Skip to content

Latest commit

 

History

History
67 lines (47 loc) · 2.74 KB

README.md

File metadata and controls

67 lines (47 loc) · 2.74 KB
Raw

Vita Forensic

Step 0 : remove passcode

If there is an unknown passcode at startup, then you will need to remove it.

YOU ONLY HAVE 4 to 5 TRIES OF PASSCODES.

To do so, you will need to check if the PS Vita is a 1st gen (PCH-100X) or 2nd gen (PCH-200X).

IN ANY CASE : MAKE A FORENSIC COPY OF THE MEMORY CARD

Remove passcode on 1st gen PS Vita (NOT TESTED, playstation credentials REQUIRED)

  • Turn off the PS Vita
  • Remove all storage cards from the console
  • Hold R + PS + power buttons until the recovery menu appears
  • On the recovery menu reset the system
  • Once the initialisation is done you need to log in with the user credentials of the same playstation account that was on the console
  • Then turn off the console and put back the memory card
  • Now your PS Vita should be able to see all content inside the memory card and you have removed the passcode !

Remove passcode on 2nd gen PS Vita (NOT TESTED, playstation credentials REQUIRED)

  • Be sure there is a storage card inserted in the console

  • If there is no card, it may be possible all data are inside the internal storage and YOU SHOULD NOT GO ANY FURTHER

  • Hold R + PS + power buttons until the recovery menu appears

  • On the recovery menu reset the system

  • Once the initialisation is done you need to log in with the user credentials of the same playstation account that was on the console

  • Then turn off the console and put back the memory card

  • Now your PS Vita should be able to see all content inside the memory card and you have removed the passcode !

Step 1 : create a backup with QCMA

https://github.com/codestation/qcma

Step 2 : get the decryption key from cma.henkaku.xyz

The AID used on the PSVita is a 16 caracters string that is shown inside the backup folder.

Step 3 : decrypt the backup with psvimgtools

https://github.com/yifanlu/psvimgtools

psvimg-extract -K [the encryption key] [your backup].psvimg [destination folder]

Step 4 : launch vitaforensic analysis

Important files

  • Contacts : ur0_contacts/database/addressbook.db
  • List of apps on the live area : ur0_shell/db/app.db
  • Each user have one folder in ur0_user/ like 00/, 01/, ...
  • Near app database : ur0_user/XX/near/data_sys/db/near.db
  • Internet browser save files : ur0_user/XX/savedata/NPXS10003/
  • Internet browser bookmarks : ur0_user/XX/savedata/NPXS10003/webbrowser_bookmark.db
  • Internet browser history : ur0_user/XX/savedata/NPXS10003/webbrowser_history.db
  • User and contacts events : ur0_user/XX/shell/db/act.db
  • Calendar : ux0_calendar/calendar.db
  • Emails : ux0_email/message/mail.db
  • Playlists : ux0_mms/music/AVContent.db ux0_mms/photo/AVContent.db ux0_mms/video/AVContent.db
  • Pictures : ux0_picture/CAMERA/
  • Screenshots : ux0_picture/SCREENSHOT/
  • All images : ux0_picture/ALL/