hemu1438/forensicsgpt-training-data huggingface dataset:
Cdma -
Code division multiple access (CDMA) is a cellular frequency that, originally developed during World War II for military purposes, incorporates "spread spectrum" techniques. Unlike other cellular systems like GSM and TDMA, every channel on the network uses the full available spectrum. This allows each user (identified by a unique pseudonoise code (pn) to communicate over several frequencies, as opposed to only one. CDMA is an improved version of TDMA (Time Division Multiple Access). TDMA uses a time-sharing protocol to provide three to four times more capacity than analog systems, just as a GSM.
History
Qualcomm developed the key advances that made CDMA suitable for cellular phones and conducted an open demonstration in San Diego in November 1989.
The first CDMA network was launched commercially in 1995 as cdmaOne and provided approximately 10 times more capacity than analog networks. CDMA has become the fastest-growing of all wireless technologies, with over 100 million subscribers worldwide.
Benefits
Greater capacity. Provides 10-20 times the capacity of analog equipment and three times the capacity of other digital platforms.
Excellent voice and call quality through the filtering out of background noise, cross-talk, and interference.
Rapid deployment. CDMA systems can be expanded quickly and more cost effectively than most landline networks.
Fewer dropped calls.
Improved security and privacy because of CDMA's digitally encoded transmissions.
Reduced background noise and interference by combining multiple signals which improves signal strength.
Forensics
Most CDMA phones do not use SIM Cards, so forensics can only be done on the phone itself, as all relevant data is stored directly on the phone. This information includes the phonebook, call history log, SMS messages, and any calendar or to-do applications the phone might have.
Due to the fact that the phone must be physically connected to a forensics workstation for data acquisition, it is important to be aware of the phone's battery state (a charging cable should be obtained to ensure constant power), and blocking the phone's signal. Also, the correct data cable must be obtained to connect the phone to the workstation (susteen) provides a kit that includes many cables for the most popular phones).
RUIM cards are the CDMA equivalent of a SIM Card, and have been in use in China since 2002. The technology has spread to other countries throughout Asia, although are yet to be release in America.
Software
Software for acquiring a CDMA-based phone includes:
BitPIM
DataPilot Secure View
Oxygen Forensic Suite
Paraben Cell Seizure
Software for acquiring CDMA RUIM data includes:
Paraben Device Seizure
External Links
Wikipedia: CDMA
Physical memory organization -
Skip to content 
IA-32 Memory Models
IA-64 Memory Models
IA-32 Memory Models
32-bit linear address space (or flat memory model)
Segmented memory model
Real-address mode memory model
IA-64 Memory Models
64-bit linear address space
Also see
Microcode
External links
Wikipedia: List of Intel microprocessors
Wikipedia: Memory address
Wikipedia: Intel Memory Model
Intel® 64 and IA-32 Architectures Software Developer’s Manual Combined Volumes: 1, 2A, 2B, 2C, 3A, 3B and 3C
Chip off blackberry bold 9780 -
Tear Down
Remove the back panel which holds the battery in place.
Remove the SIM and SD Memory Card.
Flip phone and remove the Vendor plate
Using a torx-5 screw driver remove the 2 visible screws under the vendor.
Use a guitar pick or pry tool to remove the outer bezel.
Gently remove the keyboard to 4 additional torx-5 screws to be removed.
Release the flex cable in the top left corner and remove the LCD/Motherboard from the housing.
Release the LCD and pointer flex cables and remove the LCD from the Motherboard.
The tear down is now complete
NAND Removal
The NAND is located beneath the heat shield to the left of the USB port.
Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.
Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
Continue working under the high heat. In the 9780's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.
The BlackBerry Bold 9780 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.
Position the steel plate under the heat gun. The plate will heat up and hold the heat be mindful not to burn yourself.
Transfer the NAND+Controller to the plate and allow the chip to take in some heat \~1min
Using long tweezers to hold the chip and the 10cm razor begin slicing away the epoxy that is surrounding the chip with a sharp razor the epoxy will slice easily allowing you to see a tiny gap between the NAND and the controller.
