Hello, I have an Alcatel phone locked with a pattern lock. To extract data I booted the phone into recovery, where I had the option to create a backup file. It does write a userdata_xxxx_.backup file to my SD card where xxx is the date and time. Is there any way to extract data from that file?
SB -
Have you tried running file carving utilities against the file dump you created?
There are free file carving utilities built in to Linux forensic distributions such as DEFT, or you could go the paid license route with Forensic Explorer, OSForensics, Internet Evidence Finder, EnCase, etc.
Assuming the file dump contents you made are not completely encrypted, you should be able to recover files for further analysis.
Can you see the folder and file organization in the file dump you created? You could pull the file dump into FTK Imager or Autopsy for a quick look.
Yeah I tried carving with X-Ways - no luck. The file looks like it's encrypted in hex view.
It looks like you've probably created Nandroid backup. If yes, you can import it and parse all the user data in Oxygen Forensic Suite.