HELP!!!!!!!!
I posses a Samsung S6 Edge Plus SM-G928V from Verizon running Android 7.0. Attempting to recover deleted txts and pictures. I have used low end recovery software with almost no success(only recovered two images). Paraben was unable to recover anything. An independent firm using Cellbrite and another using Oxygen are not confident an extraction is possible. Why? Is this a model issue? Android 7.0 issue? Verizon? Samsung? Combination? BlackBag, MobilEdit, Oxygen were all successfull with this specific model in 2018 when it was still running Android 5.1.1
Any advice or tips are greatly appreciated.
Your main issue is Android 7 = encryption, Android 5 = not likely encrypted
Also, Verizon likely means locked bootloader so most of the obvious bootloader attacks are not available.
Next, any exploit that could have avoided the locked bootloader likely got patched when the phone was upgraded to Android 7.
I had assumed that model was a snapdragon but quick look up says it's Exynos which might mean the Exynos exploit might work on it depending on patches but I've never tried it on anything older than an S7 so I'm not sure if it would work or not (or even supported). I would see if Cellebrite's decrypted file system method works with that phone but I'm not sure worth a shot though.
Otherwise, you might be stuck with a backup if you know the passcode.
Jamie
mcman pretty much nailed it.
Best change is doing to research into the owner and getting the pin code or lock pattern. People are creatures of habit and often use the same pin for years.
See if they have ever consented to a download in the past or given any codes up for other devices.
I have had decent luck using the old 1234 pin from time to time.
Only other option might be a chip off if you have a lab nearby that does those see if its a supported model.
I posses the pass code. Last Patch was August 2017.
Paraben, Mobile Edit, and Magnet have been fails. I have sent the phone off to a group with far more capability. They will use Oxygen and Cellbrite. I will keep you guys informed.
@mcman I have the pin code. Now I sent the phone to Black Swan Forensics who used both Magnet with zero success because they did not root the phone and Cellbrite which recovered very little. Open to suggestions or help.
