HDD GURU FORUMS
http://forum.hddguru.com/

VNR Android Data Extractor
http://forum.hddguru.com/viewtopic.php?f=27&t=37412		 Page 1 of 1
Author:  ddrecovery [ September 19th, 2018, 13:58 ]
Post subject:  VNR Android Data Extractor
I have used the Android Data Extractor in VNR on dumps many times on an EXT file system and it works well. I now have a couple of dumps that use the newer f2fs file system which is not seen by VNR. So I mounted the dump in Linux and extracted the main data folder that contains the SMS .db file. I have mounted these to VNR but the normal scan finds either no SMS or the RAW carver records very jumbled data.

Interestingly the main SMS database folder displays a green flag meaning the data is good, but on both these phones the actual .db file displays a red flag meaning its corrupt. I presume this is something to do with the f2fs file system?

Anyone found a way around this.
Author:  Sasha Sheremetov [ September 20th, 2018, 9:10 ]
Post subject:  Re: VNR Android Data Extractor
What phone this chip is from?
Author:  ddrecovery [ September 20th, 2018, 11:37 ]
Post subject:  Re: VNR Android Data Extractor
Sasha Sheremetov wrote:
What phone this chip is from?

Motorola Droid Ultra XT1080.
Author:  Sasha Sheremetov [ September 20th, 2018, 12:06 ]
Post subject:  Re: VNR Android Data Extractor
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)
Author:  ddrecovery [ September 20th, 2018, 12:30 ]
Post subject:  Re: VNR Android Data Extractor
Sasha Sheremetov wrote:
Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

Here you go.

Attachments:
SMS Database.PNG
SMS Database.PNG [ 22.45 KiB | Viewed 22293 times ]
Author:  Sasha Sheremetov [ September 21st, 2018, 6:50 ]
Post subject:  Re: VNR Android Data Extractor
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later here.
Author:  ddrecovery [ September 21st, 2018, 11:30 ]
Post subject:  Re: VNR Android Data Extractor
Sasha Sheremetov wrote:
Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later hereW.

Will do. Thanks.
Author:  Sasha Sheremetov [ September 27th, 2018, 4:35 ]
Post subject:  Re: VNR Android Data Extractor
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.
Author:  ddrecovery [ September 27th, 2018, 12:02 ]
Post subject:  Re: VNR Android Data Extractor
Sasha Sheremetov wrote:
I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

Thanks for the great service Sasha.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/