Hello!
How to save a call list of symbian phones?
Oxygen Forensic after User Agent startup resets the call list!
MobilEdit can't save a call list.
Hello!
How to save a call list of symbian phones?
Oxygen Forensic after User Agent startup resets the call list!
It's not true. OxyAgent does not change any information in a smartphone.
- Event log (which also contains calls list) is purged automatically by Symbian OS system process if a new SIM card was inserted into the device.
- Event log entries older than the "Store event log for ___ days" parameter in options (i.e. obsolete) are also purged automatically by Symbian OS system process.
[/listo]
Hi Andis,
Symbian purges old call and event record entries 30 - 1 days old automatically (as stated by Oxygen_Software).
One method you can use to obtain the maximum amount of data (although this may not be feasible at the stage of the examination you are at) is to take the battery out and leave it out for 7-21 days (depending on how modern the handset is). This should reset the time and date held by the handset.
When you power the handset back on you can enter a date and time which dates back to an earlier time, thus retaining the call records. However, if you have already powered the handset on, then this method probably will not be beneficial to you.
One method you can use to obtain the maximum amount of data (although this may not be feasible at the stage of the examination you are at) is to take the battery out and leave it out for 7-21 days (depending on how modern the handset is). This should reset the time and date held by the handset.
Thank you for the idea, Logan.
I never thought about this way.
Logan speaks the truth (and when he doesn't I throw things at him ) ) and this is something we practice with almost every Symbian device.
You should however note that this is not necessarily a solution to every examination scenario as the preservation of the handset's clock may be just as/more important in certain circumstances..
It is however a nifty trick to have in your arsenal..
Are you saying that Symbians are, by default, automatically set to purge after 30-days or are you saying that is a profile selection made by the user of the specific handset?
Valid point Greg, I don't think Logan's previous statement was 100% clear regarding the duration of data storage within the Event Log.
It is our findings that the particular setting which controls how long data is retained in the Event Log can be as little as 1 day or as many as 30 days.
Personally I have only seen devices where the options are 1 day, 10 days or 30 days. I think that the standard 'factory setting' is 30 days however this is commonly found to have been changed or set differently.
As such, it would always be highly pertinent for this to be one of the first things which is checked and possibly changed for the duration of the examination (if appropriate) to ensure that data was not 'falling off' the end of the Event Log while you were still examining the device etc.
This setting only affects data which resides in the Event Log and nothing else (according to our findings). To summarize, all calls could be lost, reference to any messages which have since been removed/deleted from the messaging folders (including message text fragments not shown by the handset but still recoverable by some tools) could be lost and also any records of data connections which the device may have stored. This list is not exhaustive but merely demonstrates the types of data which may be present in the Event Log and potentially lost if the device is handled inappropriately for the examination requirements.
The notes above refer primarily to Nokia handset's running Symbian and some of the more recent handsets from other manufacturers. There are older handsets running Symbian which do not behave in this way and this should also be noted, some do not even have an Event Log…
Hopefully this completes the initial explanation for you Andis. )
I think that the standard 'factory setting' is 30 days however this is commonly found to have been changed or set differently.
My experience shows that the factory setting for new Symbian OS phones (released in year 2010-2011) is 30 days. But all my previous phones - N96, N95, 6680, 6600 and 7650 had the 7 days factory setting.