DO YOU HAVE THE UNSOLVED CASES WITH MOBILE DEVICES?
Today, we cannot imagine our lives without portable devices. New models pop up every day: we use them to communicate, to study, to work. But so do the criminals! The complexity of modern mobile devices may bring you an unaccounted number of challenges during evidence recovery. That is why it is so important to have at your disposal every forensic data recovery tool that can help you with the investigations!
Make a full image copy of data storage using the appropriate cable! The specialized algorithms for some CPU hardware platforms allow you to get access to data even if a mobile device doesn’t have ROOT or is not bootable. For other cases, you can reach the data with specific algorithms via the ADB protocol on your mobile phone.
Is the mobile device you work with physically damaged? Use the Chip-off Method and a special SD/MMC adapter from the delivery kit to get content from the eMMC/eMCP chip. The ACE Lab SD/MMC adapter allows you to read healthy and damaged eMMC with a very high speed up to 90 MB/s! All types, sizes, connector types, and form-factors of eMMC/eMCP chips are supported.
Imaged Files Upload
Analyze the content of the mobile devices extracted with the High-level Access or the Chip-off Method thanks to the integrated content parser! You can also upload the images created with third-party solutions and extract data that conventional tools consider as “deleted”. The reports allow you to summarize information about the suspect device you are working with.
A SPECIAL SD/MMC ADAPTER
With the special SD/MMC adapter, you can deal with the following types of MMC and MCP memory chips:
WORK WITH DAMAGED DEVICES
The PC-3000 Mobile specialized modes let you deal with damaged mobile devices. In addition, it has the features to deeply analyze and recover logically damaged Files Systems: FAT12/16/32, NTFS, Ext2/3/4, HFS+, exFAT, F2FS, etc.
RECOVER DATA WITH HIGH/LOW LEVEL ACCESS & CHIP-OFF
Retrieve data through the standard ports of the devices with the help of low-level protocols and software methods that are themselves the result of many years of research and development. Besides, you can use a high-level access or a chip-off method to extract data.
Thanks to a set of analytical functions, tools for forensic analysis, and content parsing modules (contacts, calendar, SMS, WhatsApp, Web – browsing history, Wi-Fi – the list of networks, etc.), you can retrieve as much data as possible. Furthermore, you are able to upload and analyze the previously read dumps.
EXPORT DATA & GET THE REPORTS
After you get the data, you may export it to the formatted report, one of the transport formats, or files. It is also possible to generate data exports compatible with other data analysis tools that you may have in your lab to continue the investigation.
|Form factor||External device (153,50х84х40 mm)|
|Diagnostic ports||2 х USB 3.0 (HUB), 1 x USB 3.0 (Adapter), Port eMMC (SD/eMMC/eMCP), Port SD/microSD (SD/eMMC/eMCP/microSD)|
|Power adapter||4-channel independent power adapter with protection from overvoltage|
|Operating temperature range||0-40°C|
|Power Supply||External AC / DC 19 V|
|Number of active licenses:||2 (to install the software on both a desktop computer and a laptop)|
|Other||write protect switchers for SD / MMC Ports|
RECOMMENDED SYSTEM REQUIREMENTS:
|CPU||Intel Core i5 (4 cores, 4 threats) or AMD Ryzen 5|
|Available disk space||200 MB of available disk space (for installation of software)|
|Operating system||Windows 7 (SP1), 8, 8.1, 10, x86, x64|
|Display||Widescreen Full HD 1920×1080|
|Port||USB 3.0 Type-A port for connection of PC-3000 Mobile (an Intel xHCI HOST controller is recommended)|
|MMC memory chips||Types: eMMC 153/169, eMCP 162/186, eMCP 221, eMCP 529
Sizes: 11,5×13, 10×11, 9×11, 14×18, 12×18, 12×16, 15×15
|Devices||Visit the PC-3000 blog to see the latest supported Mobile devices|
How To Use
Depending on the technical capabilities, modern mobile devices (smartphones, telephones, etc.) might use different types of memory to store data: internal device memory, SIM card memory, expansion card memory, cloud storage memory.
