Making complex data simple and compelling
From digital device to digital evidence
Unlock your vehicle's digital evidence potential
Forensic Analysis and Enhancement
Investigating and analyzing financial records
Gain access to the online accounts of deceased loved ones
Clear, precise evidence for a messy world
Expert reports to suit your specific needs
We can locate people anywhere
Stop worrying and learn the truth
Prevent, Detect, Respond To Cyberattacks
First response is crucial. Every minute counts.
The first response is critical to reduce liability
Detection & Removing Spyware Services
Reduce your electronic risk from digital transmittals
Find out who you are really talking to
Experienced, Confidential Services
Swift, professional incident response
Complicated cases require compelling digital facts
Find, recover and document digital evidence
Bring solid evidence before a judge
Cases can be investigated using Social Media
Recently we faced a big problem – logical extractions didn’t allow us to get contacts and SMS-messages from new Samsung mobile devices, for example, Galaxy S4. We all know that there is a proprietary Samsung tool capable of successful backing up of such information from newer mobile devices – SmartSwitch. But here is the problem: after backing up we have files in proprietary format – modern mobile forensic software isn’t able to extract data from it.
For example, SMS-messages are stored in Message.sme file, contacts – in Contacts.spb. If top cell phone forensic software can’t parse these files, what can an examiner do? Don’t worry, we have found the solution.
We have found a piece of software capable of restoring SmartSwitch backups – Wondershare Mobile Trans:
Figure 1. Wondershare Mobile Trans
Just open it and show it your SmartSwitch backup location (choose Kies, because it doesn’t have SmartSwitch option). We backed up only SMS-messages and Contacts via SmartSwitch, so we have only these two options to restore as you can see on Figure 1.
Now you can close it. Why? Because all magic is already done. Look at your backup folder – now you have DecryptData subfolder in it. And it has two more subfolders – Contact and Message:
Figure 2. DecryptData subfolders
Inside these two folders there are two XML-files – Contact.xml and Message.xml. Now you can easily convert these files in your favorite format and add them to your report.
It’s important to note that SMS-messages are encrypted with BASE64, so don’t forget to use your favorite tool to decrypt them.
Igor Mikhaylov
Interests: Computer, Cell Phone & Chip-Off Forensics
Oleg Skulkin
Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics
Thanks for the guide, it save my days :)
Thanks for the guide, it save my days 🙂
Thanks for the guide. Here is a simple python script to convert xml to .vcf so contacts can be imported back.
“”” This is simple conversion script from Samsung kies xml format to .vcf “”” import xml.etree.ElementTree as ET
tree = ET.parse(‘Contact.xml’) root = tree.getroot()
for item in root.iter(‘{Kies.Common.Data}ContactStoreItem’): print(‘BEGIN:VCARD’) print(‘VERSION:2.1’) first = item.find(‘{Kies.Common.Data}FirstName’) if first.text is None: firstName = ” else: firstName = first.text middle = item.find(‘{Kies.Common.Data}MiddleName’) if middle.text is None: middleName = ” else: middleName = middle.text last = item.find(‘{Kies.Common.Data}LastName’) if last.text is None: lastName = ” else: lastName = last.text print(‘N:’ + lastName + ‘;’ + firstName + ‘;’ + middleName + ‘;’) if middle.text is None: print(‘FN:’ + firstName + ‘ ‘ + lastName) else: print(‘FN:’ + firstName + ‘ ‘ + middleName + ‘ ‘ + lastName) print(‘ORG:’) print(‘TITLE:’) for telNum in item.iter(‘{Kies.Common.Data}TelNum’): if telNum.text is not None: print(‘TEL;HOME;VOICE:’ + telNum.text) for addr in item.iter(‘{Kies.Common.Data}AddrStreet’): if addr.text is not None: print(‘ADR;HOME:;;’ + addr.text) for email in item.iter(‘{Kies.Common.Data}Value’): if email.text is not None: print(‘EMAIL:’ + email.text) print(‘END:VCARD\n’)
Unfortunately this program doesn’t work. It only found photos, music, and videos which were already clearly found and readable.
so how do i get the app?
Was it fixed to extract the contacts?? Thanks
Any luck on your end @rob
Please enter the result of the calculation above.
Save my name, email, and website in this browser for the next time I comment.
Δ
Speak to a Specialist Now
Get Help Now