next ….


   
ReplyQuote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

Hello,

Maybe worth a shot

http//www.mobiledit.com/phones.htm?SEARCH=nokia

I do NOT see the model 1116 listed, but there are definitely other old Nokia models listed as compatible.

Also, I do not know how accurate this site's information is (http//nokiamuseum.info/nokia-1116/) but apparently the model 1116 could hold an amazing 60 SMS messages and 200 contacts!!!!


   
ReplyQuote
Share: