In processing a Samsung SCH-U740 it was found to have a lock code enabled. Utilizing Bitpim’s File-system view I was able to obtain the file-system and hopefully the lock code in the normal areas of nvm_0002, nvm_security etc. In examining the nvm_security folder I found the security code but it was AAAA. Almost as if Samsung had hidden the security code.
A little more digging and I found a file located in the root (/) of the file-system called current_prefs.db. In this sqlite file at offset F15C I located the text “pref_device_lockcode” and right after the text was the four digit lockcode! The phone was unlocked and I was in. A little digging paid off. This is another example of why an examiner MUST always attempt to gain the file-system of the phone to do a systematic and scientific exam.
