All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: VNR Android Data Extractor
PostPosted: September 19th, 2018, 13:58 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
I have used the Android Data Extractor in VNR on dumps many times on an EXT file system and it works well. I now have a couple of dumps that use the newer f2fs file system which is not seen by VNR. So I mounted the dump in Linux and extracted the main data folder that contains the SMS .db file. I have mounted these to VNR but the normal scan finds either no SMS or the RAW carver records very jumbled data.

Interestingly the main SMS database folder displays a green flag meaning the data is good, but on both these phones the actual .db file displays a red flag meaning its corrupt. I presume this is something to do with the f2fs file system?

Anyone found a way around this.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 9:10 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
What phone this chip is from?

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 11:37 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Sasha Sheremetov wrote:
What phone this chip is from?

Motorola Droid Ultra XT1080.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 12:06 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 20th, 2018, 12:30 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Sasha Sheremetov wrote:
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

Here you go.


Attachments:
SMS Database.PNG
SMS Database.PNG [ 22.45 KiB | Viewed 22145 times ]

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 21st, 2018, 6:50 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later here.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 21st, 2018, 11:30 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Sasha Sheremetov wrote:
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later hereW.

Will do. Thanks.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 27th, 2018, 4:35 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: VNR Android Data Extractor
PostPosted: September 27th, 2018, 12:02 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Sasha Sheremetov wrote:
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

Thanks for the great service Sasha.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group