Re: Retrieve deleted data from a mobile phone

From: Job de Haas <job(at)itsx.com>
Date: Mon Jul 07 2003 - 15:29:27 EDT

Hi,

> Here's my question: is there the possibility to retrieve deleted data

I can't comment on a specific model or specific case. However, most mobile phones use flash memory to store information. Deleting something from a flash (file system) does not necessarily mean it gets erased in the flash immediately. The flash contains also the browser cache which can be intersting if someone used it (this was for my 6210).

> If it is not possible and you can tell me this for sure, I would be happy
> with it because I only need a good reason for or against this question.

It can only be tested on a case by case basis. I've never looked into it. My gut feeling is that few consider it important to really erase it from the flash if it is not convenient.

> Are there any tools which can retrieve the information I mentionded above?

The general flash tools for mobile phones can read all flash most of the time with all information in it. For Nokia phones for example this is no problem at all with a simple parallel cable.

I managed to read all flash and all RAM from an XDA PDA (sort of iPAQ) and also was able to circumvent the password protection in the process. I put up some info at http://www.itsx.com/pocketpc/ in the bootloader section.

Best regards,

Job

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Jul 8 13:05:44 2003