Paraben s Phne Recvery Stick v. 3.0 User manual
Cntents Abut Phne Recvery Stick... 3 What s new!... 3 System Requirements... 3 Applicatin User Interface... 4 Understanding the User Interface... 4 Main Page... 4 Data Page... 4 Main Menu... 6 Recvering Data... 7 Recvery Prerequisites... 7 Recvering Data frm the Andrid OS Based Device... 7 Wrking with Wrkspaces... 11 Abut Wrkspaces... 11 Creating a New Wrkspace... 11 Opening an Existing Wrkspace... 11 Validating a Wrkspace... 12 Clsing a Wrkspace... 12 Viewing Andrid OS Based Device Data... 12 Recvered Data... 12 Acquired Data frm the Phne and Memry Card... 13 Device Prperties... 14 Searching Data... 15 Exprting Data... 16 Exprting Data t MS Excel... 16 Bkmarks... 17 Accessing Bkmarks... 17 Adding a Bkmark... 17 Editing a Bkmark... 17 Deleting a Bkmark... 17 Trubleshting... 18 Creating Lg Files... 19 Phne Recvery Stick Optins... 20 Additinal Infrmatin and Training... 21 2
Abut Phne Recvery Stick Welcme t Paraben s Phne Recvery Stick! This prgram allws investigatrs t recver data frm Andrid OS based devices including SMS and MMS text messages. Als, yu can view and analyze ther acquired data frm the Andrid OS based device, including cntacts, messages, call histry, Internet Brwser data, graphics, and multimedia files. What s new! Supprt f Andrid OS 4.x devices acquisitin is added NOTE: deleted data recvery is still nt available fr sme devices with Andrid OS 4.1 and higher. Pssibility t remve the screen lck prtectin fr an Andrid device during the acquisitin is added. Recvered data parsing is imprved. Nw even mre deleted data is recvered. Overall stability and perfrmance are imprved. System Requirements The fllwing requirements must be met t use Phne Recvery Stick: Phne Recvery Stick requires a Windws XP r newer perating system. T use the Exprt t Excel feature, Micrsft Excel must be installed n yur cmputer and yu must add the.net Framewrk prgramming tls during the installatin prcess. 3
Applicatin User Interface Understanding the User Interface The Phne Recvery Stick interface includes the fllwing parts: The Main page: This page cntains infrmatin abut Phne Recvery Stick and tw buttns that let yu pen the existing wrkspace r start recvery prcess frm the Andrid OS based device. The Data page: On this page, the recvered data and ther acquired data received frm the device is displayed. The Main menu: The menu prvides access t the main functinality f Paraben's Phne Recvery Stick. Main Page The Main page f Phne Recvery Stick pens at the prgram start-up. It cntains the fllwing elements: A tl bar. Shrt descriptin f Phne Recvery Stick. Tw icns: Start Recvery and Open Wrkspace. A link t the Data page if there is any data in the wrkspace. Frm the Main page, yu can d the fllwing: Start recvery prcess frm the Andrid OS based device. Define prgram ptins. Open an existing wrkspace. Mve t the Data page. Rename the currently pened wrkspace. Exprt wrkspace data t Excel. Data Page The Data page pens when data recvery prcess finishes, yu pen a wrkspace r yu click the Back t Data link n the Main page. The Data page cntains the fllwing elements: A list f data categries. The Data pane in which data is displayed. 4
The name f the device frm which data was recvered. A Search Text field. The Details pane, including the Prperties tab, the Bkmarks tab, Acquisitin Details, and the Search Results tab. A link t the Main page. Frm the Data page, yu can d the fllwing: View the recvered data. View the prperties f the device frm which yu recvered data. Search text data in the wrkspace. Create and access bkmarks. Define prgram ptins. Open an existing wrkspace. G t the Main page. Save the pen wrkspace using a different name. Exprt wrkspace data t Excel. 5
Main Menu File Menu The File menu cntains basic file ptins fr wrking with Phne Recvery Stick. Menu Item Descriptin Open Opens a saved wrkspace. Wrkspace Save As Saves the pen wrkspace under a different name. Start Recvery Clses the pen wrkspace and displays a screen frm which yu can select a device t scan. Exprt t Excel Exprts the cntent f the wrkspace as an MS Excel (.xls) file. Exit Shuts the Phne Recvery Stick dwn. View Menu The View menu lets yu display tls in the Phne Recvery Stick user interface. Menu Item Bkmarks Opens the Bkmarks pane. Descriptin Tls Menu The Tls menu lets yu check fr Phne Recvery Stick updates and define lgging and flder ptins. Menu Item Optins Validate Wrkspace Check fr Updates Descriptin Allws yu t define lgging ptins and the default flder fr saved wrkspaces. Runs a hash encryptin algrithm n a wrkspace data t ensure the data has nt been altered. Cnnects t the Paraben s site t dwnlad updates. Help Menu The Help menu gives access t this help file, infrmatin abut the Phne Recvery Stick applicatin, and displays registratin data. Menu Item Help Abut Qt Abut Descriptin Opens Phne Recvery Stick user dcumentatin. Prvides data abut the Qt tl, licensed fr use in Phne Recvery Stick. Displays the Phne Recvery Stick descriptin and the versin number. 6
Recvering Data Phne Recvery Stick allws yu t recver data frm Andrid OS based device. WARNING: Phne Recvery Stick places recvered data in a temprary wrkspace that is autmatically created in the wrkspace flder. The flder lcatin is defined in the Optins menu and has a Wrkspace<number>.ds name. When yu clse the wrkspace, yu must save it r yu will lse the data. Recvery Prerequisites Befre the recvery prcess starts, d the fllwing: 1. Turn n the device. 2. Ensure that the device battery is cmpletely charged. 3. Cnnect the Andrid OS based device t the cmputer with a data cable. Use the USB cnnectin mde t recver data frm the Memry Card. 4. Enable the USB debugging mde n yur device. Depending n the versin f the Andrid OS, the USB debugging mde is enabled as fllws: Fr Andrid OS up t versin 4.0: In the device menu, select Settings- >Applicatins->Develpment and select the USB debugging ptin. Fr Andrid OS frm 4.0 and up t 4.2: In the device menu, select Settings- >Develper ptins and select USB debugging. Fr Andrid OS 4.2 and newer: In the device menu, select Settings->Abut device/tablet and tap Build number 7 times, then g back t Settings, select Develper ptins, and then select USB debugging. Recvering Data frm the Andrid OS Based Device The Phne Recvery Stick acquires data and recvers the deleted data frm Andrid OS based devices. This sectin explains hw t recver data frm yur Andrid OS based device. Please nte, befre acquisitin starts, the device file system will be unlcked. File system unlcking prcess is perfrmed as fllws: Fr devices with OS lwer than 4.0: The AndridService.apk installatin package is written t the /data/lcal/tmp flder. The cm.paraben.service service is 7
installed t the system flder with applicatins. They will be remved autmatically after the prcess f acquisitin finishes. Fr devices with OS 4.0 and higher: Data n the device will be backed up and then restred. This is required t place the AndridService.apk installatin package t the /data/lcal/tmp flder and install the cm.paraben.service service. These actins are required t perfrm the acquisitin, therwise the acquisitin will fail. T recver data frm the Andrid OS based device: 1. D ne f the fllwing: Click Start Recvery n the Main page. Click File > Start Recvery. Press F5. Click the image f the device yu want t scan. If multiple devices are cnnected t yur cmputer, multiple images are displayed. NOTE: If yur device desn t appear in the list in several secnds after the cnnectin, try t discnnect it and then cnnect back again. 2. Select whether yu want t acquire all data frm the Andrid OS based device r nly text data. 8
3. Select Remve the screen passwrd t remve any screen passwrd prtectin n the device (passwrd, graphical passwrd, and PIN). This feature is available nly fr Andrid OS up t versin 2.3. NOTE: If the screen passwrd still appears after remval, simply draw any pattern t remve a graphical passwrd r enter and cnfirm a new PIN r passwrd. Select Unlck the file system t unlck the device file system. This actin is required t perfrm the acquisitin. NOTE: Unlcking a device file system desn't damage the device r any data n it. 9
4. [Fr Andrid 4.0 and higher nly] a. Yu will be prpsed t cnfirm data backing up n yur device. Click OK in the cnfirmatin message in the Phne Recvery applicatin and then tap the crrespnding buttn n yur device. b. After this yu will be prpsed t cnfirm data restratin n yu device. Tap the crrespnding buttn n yur device and then click OK in the cnfirmatin message in the Phne Recvery applicatin. c. The device will restart and then acquisitin prcess will cntinue. NOTE: This des nt damage data integrity and desn t cause any damage t device. 5. The recvery prcess starts. 10
Wrking with Wrkspaces Abut Wrkspaces A wrkspace is a file with a.ds extensin that cntains infrmatin recvered frm a single Andrid OS based device. Creating a New Wrkspace When yu start data recvery, Phne Recvery Stick creates a new temprary wrkspace. The wrkspace is named Wrkspace<number>.ds. By default, the wrkspace is saved in the current Windws user flder. The wrkspace is als updated after yu create a bkmark. Yu can change the default lcatin where a wrkspace is saved, and yu can use the Save As functin t relcate and rename a saved wrkspace. T create a wrkspace: 1. Start the data recvery prcess. See Recvering Data frm Andrid OS based device. 2. Click File > Save As, then click Save. T define the default wrkspace flder: 1. Click Tls > Optins, then type the new name and brwse t the flder yu want t use. 2. Click Save. T change the name f a wrkspace: 1. Open the wrkspace that yu want t change. 2. Click File > Save As. 3. Brwse t the lcatin where yu want t save the wrkspace, then type the new name. Opening an Existing Wrkspace Wrkspaces created by Phne Recvery Stick (*.ds files) can be pened frm the user interface. T pen an existing wrkspace, d ne f the fllwing: On the Main page, click Open Wrkspace. In the File menu, select the Open Wrkspace item. Press Ctrl+O. When yu pen a new wrkspace, the currently pen wrkspace clses. Unsaved infrmatin is lst. 11
Validating a Wrkspace Thrugh data validatin yu can check if the wrkspace data has been altered. T validate a wrkspace: 1. Open an existing wrkspace with acquired data. 2. In the main menu, select Tls > Validate Wrkspace r press CTRL+L. 3. The data validatin prcess starts. 4. When the validatin prcess finishes, yu will see the message with validatin results. Clsing a Wrkspace The wrkspace clses when any ther wrkspace pens r Phne Recvery Stick shuts dwn. Viewing Andrid OS Based Device Data The Phne Recvery Stick receives three types f data frm the Andrid OS based device: Recvered data frm the phne and recvered Multimedia and Graphics frm the Memry Card. Acquired data frm the phne and Memry Card. Device prperties. NOTE: Data is recvered nly fr Andrid OS versin lwer than 4.1. Recvered Data Phne Recvery Stick recvers the fllwing types f data: SMS messages (bth incming and utging). MMS messages (bth incming and utging) are shwn as nt parsed binary. Call histry. Cntacts (nly numbers). Calendar events. T view the recvered data, select the Recvered Data categry. The recvered data is parsed and displayed in grids. There is a separate tab fr each type f the recvered data. The number f clumns fr each categry depends n the categry type. Yu can view the recrds in the nt parsed frmat in the Recvered Data tab. The selected recrd pens in the File viewer belw the Data pane. 12
T change the cde page fr the pened recrd, select the required encding in the drpdwn list. T clse the File viewer fr the recrd, click Clse. Acquired Data frm the Phne and Memry Card Acquired data frm the Andrid OS based device and frm the Memry Card cnsists f text and multimedia data. Please nte, data frm the memry card will be acquired nly if the USB cnnectin mde was used fr the Andrid device during the acquisitin. The categries f acquired data are displayed t the left f the Data page. Click the categry name t view its cntents. Text data includes the fllwing categries: Cntacts: The device phnebk. Messages: The device SMS and MMS messages. Call Histry: The device call lgs. Organizer: The device calendar and events. Brwser Data: Includes URL and Search histry. 13
Other Data: This data includes Andrid OS based device system settings. Data frm each categry is displayed in a grid t the right f the Data page. There can be several tabs in the grid if data cntains sub-categries. Multimedia data includes Graphics and Multimedia categries. This data is displayed as thumbnails. Yu can click a file t view it. The file pens in the same pane. If necessary (fr big images), it scales t fit the windw size. T return t thumbnails, click the scaled image. Yu can als use external viewers t view multimedia data. T pen the image in the external viewer, right-click n it and select Open with. Device Prperties The prperties f the Andrid OS based device frm which data was recvered are displayed in the Prperties tab f the Details pane. Click View Details t pen the details pane. 14
Searching Data The Phne Recvery Stick allws yu t search fr text data in a wrkspace. T search text data: 1. On the Data page, in the Search Text field (in the upper right crner f the page), type the search string text. 2. Click Search r press Enter. 3. The search prgress is displayed in the Search Results tab f the Details pane. Click Abrt t stp the search. 4. When the search finishes, the search results are displayed in the Search Results tab f the Details pane. Each result is displayed as <Categry name>\<sub-categry (tab) name>. 5. Duble click the search result t navigate t it. When searching, yu can use the Search Wrd List ptin that allws yu t lad the search expressin fr a Blean text search frm a file. T define the wrds list, create the text file (*.txt). Use the new line fr OR lgic. Wrds in ne line are interpreted with AND lgic. T use the Lad Wrds ptin: 1. On the Data page, in the Search Text field, click the arrw sign and select Search Wrd List. 2. In the pened windw, click Brwse and navigate t the text file with search expressins. 3. Click Start Search. 4. Data will be fund accrding t the defined search expressin. Fr example: Expressin in the table Fund result Nt fund White cat Black Dg White cat and dg Black dg White cat and black dg White snw Gray cat White Cat with dg Black White cat with dg Black cat Gray cat with dg White cat 15
Exprting Data Exprting Data t MS Excel Yu can exprt data frm the wrkspace as an Excel wrkbk (.xls file). T exprt data: 1. Click File > Exprt t Excel. 2. Click Brwse t navigate t the destinatin flder and name the exprted file. 3. Check Open file after generatin t pen the exprted file. 4. Click Exprt. 16
Bkmarks A Bkmark is a pinter t data stred in the wrkspace. Bkmarks include the fllwing infrmatin: Item (the name f the first cell f the rw t which the bkmark is pinting) Name (the name f the bkmark) Details (the descriptin f the bkmark) Accessing Bkmarks Bkmarks are displayed in the Bkmarks tab f the Details pane. T view bkmarks: 1. D ne f the fllwing: Click View > Bkmarks. On the Data page, click View Details (in the bttm left crner). 2. T view the data, t which bkmark is pinting, duble click the bkmark. Adding a Bkmark T add a bkmark: 1. Select data t be bkmarked (it can be either a cell f the grid r a rw). 2. Right click the item and select Add t Bkmarks. 3. Type a name and a descriptin fr the bkmark, and then click Save. Editing a Bkmark T edit a bkmark: 1. Open the Bkmarks tab f the Details pane. 2. Right click the bkmark and click Edit, r, frm the menu, click Manage > Edit. 3. Edit the bkmark name and descriptin, and then click Save. Deleting a Bkmark T delete a bkmark: 1. Open the Bkmarks tab f the Details pane. 2. Highlight the bkmark t delete. 3. Right click the bkmark and select Delete, r, frm the menu, click Manage > Delete. 4. Select Delete All t delete all bkmarks. 17
Trubleshting The fllwing sectin prvides answers fr sme cmmn issues that yu may encunter when using Phne Recvery Stick. Prblem: The Andrid OS based device hung. What d I d? Slutin: Reset the Andrid OS based device. Prblem: The Andrid OS based device desn't cnnect t the cmputer. What t d? Slutin: Please try ne f the fllwing: The Andrid OS based device battery might need t be recharged. If that desn't wrk, discnnect ther USB devices frm yur cmputer and cnnect the Andrid OS based device t a different USB 2.0 prt n yur cmputer. If that desn't wrk, turn the Andrid OS based device ff and turn it n again. If that desn't wrk, restart yur cmputer and recnnect the Andrid OS based device t yur cmputer. Prblem: The Andrid OS based device desn t cnnect t PC in USB cnnectin mde. What d I d? Slutin: Sme Andrid OS based devices (fr example, LG P925) can nly be cnnected t the PC using mass strage mde and charging mde. Hwever, data frm the Memry Card will nt be recvered using this mde. 18
Creating Lg Files Phne Recvery Stick has three ptins fr lgging supprt built right in: The Plug-in Lg ptin creates a text file lg f the recvery based n the plug-in activity. The Serial Lg ptin lgs all traffic acrss the cmmunicatin prt. The GUI Lg ptin lgs all events that happened in the Phne Recvery Stick interface during ne prgram sessin. Lgs cntain useful infrmatin fr reslving issues and adding supprt fr new mdels. The GUI Lg is created autmatically and rewritten each time when Phne Recvery Stick is restarted. The Plug-in Lg and the Serial Lg are ptinal. The best practice is t leave these lgging ptins turned ff unless yu encunter a prblem. Then enable bth lgging ptins and duplicate the prblem. These lgs may be needed if yu call tech supprt t assist yu. T enable the Plug-in Lg and the Serial Lg creating: 1. Click Tls > Optins. 2. Check Serial Lgs, Plugin Lgs, r bth. 3. Click Save. NOTE: All lgs are created in the user flder (by default, C:\Dcuments and Settings\{user name}\lgs). The Plug-in Lg and the Serial Lg are verwritten when a new recvery prcess is perfrmed using the same plug-in. 19
Phne Recvery Stick Optins T define Phne Recvery Stick ptins, select Tls-Optins. Phne Recvery Stick ptins are the fllwing: Lgs: Yu can define what lgs will be created during the recvery prcess. The Plugin lgs ptin creates a text file lg f the recvery prcess based n the plug-in activity and the Serial lgs ptin lgs all traffic acrss the cmmunicatin prt. If yu have any prblems with Phne Recvery Stick, send the lgs t Paraben. The lgs destinatin path is displayed belw the lgs checkbxes in the Optins windw. Default Wrkspace Flder: When recvery prcess starts, a new wrkspace is autmatically created in the default wrkspace flder. When yu clse such a wrkspace, yu re prpsed t save it under ther name. If yu dn t want t save the wrkspace, click N and the wrkspace will be deleted. Make sure that there is enugh space n the disk, n which the default wrkspace flder is stred. 20
Additinal Infrmatin and Training Paraben Crpratin ffers training classes and certificatins fr prfessinals seeking t slidify their knwledge f handheld device frensics. Cursewrk trains students n PDAs, hybrid devices, SIM cards, and GPS devices and tests that knwledge with practical examinatins using multiple tls. A Paraben Certified Mbile Examiner (PCME) is prepared fr whatever the wrld f handheld frensics thrws at them. Fr mre infrmatin n these training classes r ther Paraben frensic tls, please visit: www.paraben.cm. 21