The other thing to check is whether the handset was storing messages on a memory card (if one was present) or on the internal memory if this was an N95-8Gig.
It's been a while since I've looked into this, but checking out an old scalpel configuration the following signature looked like it worked
msg y 1024 \x68\x3C\x00\x10\x68\x3C\x00\x10
Worth checking as we've recovered lots of messages this way in the past.I post again because i can't seem to edit my previous reply.. sorry about that.
but i was wondering, did you carve that signature over a memory card or a flash dump?
also, can you point me in the right direction on where to search for such informations on a logical extraction?
i have a filesystem logical extraction but i really don't know which files store what )
Memory Card (or in the case of N95-8gig the internal mass-storage). Messages don't have to be stored on the mass storage, but they can be, and we've seen it a fair number of times (enough to make it worth a try anyway).
in my specific situation the device isn't an 8GB, and there was no memory card.
i was just curious it in your opinion, applying the same carving method on a flash dump made using ATF or other methods (chip off let's say) would produce some results.
ATF does not read ape part of flash chip in N95. Filesystem is in ape part of flash including SMS, contacts …
ATF is good for dump series S60 like N97, C5, C7, E72, …. S40 I think all like 5130, C3, 6700…
From the dump is possible extract in most of case Gallery, PhoneBook, Calend, SMS/MMS, MMC Password
actually atf software has functions for recovering videos and pictures from their flash dump, so i'd say it can dump the filesystem.
still i'm trying to dump it via FBUS, and i cant seem to dump it AT ALL
ATF does not read ape part of flash chip in N95. Filesystem is in ape part of flash including SMS, contacts …
ATF is good for dump series S60 like N97, C5, C7, E72, …. S40 I think all like 5130, C3, 6700…
From the dump is possible extract in most of case Gallery, PhoneBook, Calend, SMS/MMS, MMC Password
ok, i think i got your point..
if the phone has 2 chips (CMT and APE) it can't dump.
do you know if at least one chip (the 16MB one) can be dumped? it fails on me everytime i do read flash
ok, i think i got your point..
if the phone has 2 chips (CMT and APE) it can't dump.do you know if at least one chip (the 16MB one) can be dumped? it fails on me everytime i do read flash
Dump can be done on almost all models. Need to try USB and FBUS. ATF must be on USB2 and PC must be fast with at lest 8gb RAM. Which model is trying to read?
it's an N95-1
and i'm using FBUS cable.
it's an N95-1
and i'm using FBUS cable.
tray to change usb port of ATF. Does it ATF star reading, BusCheck is OK? BSI line on fbus must be 10K.
the bus check seems to be fine.
the phone stays in test mode, someone told me it has to be set in local mode for dumping, how to?
EDIT
no it's not even that… the phone is in local mode but it doesn't dump anything.
i tried to contact atf for informations but they don't reply p
i post the log here just so that maybe someone can help me out with these informations
================================================
Box Successfully Initialized
================================================
VBATT Powering Down <<<<
VBATT Powering Up >>>>
SET VCCIO Level Done
SET BSI Load Done
================================================
Basic Phone Information
================================================
MCU Version V 06wk41v31 05-06-07 RM-159 (c) Nokia
IMEI Plain 356996012463930
IMEI Spare A356996012463930
IMEI SV 33569960124639306F
Phone Model Nokia N95
Category Classic Phone
Phone Type RM-159
================================================
Extended Phone Information
================================================
Product Serial Number SAN504947
Product Code 0547856
Basic Production Code 0537956
Long Production SN 0
MCU SW Version V 06wk41v31 05-06-07 RM-159 (c) Nokia
HW Version 5900
RFIC Version 17141714
DSP Version dsprap_pb06w41v34
AHNE Version 11
Variant Version 12.0.01378.01
APE Test Version rm159_eno_2007wk16v0.150
RETU Version 15
TAHVO Version 22
APE HW Version 1
APE ADSP SW Version 256
Wireless LAN ID 001CD451F4D9
Bluetooth ID 001CD442B2A5
CS Type GSM850, GSM900, GSM1800, GSM1900, WCDMA I
================================================
Simlock Information
================================================
CONFIG KEY 0000000000000000
PROVIDER KEY 2440700000000000
NETWORK NAME Nokia Default;Finland
LOCK COUNTERS KEYPRESS 0/3, FBUS 0/10
SIMLOCK TABLE
Block [1] 1Open 2Open 3Open 4Open 5Open
Block [2] 1Open 2Open 3Open 4Open 5Open
Block [3] 1Open 2Open 3Open 4Open 5Open
Block [4] 1Open 2Open 3Open 4Open 5Open
Block [5] 1Open 2Open 3Open 4Open 5Open
Block [6] 1Open 2Open 3Open 4Open 5Open
Block [7] 1Open 2Open 3Open 4Open 5Open
SIMLOCK STATE Not Locked
SIMLOCK_TYPE PA_SL1
SIMLOCK_TEST PASSED
SECURITY_TEST PASSED
SECURITY_CODE 12345
PHONE_MODE LOCAL
DCC ID NOT USED
Make sure you have installed the
COMPLETE Flash Package for this Phone...
Goto "Settings" --> "Nokia Settings" and verify that
the Folder where you installed your Flash Files are
in the "PRODUCT PATH TO SCAN" List...
Booting Phone via FBUS...
