Hi all
Does anyone know of a workaround to either read out or reset the user created handset lock password for a Samsung E900 (this is not the privacy lock, it's the boot up password).
I've attempted to utilise UFS/SHU and similar tools without success. These tolls do not offer a reset or read option for the user code.
I'm aware of the full reset option (which will erase all stored data), however for the case I'm working on this is not an option and the OIC is unable to ascertain the required code from the suspect.
Many thanks in advance
Sorry vinny this is not an answer, but a question!
As someone who knows nowt of phone forensic techniques, do full resets which result in user data being deleted mean that data is securely wiped or just marked as deleted? If it is the latter is user data easily recoverable?
From reading the article Jaime posted, it doesn't sound like it would be. Because when you do that you actually clear the SIM. This means all contacts and all text messages (not stored internally) will be lost.
Only if the SIM becomes full will some models retain memory internally and even then it appears it is quite difficult to retrieve the data as it would involve removing the chip.
Not sure what you are looking for, but pictures and things like that will be internally stored not on the SIM, so clear the SIM and have at the pictures and videos. But, if it is phone usage such as text messaging or contacts you are after, then try the provider they store lots of information you might find useful.
Anyway, the number is probably only 4 characters long normally, just numeric, so you have a shot to brute-force it by hand. Otherwise you need to get the suspect to talk!
Hopefully this helps.
Try NSPro. It alows you to read the lock on any Samsung phone. When the locks are read and the phone is switched on use the "Network Lock" code when you are asked to input the handset code. this should work for the Samsung SGH-E900.
Many thanks to those who replied.
I will try the NSpro.
As far as the full reset option, yes all the user data is deleted, however I'm not sure at this time if any of this deletd data is recoverable or if it is recoverable what the evidential value of it would be.
People
An update
Re-tried the SHU box and the Samsung Tools software, this time worked a treat (not sure why it failed the first time round - possible cable issues), however the only snag is that you have to select the Unlock option which not only resets the User Lock to the factory default of 00000000, but also removes Network Locks. Not an ideal scenario but as long as all anomolies are noted I don't believe it would be a major issue.
Vinny
Quick question for you - what Samsung tools software did you use? and when you used the UNLOCK option did you loose any data and did the IMEI not get deleted?
MobilePhoneForensics
Answer to your question, I used the UFS Samsung Tools v2.0.8.0 HWK by Sara Soft and the SHU box.
Please be aware that an identical test model with known data was used to ensure 1) the tool worked and 2) no user data was compromised.
To my knowledge no user data was compromised and the IMEI was not altered.
The only change that I am aware of is that the UNLOCK option resets the user security code as well as unlcoking the network locks.
In any event the OIC was made aware of the consequences and authorisation to proceed with this method was granted.