Using DD to image s...
 
Notifications
Clear all

Using DD to image smartphones

18 Posts
6 Users
0 Likes
2,809 Views
CopyRight
(@copyright)
Posts: 184
Estimable Member
Topic starter
 

Hey guys,

can we come up with commands on DD to image smartphones, like take the entire image including system and user data, i know the commands with defer according the phone..

or maybe an article on how to use DD on smartphones and so on.

cheers

 
Posted : 30/04/2014 10:56 am
(@bitstorm)
Posts: 53
Trusted Member
 

I used in an occasion with a Smasung S4 mini the following command
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096adb pull /sdcard/userdata.img c\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.

 
Posted : 30/04/2014 4:37 pm
(@rampage)
Posts: 354
Reputable Member
 

which recovery image did you use?

a custom one?

since the memory is eMMC on this specific samsung device i'm fairly confident that you can simply do adb pull directly on the block device.

 
Posted : 02/05/2014 5:28 pm
(@zergling)
Posts: 38
Eminent Member
 

Some time ago i came across this website and it helped alot. A good place to start at least

https://viaforensics.com/resources/reports/android-forensics/physical-techniques/

Although filepathes might be different for different phones, the basic approach is usable on many occasions wink

 
Posted : 09/05/2014 10:32 am
(@rampage)
Posts: 354
Reputable Member
 

the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing

 
Posted : 09/05/2014 1:15 pm
(@zergling)
Posts: 38
Eminent Member
 

the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing

The link was intended to present some technical background wink the described techniques work with simple adb-commands and free binaries like "nanddump" or "busybox".

The tricky part is getting root access in order to mount all the logical partitions. But sites like xda-developers provide a solution for a majority of devices in this case 8)

 
Posted : 09/05/2014 4:09 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

How would you achieve this without root & debug on?

Can you give a more detail SOP for both your adb and ODIN methods?

I used in an occasion with a Smasung S4 mini the following command
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096adb pull /sdcard/userdata.img c\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.

 
Posted : 09/05/2014 10:19 pm
CopyRight
(@copyright)
Posts: 184
Estimable Member
Topic starter
 

JHUP, you need to use the fastboot boot (custom rom) which will temporarly enable USB debugging for that particular (switch on), then once the device is restated it boots the stock ROM.

But that fastboot command does not work on all makes such as Samsung.

 
Posted : 11/05/2014 10:43 am
(@trewmte)
Posts: 1877
Noble Member
 

Depending upon your requirements dd can be useful but doesn't produce a complete image as it is known dd omits OOB (out-of-band) metadata etc.

There are other trade off methods. One that might be useful to know, which I am aware that doesn't require dd, such as using adb and overwriting the recovery partition with extract and harvesting software followed by a device reboot and directing the target device into recovery mode. Using this method and excuting the new software an image can be obtained plus the OOB metadata can be recovered too; but as said this method is at the expense of overwriting existing software in recovery partition. It is noted that very often there is no evidence in the recovery partition, which usually contains software that might be used for performing maintenance tasks.

 
Posted : 11/05/2014 1:17 pm
(@rampage)
Posts: 354
Reputable Member
 

JHUP, you need to use the fastboot boot (custom rom) which will temporarly enable USB debugging for that particular (switch on), then once the device is restated it boots the stock ROM.

But that fastboot command does not work on all makes such as Samsung.

Hello
can you please articulate more about this subject? any documentation i can take a look at?

i mean, about volatile stuff

 
Posted : 12/05/2014 3:38 pm
Page 1 / 2
Share: