Articles
Now Reading
Extracting data from SmartSwitch backups
3

Extracting data from SmartSwitch backups

Recently we faced a big problem – logical extractions didn’t allow us to get contacts and SMS-messages from new Samsung mobile devices, for example, Galaxy S4. We all know that there is a proprietary Samsung tool capable of successful backing up of such information from newer mobile devices – SmartSwitch. But here is the problem: after backing up we have files in proprietary format – modern mobile forensic software isn’t able to extract data from it.

For example, SMS-messages are stored in Message.sme file, contacts – in Contacts.spb. If top cell phone forensic software can’t parse these files, what can an examiner do? Don’t worry, we have found the solution.

We have found a piece of software capable of restoring SmartSwitch backups – Wondershare Mobile Trans:

smartswitch_forensics_weare4n6

Figure 1. Wondershare Mobile Trans

Just open it and show it your SmartSwitch backup location (choose Kies, because it doesn’t have SmartSwitch option). We backed up only SMS-messages and Contacts via SmartSwitch, so we have only these two options to restore as you can see on Figure 1.

Now you can close it. Why? Because all magic is already done. Look at your backup folder – now you have DecryptData subfolder in it. And it has two more subfolders – Contact and Message:

decrypted_smartswitch_weare4n6

Figure 2. DecryptData subfolders

Inside these two folders there are two XML-files – Contact.xml and Message.xml. Now you can easily convert these files in your favorite format and add them to your report.

It’s important to note that SMS-messages are encrypted with BASE64, so don’t forget to use your favorite tool to decrypt them.

About the authors:

Igor Mikhaylov

Interests: Computer, Cell Phone & Chip-Off Forensics

Oleg Skulkin

Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics

3 Comments
  • Vince
    2018-02-24 at 10:45 AM
    Positives

    Thanks for the guide, it save my days :)

    Thanks for the guide, it save my days 🙂

  • 2018-04-13 at 1:16 PM

    Thanks for the guide. Here is a simple python script to convert xml to .vcf so contacts can be imported back.

    “””
    This is simple conversion script from Samsung kies xml format to .vcf
    “””
    import xml.etree.ElementTree as ET

    tree = ET.parse(‘Contact.xml’)
    root = tree.getroot()

    for item in root.iter(‘{Kies.Common.Data}ContactStoreItem’):
    print(‘BEGIN:VCARD’)
    print(‘VERSION:2.1’)
    first = item.find(‘{Kies.Common.Data}FirstName’)
    if first.text is None:
    firstName = ”
    else:
    firstName = first.text
    middle = item.find(‘{Kies.Common.Data}MiddleName’)
    if middle.text is None:
    middleName = ”
    else:
    middleName = middle.text
    last = item.find(‘{Kies.Common.Data}LastName’)
    if last.text is None:
    lastName = ”
    else:
    lastName = last.text
    print(‘N:’ + lastName + ‘;’ + firstName + ‘;’ + middleName + ‘;’)
    if middle.text is None:
    print(‘FN:’ + firstName + ‘ ‘ + lastName)
    else:
    print(‘FN:’ + firstName + ‘ ‘ + middleName + ‘ ‘ + lastName)
    print(‘ORG:’)
    print(‘TITLE:’)
    for telNum in item.iter(‘{Kies.Common.Data}TelNum’):
    if telNum.text is not None:
    print(‘TEL;HOME;VOICE:’ + telNum.text)
    for addr in item.iter(‘{Kies.Common.Data}AddrStreet’):
    if addr.text is not None:
    print(‘ADR;HOME:;;’ + addr.text)
    for email in item.iter(‘{Kies.Common.Data}Value’):
    if email.text is not None:
    print(‘EMAIL:’ + email.text)
    print(‘END:VCARD\n’)

  • Larry
    2018-10-08 at 9:40 AM

    Unfortunately this program doesn’t work. It only found photos, music, and videos which were already clearly found and readable.

Leave a Response