VNR Android Data Extractor

[ddrecovery]

I have used the Android Data Extractor in VNR on dumps many times on an EXT file system and it works well. I now have a couple of dumps that use the newer f2fs file system which is not seen by VNR. So I mounted the dump in Linux and extracted the main data folder that contains the SMS .db file. I have mounted these to VNR but the normal scan finds either no SMS or the RAW carver records very jumbled data.

Interestingly the main SMS database folder displays a green flag meaning the data is good, but on both these phones the actual .db file displays a red flag meaning its corrupt. I presume this is something to do with the f2fs file system?

Anyone found a way around this.

[Sasha Sheremetov]

What phone this chip is from?

[ddrecovery]

What phone this chip is from?

Motorola Droid Ultra XT1080.

[Sasha Sheremetov]

Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

[ddrecovery]

Could you share here screenshot of first sector of the sms.db file? (There's only metadata there)

Here you go.

Attachments

[Sasha Sheremetov]

Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later here.

[ddrecovery]

Looks like normal sqlite database to me. Is it possible to send a database file to our sqlite developer? If so, please drop it to veronika(at)rusolut.com, she's developer of our sqlite carver. She will guide you if she needs anything else. Will share results of research later hereW.

Will do. Thanks.

[Sasha Sheremetov]

I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

[ddrecovery]

I believe we figured the problem (and recovered data), the structure of the SQLite tables was slightly different than normal Android devices.
Using built-in universal SQLite carver we made a new carving template and carved out all deleted and actual SMS and other data.
Also will check deeper F2FS, I think it should be easy to add its partition table parser into VNR.

Thanks for the great service Sasha.