Nokia Lumia 800 [WP7]

Looking at a range of tools for Mobile WIN7 tools to see whether they are suitable for examiners. Here is one I have been reviewing last week

http//www.resco.net/developer/support/samples.aspx
http//www.resco.net/mobileformstoolkit/overview.aspx#wm
http//www.resco.net/mobileformstoolkit/download.aspx

What do you hope to do with those controls?

Hello,
sorry for the gravedigging of this thread but i thought it was better then starting a new one.

I'll have to deal with this handset soon,
does anyone know if any progress hase been made for analyzing a lumia 800?

i'm looking at the UFED compatibility list as of now, for ufed ultimate it says it supports "filesystem extraction".

but everything else is missing, like it's unable to decode anything in the physical analyzer.

any JTAG method supported or anything?

the evidence i'll have to extract are most likely whatsapp related, so i absolutely need to extract whatsapp history from the mobile.

i wonder if UFED or oxygen is capable of such a task.

I eventually have a flasher box that can be connected to the test points, but honestly i don't trust it too much and would keep it as a last resort just in case they ask me "ok do it no matter what"

We've done a few of those now. If you are able to obtain a physical extraction, you'll be able to analyse WhatsApp easily as it uses SQLite.

Polar,
thank you for your reply )

the problem is exactly that.. getting a physical dump.

i cant do a chip off but i have an ATF Box.

The phone has the DLOAD bootloader, so i'm trying to figure out which are the viable ways.

i can try to use the test point on the phone to read the flash, but i don't know if ATF can do that.. there is a function (custom read write) which allows me to specify the memory range to read to a file, so i think that if i know the exact flash chip size i can manage to dump its whole content.

second approach flash a qualcom unlocked bootloader and access the partitions using dd.
This one is easier to perform in terms of technical skills required and tools you need to do that, BUT considering i'm WRITING something on the device i have to make sure that replacing the bootloader doesn't screw up with the actual data.

do you have any experience with this equipment?

In the meanwhile i'm waiting for solderless cables for this specific model, which might compensate my lack in soldering skill

EDIT I managed to extract the partitions from the internal flash of the device.. one is approximately 15GB, which i think is the OS partitions, others are boot and stuff..

the question now is.. do you know of any tool that can interpret the filesystems?
it doesn't look like any familiar well-known filesystem.
i've tried opening the dd image using ftk imager but it cant recognize it so i cant browse files or directories in an attempt to extract data.

Windows Phone 7 has a normal exFAT filesystem. The problem is, that the partitioning is written to the flash, so there is no matching partition table for it. XWays found loads of partitions when I searched for lost partitions.

It was partition 12 for the last devices I had to work on, which was the interesting one.

So if you can't use a tool like XWays, you should search for partitions, their beginning and range and try to mount them.

The next challenge is to interpret the files. I did not find scripts or tools which help with interpreting the files so you have to do it manually or write your own scripts. WhatsApp is easy to analyse, because it uses sqlite.

Internet Evidence Finder finds some artifacts, but mostly web related ones.

Here I have a link to some informations for investigating a WP7 dump
infosec WP7 forensics

I hope I could help, even if your request is a few days old.

Maybe someone found some tools for investigating a WP7 dump?!

Hi,
sorry but i was busy during the past few days and didn't visit the forum.

I've just noticed your reply.

my flash dump appears to have a partition table like this

as shown from fdisk

# fdisk -l lumia800.bin.001

as shown by the sleuthkit mmls


# mmls lumia800.bin.001
DOS Partition Table
Offset Sector 0
Units are in 512-byte sectors

the only partition i could mount is the second partition (fat16) but that partition doesn't contain any user data, only phone specific data, certificates and such.

the partition that actually contains user data is partition 9 (in fdisk), but the filesystem doesn't seem to be exFAT.

I've managed to successfully carve out some sqlite databases that belongs to whatsapp, so in a way or another i managed to get the information i was looking for.

But i'm really interested in finding out if the logical structure can be in any way interpreted.

i've also tried running it through r-studio and scanning for parttions, but it couldn't find any exfat partition.

EDIT shame on me!
it's GPT
and the partition appears to be not correctly aligned, i've managed to find its offset using testdisk, now i've extracted it using dd, and need to find a way to read it, as appearently both Sleuthkit nor the FUSE exfat driver support the transactional version of exfat.

I think i'll give a look at it using x-ways.

I think i'll give a look at it using x-ways.

That should do it. )

once i managed to detect and isolate the partition, even r-studio could parse its content properly.

too bad TSK can't handle it, i've cloned the git repository and compiled the development branch, but appearently there are a bunch of issues, probably depending from the fact that the filesystem is TExFAT and not a simple ExFAT

also the fuse exfat module fails to mount it.

if i happen to find a disposable device i'll dump it and submit the image for testing

Hi,

I am not sure how far you have got with this using Testdisk. I had a windows lumia 610, and using testdisk i was able to export the file system and gain access to the files. (Testdisk saw the partition of interest and you can then list the files and export them)

The problem was decoding the databases (such as store.vol). I am still working on (or trying to find) a solution to parse the text messages from a windows 7 handset.

with testdisk i couldn't extract the files from the partition, it wouldn't recognize it, only identify it but i couldn't get the content.

The questions to me were really specific, they wanted me to extract whatsapp conversations, so it was pretty easy since the files are sqlite.

in fact just by carving i could extract lots of the conversations as i could extract the sqlite files.