Oxygen - 'Expired Certificate' on Nokia N97

Hi,

Recently we have been having a few New Nokia's that are refusing to install the Oxy Agent. They give the error 'Expired Certificate'.
We have tried
- Setting the time and date to match the lab computers clock and this still does not work.
- Older versions of the client with no joy.
- Altering the installation settings on the handset.

The .XRY client will still install and work correctly though. Has anyone had any luck with solving this? Do we need an update to Oxygen to get a new Oxy Agent file?

Regards,

We've had this same problem with atleast Nokia E51 and Nokia E90.
The only way we were able to extract information with Oxygen was to change the phone date back to 31.12.2008.

I'm guessing this is due to old OxyAgent, how ever we are running the latest version of Oxygen.

Doug, of the attempts to load the agents onto the exhibit phones and changing the handset clock did you record that in your notes/report?

Hi,

Please just update to the latest version of Oxygen Forensic Suite.

The reason (if interested) is
1. We use a native Agent application to obtain the data from Symbian OS smartphones.
2. Each Symbian OS application must have certificate.
3. Certificate has start and end dates.
4. Previous certificate expired at 1 November 2009.

So now we supply new OxyAgent with an updated certificate (the new expiration date is 15 October 2019 -) ).

In general I would not recommend to use obsolete versions of Oxygen Forensic Suite, because otherwise we'll have no stimulus to release the new ones wink

WBR, Oleg.

Is the operating system for the Nokia's in question symbian by any chance?

I've had a few similar problems were if the date is not set to the current time and date the client will not install in order to continue with the extraction.

I've questioned my manager about this and apparently, software tools such as xry have had to change the file name of their clients which are installed on the phone for the follwing reason. (which lead to the said problem)

' some examiners were leaving the client still installed on the handset after the examination had been completed. When the phones were being returned to their original owners, some of them were noticing the new software applications which had been installed on the handset and when googling the make of said software were finding out it was for forensic purposes, and thought that their phones had been hacked by someone.'

Software companies by law had to change their clients to names like 'connectivity assistant' (XRY) and by doing so had to implement a new 'valid from date'.

So hence when an older date, say a couple of months before the oldest dated SMS/MMS message, call log or calendar entry is set on the handset when requested (to ensure call logs are not erased), there is an error message displaying 'Certificate out of date' or 'Certificate not valid'

This is only an issue if the newer updates are installed.

Hope this wqas of help.

JB

Doug, of the attempts to load the agents onto the exhibit phones and changing the handset clock did you record that in your notes/report?

Oh yes! We ran an successful extraction in .XRY and verified the data before altering anything. And as always full notes were made at all stages!

Doug, of the attempts to load the agents onto the exhibit phones and changing the handset clock did you record that in your notes/report?

Oh yes! We ran an successful extraction in .XRY and verified the data before altering anything. And as always full notes were made at all stages!

Cheers Doug, thanks for the advice, always useful to see how others work.

The purpose of the additional work on Oxygen was to look at how Oxygen would re-build the web cache on this particular handset (A feature that .XRY does not at present support). It would not be common practice to run a full extraction, manually verify the results and then run it on another tool.

Doug, don't you really need all the stuff that is impossible to extract without an Agent?

WBR, Oleg.