±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 0 Visitors: 106

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Samsung E840

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

gurpreetthathy
Member
 

Samsung E840

Post Posted: Jul 03, 09 15:25

I need to get deleted data off a Samsung E840. Could I get a PM read using NS Pro. If yes what software can I use to decode the dump.....  
 
  

AlexC
Senior Member
 

Re: Samsung E840

Post Posted: Jul 03, 09 16:23

NS Pro will give it to you in an S-records format which is an ascii file with offsets and crcs either side of the "hex" in the middle. It's really unhelpful in this format.

If you have a UFS box you'll get a purer "hex dump" which is easier to work with. Alternatively the new version of XACT can dump that model if you have access to that.

In terms of what you can get off this handset in terms of deleted data - I'm not sure, I haven't worked on that model, but from experience with other Trident handsets there is data to be had - however I'm not aware of an off the shelf solution that will parse it - so it'll be time well speant with a hex editor. Something like reVenge or XACT that has phone specific functions will certainly help out.

Hope that's of some help to you!  
 
  

gurpreetthathy
Member
 

Re: Samsung E840

Post Posted: Jul 03, 09 17:53

Fantastic that is great help. I will let you know how I get on...  
 

Page 1 of 1