Join Us!

Cellebrite UFED ext...
 
Notifications
Clear all

Cellebrite UFED extraction  

  RSS
RieRie
(@rierie)
New Member

Hello,

Can anyone please help. I am working on a Samsung Galaxy Note 9 which has been remotely wiped or reset. Am using the cellebrite UFED touch 2 but it is unable to recover any data. it only gives me the Samsung default ringtone. No SMS, Pictures, audio, whatsapp.

Thank you.

Quote
Posted : 26/03/2019 12:02 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Recovering wiped devices is not something you will be able to do with that product.

There is a slight chance for a recovery, in-lab, at NAND protocol level, and on success it would cost you a fortune.

ReplyQuote
Posted : 26/03/2019 1:14 pm
the_Grinch
(@the_grinch)
Active Member

Have to agree with passcodeunlock, Android stepped up their game big time with their wiping so slim chance of getting anything off of that device now.

ReplyQuote
Posted : 26/03/2019 1:29 pm
arcaine2
(@arcaine2)
Active Member

I feel like this is a problem since 4.4 at least. In current version, encryption is the biggest problem and even if you managed to recoved some data prior the wipe, at NAND protocol level, it would still be encrypted, with a previous key that's unknown.

ReplyQuote
Posted : 26/03/2019 9:10 pm
passcodeunlock
(@passcodeunlock)
Senior Member

@arcaine2 What you wrote is all right. The userdata partition is almost intact after a factory reset, just the keys are destroyed. After a successful NAND recovery, the userdata partition can be decrypted in certain situations. Usually there are small chances to do it, because it depends on many factors.

ReplyQuote
Posted : 27/03/2019 6:55 am
Firdy
(@firdy)
New Member

Hi,

I'm kind of new to forensics. And currently doing a bachelors degree in cyber forensic.

Have you tried requesting from the user that previously used the mobile for any email address? Maybe you can get contacts or pictures from thereā€¦ Or maybe i need to understand remotely wiped.

Just my humble opinion.

ReplyQuote
Posted : 07/05/2019 8:38 am
Share: