Samsung Lock Location

In processing a Samsung SCH-U740 it was found to have a lock code enabled. Utilizing Bitpim’s File-system view I was able to obtain the file-system and hopefully the lock code in the normal areas of nvm_0002, nvm_security etc. In examining the nvm_security folder I found the security code but it was AAAA. Almost as if Samsung had hidden the security code.

A little more digging and I found a file located in the root (/) of the file-system called current_prefs.db. In this sqlite file at offset F15C I located the text “pref_device_lockcode” and right after the text was the four digit lockcode! The phone was unlocked and I was in. A little digging paid off. This is another example of why an examiner MUST always attempt to gain the file-system of the phone to do a systematic and scientific exam.

Lee Reiber

About Lee Reiber

Pioneering mobile device forensic examiner, consultant and trainer, software development innovator and former LE officer with the Boise Police Department
This entry was posted in Training. Bookmark the permalink.