The razor can then be used to separate the two.
Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.
Chip off blackberry bold 9900 -
Tear Down
Remove the bottom bezel from the face of the phone. Then remove the two T5 screws.
Pry the keyboard up from the bottom, and remove from phone. There is a ribbon cable attached underneath.
Remove the two T5 screws at the bottom of the screen, and slide the screen downward to expose two more T5 screws at the top of the phone.
With 6 total screws removed, the backing and case will come apart, and the mainboard can be removed.
The NAND will be top-centre of the rear of the board (Camera/SIM side).
Apply appropriate heat to remove the shield and the chip underneath. There will be epoxy on the chip so take your time, use adequate heat and gently remove the chip from the board. From personal experience, the 9900 has the highest failure rate for chip-off due to this epoxy ruining traces at the edges/corners of the chip when removing from the board, or during clean up.
The chip is now ready to be read. The chip in our test phone is a SanDisk SDIN5C2-8G. It was read using a Sireda 12x16_0.5 adapter. The resulting .dd was parsed in UFED Physical Analyzer.
Chip off blackberry z10 -
Tear Down
Remove the back panel.
Remove the Battery, SIM and SD Memory Card.
Using a torx-4 screw driver, remove the visible screws on the back of the phone.
Un-clip the back panel using a shim, guitar pick, or prying tool. This will expose the mainboard.
Un-clip all connectors (5) from the mainboard, and simply lift the board out of the phone.
Remove the shield to expose the memory module. There will be epoxy on the chip so take your time, use adequate heat, and gently remove the chip from the board.
Prepare the chip for reading. Again, take your time to carefully remove the epoxy without applying too much direct heat, and consistently adding flux paste.
The chip is now ready to be read. The chip in our test phone is a Samsung KLMAG2GE4A-A001. It was read using an UP-828 Programmer with the VBGA169E adapter. The resulting .bin was parsed in UFED Physical Analyzer.
Chip off blackberry curve 9320 -
The hardware used in the BlackBerry 9315's and 9320's are almost identical. The following link describes the differences between the models.
Tear Down
Remove the back panel.
Remove the SIM and SD Memory Card.
Using a torx-6 screw driver remove the 2 visible screws on the back of the phone.
Remove the screen protector using a shim, guitar pick, or prying tool.
Remove 2 torx-5 screws.
Use the shim to detach the outer bezel/keyboard from the device.
Remove 4 additional torx-6 screws. The main board will now easily be separated from the back plate
Peel off the vendor sticker.
Remove the plastic cover protecting the track pad ribbon cable, and disconnect the track pad.
Remove the final torx-4 screw located beneath the plastic protector, to remove the plastic keyboard overlay.
Disconnect the ribbon cable connected to the LCD. Then using a pick separate the display from the main board.
|
The tear down is now complete
eMMC Removal
The eMMC is located beneath the heat shield directly above the Micro SD card slot.
Place the main board in a stand or holder and position it approximately 2 1/2" - 3" inches away from a heat gun or device the blows super hot air.
Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
Continue working under the high heat. With the 9315/9320's I've worked on the eMMC has been ready to lift off of the main board using tweezers immediately after removing the heat shield.
Using liquid flux, or flux paste and a soldering iron clean the pads on the eMMC in preparation for a read
The eMMC is now ready to read using the appropriate adapter/programmer and software.
At the time of this writing (2013OCT29) the eMMC that was removed in this example was read using an UP828 programmer via the "VBGA169E" adapter and using the "eNAND_H9DP4GG4JJACGR-4EM/459MB" device settings. The resulting image was then parsed via the CelleBrite Physical Analyzer (V. 3.8.5.108).
Chip off blackberry curve 9300 -
Tear Down
Remove the back panel.
Remove the SIM and SD Memory Card.
Using a torx-6 screw driver remove the 2 visible screws on the back of the phone.
Remove the screen protector using a plastic shim or guitar pick.
Use the shim to detach the top-plate/cover from the device.
Remove 4 additional torx-6 screws.
Detach vendor plate and remove 2 more torx-6 screws.
Separate back plate from the main board.
The tear down is now complete
NAND Removal
Peel off the vendor sticker on the back side of the main circuit board
The NAND is located beneath the heat shield directly above the Micro SD card slot.
Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.
Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
Continue working under the high heat. In the 9300's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.
The BlackBerry Curve 9300 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.
Position the steel plate under the heat gun. The plate will heat up and hold the heat, try not to burn yourself.
Transfer the NAND+Controller to the plate and allow the chip to take in some heat \~1min.
Using long tweezers to hold the chip and the 10cm razor begin slicing away the epoxy that is surrounding the chip with a sharp razor the epoxy will slice easily allowing you to see a tiny gap between the NAND and the controller.
The razor can then be used to separate the two.
Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.
Global system for mobile communications -
The Global Systems for Mobile Communications (GSM), is a radio-based technology that allows mobile phones to communicate. GSM is considered to be the world's most ubiquitous radio-based cellular technology, with 1.7 billion users as of March 2006. In the United States, carriers such as T-Mobile and Cingular utilize GSM technology for their cellular networks.
GSM Cell Phone Providers
USA
Cingular
T-Mobile
Other
T-Mobile
Vodafone
O2
Operational Characteristics
Network Principles
GSM is considered to be 2G and uses digital data for both signaling and voice purposes. GSM uses a time division multiple access (tdma protocol to transmit information. Aside from voice, GPRS and EDGE allow for data transmissions across a GSM network.
Radio Communication
In terms of frequencies used, GSM networks often use the 900MHz and 1800MHz bands, but carriers in the United States use 850MHz and 1900MHz bands. As a result, "dual-band" phones, which only support two of the four major bands, can only be used in certain parts of the world. More common are "tri-band" phones, which usually operate on 900/1800MHz and 1900MHz. "Quad-band" phones support all four frequencies and can be used in all parts of the world.
GSM Forensics
For phones with a SIM card, perform forensics on the cell phone before removing the SIM Card.
External Links
GSM World
Wikipedia: GSM
Gprs -
General Packet Radio Services (GPRS) is a wireless data communication service that transfers data at a rate of up to 40-50Kbps, a similar access speed to a dial-up modem.
It permits continuous connection to the Internet for mobile phones and higher data rates allow for the use of multimedia applications such as websites viewing on mobile handheld devices. Other features provided through the use of GPRS are e-mail, video streaming, multimedia messages and location-based services. GPRS is based on Global System for Mobile communication, which runs at speeds of up to 9.6 kilobits, and is available on almost all GSM networks.
GPRS is an efficient way of sending and receiving small bursts of data, such as e-mail and web browsing, in addition to receiving large volumes of data.
EGPRS (Enhanced GPRS or EDGE) is an enhanced version of GPRS and uses a different type of technology. It allows GPRS transfers of approximately three times faster.
Capabilities Available With GPRS
GPRS provides the ability to make use many different mobile services and capabilities, for example e-mail, web browsing, games, calendar funcionality, using the cell phone as modem for laptops. instant messaging and lots more.
For a more complete list, see Nokia: What You Can Do With GPRS.
GPRS Classes
There are three GPRS classes which help indicate the capabilities of a mobile phone.
Class A Mobile phones of this class can be connected to both GPRS and GSM services simultaneously.
Class B Mobile phones of this class can be attached to both GPRS and GSM services, but using only one service at a time. Switching between them (suspend/resume) is done automatically.
Class C Mobile phones of this class are attached to either GPRS or GSM voice service. One needs to switch manually between services.
Comparison of Technologies
The class of the device determines the speed at which GPRS can be used. The table below displays different types of technologies and their rates of transfer.
