±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34069
New Yesterday: 2 Visitors: 145

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

A500H Samsung Running 6.0.1 Marshmellow

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

A500H Samsung Running 6.0.1 Marshmellow

Post Posted: Tue Mar 14, 2017 5:31 am

Hello Folks,

I am trying to pull some WhatsApp messages from a A500H Samsung Running on 6.0.1 Marshmallow , Celebrate could not take a logical nor a physical, Oxygen however took a logical but without the WhatsApp database. As you know WhatsApp conversations can only be decrypted with the "key" file that is only visible on rooted devices.

So I have tried many ways to root the device however none of them have worked, I've tried to flash CF,TWRP using odin .. and failed.

Is there a turn-around on this situation?

Thanks,  

CopyRight
Senior Member
 
 
  

Re: A500H Samsung Running 6.0.1 Marshmellow

Post Posted: Tue Mar 14, 2017 6:10 am

First check do you have frp activ. Put phone in download mode and check FRP:ON if yes deactivate frp. then You can root or flash custom recovery  

stetocina
Member
 
 
  

Re: A500H Samsung Running 6.0.1 Marshmellow

Post Posted: Tue Mar 14, 2017 3:59 pm

You can make dump by eMMC ISP using for example VR-Table and then analyse it using correct chain for Android as Physical image from PA - advantage of this that you will get also Unallocated Space in RAW
_________________
Multi-COM - Bogusław Rzepka
multi-com.eu 

Bolo
Senior Member
 
 
  

Re: A500H Samsung Running 6.0.1 Marshmellow

Post Posted: Thu Apr 13, 2017 7:17 am

Unfortunately logical extraction will not give you any apps databases. Samsung A500H device is supported by physical method via custom forensic recovery. Have you tried it in Oxygen Forensic Detective? This method will create a full physical dump and parse all the available apps including WhatsApp.  

OxygenForensics
Senior Member
 
 

Page 1 of 1