hp touchpad webos f...
 
Notifications
Clear all

hp touchpad webos forensics

11 Posts
2 Users
0 Reactions
1,100 Views
crazyrudy
(@crazyrudy)
Eminent Member
Joined: 20 years ago
Posts: 33
Topic starter  

I need to recover a password file from an HP touchpad. The WebOS is new to me, and none of my tools seems to support data recovery. In fact, I have only been able to recover the data section of the touchpad, and am unsure if the information I seek is available in this area. Anyone with experience on examining an HP touchpad please chime in!


   
Quote
cyrus
(@cyrus)
Eminent Member
Joined: 13 years ago
Posts: 26
 

It depends what you mean by "a password file"; the actual device password, or a password for something else?

As far as I am aware, it is not possible to recover the password from a Touchpad (someone please correct me if I am wrong), but a file might be possible, it depends how / if it is stored.


   
ReplyQuote
crazyrudy
(@crazyrudy)
Eminent Member
Joined: 20 years ago
Posts: 33
Topic starter  

I have the device password, so I can access the touchpad. i want to know if there is a way to extract stored passwords in a file, such as a windows PWL file….or whatever that might be in WebOS…a sqlite db? Also, I am interested to know if anyone has experience with examining such a device….so that I can access more than the data partition that the USB interface offers.


   
ReplyQuote
cyrus
(@cyrus)
Eminent Member
Joined: 13 years ago
Posts: 26
 

the imaging part of this document may be useful to you

https://docs.google.com/viewer?a=v&q=cache9lb_WwQBOXsJwww.dunkelheit.com.br/supsi/Mobile/palestras/MFW10_JHU_PalmPrePhoneForensics.pdf+MFW10_JHU_PalmPrePhoneForensics.pdf&hl=fr&gl=fr&pid=bl&srcid=ADGEESgeMuyiewG_p88nJimTbMOKNerA-E1WtKgXfaajRXZ6PGmNd0YlWS3AyDpSqruZ9z71eUZdFQKgvUCKKTQC-hO8RXKbx7xU3iAfb1qv4e9Q2WuN1imFP0JDKKeCwAFjKbb1_L-i&sig=AHIEtbT_nc8wO7FY4HMi2wiN2nTpCZQfMQ&pli=1

as you can image the touchpad using the techniques described. However the databases discussed are for the older palm os, and most will not be relevant for the touchpad….

When you get an image off the device, mount it (I use ftk) and you can extract all the device files. You might find your file in there somewhere.. Most of the databases on the newer devices are stored db8 format if that helps, https://developer.palm.com/content/api/dev-guide/mojo/db8.html


   
ReplyQuote
crazyrudy
(@crazyrudy)
Eminent Member
Joined: 20 years ago
Posts: 33
Topic starter  

That link does not do a very good job of describing how I dd image the device…or perhaps it is my lack of linux experience…I have connected the device and have listed the filesystems as directed in that post….but where to go from there for a dd image? Also, I would use xways, etc. to view the image and extract db's.


   
ReplyQuote
cyrus
(@cyrus)
Eminent Member
Joined: 13 years ago
Posts: 26
 

Sorry, just checked the link I gave you and it wasnt the one I thought it was….

Basically you need to enable developer mode on the device first;
http//claptop.com/2011/08/how-to-enable-developer-mode-on-a-hp-touchpad/

download and install the webos sdk and novaterm

Then connect your device to your pc, start up novaterm and run the following command from

novacom run “file//bin/dd if=/dev/mmcblock0” > filename.bin


   
ReplyQuote
crazyrudy
(@crazyrudy)
Eminent Member
Joined: 20 years ago
Posts: 33
Topic starter  

Thanks for your help. I have the command you suggested running in NovaTerm. However, I get a "can't create carlos.bin Read only filesystem". Should I be directing the file creation somewhere?


   
ReplyQuote
cyrus
(@cyrus)
Eminent Member
Joined: 13 years ago
Posts: 26
 

hhmm that command should just dump to the directory novaterm is in
Sorry i am doing this from memory so might not be quite right, and I dont have any hp / palm devices here to test it with

you could always run it from the windows command prompt. Just browse to the directory containing novacom.exe (not novaterm.exe) using command prompt, and then run the command i gave you in my last post. Thats should do it.

If it still doesnt work, you can use the the command ls to list files and folders in the current directory from novaterm. browse to the dev folder and see if i got the name right….


   
ReplyQuote
crazyrudy
(@crazyrudy)
Eminent Member
Joined: 20 years ago
Posts: 33
Topic starter  

If I run it from windows, what is the run command? Novacom? So the line would be "novacom file//bin/dd if=/dev/mmcblock0 >carlos.bin" ?

mmcblk0 is a file in the dev directory, but still no joy


   
ReplyQuote
cyrus
(@cyrus)
Eminent Member
Joined: 13 years ago
Posts: 26
 

you need to make sure you use the quote marks around the first command as it has spaces, and you need to use the run and file// part. The line below should be exactly as you should do it;

novacom run "file//bin/dd if=/dev/mmcblock0" > carlos.bin

as far as i understand it, the dd command appears as a "file" so you can run it as one. You then pass the commands to dd as you normally would, (ie if=/dev/ ….) and finally the > outputfile.


   
ReplyQuote
Page 1 / 2
Share: