±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36445
New Yesterday: 3 Visitors: 301

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Windows Mobile software

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

minime2k9
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 25, 15 21:15

That sounds great, I've emailed you for a trial version that you've mentioned was available in another post.  
 
  

PaulSanderson
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 25, 15 21:48

Hi minime - sent you a pm a couple of hours ago. Outbox says you have seen it so as you have been on-line since then I thought I would let you know.
_________________
Paul Sanderson
SQLite Forensics Book
www.amazon.com/SQLite-...entries*=0

Forensic Toolkit for SQLite
sandersonforensics.com...for-SQLite 
 
  

minime2k9
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 25, 15 21:51

Sorry Paul, I always seem to miss PM's!
As far as viewers for the SDF database's go, I managed to locate one here:
sourceforge.net/projec...mpactview/
You will need to install some things from Microsoft to make it work (Basically and SDF SDK).  
 
  

minime2k9
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 26, 15 18:02

So as an update:
Got my trial of Oxygen and ran it against JTAG Image.
Decoded contacts, SMS messages, Internet explorer history and emails. So managed to do more than UFED/XRY had.
On the flip side of that, it didn't decode the chat messages from KIK or NIMBUZZ app (no surprise on last one, first I've heard of it!), but it did do Whatsapp (again the only one to decode it).
That said it did a much better job of identifying installed applications and showing me all files relating to that app.
Either way, looks like a lot of manual decoding for me!  
 
  

PaulSanderson
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 26, 15 19:06

Hi Minime

Nimbuzz on windows is an SQLite DB so you may find it is the same on windows phone. It has a number of tables with some good info and you would probably be better off looking at it outside of a generic app that just sumarises what it thinks is important.

Kik is also SQLite on windows and again has lots of useful info that most tools just summarise for you. But I have heard somewhere that Kik on Windows uses sdf Smile

A fully functional trial is available for my Forenisc Toolkit for SQLite if it helps

sandersonforensics.com...for-SQLite

Paul
_________________
Paul Sanderson
SQLite Forensics Book
www.amazon.com/SQLite-...entries*=0

Forensic Toolkit for SQLite
sandersonforensics.com...for-SQLite 
 
  

minime2k9
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 26, 15 19:32

Paul,

Yeah I've got the Nimbuzz app as SDF database, the KIK app on Windows Phones stores the files as a flat .bf2 file. As far as I can tell its a simple binary file and there is one for each conversation.
Some apps which were Sqlite on other platforms aren't on Windows an vice versa!  
 
  

DCS1094
Senior Member
 

Re: Windows Mobile software

Post Posted: Nov 27, 15 01:40

- minime2k9
KIK app on Windows Phones stores the files as a flat .bf2 file. As far as I can tell its a simple binary file and there is one for each conversation.


We have also ran into the '.bf2' files for Kik. I can confirm one for each chat, one for contacts and one for the conversations list overview. We resulted in carving the strings of relevant chats for this one and locating the chat attachments via ID references. I'd be interested in seeing what method(s) you use to decode the chats as Kik seems to be the app of choice on WP for southerners! Smile P.S. Cheers for the feedback on Oxygen's ability when it come's to WP.  
 

Page 2 of 3
Page Previous  1, 2, 3  Next