±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 2 Overall: 36767
New Yesterday: 4 Visitors: 141

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

DCF File Types????

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


DCF File Types????

Post Posted: Jun 09, 09 14:45


I have a Sony Ericsson W850i which also has a 1gb memory card and I cannot extract some images.

They are listed on the handset as being stored on the memory card and viewable as JPG files on the handset but they could not be extracted via CelleBrite or XRY.

When I ran the memory card through Encase it has the file by the same name but it is listed as a .DCF file and cannot be viewed. I understand these are encrypted files for copyright management but is there a way to extract the files or is it just a case of using ZRT to log the data on screen?  

Senior Member

Re: DCF File Types????

Post Posted: Jun 09, 09 17:24

A .DCF Extension could be anything - take a look at http://filext.com/file-extension/dcf
The favourites are DRM Rights Configuration or the Camera File System.  

Senior Member

Re: DCF File Types????

Post Posted: Jun 09, 09 18:03

You can use This tool but in order to decrypt the data you need the key of the DRM protected content.
MelOn player supposedly can decrypt it (don't know how) but the software can only be found in it's native language: Korean (Download Here)
Facebook users: www.facebook.com/group...7471001353

Twitter List: twitter.com/liveforens...-forensics

Social Networking Search Engine: www.google.com/coop/cs...scmw8lv4je 


Re: DCF File Types????

Post Posted: Jun 09, 09 20:55

From the mobile you mention, I'd expect this to be an OMA DRM encrypted file; the data contained could be anything, in which case I would suggest:

1. check the headers
Use the OMA standard for DCF file format to examine the file headers (I'm assuming you're happy using a hex editor to examine the file):
(This link above is for the v1.0 specification, as the most likely, but the header can be checked for v2.0 and the appropriate spec downloaded for v2.0 if needed).
This should confirm the content type of the DCF (since they can contain anything), as well as providing other identification/detail information, without decrypting.

2. check for a rights object file
There may be a .dr or .drc file associated with the .dcf which defines the permissions associated with use of the file, and the encryption key used to encrypt the file.

I've not gone into detail far enough, but if the image is decryptable on the phone, I would expect the rights object to be present. If that is so, and the OMA version is v1.0, it may be possible to manually AES decrypt the data within the .dcf file to obtain the uncoded image file. Whether this is worth the effort needed, vs use of e.g. ZRT, will depend on your case.

Hope that helps,


Page 1 of 1