Paraben s Phne Recvery Stick v. 4.3 User Manual
Cntents Abut Phne Recvery Stick... 3 What s New!... 3 Getting Started... 4 System Requirements... 4 Hw t Use the Phne Recvery Stick... 4 Applicatin User Interface... 5 Understanding the User Interface... 5 Main Page... 5 Data Page... 5 Main Menu... 7 Recvering Data... 8 Recvery Prerequisites... 8 Recvering Data frm the Andrid OS Based Device... 9 Wrking with Wrkspaces... 12 Abut Wrkspaces... 12 Creating New Wrkspace... 12 Opening Existing Wrkspace... 12 Validating Wrkspace... 13 Clsing Wrkspace... 13 Viewing Andrid OS Based Device Data... 13 Recvered Data... 13 Acquired Data frm Phne and Memry Card... 14 Device Prperties... 18 Searching Data... 19 Exprting Data... 20 Exprting Data t MS Excel... 20 Bkmarks... 21 Accessing Bkmarks... 21 Adding Bkmark... 21 Editing Bkmark... 21 Deleting Bkmark... 21 Trubleshting... 22 Creating Lg Files... 23 Phne Recvery Stick Optins... 24 Additinal Infrmatin and Training... 25 2
Abut Phne Recvery Stick Welcme t Paraben s Phne Recvery Stick! This prgram allws investigatrs t recver data frm Andrid OS based devices including SMS and MMS text messages. Als, yu can view and analyze ther acquired data frm the Andrid OS based device, including cntacts, messages, call histry, Internet Brwser data, installed applicatin data, graphics, and multimedia files. What s New! Deleted data recvery fr rted Andrid 5 devices has been added. Faster recvery times. Imprved the user interface and fixed minr bugs. Added trubleshting fr devices with cnnectin prblems. Imprved wrking with the memry. Please nte: Data recvery fr rted devices supprting KNOX is nt pssible in this versin. Fr a list f devices that supprt KNOX, please visit https://www.samsungknx.cm/knxprtal/files/galaxydevicessupprtingknox.pdf 3
Getting Started System Requirements The fllwing requirements must be met t use Phne Recvery Stick: Phne Recvery Stick requires Windws Vista r newer 32 r 64-bit perating system. T use the Exprt t Excel feature, yu must install Micrsft Excel n yur cmputer and yu must add the.net Framewrk prgramming tls during the installatin prcess. Hw t Use the Phne Recvery Stick T start using Phne Recvery Stick, d the fllwing: 1. Plug the Phne Recvery Stick int the USB prt f yur cmputer. 2. Duble-click the PhneRecveryStick.exe file. 3. If drivers fr Andrid devices are nt installed, the PhneRecveryStick.exe file will initialize their installatin. Fllw the installatin wizard if needed. 4. When installatin is finished, remve the Phne Recvery Stick frm the USB prt. We als recmmend yu t restart the cmputer t make sure installatin has been cmpleted crrectly. 5. Plug the Phne Recvery Stick int the USB prt f yur cmputer. 6. Duble-click the PhneRecveryStick.exe file. 7. The Phne Recvery applicatin main windw pens. 8. Nw yu are able t perfrm data acquisitin and recvery as it is described belw. 4
Applicatin User Interface Understanding the User Interface The Phne Recvery Stick interface includes the fllwing parts: The Main page: This page cntains infrmatin abut Phne Recvery Stick and tw buttns that let yu pen the existing wrkspace r start recvery prcess frm the Andrid OS based device. The Data page: On this page, the recvered data and ther acquired data received frm the device is displayed. The Main menu: The menu prvides access t the main functinality f Paraben's Phne Recvery Stick. Main Page The Main page f Phne Recvery Stick pens at the prgram start-up. It cntains the fllwing elements: A tlbar. Shrt descriptin f Phne Recvery Stick. Tw icns: Start Recvery and Open Wrkspace. A link t the Data page if there is any data in the wrkspace. Frm the Main page, yu can d the fllwing: Start recvery prcess frm the Andrid OS based device. Define prgram ptins. Open an existing wrkspace. Mve t the Data page. Rename the currently pened wrkspace. Exprt wrkspace data t Excel. Data Page The Data page pens when data recvery prcess finishes, yu pen a wrkspace, r yu click the Back t Data link n the Main page. The Data page cntains the fllwing elements: A list f data categries. The Data pane in which data is displayed. 5
The name f the device frm which data was recvered. A Search Text field. The Details pane, including the Prperties tab, the Bkmarks tab, the Acquisitin Details pane, the Extended View tab, and the Search Results tab. A link t the Main page. Frm the Data page, yu can d the fllwing: View the recvered data. View the prperties f the device frm which yu recvered data. Search text data in the wrkspace. Create and access bkmarks. Define prgram ptins. Open an existing wrkspace. G t the Main page. Save the pened wrkspace using a different name. Exprt wrkspace data t Excel. 6
Main Menu File Menu The File menu cntains basic file ptins fr wrking with Phne Recvery Stick. Menu Item Open Wrkspace Save As Start Recvery Exprt t Excel Exit Opens a saved wrkspace. Descriptin Saves the pen wrkspace under a different name. Clses the pen wrkspace and displays a screen frm which yu can select a device t scan. Exprts the cntent f the wrkspace as an MS Excel (.xls) file. Shuts the Phne Recvery Stick dwn. View Menu The View menu lets yu display tls in the Phne Recvery Stick user interface. Menu Item Prperties Bkmarks Acquisitin Details Extended View Search Results Descriptin Opens the Prperties pane cntaining prperties f the acquired device. Opens the Bkmarks pane cntaining created bkmarks. Opens the Acquisitin Details pane cntaining infrmatin n device acquisitin. Opens the Extended View pane fr viewing advanced infrmatin n recvered data and sme applicatin data (e-mails, etc.) Opens the Search results pane cntaining results f the recent search. Tls Menu The Tls menu lets yu check fr Phne Recvery Stick updates and define lgging and flder ptins. Menu Item Optins Validate Wrkspace Check fr Updates Descriptin Allws yu t define lgging ptins and the default flder fr saved wrkspaces. Runs a hash encryptin algrithm n a wrkspace data t ensure the data has nt been altered. Cnnects t the Paraben s site t dwnlad updates. Help Menu The Help menu gives access t this help file, infrmatin abut the Phne Recvery Stick applicatin, and displays registratin data. Menu Item Help Abut Qt Abut Descriptin Opens Phne Recvery Stick user dcumentatin. Prvides data abut the Qt tl, licensed fr use in Phne Recvery Stick. Displays the Phne Recvery Stick descriptin and the versin number. 7
Recvering Data Phne Recvery Stick allws yu t recver data frm Andrid OS based device. Andrid devices vary by manufacturer. Each manufacturer has the ability t mdify the device and it can affect the supprt f the device within Phne Recvery Stick. Paraben tests n a variety f devices frm a variety f manufacturers, but that des nt guarantee 100% supprt f all Andrid devices running a particular firmware because f these manufacturer differences. If yur device firmware is supprted, but yur device des nt prcess, please gather the lgs and send them t ur supprt team. This will allw us t add mdificatins in future releases t accunt fr the manufacturer differences n the device yu were prcessing. WARNING: Phne Recvery Stick places recvered data in a temprary wrkspace that is autmatically created in the wrkspace flder. The flder lcatin is defined in the Optins menu and has a Wrkspace<number>.ds name. When yu clse the wrkspace, yu must save it r yu will lse the data. Recvery Prerequisites Befre the recvery prcess starts, d the fllwing: 1. Turn n the device. 2. Make sure that the device battery is cmpletely charged. 3. Cnnect the Andrid OS based device t the cmputer with a data cable. Use the USB cnnectin mde t recver data frm the Memry Card. 4. Enable the USB debugging mde n yur device. Depending n the versin f the Andrid OS, the USB debugging mde is enabled as fllws: Fr Andrid OS up t versin 4.0: In the device menu, select Settings- >Applicatins->Develpment and select the USB debugging ptin. Fr Andrid OS frm 4.0 and up t 4.2: In the device menu, select Settings- >Develper ptins and select USB debugging. Fr Andrid OS 4.2 and newer: In the device menu, select Settings->Abut device/tablet and tap Build number 7 times, then g back t Settings, select Develper ptins, and then select USB debugging. 8
Recvering Data frm Andrid OS Based Device The Phne Recvery Stick acquires data and recvers the deleted data frm Andrid OS based devices. This sectin explains hw t recver data frm yur Andrid OS based device. Please nte, befre acquisitin starts, the device file system will be unlcked. Fr this purpse, the AndridService.apk installatin package is written t the /data/lcal/tmp flder, and the cm.paraben.service service is installed t the system flder with applicatins. They will be remved autmatically after the recvery finishes. T recver data frm the Andrid OS based device: 1. D ne f the fllwing: Click Start Recvery n the Main page. Click File > Start Recvery. Press F5. 2. Click the image f the device yu want t scan. If multiple devices are cnnected t yur cmputer, multiple images are displayed. NOTE: If yur device des nt appear in the list in several secnds after the cnnectin, try t discnnect it and then cnnect it back again. 3. Select ne f the fllwing acquisitin ptins and click the crrespnding buttn t start acquisitin: Acquire textual data: This type f acquisitin takes the shrtest time. SMS, Call Lgs, Ntes, calendar, etc. will be acquired and recvered. 9
Acquire textual and multimedia data: This type f acquisitin allws acquiring graphics and multimedia alng with the textual data. Acquire all data including 3rd party Apps: This type f acquisitin takes the lngest time. Acquired data will cntain nt nly text data and multimedia, but a full list f applicatins installed n the device, the list f their permissins, and data frm mst ppular applicatins (Skype, Facebk, etc.). 4. Befre acquisitin starts, yu need t select additinal ptins: Select Remve the screen passwrd t remve any screen passwrd prtectin n the device (passwrd, graphical passwrd, and PIN). This feature is available nly fr Andrid OS up t versin 4.1. NOTE: If the screen passwrd still appears after remval, simply draw any pattern t remve a graphical passwrd r enter and cnfirm a new PIN r passwrd. Cnfirm device file system unlcking by selecting Unlck the file system. This actin is required t perfrm the acquisitin. NOTE: Unlcking a device file system des nt damage the device r any data n it. 10
5. A message might appear asking yu t allw the USB debugging n the device. Click OK in the message in Phne Recvery Stick and tap OK in the message that appears n the device. 6. The recvery prcess starts. NOTE: During the acquisitin and recvery, messages might appear n the device: - If the Waiting Fr Debugger message appears n the device, d nt clse this message, therwise the acquisitin will fail. We guarantee that this des nt affect data integrity n the device. - If the Chse Cnnectin Mde message reappears n the device, please chse the mde. 11
Wrking with Wrkspaces Abut Wrkspaces A wrkspace is a file with a.ds extensin that cntains infrmatin recvered frm a single Andrid OS based device. Creating New Wrkspace When yu start data recvery, Phne Recvery Stick creates a new temprary wrkspace. The wrkspace is named Wrkspace<number>.ds. By default, the wrkspace is saved in the current Windws user flder. The wrkspace is als updated after yu create a bkmark. Yu can change the default lcatin where a wrkspace is saved, and yu can use the Save As functin t relcate and rename a saved wrkspace. T create a wrkspace: 1. Start the data recvery prcess. See Recvering Data frm Andrid OS based device. 2. Click File > Save As, then click Save. T define the default wrkspace flder: 1. Click Tls > Optins, then type the new name and brwse t the flder yu want t use. 2. Click Save. T change the name f a wrkspace: 1. Open the wrkspace that yu want t change. 2. Click File > Save As. 3. Brwse t the lcatin where yu want t save the wrkspace, then type the new name. Opening Existing Wrkspace Wrkspaces created by Phne Recvery Stick (*.ds files) can be pened frm the user interface. T pen an existing wrkspace, d ne f the fllwing: On the Main page, click Open Wrkspace. In the File menu, select the Open Wrkspace item. Press Ctrl+O. When yu pen a new wrkspace, the currently pened wrkspace clses. infrmatin is lst. Unsaved 12
Validating Wrkspace Using data validatin yu can check if the wrkspace data has been altered. T validate a wrkspace: 1. Open an existing wrkspace with acquired data. 2. In the main menu, select Tls > Validate Wrkspace r press CTRL+L. 3. The data validatin prcess starts. 4. When the validatin prcess finishes, yu will see the message with validatin results. Clsing Wrkspace The wrkspace clses when any ther wrkspace pens r Phne Recvery Stick shuts dwn. Viewing Andrid OS Based Device Data The Phne Recvery Stick receives three types f data frm the Andrid OS based device: Recvered data frm the phne and recvered Multimedia and Graphics frm the Memry Card. Acquired data frm the phne and Memry Card. Device prperties. NOTE: Data is recvered nly fr Andrid OS versin 4.4.2 and lwer. Recvered Data Phne Recvery Stick recvers the fllwing types f data: SMS messages (bth incming and utging) MMS messages (bth incming and utging) shwn as nt parsed binary data Call histry Cntacts (nly numbers) Calendar events Multimedia files Applicatin data T view the recvered data, select the Recvered Data categry. The recvered data is parsed and displayed in grids. There is a separate tab fr each type f the recvered data. The number f clumns fr each categry depends n the categry type. Yu can view the recrds in the nt parsed frmat in the Recvered Data tab. The selected recrd pens in the File viewer belw the Data pane. 13
T change the cde page fr the pened recrd, select the required encding in the drpdwn list. T clse the File viewer fr the recrd, click Clse. Acquired Data frm Phne and Memry Card Acquired data frm an Andrid OS based device and frm the Memry Card cnsists f text data, multimedia data, and applicatin data. The amunt f data depends n the selected type f the acquisitin. The categries f acquired data are displayed t the left f the Data page. Click the categry name t view its cntent. Text data includes the fllwing categries: Cntacts: The device phnebk. Messages: The device SMS and MMS messages. 14
Call Histry: The device call lgs. Organizer: The device calendar and events. Internet Data: Includes URL and Search histry. Other Data: This data includes Andrid OS based device system settings. Data frm each categry is displayed in a grid t the right f the Data page. There can be several tabs in the grid if data cntains sub-categries. Multimedia data includes Graphics and Multimedia categries. This data is displayed as thumbnails. Yu can click a file t view it. The file pens in the same pane. If necessary (fr big images), it scales t fit the windw size. T return t thumbnails, click the scaled image. Yu can als use external viewers t view multimedia data. T pen the image in the external viewer, right-click it and select Open with. 15
Applicatin data includes a full list f installed applicatins, parsed applicatin data fr the mst ppular applicatins, and the permissin list, which includes the full list f permissins an applicatin has and the applicatin suspicin rate basing n its permissins. Data is displayed in three tabs: the first tab displays applicatin permissins, the secnd tab includes the list f all installed applicatins, and the third tab displays the parsed applicatin data in the tree-view structure. NOTE: Applicatin list is acquired fr any Andrid OS versin. Applicatin data is acquired nly fr Andrid OS versin 4.4.2 and lwer. Applicatin data fr the fllwing applicatins is parsed: Whisper, WhatsApp, KIK, LinkedIn, Jtt Messenger, TextFree, TextPlus, Vkntakte, Facebk, Facebk Messenger, Pinger, Skype, and Ggle Chrme. 16
17
Device Prperties The prperties f the Andrid OS based device frm which data was recvered are displayed in the Prperties tab f the Details pane. Click View Details t pen the details pane. 18
Searching Data The Phne Recvery Stick allws yu t search fr text data in a wrkspace. T search text data: 1. On the Data page, in the Search Text field (in the upper right crner f the page), type the search string text. 2. Click Search r press Enter. 3. The search prgress is displayed in the Search Results tab f the Details pane. Click Abrt t stp the search. 4. When the search finishes, the search results are displayed in the Search Results tab f the Details pane. Each result is displayed as <Categry name>\<sub-categry (tab) name>. 5. Duble-click the search result t navigate t it. When searching, yu can use the Search Wrd List ptin that allws yu t lad the search expressin fr a Blean text search frm a file. T define the wrds list, create the text file (*.txt). Use the new line fr OR lgic. Wrds in ne line are interpreted with AND lgic. T use the Lad Wrds ptin: 1. On the Data page, in the Search Text field, click the arrw sign and select Search Wrd List. 2. In the pened windw, click Brwse and navigate t the text file with search expressins. 3. Click Start Search. 4. Data will be fund accrding t the defined search expressin. Fr example: Expressin in the table Fund result Nt fund White cat Black Dg White cat and dg Black dg White cat and black dg White snw Gray cat White Cat with dg Black White cat with dg Black cat Gray cat with dg White cat 19
Exprting Data Exprting Data t MS Excel Yu can exprt data frm the wrkspace as an Excel spreadsheet (.xls file). T exprt data: 1. Click File > Exprt t Excel. 2. Click Brwse t navigate t the destinatin flder and name the exprted file. 3. Check Open file after generatin t pen the exprted file. 4. Click Exprt. 20
Bkmarks A Bkmark is a pinter t data stred in the wrkspace. Bkmarks include the fllwing infrmatin: Item (the name f the first cell f the rw t which the bkmark is pinting) Name (the name f the bkmark) Details (the descriptin f the bkmark) Accessing Bkmarks Bkmarks are displayed in the Bkmarks tab f the Details pane. T view bkmarks: 1. D ne f the fllwing: Click View > Bkmarks. On the Data page, click View Details (in the bttm left crner). 2. T view the data t which bkmark is pinting, duble-click the bkmark. Adding Bkmark T add a bkmark: 1. Select data t be bkmarked (it can be either a cell f the grid r a rw). 2. Right-click the item and select Add t Bkmarks. 3. Type a name and a descriptin fr the bkmark, and then click Save. Editing Bkmark T edit a bkmark: 1. Open the Bkmarks tab f the Details pane. 2. Right-click the bkmark and click Edit, r, frm the menu, click Manage > Edit. 3. Edit the bkmark name and descriptin, and then click Save. Deleting Bkmark T delete a bkmark: 1. Open the Bkmarks tab f the Details pane. 2. Highlight the bkmark t delete. 3. Right-click the bkmark and select Delete, r, frm the menu, click Manage > Delete. 21
4. Select Delete All t delete all bkmarks. Trubleshting The fllwing sectin prvides answers fr sme cmmn issues that yu may encunter when using Phne Recvery Stick. Prblem: The Andrid OS based device hung. What d I d? Slutin: Reset the Andrid OS based device. Prblem: The Andrid OS based device desn't cnnect t the cmputer. What t d? Slutin: Please try ne f the fllwing: The Andrid OS based device battery might need t be recharged. If that des nt wrk, discnnect ther USB devices frm yur cmputer and cnnect the Andrid OS based device t a different USB 2.0 prt n yur cmputer. If that des nt wrk, turn the Andrid OS based device ff and turn it n again. If that des nt wrk, restart yur cmputer and recnnect the Andrid OS based device t yur cmputer. Prblem: The Andrid OS based device desn t cnnect t PC in USB cnnectin mde. What d I d? Slutin: Sme Andrid OS based devices (fr example, LG P925) can nly be cnnected t the PC using mass strage mde and charging mde. Hwever, data frm the Memry Card will nt be recvered using this mde. Prblem: When I launch the stick, all functins are disabled and a message appears asking me t activate the prgram, althugh the stick wrked fine befre. What happened? Slutin: Mst prbably yu have renamed the stick drive. In this case, yu need t rename the stick back t Drid Stick. 22
Creating Lg Files Phne Recvery Stick has three ptins fr lgging supprt built right in: The Plug-in Lg ptin creates a text file lg f the recvery based n the plug-in activity. The Serial Lg ptin lgs all traffic acrss the cmmunicatin prt. The GUI Lg ptin lgs all events that happened in the Phne Recvery Stick interface during ne prgram sessin. Lgs cntain useful infrmatin fr reslving issues and adding supprt fr new mdels. The GUI Lg is created autmatically and rewritten each time when Phne Recvery Stick is restarted. The Plug-in Lg and the Serial Lg are ptinal. The best practice is t leave these lgging ptins turned ff unless yu encunter a prblem. Then enable bth lgging ptins and replicate the prblem. These lgs may be needed if yu call tech supprt t assist yu. T enable the Plug-in Lg and the Serial Lg creating: 1. Click Tls > Optins. 2. Check Serial Lgs, Plugin Lgs, r bth. 3. Click Save. NOTE: All lgs are created in the user flder (by default, C:\Dcuments and Settings\{user name}\lgs in Windws XP and C:\Users\Default\AppData\Lcal\Temp\lgs in Windws 7). The Plug-in Lg and the Serial Lg are verwritten when a new recvery prcess is perfrmed using the same plug-in. 23
Phne Recvery Stick Optins T define Phne Recvery Stick ptins, select Tls-Optins. Phne Recvery Stick ptins are the fllwing: Lgs: Yu can define what lgs will be created during the recvery prcess. The Plugin lgs ptin creates a text file lg f the recvery prcess based n the plug-in activity and the Serial lgs ptin lgs all traffic acrss the cmmunicatin prt. If yu have any prblems with Phne Recvery Stick, send the lgs t Paraben. The lgs destinatin path is displayed belw the lgs checkbxes in the Optins windw. Default Wrkspace Flder: When the recvery prcess starts, a new wrkspace is autmatically created in the default wrkspace flder. When yu clse such a wrkspace, yu are prpsed t save it under ther name. If yu d nt want t save the wrkspace, click N and the wrkspace will be deleted. Make sure that there is enugh space n the disk n which the default wrkspace flder is stred. 24
Additinal Infrmatin Paraben Crpratin ffers a variety f tls fr investigatins. These tls include irecvery Stick fr Andrid devices, Data Recvery Stick fr deleted data recvery f a cmputer, Chat Stick fr review and recvery f instant messaging data, and the Prn Detectin Stick fr the recvery and detectin f illicit materials. Fr any details n any f these prducts, please visit us at www.paraben-cnsumer.cm 25