Nokia N8-00 copying...
 
Notifications
Clear all

Nokia N8-00 copying emails (files *.CFS)

3 Posts
2 Users
0 Reactions
645 Views
(@jahelka)
Active Member
Joined: 13 years ago
Posts: 11
Topic starter  

I have a problem with the Nokia N8-00, and copying emails. The old firmware version 025.007 (2011-09-16) I did Oxygen Program Analyst. The new firmware version 11.040.1511 (2012-07-28) does not copy these emails. I also tried UFED Analyzer (physical extraction), but the emails are not there.

Using EnCase and keywords I found this

Overview emails
XSR_FILESYSTEM remapped (XSR) \ private \ 2001fda4 \ message_store.db

The complete contents of emails
XSR_FILESYSTEM remapped (XSR) \ private \ 2001f6f7 \ indexing \ indexdb \ root \ msg \ email \ _1 \ _0.cfs

You do not know anyone like to browse files with CFS? Or have consulted a different approach to backup emails from a mobile phone?


   
Quote
bigjon
(@bigjon)
Estimable Member
Joined: 17 years ago
Posts: 159
 

Have you tried going into your ufed extraction folder / Files / databases, this usually gives a list of all its extracted, however you may see files named 000000001.db 000000002.db

These are third party apps, Yahoo etc, open these with SQLite to reveal the mail


   
ReplyQuote
(@jahelka)
Active Member
Joined: 13 years ago
Posts: 11
Topic starter  

Have you tried going into your ufed extraction folder / Files / databases, this usually gives a list of all its extracted, however you may see files named 000000001.db 000000002.db

These are third party apps, Yahoo etc, open these with SQLite to reveal the mail

I found files (path XSR_FILESYSTEM remapped (XSR) \ private \ 200267c0 \ data \ 235503028 \ widget_235503028_0), but it contains no data to email.

I have found that in the directory
XSR_FILESYSTEM remapped (XSR) \ private \ 2001fda4

subdirectories C0 to C24 and inside is 8 files (sometimes more) that contain the parts e-mail.

For example
2AF8 = html text email
2b8e = advertising text
1518 = Word - doc (attached)
DDE = Image - jpg (Annex)

after adding extensions are executable files and functional. Unfortunately, I have too much e-mail. You can not do it by hand and combine fragments. In addition, e-mail addresses and dates are listed in the previous files.


   
ReplyQuote
Share: