Hacker News Reader

Comment by FaceKicker | Hacker News Reader

It's a pattern lock, so it must not be using disk encryption (only available on Ice Cream Sandwich with either PIN or password). Is there some reason they can't just open it up and see what's on it?

View on HN

Text messages are on internal storage, which becomes unmountable when the device is locked.

Depending on the phone, they should be able to get into recovery mode and connect via adb. However, if it has a locked bootloader, they're SOL, and my schaudenfreude is without limit :)

Sorry, I'm not sure I understand - can you explain more? How does the OS making it unmountable when it's locked stop the FBI from physically removing the internal storage and looking at its contents via another device? I can see how it might require specialized forensics equipment depending on how obscure/proprietary the internal storage hardware is, but that seems like something the FBI would have access to or be able to obtain...

It's weird that they're accessing the device without using forensic "data preservation" techniques.

Surely anything they gather from the phone now will be useless in court?

I would imagine that busting a pimp isn't exactly high up there on the FBI's list of priorities, at least not high enough to desolder a NAND chip (possibly destroying evidence) and reverse-engineer its raw access protocol. Far simpler to just make Google give them the password.

The article states it's a Samsung phone, almost certainly a Galaxy S variant by market share. All Samsung phones I know honor a pre-bootloader protocol (accessible by a leaked tool named "Odin" or its reverse-engineered open source equivalent "Heimdall"). This can read out the contents of all partitions without ever running a Linux kernel. The mountable filesystems are all readable just fine on the host.

The FBI's forensics people are idiots, basically. They have what they want already, they never needed the PIN code.

don't forget that they have strict requirements they have to follow for the data gathered from their forensics to be admissible as evidence.

If those requirements are sane, then a non-invasive raw dump of the flash using only factory-installed firmware is surely more compliant.

Cost-benefit analysis: spend a few hours trying to translate a raw flash dump into a readable format (in addition to the normal forensic work of looking at the phone's drive's contents), or spend <1hr to see whether a pro forma subpoena makes all that work unneccessary?

This isn't a high-priority case, so the FBI will always go with the cheaper, quicker option.

Good grief: "mount -o loop raw_flash_dump /where/ever". I weep for the state of things that straightforward tasks like this seem "hard" not just to yahoos at the FBI but even to Javascript jockeys who frankly should know better.

Going to court harder than spending half an hour to dump the phone? Really?

Reply on news.ycombinator.com