All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: VNR Android Data Extractor
PostPosted: September 19th, 2018, 13:58 
Offline

Joined: June 11th, 2013, 17:01
Posts: 1015
Location: USA
I have used the Android Data Extractor in VNR on dumps many times on an EXT file system and it works well. I now have a couple of dumps that use the newer f2fs file system which is not seen by VNR. So I mounted the dump in Linux and extracted the main data folder that contains the SMS .db file. I have mounted these to VNR but the normal scan finds either no SMS or the RAW carver records very jumbled data.

Interestingly the main SMS database folder displays a green flag meaning the data is good, but on both these phones the actual .db file displays a red flag meaning its corrupt. I presume this is something to do with the f2fs file system?

Anyone found a way around this.

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 9:10 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
What phone this chip is from?

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 11:37 
Offline

Joined: June 11th, 2013, 17:01
Posts: 1015
Location: USA
Sasha Sheremetov wrote:
What phone this chip is from?

Motorola Droid Ultra XT1080.

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 12:06 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 12:30 
Offline

Joined: June 11th, 2013, 17:01
Posts: 1015
Location: USA
Sasha Sheremetov wrote:
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

Here you go.


Attachments:
SMS Database.PNG
SMS Database.PNG [ 22.45 KiB | Viewed 694 times ]

_________________
Hard Drive and RAID Data Recovery
Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 21st, 2018, 6:50 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later here.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 21st, 2018, 11:30 
Offline

Joined: June 11th, 2013, 17:01
Posts: 1015
Location: USA
Sasha Sheremetov wrote:
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later hereW.

Will do. Thanks.

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 27th, 2018, 4:35 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 169
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 27th, 2018, 12:02 
Offline

Joined: June 11th, 2013, 17:01
Posts: 1015
Location: USA
Sasha Sheremetov wrote:
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

Thanks for the great service Sasha.

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group