View Single Post
Old 07-18-2017, 13:58   #1 (permalink)
chandanps18
No Life Poster
 
Join Date: Dec 2013
Location: India
Posts: 1,893
Member: 2082450
Status: Offline
Thanks Meter: 1,454
Arrow [Forensic Time] {Part - 2} Recover Deleted/Erased data from a Phone [Video Guide]

Hey Guys,
Few days back, I have created a tutorial video regarding extract user data from a dump made by Infinity CM2.
Did you just miss it????
Just look at here: http://forum.gsmhosting.com/vbb/f296...guide-2195031/




Today, I am gonna show you some hot Stuffs i.e. Recover Mistakenly Deleted/Erased DATA from a phone using CM2 and Third party tools.

Let's Start.


Pre-Requistie


  1. Take the userdata backup (Dump) of the phone
  2. R-studio


Process


  1. Open "Rstudio.exe".
  2. Click on Open "Image".
  3. Browse your Image and click on "Open".
  4. Right Click on the selected image and press on "Scan" Button. (Wait untill the scan operation finished).
  5. Here it shows the type of partitions e.g. Ext4, Ext2, FAT32 (In general the data partition type depends on the phone).
  6. Select the desired data partition and Right click on it and click on "Open Drive Files".[ In my case, I selected FAT32 (as the device is old one, The data partition type may vary phone to phone.
  7. It will show the root of the data partition i.e internal user available storage.
  8. Now go to desired location and find the deleted data ( Delete Symbol :- Easy to notice it (Red Cross Mark) & The Deleted symbol is just right to the left of the file name.)
  9. Select the no of data you want to recover, Then click on "Recover Marked".
  10. Or Simply if you want to recover all Deleted/Erased data from the dump of the phone, Check Mark "Extra Found Files".
  11. Choose your output folder, Click on "OK".




That's it, Lets see all this in the video...





Some Important things needs to remember.


The USERDATA (Alive/Erased) can be recovered from the dump of a semi-dead/hang on logo mobile in the following case

  1. The phone's user data is not encrypted.
  2. The data on the storage can be recovered only if the free space is not overwritten by any other files.
  3. MFT Entries are not destroyed.
  4. Secure Deletion is not processed by any tools.
  5. also, only if the mobile is not formatted.


PS: One may have know this process, and one may not. I assume that this will help someone to make his pocket warm. This is just to simplify data recovery with the help of these tools.



Again,
How much did you get from a customer after data recovery!!!! LOL!!!


If like this post, Don't forget to hit on Thanks Button....
  Reply With Quote
The Following 7 Users Say Thank You to chandanps18 For This Useful Post:
Show/Hide list of the thanked
 
Page generated in 0.09896 seconds with 7 queries