±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 32771
New Yesterday: 9 Visitors: 153

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Using DD to image smartphones

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Using DD to image smartphones

Post Posted: Wed Apr 30, 2014 4:56 am

Hey guys,

can we come up with commands on DD to image smartphones, like take the entire image including system and user data, i know the commands with defer according the phone..

or maybe an article on how to use DD on smartphones and so on.

cheers  

CopyRight
Senior Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Wed Apr 30, 2014 10:37 am

I used in an occasion with a Smasung S4 mini the following command:
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096 adb pull /sdcard/userdata.img c:\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.  

Bitstorm
Senior Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Fri May 02, 2014 11:28 am

which recovery image did you use?

a custom one?

since the memory is eMMC on this specific samsung device i'm fairly confident that you can simply do adb pull directly on the block device.  

Rampage
Senior Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Fri May 09, 2014 4:32 am

Some time ago i came across this website and it helped alot. A good place to start at least

viaforensics.com/resou...echniques/

Although filepathes might be different for different phones, the basic approach is usable on many occasions Wink  

Zergling
Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Fri May 09, 2014 7:15 am

the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing  

Rampage
Senior Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Fri May 09, 2014 10:09 am

- Rampage
the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing


The link was intended to present some technical background Wink the described techniques work with simple adb-commands and free binaries like "nanddump" or "busybox".

The tricky part is getting root access in order to mount all the logical partitions. But sites like xda-developers provide a solution for a majority of devices in this case Cool  

Zergling
Member
 
 
  

Re: Using DD to image smartphones

Post Posted: Fri May 09, 2014 4:19 pm

How would you achieve this without root & debug on?

Can you give a more detail SOP for both your adb and ODIN methods?

- Bitstorm
I used in an occasion with a Smasung S4 mini the following command:
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096 adb pull /sdcard/userdata.img c:\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.
 

jhup
Senior Member
 
 

Page 1 of 3
Go to page 1, 2, 3  Next