User Data Extraction Help! On NOKIA TA-1024 [Answered] - GSM-Forum

ACiD FLaSHeR · 02-11-2021, 19:44

Hello Team!

Today I got liquid damaged NOKIA TA-1024 that is completely dead! the owner wanted from me to extract all pictures and data if is possible!
I removed the EMMC chip and with Medusa i make extraction of userdata.bin but i cannot open it! So seems that is encrypted! Is there any method to make extract this data from the userdata.bin file?

In Medusa Software there is no info if the memory is encrypted or no! And will be good idea to add info message on every reading of EMMC/UFS Chip to show it is encrypted or not! In my case is not showing nothing!

In this case is it possible to solder this EMMC on other same model working motherboard in order to start the phone and make extract the data?
Hopefully you can help me! The data is so needed to my customer!

Here is the Log:

Model Settings: Interface : eMMC
Voltage : 2.4V
Bus Mode : 4 bits
Bus speed : Auto

Connecting...
Device : Hynix eMMC HAG4a2
Page size : 512 B
Block size : 512 B
Block count : 30777344
Size : 14.68 GB (15028.00 MB)
---------------------------------------------------------------
CID Info

CID : 90014A484147346132A5357810A5A40B
Manufacturer ID : 0X90
Device/BGA : BGA (Discrete embedded)
OEM/Application ID : 0X4A
Product name : HAG4a2
Product revision : 10.5
Product serial number : (hex) 357810A5
Manufacturing date : 10/2017
---------------------------------------------------------------
CSD Info

CSD : D02701328F5903FFFFFFFFE78A400017
CSD structure : CSD version No. 1.2
SPEC version : 4.1, 4.2, 4.3, 4.4, 4.41, 4.5,
4.51, 5.0, 5.01, 5.1
Data read access time1: 15 ms
TRAN speed : 26 MHz
READ block length : 512 Bytes
WP group enable : YES
PERM_WRITE_PROTECT : NO
TMP_WRITE_PROTECT : NO
---------------------------------------------------------------
EXTCSD Info

Revision 1.8 (for MMC v5.1)
Erase block size : 512 Kbytes
Boot1 size : 4096 Kbytes
Boot2 size : 4096 Kbytes
RPMB size : 4096 Kbytes

Partition config : (0x38) 00111000
Boot partition enable : User area
(Bus width = 1Bit)
Boot ACK : No boot acknowledge sent (default)

Boot bus conditions : (0x00) 00000000
Boot bus width : x1 (sdr) or x4 (ddr) bus width in boot operation mode (default)
Reset boot bus conditions : Reset bus width to x1, single data rate and backward compatible timings after boot operation (default)
Boot mode : Use single data rate + backward compatible timings in boot operation (default)

RST_n function : (0x01) RST_n signal is permanently enabled

Partitioning support : Device supports partitioning features
Enhanced attribute : Device can have enhanced technological features in partitions and user data area.
Max enhanced data size: 7692288 Kbytes
Partitions attribute : 0x0
Part setting completed: 0x0
GP partition 1 size : 0 b
GP partition 2 size : 0 b
GP partition 3 size : 0 b
GP partition 4 size : 0 b
Enhanced area size : (0x0) 0 b
Enhanced area start : (0x0) 0 b

Backup EXT_CSD saved to file C:/Program Files (x86)/Medusa Pro Software/EXT_CSD Backups/HAG4a2_11_02_2021_19_21_33.bin.
Connect successful.
---------------------------------------------------------------
SW: 2.2.0; FW: 1.24.
P00: GPT (00000000, 00001000) 2048 KB
P01: modemst1 (00001000, 00000C00) 1536 KB
P02: modemst2 (00002000, 00000C00) 1536 KB
P03: fsg (00003000, 00000C00) 1536 KB
P04: fsc (00004000, 00000002) 1024 b
P05: securefs (00004002, 00004000) 8 MB
P06: rf_nv (00008002, 00001000) 2048 KB
P07: deviceinfo (00009002, 00000800) 1024 KB
P08: modem (00020000, 0002A000) 84 MB
P09: ssd (00060000, 00000010) 8 KB
P10: sbl1 (00060010, 00000400) 512 KB
P11: sbl1bak (00060410, 00000400) 512 KB
P12: rpm (00060810, 00000400) 512 KB
P13: rpmbak (00060C10, 00000400) 512 KB
P14: tz (00061010, 00001000) 2048 KB
P15: tzbak (00062010, 00001000) 2048 KB
P16: devcfg (00063010, 00000200) 256 KB
P17: devcfgbak (00063210, 00000200) 256 KB
P18: dsp (00063410, 00008000) 16 MB
P19: DDR (00080000, 00000040) 32 KB
P20: sec (00080040, 00000020) 16 KB
P21: splash (000A0000, 00005800) 11 MB
P22: aboot (000C0000, 00000800) 1024 KB
P23: abootbak (000C0800, 00000800) 1024 KB
P24: boot (000C1000, 00020000) 64 MB
P25: recovery (000E1000, 00020000) 64 MB
P26: devinfo (00101000, 00000800) 1024 KB
P27: reserved (00120000, 00008000) 16 MB
P28: ftmboot (00128000, 00020000) 64 MB
P29: cust_nv (00148000, 00001000) 2048 KB
P30: default_nv (00149000, 00001000) 2048 KB
P31: hwcfg (0014A000, 00000800) 1024 KB
P32: sutinfo (0014A800, 00000002) 1024 b
P33: systeminfo (0014A802, 00000200) 256 KB
P34: ftmlog (0014AA02, 00010000) 32 MB
P35: box (0015AA02, 00004000) 8 MB
P36: multi_splash (0015EA02, 00008000) 16 MB
P37: hidden (00166A02, 00014000) 40 MB
P38: cda (0017AA02, 00004000) 8 MB
P39: reserved_bak (0017EA02, 00008000) 16 MB
P40: persist (00186A02, 00010000) 32 MB
P41: misc (00196A02, 00000800) 1024 KB
P42: keystore (00197202, 00000400) 512 KB
P43: config (00197602, 00000040) 32 KB
P44: oem (00197642, 00080000) 256 MB
P45: limits (00220000, 00000040) 32 KB
P46: mota (00240000, 00000400) 512 KB
P47: dip (00240400, 00000800) 1024 KB
P48: mdtp (00240C00, 00010000) 32 MB
P49: syscfg (00250C00, 00000400) 512 KB
P50: mcfg (00251000, 00002000) 4 MB
P51: cmnlib (00260000, 00000200) 256 KB
P52: cmnlibbak (00260200, 00000200) 256 KB
P53: cmnlib64 (00260400, 00000200) 256 KB
P54: cmnlib64bak (00260600, 00000200) 256 KB
P55: keymaster (00260800, 00000200) 256 KB
P56: keymasterbak (00260A00, 00000200) 256 KB
P57: apdp (00280000, 00000200) 256 KB
P58: msadp (00280200, 00000200) 256 KB
P59: dpo (00280400, 00000010) 8 KB
P60: system (002A0000, 007FF800) 4095 MB
P61: cache (00AA0000, 00080000) 256 MB
P62: logdump (00B20000, 00020000) 64 MB
P63: userdata (00B40000, 01219FDF) 9.051 GB
Backuping modemst1 partition...
Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_modemst1_0x1000_0xc00_11_02_2021_19_21_33.b in file...
Reading. Please wait... Done.
Elapsed time 00:00:00
SW: 2.2.0; FW: 1.24.
Backuping modemst2 partition...
Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_modemst2_0x2000_0xc00_11_02_2021_19_21_33.b in file...
Reading. Please wait... Done.
Elapsed time 00:00:00
SW: 2.2.0; FW: 1.24.
Backuping fsg partition...
Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_fsg_0x3000_0xc00_11_02_2021_19_21_33.bin file...
Reading. Please wait... Done.
Elapsed time 00:00:00
SW: 2.2.0; FW: 1.24.

---------------------------------------------------------------
Searching Android build info...
Ok

Disk/Image size : ab400000 bytes
Device sector size : 512 bytes
Partition offset : 2752512
Number of sectors : 8386560
Device Manufacturer : FIH
Build ID : PKQ1.181105.001
Display Build ID : 00WW_6_19B
Release ID : 9
Device Model : FIH-D1C-FIH
Device Name : D1C_00WW_FIH
Architecture ABI : arm64-v8a
Architecture ABI List : arm64-v8a,armeabi-v7a,armeabi
Build Description : TA-1024_00WW-user 9 PKQ1.181105.001 00WW_6_19B release-keys

---------------------------------------------------------------

andrei_d1978 · 02-11-2021, 20:12

The data is encrypted by a specific processor. Re-soldering only the memory chip will not give a result, you need to transfer a pair of processor-memory to the working board

Medusa Box · 02-15-2021, 10:44

Hello.

If the data is encrypted, then unfortunately we do not have a tool to extract it.