AdvanceBox SendBootCodeEx
InitialiseBootstrap_DCT5 DIR
BootFlashMode_DCT5
***************************************************
TIME STARTS HERE
***************************************************
BootFlashModeDCT5Ex Succeeded First Time
SYSTEM_ID_RESPONSE_BB5 (0xC0) - 0 (0x00) bytes returned
Number of Sub Blocks 11 (0x0B)
1 SYSTEM_ASIC_ID 01
Block Length 5 (05)
BB ASIC Index 1 (01) APE
ID DWORD 0 24200705
2 ASIC_MODE_ID 13
Block Length 2 (02)
BB ASIC Index 1 (01) APE
Mode Id 00
3 PUBLIC_ID 12
Block Length 21 (15)
BB ASIC Index 1 (01) APE
ID DWORD 0 323C2DC2
ID DWORD 1 05A1B3A8
ID DWORD 2 D98B88B7
ID DWORD 3 31C269B7
ID DWORD 4 A6675FEC
4 ROOT_KEY_HASH 14
Block Length 21 (15)
BB ASIC Index 1 (01) APE
Hash BA 87 10 A7 E1 CD 5A 29 09 B9 A8 75 DB 27 AA 24 00 00 00 00
5 SYSTEM_ASIC_ID 01
Block Length 21 (15)
BB ASIC Index 0 (00) CMT
ID DWORD 0 00000001
ID DWORD 1 00000226
ID DWORD 2 00010006
ID DWORD 3 400C1921
ID DWORD 4 01011103
6 EM_ASIC_ID 02
Block Length 5 (05)
BB ASIC Index 0 (00) CMT
ID DWORD 0 00000295
7 EM_ASIC_ID 02
Block Length 5 (05)
BB ASIC Index 0 (00) CMT
ID DWORD 0 00000B22
8 PUBLIC_ID 12
Block Length 21 (15)
BB ASIC Index 0 (00) CMT
ID DWORD 0 11F00014
ID DWORD 1 47630058
ID DWORD 2 FC56857B
ID DWORD 3 06975643
ID DWORD 4 CDC4A588
9 ASIC_MODE_ID 13
Block Length 2 (02)
BB ASIC Index 0 (00) CMT
Mode Id 00
10 ROOT_KEY_HASH 14
Block Length 17 (11)
BB ASIC Index 0 (00) CMT
Hash CA EE BB 65 D3 C4 8E 6D C7 3B 49 DC 50 63 A2 EE
11 ROM_ID 15
Block Length 9 (09)
BB ASIC Index 0 (00) CMT
CRC 0 F2C6EBAD
CRC 1 C86E6189
Checksum 1D
SearchForBootstrap_DCT5..
C\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\Old\RAPIDOv11_2nd.fg
Boot File - Version 01.037.01
Boot File - Revision 0x0000 (0)
eBB5ProtocolType == Original
SearchForBootstrap_DCT5 No Error - 0 (0x00)
Secondary Loader Sent...
ConfigurationRequest_DCT5 (RAM_SIZE_BB5 0x0000)..
MCU_CONFIGURATION_RESPONSE_BB5
MessageID 03
SubBlocks 03
1 Sub Block ID 10 STORAGE_DEVICE_ID_BB5
Block Length 0B
BB ASIC Index CMT 00
Device Type NOR 00
Device Index 00
Manufacturer Code 0001 ->
Device ID 0035 -> 72NS128N
Extended/Fixed ID 0000
Revision ID 6921
2 Sub Block ID 11 STORAGE_DEVICE_CONTENTS_BB5
Block Length 13
BB ASIC Index CMT 00
Device Type NOR 00
Device Index 00
Device Contents 00000000000000000000
3 Sub Block ID 10 STORAGE_DEVICE_ID_BB5
Block Length 0B
BB ASIC Index CMT 00
Device Type MMC 04
Device Index 00
Manufacturer Code FFFF -> Flash
Device ID 0000 -> BAD FLASH TYPE
Extended/Fixed ID 0000
Revision ID 0000
Checksum E0
SearchForBootstrap_DCT5 No Error - 0 (0x00)
FLS1SendAlgoCodeEx..
SendAlgoCode_DCT5..
SearchForAlgorithm_DCT5..
Looking for ALL Devices...
Searching Algorithm Files NOR (00) ManID 0001 DevID 0035 ExtID 0000 RevID 6921
Flash Descriptor
Manufacturer Code 0001
Device ID 0035
Extended/Fixed ID 0000
Revision ID 0000
Size 01000000 (16 MB)
VPP Info 0009
Erase10s 28
Block1s 32
BErase1s 02
Reserved0 00
Reserved1 00
Reserved2 00
VPPInfo VPP_INFO_3V_MASK VPP_INFO_9V_MASK
C\AdvanceBox Turbo Flasher\Nokia\BB5_Loader\Old\RAPIDOv11_algo.fg
Algorithm File - Version 01.040.00
Algorithm File - Revision 0x0000 (0)
eBB5ProtocolType == Original
SearchForAlgorithm_DCT5 No Error - 0 (0x00)
TransmissionTypeRequest_DCT5...
SuggestedType 01 16BIT
TRANSMISSION_TYPE_REQUEST_BB5 59 01 20 01 01 DC
ReturnedType 01 16BIT
TransmissionTypeRequest_DCT5 No Error - 0 (0x00)
Uploading ALGO File...
SendAlgoCodeFile_DCT5 No Error - 0 (0x00)
PAPUB_KEYS_HASH_REQ_BB5
PhoneInfoRequest_BB5 (Asic Index 00 )
PHONE_INFO_RESPONSE_BB5
PAPUB_KEYS_HASH_RESP_BB5 2A
BB Asic Index 00
CMT PAPUBKEYS HASH
25129A39D9A3B031CA0124E1E90F5A17ED3EFC89
DDR PROTOCOL ERROR Phone did not Ack !!!
ERROR DDR Transmission Error
VBATT Powering Down <<<<
VBATT Powering Up >>>>
SET VCCIO Level Done
SET BSI Load Done
Total Time 000005
3rd post on this link states phones with dual cpu are not supported for read flash by ATF cry