Imaging Samsung- A1...
 
Notifications
Clear all

Imaging Samsung- A105F - Incomplete Results

mmuchiri
(@mmuchiri)
New Member

I have imaged a Samsung A105F using Magnet Acquire. 1) It did not give me an option of getting a full image but had only the option of Quick image. 

2) After processing the image, i a missing phone text messages, Whatsapp messages which i can see while navigating the phone normally.  What could i have missed during imaging or preparing the phone for imaging? 

Quote
Topic starter Posted : 26/11/2020 12:09 pm
mmuchiri
(@mmuchiri)
New Member

From Magnet Axiom, how do you tell if some information on the phone was wiped out? Where do you check? 

ReplyQuote
Topic starter Posted : 26/11/2020 12:17 pm
UnallocatedClusters
(@unallocatedclusters)
Senior Member

A couple of suggestions:

Try Compelson's MOBILedit Forensic Express single phone license (US$99.00).

Once you have made a forensic image using MOBILedit, then attempt to root your phone:

[Guide/Magisk] Root for the Galaxy A10 Serie… | Samsung Galaxy A10 (xda-developers.com)

** I recommend purchasing a test phone of the exact same model and attempting to root your test phone first before attempting to root the original phone evidence.

Once you have achieved root access on your phone, you will be able to generate a physical forensic image as compared to the logical image Magnet Acquire created originally and potentially recover significantly more evidence.

 

ReplyQuote
Posted : 30/11/2020 10:00 pm
arcaine2
(@arcaine2)
Active Member
Posted by: @unallocatedclusters

Once you have made a forensic image using MOBILedit, then attempt to root your phone:

[Guide/Magisk] Root for the Galaxy A10 Serie… | Samsung Galaxy A10 (xda-developers.com)

 

This is no use here. Rooting the phone requires flashing TWRP and this itself requires unlocking the bootloader first. Unlocking bootloader wipes the phone.

 

New Samsung phones comes with factory locked bootloader, all of them, even international variants with Exynos chipsets.

ReplyQuote
Posted : 01/12/2020 7:40 pm
passcodeunlock
(@passcodeunlock)
Senior Member

If it is important, send in the phone to my lab. I extracted this before with temporary rooting and feeding it to any click forensics software.

ReplyQuote
Posted : 14/12/2020 9:07 pm
Share: