Hello,
My client has a Samsung Galaxy Note 4 that has a 4 digit pin code screen lock in place.
I want to image the Note 4 and recover deleted text messages. However, the 4 digit pin code screen lock is in place.
Tools at my disposal
* UFED 4PC
* Andriller
* Lantern
* MobilEdit Forensic
Here is the scenario
The Note 4 belonged to a former employee.
Before engaging me, the client's internal IT person used Samsung's SmartSwitch software to transfer data from the Note 4 to a new phone; the new phone was handed to the former employee who now has the new phone. We have the Note 4 in our possession.
After the SIM card was transferred from the Note 4 to the new phone, a 4 digit pin code screen lock appeared on the Note 4.
The former employee provided the supposedly correct 4 digit pin code to unlock the Note 4, but the pin code does not work.
My client's internal IT person attempted 7 times to type in the 4 digit pin code without success.
Now the Note 4 states "3 more tries until factory reset". At this point, the customer decided to call me…..
QUESTIONS
1. Is it possible that using SmartSwitch changed the Note 4's pin code to a factory standard code?
2. Did the removal of the SIM card from the Note 4 turn on the 4 digit pin code or somehow lock the phone?
3. What approach/tool is recommended to bypass the 4 digit pin code?
NOTES
I will be provided with the former employee's laptop to image and analyze. Would connecting the Note 4 to the laptop possibly allow for the bypass of the pin code screen lock? I doubt it but I am wondering if the laptop and Note 4 are "trusted" devices to each other and if that could help the client's situation.
The former employee claims he is providing the correct 4 digit pin code, but the provided code is not working. I can hypothesize that the former employee is not providing the correct 4 digit pin code.
Many thanks for any advice or guidance.
If time isn't an issue, wait for physical support (download mode image). Samsung devices usually support download mode physical acquisitions, eventually.
If the phone allows a custom recovery to be flashed without rooting, you could flash a custom recovery via Odin, boot to recovery, and create a nandroid backup. The nandroid backups can be parsed in Cellebrite Physical Analyzer.