tag:blogger.com,1999:blog-8616548328716134487.post1331982958760125815..comments2024-03-21T07:36:40.286+01:00Comments on Forense nella Nebbia: Windows Phone 7.8 ForensicsGabriele Zambellihttp://www.blogger.com/profile/15938791338964824110noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-8616548328716134487.post-79498859517954120682016-03-30T22:08:43.971+02:002016-03-30T22:08:43.971+02:00Hi, thanks for your info regarding the CommsBackup...Hi, thanks for your info regarding the CommsBackup.xml file. I'll check it out as soon as I have another phone to analyze.Gabriele Zambellihttps://www.blogger.com/profile/15938791338964824110noreply@blogger.comtag:blogger.com,1999:blog-8616548328716134487.post-7600286841422686732016-03-27T22:18:07.906+02:002016-03-27T22:18:07.906+02:00Might be worth mentioning that CommsBackup.xml (i ...Might be worth mentioning that CommsBackup.xml (i assume it's that file) might contain contacts as well. I've had 2 Lumia 800s recently. One booting fine, with cracked screen. Second that doesn't go past bootscreen, stuck on operator logo. I dumped emmc from both of them via qualcomm mmc storage (unlocked bootloader) and the used winhex on both of them. Winhex found exfat partition on the first one that worked, managed to see the files and extract store.vol without any problem. On second one, it looks like it found the second (should be exfat) partiton but with the same data as on the first one, and over 14GB marked as aunallocated space. I've used R-Studio on that dump, extacted a lot of .xml files and checked the few bigger ones (over 1M). I found that beside SMS "node" (not exacly sure if it the correct name for that part in XML) i also found one named "PhoneContacts" and managed to get over 170 of them. No idea if that's all of them, not sure what happends in someone have multiple numbers per contact as in this example i see only single per name, but that's still something useful.Arcainhttp://arcaine.netnoreply@blogger.com