Spreadtrum - Get Physical dump from Spreadtrum

Intro

The Spreadtrum method extracts a physical image from phones that use Spreadtrum or UNISOC chipsets without having root access and by bypassing the lockscreen. Using the Spreadtrum bootloader mode (SPD), MOBILedit Forensic accesses the phone memory through the System on Chip (SOC).

Spreadtrum chipsets are manufactured by UNISOC.

Many devices that run on the KaiOS operating system use a spreadtrum chipset. The only way to get data from KaiOS devices using MOBILedit Forensic is with one of the chipset methods like Spreadtrum, acquiring a physical image and, re-importing the physical for a logical extraction and analysis.

Please note that the physical image is as big as the full phone storage.

Approach

The Spreadtrum method can be accessed via:

• A live-connected device and choosing “Next”.

• Security bypassing option on the “Connect devices or import data” screen:

  • By model

  • By chipset

  • By method

• “Connect device” option on the “Connect devices or import data” screen

To read more about these options, visit the “approach” page.

Spreadtrum bootloader mode (SPD)

Spreadtrum method is a way of extracting physical images from phones with Spreadtrum or UNISOC chipsets. This option does not require the phone to be rooted and works on most Spreadtrum/UNISO-equipped devices once the device is in SPD mode.

Every device has a specific way to enter SPD mode:

• Handset key combination

• Test points (See image below)

When in SPD mode, the device identifies itself as “xxxx” in device manager.

You must have the “Unlocking drivers” installed for Windows to communicate with the device in EDL mode.

IMAGE OF SPD TEST POINTS

When using the “By model” option it may be possible to see a photo detailing the location of test points for a device if the test points are known to us.

Where it is known to us that shorting of the test points is required to enter EDL mode and, we have previously tested that specific device, we have provided graphical instructions within the software to assist you. Below is an example of the location of the test points on a phone's printed circuit board assembly.

SCREENSHOT OF SPD TEST POINTS IN MEF

HOW TO

Whatever “approach” you choose to access the Spreadtrum method, you will ultimately reach the screen below where there is a reminder of the prerequisites, connection steps and how to enter SPD mode:

If MOBILedit Forensic does not have a preinstalled PAC file for your device, you can try to search for a file yourself on the internet.

Once found, choose "Select PAC file" and import the file to MOBILedit Forensic using the three dots. Then after selecting the file and clicking “Next”, connect the phone in SPD mode, if the PAC file is correct, a physical image will be extracted.

We recommend looking for a PAC file for the phone you are investigating, however a PAC file for a similar phone or chipset may also work.

There is no risk of data loss by trying different PAC files.

1. To show the method in full, we will use a live-connected device and select “Next”

2. Choose a security bypassing approach.

Other info

There are videos online that show how to create a PAC file, you can find them on YouTube, Vimeo or other sources.