Recovery Type: Mobile Phone
Internal Memory: 7.8GB
Model Name: Moto E
Operating System: Android
Carrier: TracFone Wireless (GSM)
Model Number: XT1526
Manufacture Date: 03/2015
Main Symptom: Locked out
Type of Data: Photos, text messages, contacts
Data Recovery Grade: 10
MCP Chip Information
Serial Number: GGD472MBS
In recent months, Gillware has been handling an increasing number of mobile device data recoveries. While many are personal cell phones containing family photos or important business contacts, our engineers have also been working on some interesting forensic data recoveries for law enforcement agencies. In this case, officers contacted Gillware in need of data recovery in a hurry. This phone, along with one other, were suspected to contain text messages ordering a “hit” on someone. Officers needed photos and text messages from the phone, which were stored in a SQLite database. The suspect in the case would not provide their passcode, so the investigators were effectively locked out of the phone. They turned to Gillware to gain access to this vital information in the case.
Once Gillware engineers received the phone, they performed a full analysis. We have successfully recovered data from this type of device before, so engineers knew it had an F2FS file system and that we would likely be able to successfully recover.
The data recovery method used in a lot of mobile device data recovery is called a “chip off“, in which engineers remove the flash memory chip from the phone and place it in a special adapter used to retrieve the lost data. However, the recovered data was not in a format that was very usable for humans. It would require SQL queries and Unix Time conversion to make a more human-friendly spreadsheet of the recovered data.
Gillware engineers were successful in retrieving the phone’s SQLite database and pictures. This information was provided to the investigators on the case to further their progress. If you are a law enforcement professional looking for forensic data recovery from mobile devices, get in touch with our recovery team.