[Case Study] Mobile Forensics: How to Extract Data from Locked Devices Powered by Qualcomm

Qualcomm is an American multinational company which focuses on a single goal—invent mobile technology breakthroughs and it is pioneered the commercialization of 3G, 4G, 5G and next-generation wireless cellular communications. Qualcomm’ products are used by many cell phone manufacturers, especially for Android devices.

The existing method of extracting data from these devices is not efficient enough because rooting Android devices are becoming harder, as the data will be also destroyed if a user unlocks the bootloader lock. Therefore, experts are using the chip-off procedure to extract the data, but it can also easily lead to data loss.

Now it’s all in the past!

Forensic experts from SalvationDATA developed a more effective solution. In order to extract and recover data from such locked devices, You have to access Qualcomm 9008 mode and redefine the mobile device as a data storage device. Then it will become easy for operating the physical extraction. After that, your phone can still be restored to its original state, just remember to check the data extraction result.

This physical extraction method of mobile forensics supports the most popular Chinese smartphone brands in the world such as Xiaomi(MI), OPPO, VIVO, ZTE, Letv, and OnePlus, etc. It also has already been integrated into SmartPhone Forensic System(SPF), you can download the software from our resources page of the website and have a free trial.

To enter 9008 Mode, we provide 3 different methods, they are ADB Command, manual operation, and engineering cable connection. How do we decide which method to enter 9008 Mode is the best?

Actually, it is based on your smartphone condition, if the phone is locked or dead we recommend method 2 or 3 and for the unlocked working device, you can just start with method 1.

FYI: The instruction of each method will be shown when you click them.

Now Let’s take a look at how we can extract data from a locked mobile device. (Demonstration used VIVO X7)

Step 1. Run SPF (SmartPhone Forensic System)>Click Tools>Select Qualcomm HS-USB Qdloader.

 

Step 2. Connect your phone>>Select brand model>>click “next”.

 

Click Method 2 you will see instructions 

VIVO X7 is locked and we don’t know the password so we are going to enter 9008 Mode by using manually method 2.

 

Step 3. Press and Hold power button until power switch options appear>>Hold Volume + & – simultaneously>>Press “Power off” and keep holding Volume + & – until screen turns black>>Click “Device Detection” when you see Device detected then you have successfully entered 9008 Mode and click “next”.

 

Step 4. Select the same port with your phone>>choose Image Destination>>Click Start.

PS: If you don’t know which port is your phone, you can check the Device Manager.

 

Step 5. When it’s done, you can check the extracted file.

Well, this is the procedure we extracted data from locked Vivo X7, what can we get from this file? The answer is you can use any mobile forensic tool to import the file for data analysis.

Here, we give you an example for using SmartPhone Forensic System(SPF).

Step 1. Create Task information and click “OK”

 

Step 2. Click “Acquire”

 

Step 3. Click “Load Image”>>Load Image file from saved destination>>Click “OK”

 

Step 4. Select the items that you would like to acquire and Click “Start”

 

Final step: As you can see, we have successfully extracted and recovered data from the file and analysis in SPF.

Conclusion: Use this Qualcomm physical extraction can make a bit-by-bit copy of the flash memory of a locked mobile device. This extraction method is not only extracting the intact data but also extracting the data is hidden or has been deleted.

This technique developed by SalvationDATA also includes read-only functionality, ensuring that data from mobile devices is extracted in a forensically sound manner. We will never stop for developing technique, and help the DFIR community to deal with mobile devices more efficiency in mobile forensics.