HDD GURU FORUMS
http://forum.hddguru.com/

Recovery from Blackberry Image/Dump
http://forum.hddguru.com/viewtopic.php?f=10&t=36164
Page 1 of 1

Author:  Giroot [ December 8th, 2017, 14:43 ]
Post subject:  Recovery from Blackberry Image/Dump

Anyone have any experience with recovering data off a Blackberry image dump?

Dump came from a Blackberry Z10 specifically.

Author:  lcoughey [ December 9th, 2017, 8:27 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

I'm pretty sure it is encrypted. If not, just scan for raw data

Author:  hddguy [ December 11th, 2017, 6:42 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

Pretty sure the Cellebrite can handle this if you have access to it or know someone who could parse the dump for you.

Author:  Bolo [ December 12th, 2017, 16:59 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

Not all Z10 are encrypted - if you will need we can perform Physical Analysis using latest UFED PA..just contact me

Author:  Giroot [ December 15th, 2017, 16:27 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

Bolo wrote:
Not all Z10 are encrypted - if you will need we can perform Physical Analysis using latest UFED PA..just contact me


I'm able to see pictures with a raw scan. So it looks like it's not entirely encrypted.

I'm looking for messages in particular. Is Cellebrite also capable of finding those?

Author:  einstein9 [ December 16th, 2017, 3:43 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

Giroot wrote:
Bolo wrote:
Not all Z10 are encrypted - if you will need we can perform Physical Analysis using latest UFED PA..just contact me


I'm able to see pictures with a raw scan. So it looks like it's not entirely encrypted.

I'm looking for messages in particular. Is Cellebrite also capable of finding those?


You may ask Sasha also here: http://rusolut.com/
they tried hundreds or maybe more and they are well known on the field.

Author:  Bolo [ December 16th, 2017, 15:27 ]
Post subject:  Re: Recovery from Blackberry Image/Dump

@Giroot: from physical dump not - but writing a small parser in Python as a addon for PA can give results

Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/