Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: BarronVonB
New Today: 0
New Yesterday: 1
Overall: 29281

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Final Year Project
 Android devices with PIN screen lock and without USBdebb. on
 Can file creation and modifications on pendrives be found?
 Viewing real MAC times of a timestomped file
 software that can view files in Volume Slack

Computer Forensics World Forums


Pages Served
We received
49799213
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - MOBILE phone raw image carver
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

MOBILE phone raw image carver

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools
View previous topic :: View next topic  
Author Message
bols5
Newbie
Newbie


Joined: Nov 18, 2013
Posts: 3

PostPosted: Mon Nov 18, 2013 9:05 pm    Post subject: MOBILE phone raw image carver Reply with quote

Hello,

I used itsutils to dump my Palm TreoPro partitions. (extracted to *.raw files)
Are there any freeware tools that would allow me to carve/preview folders files ?
I found one tool "GetData Phone Image Carver" which recovers many images, files from *.raw but can't save anything since this tool is shareware

I can't get any other tool to see contents of these raw files - for example with DFF or FTK I can only view contents in HEX editor

Any advice ?
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Mon Nov 18, 2013 9:32 pm    Post subject: Reply with quote

If the RAW was acquired correctly, FTK or EnCase should see the disk.

Try following the instructions here: h t t p : // computer-forensics . sans . org / blog / 2009 / 08 / 12 / acquiring-data-from-windows-mobile-devices /

Freeware tools are not very prevalent for mobile devices.
Back to top
View user's profile
bols5
Newbie
Newbie


Joined: Nov 18, 2013
Posts: 3

PostPosted: Sun Nov 24, 2013 7:18 am    Post subject: Reply with quote

ok, well I found free tool that recovered some images from raw file.

Pardon my noob question, but where do I look for deleted text msgs ?

114.88M FLASHDR

| 3.12M Part00
| 2.88M Part01
| 50.88M Part02
| 58.00M Part03
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Sun Nov 24, 2013 2:07 pm    Post subject: Reply with quote

bols5 wrote:
ok, well I found free tool that recovered some images from raw file.
I thought you were unable to see the underlying structure of files from the raw with DFF or FTK? What freeware tool was able to open a raw that DFF or FTK could not?

bols5 wrote:
Pardon my noob question, but where do I look for deleted text msgs ?

114.88M FLASHDR

| 3.12M Part00
| 2.88M Part01
| 50.88M Part02
| 58.00M Part03

SMS are stored in a database named mmssms.db
"Should" be in data/com.android.providers.telephony/databases
It will likely take some parsing. You can also carve unallocated space for SQLite files.
Back to top
View user's profile
bols5
Newbie
Newbie


Joined: Nov 18, 2013
Posts: 3

PostPosted: Sun Nov 24, 2013 5:51 pm    Post subject: Reply with quote

I used Blade 1.9 - not freeware - but fully operational 30 day Trial
A lot faster than GetData's software.
TreoPro is a WM6 phone, so sms are stored in cemail.vol
still trying to figure out how to read that file
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Mon Nov 25, 2013 12:13 am    Post subject: Reply with quote

bols5 wrote:
TreoPro is a WM6 phone, so sms are stored in cemail.vol
still trying to figure out how to read that file


There is a post for that on SANS
>>computer-forensics.sans.org/blog/2009/10/22/recovering-deleted-text-messages-from-windows-mobile-devices<<
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Forensic Software and Tools All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.