[Q] windows phone 8 forensics . - Windows Phone 8 Q&A, Help & Troubleshooting

How can i extract logical and physical data from windows phone8 ?
Is there any forensics tools available for windows phone 8 ?
Please suggest some.

I don't know of any publicly available ones. Some phones - I'm not sure which, or exactly how - can be booted into a mode where it's possible to read their internal storage over USB, but that might only be engineering handsets, not retail ones. To get raw access, you'd probably need to disassemble the phone and extract the storage chip. In theory, software running on the phone could get block-level access, but that requires far more privileges than any third-party app is allowed to have.

Related

What's Wrong With My Computer!?!?!

I have two PC's, one is a XP Media Center Edition. It had a virus on it and kept getting a corrupt file, so my techyish relative came and wiped the hard drive from scratch ( or so he says but it was a partial wipe) and reloaded the OS onto it. It worked fine, but then kept getting the corrupt file again. I then decided to order the recovery disks from HP, which is the computer manufactuer. They arrived and I put them in, followed the steps, and all wen well until I came to the recovery partition. It was backing everything up ( one time process only) into the recovery partition all fine and dandy until it came to a file that had to do with Microsoft Office. It stayed their for about 45 minutes backing up this file where the longest had been 10 minutes max for all the others. I looked the file up and it said it was a small 10 mb file, so I turned the computer off and went to normal without the recovery partition. Worked fine until one day something happened and I guess I needed to do the recovery again (it's been a few months since this has happened) and did all the steps, but it wouldn't take. It gets to about 4% and then dies with a BSOD and this message:
A problem has been detected and Windows has been shut down to prevent damage to your computer.
DATA_KERNAL_INPAGE_ERROR
If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:
Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need.
If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Technical information:
*** STOP: 0x0000007A (0xE121F318, 0xC0000185, 0xBF8B6147, 0x1C610860)
*** win32k.sys – Address BF8B6147 base at BF800000, Datestamp 3b7de698
Copied it down word for word, space for space. Can anyone help me get this thing up and running again? It's now getting important.
Forgot to mention that I get the same problem each time I put the recovery disk in.
I'd recommend using a NON-Recovery Disk, but rather a Clean, Non-OEM, Windows Disk. If the issue pertains to the Kernal, it's usually unfixable without a Hard Boot of the Drive. You should do more than Re-Format.. you should delete all the partitions off of your Hard Drive with a Windows Disk, then pop in the Recovery Disks and do the OEM install.
So I need to wipe the hard drive clean again and put in another non OEM OS?
Not quite. Wipe the HDD clean with the NON-OEM Windows Disk, as most Recovery Disks do not allow you to alter the Partitions [Everything is done for you], then pop in your Recovery Disk and let it install the new Primary, and possibly the Recovery, Drives.
I see what your saying now, so what exactly happened to it?
Get Windows 7
I have windows 7, that's my other computer.
The guy at the un paso store got you too!!
At the step store? Lol.
PurpleLlamaLover said:
I see what your saying now, so what exactly happened to it?
Click to expand...
Click to collapse
When your supposed "Tech Savvy" friend attempted to fix your computer.. he, I'm assuming, did a simple "Repair" of the partition with an XP Disc. That is LITERALLY the most unwanted version of a fix ever... All it does is replace the system files, but keeps all of the other software that may have been conflicting with the system itself, BUT usually, all of the software is inaccessible. It's still on your computer, f*cking it up, but you can't see it.
Thus I always say, "If you get a bluescreen... more than once, and don't know what the code means... don't repair your computer.. re-format that b*tch after recreating the partitions."
But, if your XP compy has the specs to support Windows 7, your best bet, all in all, would be to install Windows 7. Doing so will save you the hassle of having to manually download all of the drivers for it... unlike installing a non OEM Windows XP [have to download & install the drivers manually].
PurpleLlamaLover
it sounds like the HP recovery disk could well be corrupt,
So you now have 3 options:
1. Try Linux Ubunut 10.4 LTS (Free Distro)
2. Buy a ligit copy of Windows 7
3. Download Windows Vista / 7 / XP from a torrent
and try untill you find a OS you lyk
Agent Zach said:
When your supposed "Tech Savvy" friend attempted to fix your computer.. he, I'm assuming, did a simple "Repair" of the partition with an XP Disc. That is LITERALLY the most unwanted version of a fix ever... All it does is replace the system files, but keeps all of the other software that may have been conflicting with the system itself, BUT usually, all of the software is inaccessible. It's still on your computer, f*cking it up, but you can't see it.
Thus I always say, "If you get a bluescreen... more than once, and don't know what the code means... don't repair your computer.. re-format that b*tch after recreating the partitions."
But, if your XP compy has the specs to support Windows 7, your best bet, all in all, would be to install Windows 7. Doing so will save you the hassle of having to manually download all of the drivers for it... unlike installing a non OEM Windows XP [have to download & install the drivers manually].
Click to expand...
Click to collapse
I'll try and get 7 for it. It was the last of the XP models, just before vista so i'd think it should be able to run 7. Think I need a new hard drive?
Bro that Simon_WM guys a genius. Listen to him.
Yea. This is my computer here, http://h10025.www1.hp.com/ewfrf/wc/...en&dlc=en&cc=us&product=3257746&lang=en#N1030
Think it'll run it?
PurpleLlamaLover said:
Yea. This is my computer here, http://h10025.www1.hp.com/ewfrf/wc/...en&dlc=en&cc=us&product=3257746&lang=en#N1030
Think it'll run it?
Click to expand...
Click to collapse
it may run with a lag
I just want it back up and running, I don't want vista though. On the little windows sticker is says "Vista Capable" but i've heard bad things about it, especially rom updating.
PurpleLlamaLover said:
I just want it back up and running, I don't want vista though. On the little windows sticker is says "Vista Capable" but i've heard bad things about it, especially rom updating.
Click to expand...
Click to collapse
ummm i use vista and have updated all my win mo phones on it...never had a problem
Really? Well, i'll keep in mind if I can't get XP back on it. I'd rather just have 7 and XP. I don't care what it runs as long as it runs again.
the best suggestion in this thread was install linux , however i take it that isn't a possibility. so here's what you need to do, you will require the following:
1) a fresh mind
2) a freshly burned copy of XPwhateverflavoryouwant
3) you do not care about anything on that drive.
put in freshly burned xp into computer, boot to cd drive, follow onscreen instructions, delete all partitions, create new NTFS partition, install to new partition.
if error comes back, it is not a software issue. fixing a xp bsod really is simple if it isnt hardware related.

