Hi all,
I was wondering if anyone could help me out with a problem - I have acquired all the live data stored on an O2 XDA Orbit 2 but I have now been told that the data required has been deleted from the handset.
Does anyone know of a way to get deleted SMS messages and call register data from this handset? I've looked into it but everything is telling me it can't be done.
Thanks in advance,
TW
Handy Recovery 4 recovers deleted data from flash memory but that would require connecting the 256MB ROM 128MB RAM Micro SD to your PC to read your PPC so to speak.
May not be forensics, but you may have to crack a few eggs to make a cake.
Is this for a criminal case?
Don't listen when they say it can't be done.
My workplace pioneered the extraction of deleted data from mobile phones and continues to do so. Chip removal is an option providing the chip is supported and can be examined. That said, an O2 XDA is a new one on me. Don't give up, I suggest you Google Mobile Phone Forensics and see what comes up. A phone call could change your situation
MD5 provide chip removal services to some of the major police forces in the UK. We are able to extract deleted data from handsets that are not supported using the 'standard' tools. If anyone would like costs or information sending please feel free to pm me.
I thought i would offer the services to save you trawling through google!
The O2 XDA Orbit 2 uses the Windows Mobile OS and is supported by XACT but unfortunately unallocated clusters/area are inaccessible. As mentioned above your best bet might be a hardware read of the flash chips.
Good observations KVS379 but have you done this yet?
With this model, O2 XDA Orbit 2 it uses WM OS-6 and is a cloaked HTC. It has the same recovery problems as the HTC P3300 and the MDA Compact III.
The hardware read of flash chips do not produce the same results on each model and can be problematical.
However, I am not entirely familiar with every model's firmware and always willing to learn if you can give any suggestions?
Now I can't say fairer than that, can I?
Deleted data is accessible through CelleBrite Physical Analyser