Cellebrite UFED extraction
Can anyone please help. I am working on a Samsung Galaxy Note 9 which has been remotely wiped or reset. Am using the cellebrite UFED touch 2 but it is unable to recover any data. it only gives me the Samsung default ringtone. No SMS, Pictures, audio, whatsapp.
Recovering wiped devices is not something you will be able to do with that product.
There is a slight chance for a recovery, in-lab, at NAND protocol level, and on success it would cost you a fortune.
Have to agree with passcodeunlock, Android stepped up their game big time with their wiping so slim chance of getting anything off of that device now.
I feel like this is a problem since 4.4 at least. In current version, encryption is the biggest problem and even if you managed to recoved some data prior the wipe, at NAND protocol level, it would still be encrypted, with a previous key that's unknown.
@arcaine2 What you wrote is all right. The userdata partition is almost intact after a factory reset, just the keys are destroyed. After a successful NAND recovery, the userdata partition can be decrypted in certain situations. Usually there are small chances to do it, because it depends on many factors.
I'm kind of new to forensics. And currently doing a bachelors degree in cyber forensic.
Have you tried requesting from the user that previously used the mobile for any email address? Maybe you can get contacts or pictures from there… Or maybe i need to understand remotely wiped.
Just my humble opinion.