[Q] Capture image of a X8 internal memory

I am interested in creating a forensic image of a Xperia x8 internal memory (school purpose). When I connect the device with the USB cable I can only see the SD card partition. I tried with different tools: ProDiscoverer Basic, WinHex...
How can this be accomplished ?
I don't want to root, install a particular app or alter in any way the content of the internal memory, that will ruin the hole ideea of a forensic image..
Oh yeah.. on previous owned devices: SE Elm or SE Z520, after connecting the device I did have access to the internal memory.
Connecting the device in USB storage mode won't get you any far. That way, as you already worked out, you only gain access to the SD card contents.
You actually need to look into the "adb" commandline tool that comes as a part of the Android SDK (if you look around on XDA you will find adb.exe plus the two required DLLs so you don't need to install the whole SDK along with the Java JDK).
The problem you will face:
If the the phone isn't rooted you won't be able to gain access to all parts of the internal file-system (i.e. some directories may appear empty though there are files and directories inside).
Apart from that - that's not a approach fit for forensic analysis.
IF you would want to tap into a device that's up for forensic investigation the worst thing you can possibly do is to actually turn the device on, let alone boot it up. Chance are that this could destroy valuable evidence (don't take everything you see in CSI:Retards for real) or trigger a "killswitch" that could delete data.
To perform a real forensic analysis you would actually take the phone apart and tap into the system through the JTAG interface. There you are talking directly to the hardware without the phone being booted or even "turned on" (it'll just sit there in "standby-ish" mode).
From there you would then dump the contents of the NAND (the internal memory of the phone where the Android OS, data and installed apps reside) into a file on your computer to perform further analysis.
Once the content of the NAND is secured you can crack down on the SD card (to secure further data for investigation) by slapping it into a card reader being WRITE PROTECTED and do a dump of the SD into a image you can then later mount or hex-view on the computer.
In other words ... to "emulate" a forensic analysis (by ignoring the fact to break basic safety measures) you would actually need to ROOT the phone. Once you did that, and therefore have busybox and su in your ROM, you can then use "mtd_utils" to dump the nand into a file for further analysis.
EDIT:
MTD Utils (i.e. dump the content of the NAND)
These files need to go onto your phone! This are NOT executables for Windows or Linux desktop PCs!
ADB (Windows, Android Platform Tools r10 at the time of writing)
Download the ZIP and extract it ... you only need adb.exe, adbwinapi.dll and adbwinusbapi.dll
Do NOT forget that the Android drivers for your phone need to be installed!
Thanks for the answer. Do you know/have any links regarding what cables/connectors or other hardware tools I need to tap into the system through the JTAG interface.
I found a link:
gsm-technology.com/index.php/en_US,details,id_pr,8466,menu_mode,categories.html
.. dude has a lot o hardware equipment and cables... where can I get & buy stuff like that?
I would try eBay first - or look into finding online retailers selling you a RIFF Box plus required toolset.
Since you said it's for a study project I'm not sure if the equipment you need to really replicate a "professional forensic analysis" will match your budget. A RIFF Box usually goes for USD 150+ over the counter, and then you need some experience to get it to good use and also know a thing or two about electronics in general.
EDIT: Well, the link you posted is the JTAG Header adapter (for the X8 and possibly also W8). If you scroll down they also have the RIFF Box for EUR 119,00 enlisted. And it seems that's actually a online retailer where you could buy the stuff.
---------- Post added at 11:12 AM ---------- Previous post was at 11:02 AM ----------
Ok, to pull it together ...
Xperia X8/W8 is based on the MSM7227 CPU, hence you need ...
Medusa JTAG Box EUR 119,00 (w/o VAT)
Supports MSM7227 based devices. Cables come with the box.
