Join Us!

Nokia Lumia 930 - C...
 
Notifications
Clear all

Nokia Lumia 930 - Chip Off forensics  

  RSS
harshbehl
(@harshbehl)
Member

Hi
I have the subjected device which has fallen from the stairs and only possible way of data extraction is chip-off forensics. Has anyone ever tried it on this phone ? i hope it doesnt have encrypted memory ? Response will be highly appreciated.

Quote
Posted : 30/07/2015 2:13 pm
Igor_Michailov
(@igor_michailov)
Senior Member

Do you want recover data yourself?
It is enough hard.

ReplyQuote
Posted : 30/07/2015 4:33 pm
TomP
 TomP
(@tomp)
Junior Member

I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.

ReplyQuote
Posted : 04/08/2015 6:22 pm
harshbehl
(@harshbehl)
Member

I'm fairly confident it isn't encrypted once you get a read. There will be a lot of partitions present when you view the extracted file. It should be fairly obvious which one you want. Most of the user data is stored in store.vol.

Thanks mate. I really appreciate your encouraging words. Will let you know once i follow the procedure. However my only concern was to know if the read will be encrypted or not. Thanks for the prompt.

ReplyQuote
Posted : 05/08/2015 12:11 am
TomP
 TomP
(@tomp)
Junior Member

It should load straight into FTK. Just be mindful of hidden file settings and permissions when exporting folders.

ReplyQuote
Posted : 05/08/2015 12:21 am
harshbehl
(@harshbehl)
Member

Tom,
i would definitely pick from your advice. I have UFED PA also. So i think that might also help me in reading the image. What do you say ?

ReplyQuote
Posted : 05/08/2015 2:35 am
TomP
 TomP
(@tomp)
Junior Member

I don't have the cellebrite support file to hand so can't check, the latest version may have support now when at a certain level of charge for an extraction. If you export store.vol and its associated folders you will need to repair it. Windows has this as a built in feature and you can google how to. I don't see a huge amount of windows phones if I'm honest although I have helped our r&d team with the the make up of the database. It's quite daunting to start with if there is a lot of data present. See if you can get a physical read first and we can go from there.

ReplyQuote
Posted : 05/08/2015 4:20 am
harshbehl
(@harshbehl)
Member

Allryt buddy. Thanks for all this. We are still looking for court orders to do the chip-off on this phone as they are required in this particular case. Will PM you once i get the physical image. Thanks again.

ReplyQuote
Posted : 05/08/2015 12:50 pm
Share: