BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 11-05-2007, 10:53 AM   #1 (permalink)
New Member
 
Join Date: Nov 2007
Model: 7250
PIN: N/A
Carrier: MTS
Posts: 8
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default Forensics, password resetting, etc.

Please Login to Remove!

Hi Guys,

I'm working in the forensics field, and I have a situation that I'll outline. Hopefully, somebody will have some insight.

I have a Blackberry that's locked with a user's password, and I have no way to get that password. It's on a BES server that I do have access to, but due to the battery almost dying, the transmitter automatically turned itself off.

What I need is to get the blackberry unlocked without losing all of the user's data, as it's important to an investigation.

So my questions are:
- Is there any software that can reset a user's password? Somebody recommended Polarbox 2, but I haven't been able to get a clear response about whether it can do what I need.
- Is it possible to re-enable the wireless connection to the BES server without unlocking the phone?
- Is it possible to bruteforce the encrypted (or hashed?) password from the BES server? I read that passwords are hashed with SHA1, so if I can recover the hash then I might have a chance.
- If all else fails, is it possible to remove the harddrive and acquire the data directly, or is it a proprietary interface?

Thank you very much, and I appreciate any assistance.

Ron

Last edited by iago : 11-05-2007 at 10:59 AM.
Offline  
Old 11-05-2007, 10:55 AM   #2 (permalink)
Retired BBF Moderator
 
Sith_Apprentice's Avatar
 
Join Date: Aug 2005
Model: 9000
OS: 4.6.0.xxx
Carrier: AT&T
Posts: 10,149
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

if you have access to the BES when you charge the blackberry up it should turn wireless back on should it not? I am on a BIS but when i am down to about 3% battery life the wireless shuts off, then when it gets above 15% or so it turns back on.
Offline  
Old 11-05-2007, 10:58 AM   #3 (permalink)
New Member
 
Join Date: Nov 2007
Model: 7250
PIN: N/A
Carrier: MTS
Posts: 8
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

A co-worker has charged it all the way and it didn't come back on. Perhaps on different models it doesn't?
Offline  
Old 11-05-2007, 11:02 AM   #4 (permalink)
Crimson Tide Moderator
 
JSanders's Avatar
 
Join Date: Oct 2004
Location: North of the moss line
Model: 9xx0
OS: 7.0sumtin
PIN: t low
Carrier: Verizon
Posts: 41,907
Post Thanks: 60
Thanked 244 Times in 182 Posts
Default

Ron, welcome to the BBForums.

What Sith said correct, when charged up to 15%, it will turn wireless back on.

--The BES admin can reset the Password.
--re-enable, yes, the BES Admin can do that.
--I don't know. I don't think so.
--No. If this were possible, you would already know it, and RIM would not be the device of choice for the major corps and goverment.

Good luck.
Offline  
Old 11-05-2007, 11:04 AM   #5 (permalink)
Crimson Tide Moderator
 
JSanders's Avatar
 
Join Date: Oct 2004
Location: North of the moss line
Model: 9xx0
OS: 7.0sumtin
PIN: t low
Carrier: Verizon
Posts: 41,907
Post Thanks: 60
Thanked 244 Times in 182 Posts
Default

At least clue us in on the Model Number. Take the battery out and look at the white sticker for a model#, or a website for similar:
Blackberry Software & Accessories Store - Allblackberry
Offline  
Old 11-05-2007, 11:12 AM   #6 (permalink)
CrackBerry Addict
 
bertiebassett's Avatar
 
Join Date: Aug 2005
Location: London, UK
Model: 9700
Carrier: O2
Posts: 961
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

the trick here is get the battery fully charged, do a change password request fro m the BES, then turn the device on and make an emergency call which will force the wireless to connect, disconnect the emergency call (and apologise profusely) and provided the device has updated to the data network then the password request should have taken.

Then unlock the device with the new password...
__________________
LOTS of answers here: Main Page - BlackBerryFAQ
Offline  
Old 11-05-2007, 11:35 AM   #7 (permalink)
New Member
 
Join Date: Nov 2007
Model: 7250
PIN: N/A
Carrier: MTS
Posts: 8
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Thanks for the replies!

There are actually several different model numbers, I can get a list but I really need something generic.

The connection wasn't re-established after charging it, but making an emergency call is a good idea. I'll have to run that one by my boss, though, I could see him not liking that option.

Thanks again!
Offline  
Old 11-05-2007, 11:46 AM   #8 (permalink)
CrackBerry Addict
 
wibbly's Avatar
 
Join Date: Apr 2005
Location: UK
Model: 9700
Carrier: T-Mobile UK
Posts: 857
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

If you are in the field you say, and this is a legitimate investigation, why take risks? Call RIM. I'd have thought they would help make sure you don't mess things up by accident...
Offline  
Old 11-05-2007, 11:55 AM   #9 (permalink)
New Member
 
Join Date: Nov 2007
Model: 7250
PIN: N/A
Carrier: MTS
Posts: 8
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I am, and it is, but I was sort of thrown into this investigation late (I just started here Thursday) and asked to reset it.

That's a great suggestions, though, I will contact RIM and see what they say. If they give me any good information that I can share, I'll post it back here for others' benefits.

Thanks!
Offline  
Old 11-05-2007, 12:15 PM   #10 (permalink)
CrackBerry Addict
 
bertiebassett's Avatar
 
Join Date: Aug 2005
Location: London, UK
Model: 9700
Carrier: O2
Posts: 961
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by iago View Post
Thanks for the replies!

There are actually several different model numbers, I can get a list but I really need something generic.

The connection wasn't re-established after charging it, but making an emergency call is a good idea. I'll have to run that one by my boss, though, I could see him not liking that option.

Thanks again!
Sure but it's the only way of forcing the radio back on if it's been turned off and the device is locked...

Don't bother wasting time with RIM, the people that know the right answers are right here...
__________________
LOTS of answers here: Main Page - BlackBerryFAQ
Offline  
Old 11-08-2007, 01:36 PM   #11 (permalink)
New Member
 
Join Date: Nov 2007
Model: 7250
PIN: N/A
Carrier: MTS
Posts: 8
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Yeah, RIM was no help, they directed me to my provider, and I didn't pursue that avenue.

As an experiment, I discharged my own Blackberry. When it fell below 5%, the transmitter turned off. I charged it up to 100%, and it didn't come back on. That's what I expected.

So, with my boss' permission, I hit "make emergency call", and hung up right away. I guess it didn't go through, since they didn't call me back. The wireless antenna did come back on.

Then, at the BES end, we sent out a password reset command. The password was successfully reset!

Bottom line: Making an emergency call worked perfectly. Thanks to everybody who helped!
Offline  
Old 11-08-2007, 01:48 PM   #12 (permalink)
zip
Thumbs Must Hurt
 
Join Date: Oct 2005
Model: 9700
Carrier: at&t
Posts: 57
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Just look out for devices with content protection enabled on them. This solution won't work for those devices.

-zip
Offline  
Old 11-08-2007, 09:04 PM   #13 (permalink)
BlackBerry Extraordinaire
 
003402's Avatar
 
Join Date: Nov 2005
Location: Colorado Foothills
Model: 8330
PIN: S AND NEEDLES
Carrier: VZW
Posts: 1,098
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I have a model 7130e and it NEVER turns the radio back on if it discharges completely then recharges. Really torques me. Especially if I forget to turn it back on and wonder why i havent been getting any calls....
__________________
"out of chaos comes opportunity"
Offline  
Old 05-04-2008, 07:15 PM   #14 (permalink)
New Member
 
Join Date: May 2008
Model: 8310
PIN: N/A
Carrier: T-Mobile
Posts: 5
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I am looking for deleted SMS messages that are not on a SIM card. If someone executed a 'wipe' to the blackberry and then restored the device with an old backup that did not contain the deleted SMS messages I'm looking for, can I still retrieve the SMS messages?
Offline  
Old 05-04-2008, 11:35 PM   #15 (permalink)
Crimson Tide Moderator
 
JSanders's Avatar
 
Join Date: Oct 2004
Location: North of the moss line
Model: 9xx0
OS: 7.0sumtin
PIN: t low
Carrier: Verizon
Posts: 41,907
Post Thanks: 60
Thanked 244 Times in 182 Posts
Default

bbfrauddector, welcome to the BBForum.

A backup IPD file should contain SMS messages. However, if it does not have your SMS messages you need, you are out of luck.
Offline  
Old 05-05-2008, 07:09 AM   #16 (permalink)
New Member
 
Join Date: May 2008
Model: 8310
PIN: N/A
Carrier: T-Mobile
Posts: 5
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

JSanders, thanks for the response. that sucks. I take it the hex logs are wiped out and the restore of data only refreshes what was saved. Hence the ghost images of old SMS files that have been deleted and stord on the flash memory are toast?
Offline  
Old 05-06-2008, 07:36 PM   #17 (permalink)
New Member
 
Join Date: May 2008
Model: 8310
PIN: N/A
Carrier: T-Mobile
Posts: 5
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Can someone please let me know if the blackberry backup also captured the deleted byte files that store deleted records? Or does a backup just capture the data in the databases and the byte data log of the deleted record that can be used to recreate a message is stored on the physical machine and not backed up via the blackberry backup?
Offline  
Old 05-07-2008, 04:37 AM   #18 (permalink)
CrackBerry Addict
 
wibbly's Avatar
 
Join Date: Apr 2005
Location: UK
Model: 9700
Carrier: T-Mobile UK
Posts: 857
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

> the byte data log of the deleted record that can be used to recreate a message

How can deleted records be used to do this anyway? Is this a BES thing? Something mere mortal users can do, or somthing that requires hacking at binary files manually?
Offline  
Old 05-07-2008, 11:09 AM   #19 (permalink)
New Member
 
Join Date: May 2008
Model: 8310
PIN: N/A
Carrier: T-Mobile
Posts: 5
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

My understanding is that when a file is deleted from a blackberry what happens is the file is compressed by the bb, and then marked by the bb as usable memory. The deleted file then stays on the bb until it is overwritten by another incoming or deleted file. The order of which I can not determine, but I imagine there is a que that exists in the bb handheld device that overwrites the files in the same order they were deleted. During the time the deleted file is on the bb and before it is overwritten, the contents of that file can be retrieved via a hexidecimal dump, and then the content can be recreated to using bb SDK and a hex compiler. What I don't know is if the deleted file is stored on the orginating DB or moved to a file located on the physical bb and stored as flash memory.
Offline  
Old 05-07-2008, 12:54 PM   #20 (permalink)
New Member
 
Join Date: May 2008
Model: 8310
PIN: N/A
Carrier: T-Mobile
Posts: 5
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

after speaking with a guy from Paraben Corporation, he confirmed the deleted files are retrievable if you can physically secure the bb device. However, the deleted files are transferred to the flash memory and if the device is 'wiped' they are gone, with only a slim chance of retrieval. That chance only exists if the files are related to a specific application as the 'wipe' will not delete the application leaving a chance the deleted files might be there, but he did not think there would be any way to get the deleted data back after a wipe has been executed.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright 2004-2014 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.