JTAG Xperia X8 EUR 8 (w/o VAT)
That's the JTAG header adapter
Apart from that you may need some software and a good idea about how to wire the cable from the Medusa Box to the pins on the JTAG adapter. Chances are you may also need a power adapter to power the JTAG (if powering the phone through USB doesn't work).
EDIT: Forgot: While the Xperia phones aren't really listed at the RIFF Box that box should work as well.

Ideas to jailbreak Windows Phone 8

I suggest that this topic should serve as a place for people to suggest ideas on how to jailbreak Windows Phone 8.
Like that there is a centralized place to talk about how to jailbreak wp8.​
Ideas:
-Flash the emulator ROM on the phone to have a dev unlock. USSELES
Original post:
I just thought about a eventual way to jailbreak Windows Phone 8. I have no idea if this is possible or not.
On The Windows Phone SDK you need a dev account to install apps to your phone. Right? How about the emulator ROM? No. You don't. You can test your apps on the emulator without a dev account. So, I was thinking, how about Flashing a device with the emulator ROM, which I suppose would need to be conditioned for each different wp8 device separately, and then, as on the emulator, you don't need a dev account to install unsigned .xap files!
This might be totally unrealistic, but then it might not. (btw I'm a noob in hacking/development)
Click to expand...
Click to collapse
GenieEte0 said:
Hi everybody,
I just thought about a eventual way to jailbreak Windows Phone 8. I have no idea if this is possible or not.
On The Windows Phone SDK you need a dev account to install apps to your phone. Right? How about the emulator ROM? No. You don't. You can test your apps on the emulator without a dev account. So, I was thinking, how about Flashing a device with the emulator ROM, which I suppose would need to be conditioned for each different wp8 device separately, and then, as on the emulator, you don't need a dev account to install unsigned .xap files!
This might be totally unrealistic, but then it might not. (btw I'm a noob in hacking/development)
Click to expand...
Click to collapse
The WP8 emulator rom is very different from the roms that are on the devices. The emulated WP8 device is extremely limited. If its the same as it was with WP7, It only allows access to the internet browser, settings (just access to change the accent color), and the app (the files deployed are called xaps). The unlocked emulator files for WP7 allow access to almost everything. The biggest exception was downloading apps from the store. I'm sure someone has thought of it since then.
GenieEte0 said:
Hi everybody,
I just thought about a eventual way to jailbreak Windows Phone 8. I have no idea if this is possible or not.
On The Windows Phone SDK you need a dev account to install apps to your phone. Right? How about the emulator ROM? No. You don't. You can test your apps on the emulator without a dev account. So, I was thinking, how about Flashing a device with the emulator ROM, which I suppose would need to be conditioned for each different wp8 device separately, and then, as on the emulator, you don't need a dev account to install unsigned .xap files!
This might be totally unrealistic, but then it might not. (btw I'm a noob in hacking/development)
Click to expand...
Click to collapse
The emulator is compiled to x86 code. The code base, even if decompiled somehow then recompiled for ARM, will probably not work.
There is a really big problem with this idea (several of them, actually).
First and foremost, the "emulator" image is actually just a virtual machine hard disk file (.vhdx). Since it runs on x86 Windows machines, it is over course an x86 VM image. The phones use ARM CPUs; they can't execute x86 code.
Second, the emulator image is crippled to hell and gone. Have fun using a phone that can no longer make phone calls or use a cellular radio.
Third, the emulator image has drivers for the emulated hardware. It does not have drivers for the hardware on the phone. Nothing on the phone would work, even if the image included the software to use it.
Fourth, the emulator image is probably not signed with a signature that the phones' bootloaders would trust. Therefore, it would in effect be a custom ROM; most phones wouldn't allow us to flash it.

