Anyone interested in data recovery from damaged mobiles?
18 September 2006, 10:54 PM
#1
Scooby Regular
Thread Starter
Anyone interested in data recovery from damaged mobiles?
Just interested. I've developed a method for doing this on Nokia handsets, maybe other makes to follow.
19 September 2006, 11:24 AM
#4
Scooby Regular
Thread Starter
What type of phone, David?
this technique can recover data from old phones with no SIM/battery - even those that won't turn on!
this technique can recover data from old phones with no SIM/battery - even those that won't turn on!
19 September 2006, 01:33 PM
#5
Scooby Regular
iTrader: (13)
Join Date: Jan 2001
Location: Midlands - between notts and derby !
Posts: 4,997
Likes: 0
Received 0 Likes
on
0 Posts
it was a challenge set to recover a deleted txt message from a sim on a nokia 6230i - managed to do it, but then again it was not well "removed".
came across a couple of interesting bits of software
http://tulp2g.sourceforge.net/ - could not get it working but looked interesting
but borrowed a sim reader and this http://vidstrom.net/stools/undeletesms/ txt recovered no problem.
My main interest is now how many company phones are we giving away with potential dangerous information on (including blackberries)
Dave.
came across a couple of interesting bits of software
http://tulp2g.sourceforge.net/ - could not get it working but looked interesting
but borrowed a sim reader and this http://vidstrom.net/stools/undeletesms/ txt recovered no problem.
My main interest is now how many company phones are we giving away with potential dangerous information on (including blackberries)
Dave.
19 September 2006, 02:31 PM
#6
Scooby Regular
Thread Starter
TULP is software developed by the Dutch Forensic Institute - I have contact with the author.
My method analyses handset data (not SIM). It's commonly known that the SIM card has a finite number of locations where it can store SMS and (like windows filesystems) when they are deleted they are *not always* erased fully - just the "active" flag removed. These slots do become available for new messages to drop into, however, so as long as no new messages have arrived then you have a very high probability of retrieving the data assuming the handset writes the SMS data to the SIM and not its own internal memory.
Phonebase2, SIMCon, MOBILedit!, XRY, USIM Detective are all similar SIM/USIM software apps that can do this job.
As for handset data, and "dead" handsets at that, there's next to nothing that can retrieve (and decrypt) this data. Not yet, anyway
My method analyses handset data (not SIM). It's commonly known that the SIM card has a finite number of locations where it can store SMS and (like windows filesystems) when they are deleted they are *not always* erased fully - just the "active" flag removed. These slots do become available for new messages to drop into, however, so as long as no new messages have arrived then you have a very high probability of retrieving the data assuming the handset writes the SMS data to the SIM and not its own internal memory.
Phonebase2, SIMCon, MOBILedit!, XRY, USIM Detective are all similar SIM/USIM software apps that can do this job.
As for handset data, and "dead" handsets at that, there's next to nothing that can retrieve (and decrypt) this data. Not yet, anyway
19 September 2006, 03:27 PM
#7
Guest
Posts: n/a
Originally Posted by BuRR
As for handset data, and "dead" handsets at that, there's next to nothing that can retrieve (and decrypt) this data. Not yet, anyway
Asking 'cos I was wondering if the buyer could retrieve anything?
Cheers
Dave
Trending Topics
19 September 2006, 04:58 PM
#8
Scooby Regular
Thread Starter
The only way to get rid of a handset's data is to burn it. (or shred it) - the factory reset is fine for the most of the time, but there is still data held in the NAND memory.
For the majority of people, however, a factory reset will prevent them gaining access to the data - however there are procedures that can access data that was previously considered to be deleted.
As an example, I recently recovered 2000 SMS messages from the NAND memory of a Samsung SGH-D500, and also 50+ deleted images from a Sony Ericsson T610
For the majority of people, however, a factory reset will prevent them gaining access to the data - however there are procedures that can access data that was previously considered to be deleted.
As an example, I recently recovered 2000 SMS messages from the NAND memory of a Samsung SGH-D500, and also 50+ deleted images from a Sony Ericsson T610
14 June 2007, 11:29 PM
#12
Scooby Regular
Thread Starter
woah.
You need a UFS box, or SETool, and carve the data looking for the PDU that contains the SMS.... (OR find someone who has one)
You need to appreciate that the SMS alphabet is effectively a 128 character (7-bit) alphabet, arranged rather weirdly in 8-bit chunks - thus allowing 160 characters to be sent in 140 bytes.
sorry.... didn't realise you'd all dropped off to sleep mid-post
You need a UFS box, or SETool, and carve the data looking for the PDU that contains the SMS.... (OR find someone who has one)
You need to appreciate that the SMS alphabet is effectively a 128 character (7-bit) alphabet, arranged rather weirdly in 8-bit chunks - thus allowing 160 characters to be sent in 140 bytes.
sorry.... didn't realise you'd all dropped off to sleep mid-post
14 June 2007, 11:33 PM
#13
Scooby Regular
Thread Starter
..just a quick one from above. In sony Ericsson phones, the SMS may not be in the NAND, rather in the GDFS area of memory which is set aside for user data (call logs, address book, sms etc) - its suck it and see on a per-handset basis I'm afraid.
One way of searching through the file you may have, is with a good hex editor (winhex for example) and search for your phone number (sender/recipient) in a reverse-nibbled format - search the hex byte values rather than the ascii content.
an example - +447976134768 will be stored 91 44 97 67 31 74 86
One way of searching through the file you may have, is with a good hex editor (winhex for example) and search for your phone number (sender/recipient) in a reverse-nibbled format - search the hex byte values rather than the ascii content.
an example - +447976134768 will be stored 91 44 97 67 31 74 86
10 May 2009, 11:24 AM
#15
Scooby Newbie
Join Date: May 2009
Posts: 4
Likes: 0
Received 0 Likes
on
0 Posts
10 May 2009, 12:30 PM
#19
Scooby Newbie
Join Date: May 2009
Posts: 4
Likes: 0
Received 0 Likes
on
0 Posts
it was a challenge set to recover a deleted txt message from a sim on a nokia 6230i - managed to do it, but then again it was not well "removed".
came across a couple of interesting bits of software
TULP2G project website - could not get it working but looked interesting
but borrowed a sim reader and this vidstrom.net - security tools txt recovered no problem.
My main interest is now how many company phones are we giving away with potential dangerous information on (including blackberries)
Dave.
came across a couple of interesting bits of software
TULP2G project website - could not get it working but looked interesting
but borrowed a sim reader and this vidstrom.net - security tools txt recovered no problem.
My main interest is now how many company phones are we giving away with potential dangerous information on (including blackberries)
Dave.
Thread
Thread Starter
Forum
Replies
Last Post
Sam Witwicky
Engine Management and ECU Remapping
17
13 November 2015 10:49 AM
shorty87
Wheels And Tyres For Sale
0
29 September 2015 02:18 PM