02-11-2021, 19:44	#1 (permalink)
ACiD FLaSHeR Freak Poster Join Date: Aug 2017 Posts: 125 Member: 2748254 Status: Offline Thanks Meter: 87	User Data Extraction Help! On NOKIA TA-1024 [Answered] Hello Team! Today I got liquid damaged NOKIA TA-1024 that is completely dead! the owner wanted from me to extract all pictures and data if is possible! I removed the EMMC chip and with Medusa i make extraction of userdata.bin but i cannot open it! So seems that is encrypted! Is there any method to make extract this data from the userdata.bin file? In Medusa Software there is no info if the memory is encrypted or no! And will be good idea to add info message on every reading of EMMC/UFS Chip to show it is encrypted or not! In my case is not showing nothing! In this case is it possible to solder this EMMC on other same model working motherboard in order to start the phone and make extract the data? Hopefully you can help me! The data is so needed to my customer! Here is the Log: Model Settings: Interface : eMMC Voltage : 2.4V Bus Mode : 4 bits Bus speed : Auto Connecting... Device : Hynix eMMC HAG4a2 Page size : 512 B Block size : 512 B Block count : 30777344 Size : 14.68 GB (15028.00 MB) --------------------------------------------------------------- CID Info CID : 90014A484147346132A5357810A5A40B Manufacturer ID : 0X90 Device/BGA : BGA (Discrete embedded) OEM/Application ID : 0X4A Product name : HAG4a2 Product revision : 10.5 Product serial number : (hex) 357810A5 Manufacturing date : 10/2017 --------------------------------------------------------------- CSD Info CSD : D02701328F5903FFFFFFFFE78A400017 CSD structure : CSD version No. 1.2 SPEC version : 4.1, 4.2, 4.3, 4.4, 4.41, 4.5, 4.51, 5.0, 5.01, 5.1 Data read access time1: 15 ms TRAN speed : 26 MHz READ block length : 512 Bytes WP group enable : YES PERM_WRITE_PROTECT : NO TMP_WRITE_PROTECT : NO --------------------------------------------------------------- EXTCSD Info Revision 1.8 (for MMC v5.1) Erase block size : 512 Kbytes Boot1 size : 4096 Kbytes Boot2 size : 4096 Kbytes RPMB size : 4096 Kbytes Partition config : (0x38) 00111000 Boot partition enable : User area (Bus width = 1Bit) Boot ACK : No boot acknowledge sent (default) Boot bus conditions : (0x00) 00000000 Boot bus width : x1 (sdr) or x4 (ddr) bus width in boot operation mode (default) Reset boot bus conditions : Reset bus width to x1, single data rate and backward compatible timings after boot operation (default) Boot mode : Use single data rate + backward compatible timings in boot operation (default) RST_n function : (0x01) RST_n signal is permanently enabled Partitioning support : Device supports partitioning features Enhanced attribute : Device can have enhanced technological features in partitions and user data area. Max enhanced data size: 7692288 Kbytes Partitions attribute : 0x0 Part setting completed: 0x0 GP partition 1 size : 0 b GP partition 2 size : 0 b GP partition 3 size : 0 b GP partition 4 size : 0 b Enhanced area size : (0x0) 0 b Enhanced area start : (0x0) 0 b Backup EXT_CSD saved to file C:/Program Files (x86)/Medusa Pro Software/EXT_CSD Backups/HAG4a2_11_02_2021_19_21_33.bin. Connect successful. --------------------------------------------------------------- SW: 2.2.0; FW: 1.24. P00: GPT (00000000, 00001000) 2048 KB P01: modemst1 (00001000, 00000C00) 1536 KB P02: modemst2 (00002000, 00000C00) 1536 KB P03: fsg (00003000, 00000C00) 1536 KB P04: fsc (00004000, 00000002) 1024 b P05: securefs (00004002, 00004000) 8 MB P06: rf_nv (00008002, 00001000) 2048 KB P07: deviceinfo (00009002, 00000800) 1024 KB P08: modem (00020000, 0002A000) 84 MB P09: ssd (00060000, 00000010) 8 KB P10: sbl1 (00060010, 00000400) 512 KB P11: sbl1bak (00060410, 00000400) 512 KB P12: rpm (00060810, 00000400) 512 KB P13: rpmbak (00060C10, 00000400) 512 KB P14: tz (00061010, 