Retrieving contents of the internal memory of the device is very important during data recovery. The internal memory of a modern mobile device is a physically independent non-volatile solid-state memory chip that has one of the following interfaces: NAND, eMMC, UFS, PCIe. However, the newer the device and the installed OS, the more internal memory is logically “binded” to the main controller of a smartphone or a tablet and their peripheral units.
Besides, the need for reliable protection of user data leads to even more reliable and persistent mechanisms used by the developers of mobile platforms to restrict unconventional or unauthorized access. Initially, the developers only used software methods to do that. But in modern mobile devices, these methods became more sophisticated due to their intrinsic binding to the unique hardware data of the specific processor of a smartphone or a tablet. As a result, you can not use the memory chip apart from a fully-functional mobile device to recover data.
That is why there are many requirements for mobile data recovery methods. And that is why all existing data recovery tools have a limited support of mobile devices.
ACCESS TO DATA VIA THE STANDARD INTERFACE
The first method to work with mobile devices is a connection via the standard interface. You may also use it when the smartphone/tablet has a data protection mechanism based on the hardware uniqueness or if it is not possible to disassemble the device.
If a smartphone or a tablet is physically damaged, you should repair it to a basic- or fully-functional state, depending on the interface type and the method you’re going to use. In such a case, we do not recommend using a Chip-off method.
Another important thing is the hardware platform of the device and the installed OS. The device itself, its state, and the task also influence the data recovery methods. To choose the correct approach, please select the device in the menu or access method from the list and follow the instructions of the wizard.
The universal way of data recovery via the standard interface of a mobile device based on the Android OS is to use the ADB protocol (Android Debug Bridge). The procedure requires compliance with the following conditions:
- The “USB debug” mode should be enabled in the mobile device settings.
- The mobile device should be in the root mode (administrator right level). In most cases, mobile devices have a number of limitations connected with the launching of user programs. But at the same time, the user can get the maximum level of right himself.
Here is the video guide on how to get access to a mobile device via the ADB protocol:
Another method of access data via the standard interface is to use the hardware capabilities of modern mobile devices. E.g. such hardware platforms as MediaTek, Qualcomm, LG, Spreadtrum, Kirin, Exinos, Apple have their own debug protocol executed at the early stages of the device initialization. In many cases, this method allows you to access data without the need for the root mode.
Here is the video guide on how to get access to a mobile device via the debug protocol:
ACCESS TO DATA USING DIRECT eMMC CHIP READING
In most cases, if a smartphone or a tablet is damaged, the only way to recover data is a direct work with their internal memory. Of course, the interface type of the memory chip should be supported and there should be no other restrictions such as data protection mechanism based on the hardware uniqueness.
So, to recover data you need to disassemble the device and extract the mainboard with the memory chip. Then you can proceed with the chip-off and clearing of the contacts. Please note, that it’s very important to do it carefully, complying with all the requirements for the procedure. Then you install the microchip into the specialized eMMC/eMCP adapter, run the software, and follow the instructions on the screen and in the manual.
WORK WITH AN IMAGE FILE
All the information inside the internal memory of the mobile devices is stored as files. This is not convenient for visual perception or further analysis because almost all types of data in smartphones or tablets use special apps to display data. These apps can technically have any storage format, but in practice, there are some standard file types.
That is why it is not possible to recover user data in the same way we used to see it on the mobile device screen. For example, the standard contacts info has a very complex storage format that consists of several database files with a complex linkage. As a result, an additional stage of data recovery – parsing of the standardized content – is required. As such, we need to extract user data that will be enough for further analysis from the technical storage format, taking into account the characteristics of a particular manufacturer and the OS version. At the same time, such an extraction should be individual for each data (content) type.
The PC-3000 Mobile allows you to upload previously read dumps of the mobile devices’ external memory to perform further parsing of the standardized content. The Module contains special algorithms to work with damage storage formats as well as proprietary format decoders to extract data that conventional tools consider as “deleted”.
- PC-3000 Mobile controller
- PC-3000 Mobile power supply unit
- SD/MMC adapter + 7 size constraint frames
- USB 3.0 – USB Type-C adapter
- MicroUSB – USB Type-C adapter
- USB 3.0 cable
- USB-USB Type С cable
- USB-micro USB cable
- Universal download сable
- PC-3000 Mobile software
- User manual