[Q] Unable to select USB mode and do file transfer

I was wondering if it is possible to transfer files from my Z1 to a linux desktop without installing any softwares?
Currently I think I am unable to do so because the option of USB Connection Mode is greyed out, rendering me unable to do anything about it unless I install the software (as depicted here)
And thus, are there any 3rd party apps that I can install or tweak some settings in my phone so that I can transfer files?
Salik89 said:
I was wondering if it is possible to transfer files from my Z1 to a linux desktop without installing any softwares?
Currently I think I am unable to do so because the option of USB Connection Mode is greyed out, rendering me unable to do anything about it unless I install the software (as depicted here)
And thus, are there any 3rd party apps that I can install or tweak some settings in my phone so that I can transfer files?
Click to expand...
Click to collapse
Most devices nowadays (if not all of them) use MTP to transfer files from and to the device. MTP is not well supported under Linux as far as I'm aware, there are a couple of guides out there to get it working, you shouldn't have too many issues finding those by using Google.
Personally I prefer to use ADB to transfer files between my device and my desktop, you'll have to have some experience working with the terminal, it's not hard though.

how to mount windows phone as drive?

how do you mount a windows phone 8 as drive? (etc: e:/) i want to get import some app data and change my other phone to windows phone
You don't, unless you have a (very rare and not available for sale) engineering/development device. Retail WP8 devices use Media Transfer Protocol (MTP, same as cameras and many MP3 players). You can browse part of the filesystem using Windows Explorer, and upload or download files from those parts that you can access, but you aren't directly interacting with anything that appears as a file system so you can't mount it as a drive.
@ Goodday
is that the same reason thats why you cant reach the files with the commandpromt from your pc?
I have beeing playing with the older version of windowsexplorer app......
The one you can use the cmd line..................i wanted to try the same from my pc but....no go.
just curious
Correct, CMD does not support MTP devices. Windows Explorer and a few other programs (Total Commander has a plugin for it, I think) can access MTP, but CMD only supports things that can be specified by UNC, and that doesn't include MTP.
EDIT: it's possible to actually run CMD on your phone, and access it using Telnet. You currently have to use an app sandbox (the CMD binary isn't signed, so far as I can tell, and therefore can't be run outside a sandbox) so the privileges are pretty limited even with capability-unlock and are minimal without it, but it's possible nonetheless.
so if it isn't possible to mount windows phone as drive, what about emulator on a phone? does it works?
wuiyang said:
so if it isn't possible to mount windows phone as drive, what about emulator on a phone? does it works?
Click to expand...
Click to collapse
As GoodDayToDie already stated in his previous post, it's not possible.

Categories

Resources