ATF D.R.I.V.E Demonstration on Lumia 630 Phone

[GPG_Staff]

*** WARNING ***

The Video has NO SOUND !!!

Please Play your favorite MP3 Song In the Background before

viewing. Also change Video Quality to 720p HD

ATF D.R.I.V.E.

Data Recovery Interface Via EMMC


EMMC PARTITIONS from a Mobile Phone BECOMES A REMOVABLE DRIVE
in your DESKTOP PC Running WINDOWS XP, Vista, 7, 8.0, 8.1 (32-bit and 64-bit Versions)

[GPG_Staff]

Important Information about NTFS Partitions


1. Most NTFS Partitions from Windows Phone 8.0, 8.1 and 10 will only MOUNT if your remove "Read Only" check.

2. If it takes too long to Mount the Partition (More than 1 minute), then just click "DISMOUNT" and wait until it will Dismount Properly. Then mount the Partition again while still removing the check on "Read Only". It should now mount correctly.

3. NEVER Force Close ATF eMMC to Virtual Drive Software! You need to wait until it will properly DISMOUNT the Drive from your Windows System. Sometimes it will take upto 30 seconds for NTFS Partitions.


Here are interesting Folders/Files Inside a Windows Phone Data/MainOS Partition:

SMS Location:
Users\WPCOMMSERVICES\APPDATA\Local\Unistore\ store.vol

Call Logging:
Users\WPCOMMSERVICES\APPDATA\Local\UserData\phone

Internet Cache:
Users\DefApps\APPDATA\INERNETEXPLORER\INetCache
Users\DefApps\APPDATA\Local\Microsoft\Windows\WebC acheV01.dat.

Pictures from Camera Roll:
Users\Public\Pictures\CameraRoll\

Pictures From Facebook Etc:
Users\Public\Pictures\SavedPictures\


More Information about Windows Phone Forensic:
http://www.sans.org/reading-room/whi...rtifacts-35787



*** EVEN IF your Windows Phone MBR, GPT or BOOTLOADERS are ERASED/Corrupted, ATF WILL STILL FIND Your Partitions inside the eMMC!!! ***

*** Professionals Use ATF... What are you using?