I have seen previous posts about this phone and wanted to see if anyone had any suggestions for my case. I have an unlocked Galaxy J3 which is encrypted and running Android 6.0.1 with security patch August 1, 2017. I obtained a file system extraction and logical extraction through the UFED Touch 2. The extractions didn't get me any internet data, or images.
If I press the phone's recent apps button, I can see he had the web browser open and what pages he was viewing last.
Any suggestions on how to extract this data? I tried Axiom and was unsuccessful at getting an extraction. I have not tried XRY at the time of this post, but will be trying that later today. I would prefer to not have to do screen shots of all the internet history, not to mention that doesn't give me the images in cache, because he didn't save any of the images.
Thanks,
Steve
Hey Steve, what happens if you throw the file system extraction from Cellebrite into AXIOM? If the extraction is good, no need to reacquire, just load it in as an image. Curious if you still don't get any Internet history or images. If Cellebrite just provided an encrypted extraction, you won't get anything no matter what tool you use. File system extraction should avoid an encrypted image though.
Also might want to look at what browser was being used. Some Samsungs will use Chrome as the default browser or Samsung's own browser, tends to depend on the carrier.
Jamie McQuaid
Magnet Forensics
For the File System Extraction did you also do the Android Backup APK Downgrade, which is located under the device model file system option?
You can also try the android generic profile which can be found at
Browse manually
Type smart phone
select smart phone profile
select android
then extract via logical and file system (android backup and android backup APK downgrade).
Just be forewarned that if you use the APK download method you might lose the cloud login token associated with the app that is downgraded.
There is another type of physical extraction capable using Cellebrite Android Qualcomm but I don't believe the chipset in a SM-J327P is compatible.