PC-3000 Mobile

 

DO YOU HAVE THE UNSOLVED CASES WITH MOBILE DEVICES?

Today, we cannot imagine our lives without portable devices. New models pop up every day: we use them to communicate, to study, to work. But so do the criminals! The complexity of modern mobile devices may bring you an unaccounted number of challenges during evidence recovery. That is why it is so important to have at your disposal every forensic data recovery tool that can help you with the investigations!

High-Level Access
Make a full image copy of data storage using the appropriate cable! The specialized algorithms for some CPU hardware platforms allow you to get access to data even if a mobile device doesn’t have ROOT or is not bootable. For other cases, you can reach the data with specific algorithms via the ADB protocol on your mobile phone.

In-Depth Research
Is the mobile device you work with physically damaged? Use the Chip-off Method and a special SD/MMC adapter from the delivery kit to get content from the eMMC/eMCP chip. The ACE Lab SD/MMC adapter allows you to read healthy and damaged eMMC with a very high speed up to 90 MB/s! All types, sizes, connector types, and form-factors of eMMC/eMCP chips are supported.

Imaged Files Upload
Analyze the content of the mobile devices extracted with the High-level Access or the Chip-off Method thanks to the integrated content parser! You can also upload the images created with third-party solutions and extract data that conventional tools consider as “deleted”. The reports allow you to summarize information about the suspect device you are working with.

 
 

WORK WITH DAMAGED DEVICES

The PC-3000 Mobile specialized modes let you deal with damaged mobile devices. In addition, it has the features to deeply analyze and recover logically damaged Files Systems: FAT12/16/32, NTFS, Ext2/3/4, HFS+, exFAT, F2FS, etc.

ANALYZE CONTENT

Thanks to a set of analytical functions, tools for forensic analysis, and content parsing modules (contacts, calendar, SMS, WhatsApp, Web – browsing history, Wi-Fi – the list of networks, etc.), you can retrieve as much data as possible. Furthermore, you are able to upload and analyze the previously read dumps.

EXPORT DATA & GET THE REPORTS

After you get the data, you may export it to the formatted report, one of the transport formats, or files. It is also possible to generate data exports compatible with other data analysis tools that you may have in your lab to continue the investigation.

Technical Features

RECOMMENDED SYSTEM REQUIREMENTS:

SUPPORTED DEVICES:

How To Use

Depending on the technical capabilities, modern mobile devices (smartphones, telephones, etc.) might use different types of memory to store data: internal device memory, SIM card memory, expansion card memory, cloud storage memory.

Retrieving contents of the internal memory of the device is very important during data recovery. The internal memory of a modern mobile device is a physically independent non-volatile solid-state memory chip that has one of the following interfaces: NAND, eMMC, UFS, PCIe. However, the newer the device and the installed OS, the more internal memory is logically “binded” to the main controller of a smartphone or a tablet and their peripheral units.

Besides, the need for reliable protection of user data leads to even more reliable and persistent mechanisms used by the developers of mobile platforms to restrict unconventional or unauthorized access. Initially, the developers only used software methods to do that. But in modern mobile devices, these methods became more sophisticated due to their intrinsic binding to the unique hardware data of the specific processor of a smartphone or a tablet. As a result, you can not use the memory chip apart from a fully-functional mobile device to recover data.

That is why there are many requirements for mobile data recovery methods. And that is why all existing data recovery tools have a limited support of mobile devices.
 
 

ACCESS TO DATA VIA THE STANDARD INTERFACE

The first method to work with mobile devices is a connection via the standard interface. You may also use it when the smartphone/tablet has a data protection mechanism based on the hardware uniqueness or if it is not possible to disassemble the device.

If a smartphone or a tablet is physically damaged, you should repair it to a basic- or fully-functional state, depending on the interface type and the method you’re going to use. In such a case, we do not recommend using a Chip-off method.

Another important thing is the hardware platform of the device and the installed OS. The device itself, its state, and the task also influence the data recovery methods. To choose the correct approach, please select the device in the menu or access method from the list and follow the instructions of the wizard.

The universal way of data recovery via the standard interface of a mobile device based on the Android OS is to use the ADB protocol (Android Debug Bridge). The procedure requires compliance with the following conditions:

• The “USB debug” mode should be enabled in the mobile device settings.
• The mobile device should be in the root mode (administrator right level). In most cases, mobile devices have a number of limitations connected with the launching of user programs. But at the same time, the user can get the maximum level of right himself.

Here is the video guide on how to get access to a mobile device via the ADB protocol:

 
 
Another method of access data via the standard interface is to use the hardware capabilities of modern mobile devices. E.g. such hardware platforms as MediaTek, Qualcomm, LG, Spreadtrum, Kirin, Exinos, Apple have their own debug protocol executed at the early stages of the device initialization. In many cases, this method allows you to access data without the need for the root mode.

Here is the video guide on how to get access to a mobile device via the debug protocol:

ACCESS TO DATA USING DIRECT eMMC CHIP READING

In most cases, if a smartphone or a tablet is damaged, the only way to recover data is a direct work with their internal memory. Of course, the interface type of the memory chip should be supported and there should be no other restrictions such as data protection mechanism based on the hardware uniqueness.

So, to recover data you need to disassemble the device and extract the mainboard with the memory chip. Then you can proceed with the chip-off and clearing of the contacts. Please note, that it’s very important to do it carefully, complying with all the requirements for the procedure. Then you install the microchip into the specialized eMMC/eMCP adapter, run the software, and follow the instructions on the screen and in the manual.

WORK WITH AN IMAGE FILE

All the information inside the internal memory of the mobile devices is stored as files. This is not convenient for visual perception or further analysis because almost all types of data in smartphones or tablets use special apps to display data. These apps can technically have any storage format, but in practice, there are some standard file types.

That is why it is not possible to recover user data in the same way we used to see it on the mobile device screen. For example, the standard contacts info has a very complex storage format that consists of several database files with a complex linkage. As a result, an additional stage of data recovery – parsing of the standardized content – is required. As such, we need to extract user data that will be enough for further analysis from the technical storage format, taking into account the characteristics of a particular manufacturer and the OS version. At the same time, such an extraction should be individual for each data (content) type.

The PC-3000 Mobile allows you to upload previously read dumps of the mobile devices’ external memory to perform further parsing of the standardized content. The Module contains special algorithms to work with damage storage formats as well as proprietary format decoders to extract data that conventional tools consider as “deleted”.

Delivery Kit