00001000) 2048 KB P15: tzbak (00062010, 00001000) 2048 KB P16: devcfg (00063010, 00000200) 256 KB P17: devcfgbak (00063210, 00000200) 256 KB P18: dsp (00063410, 00008000) 16 MB P19: DDR (00080000, 00000040) 32 KB P20: sec (00080040, 00000020) 16 KB P21: splash (000A0000, 00005800) 11 MB P22: aboot (000C0000, 00000800) 1024 KB P23: abootbak (000C0800, 00000800) 1024 KB P24: boot (000C1000, 00020000) 64 MB P25: recovery (000E1000, 00020000) 64 MB P26: devinfo (00101000, 00000800) 1024 KB P27: reserved (00120000, 00008000) 16 MB P28: ftmboot (00128000, 00020000) 64 MB P29: cust_nv (00148000, 00001000) 2048 KB P30: default_nv (00149000, 00001000) 2048 KB P31: hwcfg (0014A000, 00000800) 1024 KB P32: sutinfo (0014A800, 00000002) 1024 b P33: systeminfo (0014A802, 00000200) 256 KB P34: ftmlog (0014AA02, 00010000) 32 MB P35: box (0015AA02, 00004000) 8 MB P36: multi_splash (0015EA02, 00008000) 16 MB P37: hidden (00166A02, 00014000) 40 MB P38: cda (0017AA02, 00004000) 8 MB P39: reserved_bak (0017EA02, 00008000) 16 MB P40: persist (00186A02, 00010000) 32 MB P41: misc (00196A02, 00000800) 1024 KB P42: keystore (00197202, 00000400) 512 KB P43: config (00197602, 00000040) 32 KB P44: oem (00197642, 00080000) 256 MB P45: limits (00220000, 00000040) 32 KB P46: mota (00240000, 00000400) 512 KB P47: dip (00240400, 00000800) 1024 KB P48: mdtp (00240C00, 00010000) 32 MB P49: syscfg (00250C00, 00000400) 512 KB P50: mcfg (00251000, 00002000) 4 MB P51: cmnlib (00260000, 00000200) 256 KB P52: cmnlibbak (00260200, 00000200) 256 KB P53: cmnlib64 (00260400, 00000200) 256 KB P54: cmnlib64bak (00260600, 00000200) 256 KB P55: keymaster (00260800, 00000200) 256 KB P56: keymasterbak (00260A00, 00000200) 256 KB P57: apdp (00280000, 00000200) 256 KB P58: msadp (00280200, 00000200) 256 KB P59: dpo (00280400, 00000010) 8 KB P60: system (002A0000, 007FF800) 4095 MB P61: cache (00AA0000, 00080000) 256 MB P62: logdump (00B20000, 00020000) 64 MB P63: userdata (00B40000, 01219FDF) 9.051 GB Backuping modemst1 partition... Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_modemst1_0x1000_0xc00_11_02_2021_19_21_33.b in file... Reading. Please wait... Done. Elapsed time 00:00:00 SW: 2.2.0; FW: 1.24. Backuping modemst2 partition... Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_modemst2_0x2000_0xc00_11_02_2021_19_21_33.b in file... Reading. Please wait... Done. Elapsed time 00:00:00 SW: 2.2.0; FW: 1.24. Backuping fsg partition... Opening C:/Program Files (x86)/Medusa Pro Software/Backups/HAG4a2_fsg_0x3000_0xc00_11_02_2021_19_21_33.bin file... Reading. Please wait... Done. Elapsed time 00:00:00 SW: 2.2.0; FW: 1.24. --------------------------------------------------------------- Searching Android build info... Ok Disk/Image size : ab400000 bytes Device sector size : 512 bytes Partition offset : 2752512 Number of sectors : 8386560 Device Manufacturer : FIH Build ID : PKQ1.181105.001 Display Build ID : 00WW_6_19B Release ID : 9 Device Model : FIH-D1C-FIH Device Name : D1C_00WW_FIH Architecture ABI : arm64-v8a Architecture ABI List : arm64-v8a,armeabi-v7a,armeabi Build Description : TA-1024_00WW-user 9 PKQ1.181105.001 00WW_6_19B release-keys ---------------------------------------------------------------

02-11-2021, 20:12	#2 (permalink)
andrei_d1978 Freak Poster Join Date: Aug 2010 Location: Russia,Yekaterinburg Posts: 102 Member: 1363017 Status: Offline Thanks Meter: 44	The data is encrypted by a specific processor. Re-soldering only the memory chip will not give a result, you need to transfer a pair of processor-memory to the working board

02-15-2021, 10:44	#3 (permalink)
Medusa Box Product Supporter Join Date: Mar 2011 Location: Octopus-team Posts: 9,360 Member: 1538383 Status: Offline Sonork: 100.1587278 Thanks Meter: 3,398	Hello. If the data is encrypted, then unfortunately we do not have a tool to extract it.