Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

Mobile Phone Forensics: Nokia N8-00 copying emails (files *.CFS)

$
0
0
bigjon wrote: Have you tried going into your ufed extraction folder / Files / databases, this usually gives a list of all its extracted, however you may see files named 000000001.db 000000002.db These are third party apps, Yahoo etc, open these with SQLite to reveal the mail I found files (path: XSR_FILESYSTEM remapped (XSR) \ private \ 200267c0 \ data \ 235503028 \ widget_235503028_0), but it contains no data to email. I have found that in the directory XSR_FILESYSTEM remapped (XSR) \ private \ 2001fda4 subdirectories C0 to C24 and inside is 8 files (sometimes more) that contain the parts e-mail. For example: 2AF8 = html text email 2b8e = advertising text 1518 = Word - doc (attached) DDE = Image - jpg (Annex) after adding extensions are executable files and functional. Unfortunately, I have too much e-mail. You can not do it by hand and combine fragments. In addition, e-mail addresses and dates are listed in the previous files.

Viewing all articles
Browse latest Browse all 20102

Trending Articles