±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35770
New Yesterday: 2 Visitors: 97

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

App Data from Samsung Galaxy S9+

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

lmo1331
Newbie
 

App Data from Samsung Galaxy S9+

Post Posted: Jan 10, 19 15:03

Hey Everyone,

I am new to the forensics field (and this blog) but am running into some issues I hope you can help with.

Currently, I am working on a Samsung Galaxy S9+ (no passcode/unlocked and Sprint) running 8.0 Oreo. I am using Magnet acquire but am only getting information like call logs, texts, pics. I was hoping to get app data, as I can see there are Facebook messenger messages as well as some other stuff. Very frustrating to view it on the phone, but not be able to get it off.

Now, in doing research on the S9+'s, sounds like they are difficult (if not impossible) to root, or do a flash recovery? I tried getting a backup with Samsung Smart Switch and found out that they encrypt the backup, so that's been a dead end.

Is this just an issue with Galaxy S9+'s in that they are still pretty new? What are my options, if any at all? I am still pretty new to the mobile device arena and am hoping that someone can give me some advice/guidance on if this is even possible to get this app data off and/or what steps I should go about to do that.

Thank You!  
 
  

UnallocatedClusters
Senior Member
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 10, 19 16:44

If you have the funds, try a $99.00 single phone license of Mobiledit Forensic Express. No guarantees you wil extract more data but at a minimum you can validate the Magnet Acquire results.

Also, consider other routes to collect evidence such as using Facebook’s built in profile archiving solution which will include Messenger messages.

Other apps might also have a Windows desktop version that will allow one to download and then collect the desired data assuming you have the usernames and passwords required.  
 
  

lmo1331
Newbie
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 10, 19 17:43

Awesome, thank you for the advice. The phone is logged into Facebook, but I don't have the password....do you by chance know if Facebook's built in profile archiving solution would work through a mobile phone? Or just on a desktop? What I mean is if I have it already logged in, could I do that or do you think I would still need the password?  
 
  

Thomass30
Senior Member
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 10, 19 22:43

As far as I know there is no forensic software that support data extraction from Smart Switch backups.
But you can try to upload created backup into another rooted Samsung Phone and then data can be extracted by any forensic program.  
 
  

giandega
Senior Member
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 11, 19 08:48

MOBILE EDIT support smart switch  
 
  

passcodeunlock
Senior Member
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 11, 19 10:10

MEF supports smart switch backups but it doesn't extract FB or messenger data. From a backup you get the same results as from the device directly (no data).
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

OxygenForensics
Senior Member
 

Re: App Data from Samsung Galaxy S9+

Post Posted: Jan 11, 19 15:03

lmo1331m, we can advise you how to extract all WhatsApp data when you have access to the mobile device but cannot acquire it in any forensic tool. Our Oxygen Forensic Detective software exclusively allows you to scan a WhatsApp QR code from the mobile device in our Cloud Extractor and acquire all WhatsApp messages, calls, contacts, etc. Hope it may help you.  
 

Page 1 of 2
Page 1, 2  Next