Imaging a mobile ph...
 
Notifications
Clear all

Imaging a mobile phone

5 Posts
5 Users
0 Reactions
1,127 Views
(@daver)
Active Member
Joined: 16 years ago
Posts: 11
Topic starter  

Before examining a hard drive an image should always be taken and worked on, rather than examining the HD itself.
I use Oxygen for mobile phone examination but I have never tried to take an image of a phone and instead, once the phone data has been extracted, I work on the extraction information stored by Oxygen.
A colleague who often has to analyse mobile phones on behalf of the law enforcement is always given an image to work on and never the phone itself (I do not know what software is used).
Question is it possible - using Oxygen- to take an image of a mobile phone which can then be passed onto a third party for examination? If it can then has the other software also got to be Oxygen or can the image be examined using other software - Xact, Device Seizure, MobilEdit etc?


   
Quote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

"imaging" a phone, in the way you think about imaging an hard drive is not generally possible via software, and sometimes not even using specified hardware.

there are hardware tools like cellbrite UFED that can perform a physical acquisition of the memory of many mobile devices, but not all.

that's becouse you are bound to the interfaces that the device itself exposes to the user/examiner, which in many cases are not capable or simply are not meant to perform a raw image of the internal memory of the device itself.

for "imaging" a mobile phone for real (dumping) you should image the internal flash memory and analyze it, in really few cases, only really important ones, this technique is used on broken phones or phones that can't be turned on, maybe becouse they were soaked in water and therefore the electronic part is heavly damaged.

a paper was submitted and a challenge proposed for the 2010 Digital forensics research workshop, you can have a read of it which would explain a lot of things )

hope i've been able to answer your question.

EDIT well obvioysly this is not applied to ALL mobile phones, for example an iphone can be imaged using dd but the dd must be run from inside the phone and therefore the device must be jailbroken.

other OSes like windows mobile are accessible using RAPI, but i don't know how far you can go with them, i don't think you can "image" the internal flash memory.


   
ReplyQuote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

Like Rampage stated, 'imaging' a mobile phone is not always possible. Many different techniques are used for many different handsets.

XRY also takes a 'physical read' of the handsets memory and interprets the data (if supported). Another technique is obtain a read of the memory chip using the JTAG method, and interpreting the data that is obtained.


   
ReplyQuote
(@jonathan)
Prominent Member
Joined: 20 years ago
Posts: 878
 

Question is it possible - using Oxygen- to take an image of a mobile phone which can then be passed onto a third party for examination? If it can then has the other software also got to be Oxygen or can the image be examined using other software - Xact, Device Seizure, MobilEdit etc?

No. Generally Oxygen extracts just logical areas to be examined in the Oxygen interface. It doesn't produce a cross-platform image.


   
ReplyQuote
KeithD
(@keithd)
New Member
Joined: 18 years ago
Posts: 2
 

Depending on what is needed and how important, there is always the option of removing the EEPROM and imaging/processing the data. The only hang-up is getting the proper readers and address schemes, but once you whip that it is easy.


   
ReplyQuote
Share: