Conducted a physical on this device with UFED. Took couple of hours. Getting error message stating unable to write to target device (8GB thumb drive). Looked on target and can see files written to it. A 2GB UFED Dump and several BIN Files. I opened the dump in Physical Analyzer but there is no data there. I am trying to conduct another Physical now…Is it normal to take this long..and am I doing something wrong. Any help will be greatly appreciated!!
Some of those physical dumps can be 15GB. If I remember right the last one I did on an Inspire was about 10GB. I'd get a larger (32GB) thumb drive and give that a try.
Is it possible your thumbdrive is formatted as FAT32 and the physical dump is larger than 4GB? Why not just connect the UFED device to a computer with a USB cable and eliminate the thumbdrive entirely?
FAT32 is OK, UFED splits the files automatically if there are above 4GB
Ron
Thanks for all the replies. I decided to just connect straight to laptop and not use thumbdrive at all. Worked much better.
Ron, Thanks for all your help!! I was able to recover over 50 deleted contacts, 48 deleted SMS and 24 deleted outgoing calls.
nice.
Happy to help