Can a SDCard be lin...
 
Notifications
Clear all

Can a SDCard be linked to a phone?

RedEyes
(@redeyes)
New Member

I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE

Quote
Topic starter Posted : 19/03/2014 8:55 pm
jhup
 jhup
(@jhup)
Community Legend

Possibly, but it will take some work.

Can you take at least one, identical picture with all of the cell phones?

Can you retake at least one of the pictures you collected, with all of the cell phones?

ReplyQuote
Posted : 20/03/2014 4:36 am
Zergling
(@zergling)
Junior Member

I have a few SD cards recovered from a scene, and a few likely handsets they may have been in. Picture metadata tells me what phones the pictures were taken with but I need to link card to particular handsets.

So, is there data within the Android file system that may store volume serials etc? Likewise, is IMEI, IMSI or ICCID stored on memory cards?

Thanks

MRE

It may differ (depending on the android phone) but some devices store a list of files from external(and internal) memory cards in

\data\data\com.android.providers.media\databases\external.db

So you could check the filestructure in this database and see if it matches with the one found on the memory card.

Some phones also add the volume id to the database name, which can be compared (on windows) with the commandline "vol" followed by the drive letter.

eg vol e

But beware that the volume ID is not hardware-linked. It will for example change with a new partition and so on.

furthermore you could link the card to the phone based on appdata that is stored on the card.
WhatsApp for example stores backup files on the SD which contain encrypted msgstore.db's that can be compared to the msgstore.db file on the internal memory ( /data/data/##WhatsApp##\databases… ) The method to decrypt the file is wide spread among the web. Just google something like "WhatsAppXtract".
In this case you want to compare the most recent backup file so the content should be (in case it is from that phone) almost identical.

ReplyQuote
Posted : 20/03/2014 11:56 am
RedEyes
(@redeyes)
New Member

Thank you for the replies, certainly gives me a steer of where to go. It will not be possible to take photos with the handsets at this stage, but maybe possible later - all avenues exhausted etc. I am aware of work being done to link lens aberration to digital images.

Hopefully I can get a test model of each phone and swap memory cards around and establish differences.

MRE

ReplyQuote
Topic starter Posted : 20/03/2014 1:42 pm
trewmte
(@trewmte)
Community Legend

When you examined the handset did you have to input a handset password?

ReplyQuote
Posted : 20/03/2014 2:45 pm
RedEyes
(@redeyes)
New Member

We have a number of likely candidates as regards handsets. Two were reset to factory defaults. Two others are resisting all attempts at a physical download… I haven't tried a logical yet.

ReplyQuote
Topic starter Posted : 21/03/2014 11:28 am
bravo1800
(@bravo1800)
New Member

Just a quick note you may also search the file directory structure on the memory cards as this may steer you to which memory card was inserted in which device. For instance if it was a Blackberry there will be files which may give you the BB Pin number and also store backups of the apps installed on the device.
If you need verification if a picture was taken on that handset I am aware there are a few agencies that can assist you in this type of verification.

Regards

Chris

ReplyQuote
Posted : 27/03/2014 7:19 pm
Rich2005
(@rich2005)
Senior Member

This may not be helpful but just in case - off the top of my head I seem to remember in the past seeing firmware versions of devices also stored in images (probably the EXIF).
So whilst this wouldn't help you tie the card to a phone exactly/definitely, it might be enough to narrow down to which of the devices the card likely belonged, if a likelihood is enough for your purposes in this instance.

ReplyQuote
Posted : 27/03/2014 7:37 pm
Coligulus
(@coligulus)
Active Member

This may not be helpful but just in case - off the top of my head I seem to remember in the past seeing firmware versions of devices also stored in images (probably the EXIF).
So whilst this wouldn't help you tie the card to a phone exactly/definitely, it might be enough to narrow down to which of the devices the card likely belonged, if a likelihood is enough for your purposes in this instance.

Do you not think this would merely show that the card was in that phone once?….

ReplyQuote
Posted : 27/03/2014 9:07 pm
RedEyes
(@redeyes)
New Member

Thanks for the replies people. I shall update the post with any progress and successes.

ReplyQuote
Topic starter Posted : 28/03/2014 1:41 am
Rich2005
(@rich2005)
Senior Member

Coligulus - yeah - as I say - it's most certainly not definitive proof of anything in any way. But could give him an indication (that's even if he can find such a model + firmware embedded).
Obviously, for example, the person might have used all 3 memory cards in all 3 different devices at some point, swapping them around.

ReplyQuote
Posted : 28/03/2014 3:01 pm
Share: