Scribd
Upload
128 views15 pages

Physical Extraction Enhanced Bootloaderv7

Uploaded by

edgar reyes
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
128 views15 pages

Physical Extraction Enhanced Bootloaderv7

Uploaded by

edgar reyes
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 15

UFED Touch/4PC

Physical extraction using enhanced bootloader


October 2015
Version 4.2.6
2 Physical extraction using enhanced bootloader

1. Introduction
As part of our ongoing effort to provide the best physical extraction capabilities for the latest Samsung
Android devices, you can now obtain additional data by performing a physical extraction using the
enhanced bootloader method that supports the latest firmware running Android 5.x on Samsung
Android devices.

This extraction method uses a blank memory card that is not related to the case and needs to
be inserted into the source device.

1.1. FAQ
n Why is a blank memory card required?
A blank memory card is used in this method as part of the bypass process and it does not contain
any user information.
n What is stored on the memory card?
This method enforces the bypass of the device password, by "opening" the device via the memory
card's interface. It does NOT store any user data or system data on the memory card. It only emulates
a mass storage device in the system, and thereby bypasses the password and performs a physical
extraction.
n What happens to the data on the device during the extraction?
The device's system data or the user data files are not tampered with or corrupted during the
extraction. This extraction method is forensically sound.
n What should I do if the extraction does not work?
Perform all the steps for the extraction again or try a different memory card.

Performing a physical extraction using the enhanced bootloader method:


1. Tap Mobile device in the home screen.
2. Identify the device. The Select Extraction Type window appears:
©2015 Cellebrite Mobile Synchronization Ltd. 3

3. Tap Physical Extraction. The following window appears:

4. Tap Boot Loader. The following window appears:

5. Connect the source device to the USB port. If the device is already connected, disconnect and then
reconnect the device. Follow the instructions to place the device in Download mode using cable A
with the Yellow tip T-133. Examples are displayed next.
4 Physical extraction using enhanced bootloader
©2015 Cellebrite Mobile Synchronization Ltd. 5

The Cellebrite Extension Cable is recommended for UFED Touch, but is not required when
using UFED 4PC.

6. In the Waiting for Device window, tap Continue. The following window appears:

Reading Phone Info appears on the Extraction in Progress window for approximately 2 minutes.
The following window appears:
6 Physical extraction using enhanced bootloader

7. Follow the steps and tap Continue.


"INVALID ODIN CMD" should be displayed on the device's screen.
©2015 Cellebrite Mobile Synchronization Ltd. 7

The following window appears:

Reading Phone Info appears on the Extraction in Progress window for approximately 5 seconds. The
following window appears:

8. Make sure that the device is connected to UFED, and remove the memory card. Do not disconnect
anything such as the battery or cable.

To protect the user data on the memory card, if you do not remove the memory card the
extraction will end.
8 Physical extraction using enhanced bootloader

9. Tap Continue a message will appear on the device "Failed to Initialize SD card".

The following window appears:


©2015 Cellebrite Mobile Synchronization Ltd. 9

10. Insert a blank memory card into the device that is not related to the case (without disconnecting
anything such as the battery or cable) and tap Continue. The memory card will be used for the
extraction and its existing data will be overridden.
If a blank memory card was inserted in the device the extraction continues. Reading Phone Info
appears in the Extraction in Progress window for approximately 2 – 3 minutes.

During the extraction process, numerous "T-FLASH MODE" messages appear on the device's screen.
10 Physical extraction using enhanced bootloader

The following window appears:


©2015 Cellebrite Mobile Synchronization Ltd. 11

11. During the extraction process, Reading Phone Info appears on the Extraction in Progress window for
approximately 2 minutes and numerous "T-FLASH MODE" messages appear on the device's screen.

Initializing is displayed on the Extraction in Progress window for approximately 20 minutes.


12 Physical extraction using enhanced bootloader

Numerous "T-FLASH MODE" messages appear on the device's screen. Examples are displayed next.
©2015 Cellebrite Mobile Synchronization Ltd. 13

The Reading File process starts, wait until the extraction completes.
14 Physical extraction using enhanced bootloader

The following window appears:

12. Follow the instructions for the source device and then tap OK. The following window appears:
©2015 Cellebrite Mobile Synchronization Ltd. 15

13. Tap Finish.

You might also like