Type Uplink (Send) Downlink (Receive) 
GPRS	14 kbps	28-64 kbps	
GSM CSD	9.6-14 kbps	9.6-14 kbps	
Dial-UP	56 kbps	56 kbps	
ISDN Standard	64 kbps	64 kbps	
Broadband	2 Mbps	2 Mbps	
External Links
Wikipedia: GPRS
Iden -
The Integrated Digital Enhanced Network (iDEN) is a proprietary mobile communications technology from Motorola. It is a TDMA based digital wireless standard that operates in the 800 MHz, 900MHz, and 1.5 GHz bands. It combines the capabilities of a digital cellular telephone and a two-way radio known as push-to-talk (ptt).
Motorola’s iDEN technology phones support many other features including Bluetooth, location-based services, MOTOTalk and support for expandable memory (Micro SD). Sprint Nextel is the largest U.S. retailer of iDEN services.
Newer iDEN phones use a SIM card that is compatible with GSM phones for overseas roaming but iDEN is a very different standard from GSM. iDEN phones are not compatible with GSM networks and GSM phones are not compatible with iDEN networks.
History
iDEN was invented by Motorola who is presently the primary manufacturer of iDEN devices.
Nextel has started to develop a 2.5G technology called WiDEN (an expansion of iDEN) that includes four carriers (100kHz) into one channel. This results in a much higher download speed of 96 kbit/s.
Software
Software for acquiring a iDEN data includes:
iDEN Phonebook Manager
SIM Explorer
External Links
Motorola: The iDEN Solution
iDEN Home
Wikipedia: Integrated Digital Enhanced Network
Jtag huawei tracfone h866c -
Huawei H866C - Ascend Y
This phone is supported by the Tracfone. This uses a Qualcomm 7625A 800 MHz (S1) Processor and comes standard with Android version 2.3. This phone is unsupported by RIFF Box for the JTAG process for resurrector.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Remove the battery and peel the label back to expose the TAPS.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS are located under the battery, behind the Huawei phone label. The phone will be powered by a Micro USB cord from an AC battery charger.
The TAPS order is as follows:
1=Not Used
2=TCK
3=GND
4=TMS
5=TDI
6=TDO
7=RTCK
8=TRST
9=NRST
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into a wall outlet. The phone should respond with the vibrator switch activating for less than a second.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Huawei U8655
Auto FullFlash size
Advanced Settings:
Ignore Target IDCODE during Resurrection and DCC Loader operations
Then connect and get the ID, you should receive the dead body signal. Then read the memory.
Notes
The phone has a 512 MB NAND flash memory chip which should take approximately 30 minutes to download.
Jtag samsung galaxy ace q (sgh i827d) -
JTAG Samsung Galaxy Ace Q (SGH-I827D)
The Samsung Galaxy Ace Q is an Android based smartphone. At the time of this writing (2014AUG26), I am unaware of any method other than JTAG to acquire a physical image of the NAND on a Samsung Galaxy Ace Q.
For the purpose of this document, a Samsung Galaxy Ace Q was disassembled, read via JTAG, and reassembled.
Getting Started
What you need to dump the NAND:
A Octoplus Box 1
Soldering skills and ultra-fine tip soldering iron (a JTAG jig may be available).
A DC Power supply capable of supplying 3.8V/1.83A output. The power supply used for this was an U8002A DC Power Supply.
NAND Dump Procedure
Disassemble the phone down to the PCB.
Connect the Octoplus JTAG Box to the PC via USB.
Connect the Octoplus JTAG Box to the PCB via the JTAG pins.
Connect the PCB to the DC power supply.
Start the "Octoplus JTAG" software.
Enable the power on the DC power supply.
Power the phone via the power button.
Dump the NAND via the Octoplus software.
Instructions for disassembly can be found on Internet but it can be summarized as follows:
* Remove the rear cover and battery. * Remove the 8 x Phillips screws. * Split the phone case using a case opening tool (guitar pick).
* Remove the metal shield. * Disconnect the LCD display connector, and remove the battery mount. * Separate main-board from the device. The JTAG port is located on the opposite side to the left of the keypad.
* Solder the JTAG connector to the JTAG port as follows. I used 0.040 gauge magnet wire to connected an adapter that was inserted into the 20 pin ribbon cable supplied with the RIFF box.
* Re-connect the LCD display connector to the mainboard. * Connect the PCB battery terminal connections to the DC power supply. The positive (+) connection is the outermost pin (1) and the negative (-) pin is the outermost pin (3). You can configure your power supply to match the battery specifications which in this case is 3.8V and 1.80A but do not apply power at this time.
* Now we can start the Octoplus JTAG software and configure it, and connect the phone to the Octoplus box. See the picture for more detail.
Apply power to the DC power supply and turn the phone on using the button on the side of the PCB. After powering the phone on, select "Connect". If all goes well the "READ" button and options will be available. Select "Full Flash", followed by "Read". Once the read is complete you can save the output to the destination of choice.
Jtag huawei tracfone m865c -
JTAG Huawei TracFone M865C (Ascend II)
This phone is supported by the Cricket Network and Tracfone. This uses a Qualcomm 7627 600 MHz (S1) Processor and comes standard with Android version 2.3. This phone is unsupported by RIFF Box for the JTAG process for resurrector.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Disassemble the phone down to the PCB.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS are located under the battery, behind the Huawei phone label. The phone will be powered by a Micro USB cord from an AC battery charger.
The TAPS order is as follows:
1=Not Used
2=TCK
3=GND
4=TMS
5=TDI
6=TDO
7=RTCK
8=TRST
9=NRST
For the TAPs, the Huawei-8650 was utilized, pictured above. The TAPS on the M865C are located in the same location as the 8650. See below for TAPS locations.
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into a wall outlet. The phone should respond with the vibrator switch activating for less than a second.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Huawei U8650
Auto FullFlash size
Advanced Settings:
Ignore Target IDCODE during Resurrection and DCC Loader operations
Then connect and get the ID, you should receive the dead body signal. Then read the memory. JTAG complete.
Notes
The phone has a 512 MB NAND flash memory chip which should take approximately 30 minutes to download.
References
Huawei Ascend II
Jtag huawei tracfone m866c -
Huawei H866C - Ascend Y
This phone is supported by the Tracfone. This uses a Qualcomm 7625A 800 MHz (S1) Processor and comes standard with Android version 2.3. This phone is unsupported by RIFF Box for the JTAG process for resurrector.
Getting Started
What you need:
Riff Box
USB to Micro USB cord
NAND Dump Procedure
Remove the battery and peel the label back to expose the TAPS.
Connect the RIFF box to the PC via USB.
Connect the RIFF box to the PCB via the JTAG pins.
Connect the PCB to a Micro USB cord and power via a power supply.
Start the "RIFF box" software.
Power the PCB.
Dump the NAND.
The TAPS are located under the battery, behind the Huawei phone label. The phone will be powered by a Micro USB cord from an AC battery charger.
The TAPS order is as follows:
1=Not Used
2=TCK
3=GND
4=TMS
5=TDI
6=TDO
7=RTCK
8=TRST
9=NRST
After the wires are connected to the board, the phone is powered by the USB connection. Plug the Micro USB into the USB connection on the device and then plug the phone into a wall outlet. The phone should respond with the vibrator switch activating for less than a second.
Launch the Riff Box JTAG Manager and use the following settings:
JTAG TCK Speed = RTCK
Resurrector Settings= Huawei U8655
Auto FullFlash size
Advanced Settings:
Ignore Target IDCODE during Resurrection and DCC Loader operations
Then connect and get the ID, you should receive the dead body signal. Then read the memory.
Notes
The phone has a 512 MB NAND flash memory chip which should take approximately 30 minutes to download.
References
https://www.phonescoop.com/phones/phone.php?p=3308