±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 35989
New Yesterday: 3 Visitors: 117

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Mini PC Android RIKOMAGIC MK802IIIS

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

sam305754
Member
 

Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: Apr 24, 15 14:48

Hello,

We got an Android device in our case, it is a mini PC Rikomagic MK802 IIIS running Android 4.2 with 4 Go memory. We plugged it behind a write blocker but it is not seen in device manager.
There is a micro SD slot on it, so may be we can transfer data from memory to SD card. Before to go further I would like to know if somebody has already encountered this kind of device and the process used to analyze it.

Regards  
 
  

4Rensics
Senior Member
 

Re: Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: Apr 24, 15 17:17

Not that exact device, but have had one of those cheap and nasty Android TV boxes in. Not sure if its in the same league, but basically no HD in it, all on board. Only connection was USB and HDMI. When plugged into a PC it shown up as an internal storage style device. I could see the file system and manually copy folders, but it was not mounted, so could not image it.

I think in the end I did managed to get a generic Android dump via Oxygen. (It was a while ago)

If you have phone kit, try treating it like a phone and dumping it that way. Its better than nothing if it works.

Plan B is plug it in and get your camera out! Shocked

4R  
 
  

paraben
Member
 

Re: Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: Apr 24, 15 21:43

Your mobile forensic tool should be able to get both a logical and a physical acquisition if it's running Android 4.2. You won't be able to use a write blocker since it's a mobile operating system and your tool won't work if it's blocked.
_________________
Paraben Corporation 
 
  

zoltandfw
Member
 

Re: Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: Apr 24, 15 22:22

It seems like the you will have more or less luck based on the firmware version of the device. In any case, in Android/settings/USB, I check the "Connect to PC" option, and in "Developer Options" check "USB debugging".

You should always have the Android SDK and the Intel USB drivers installed on your investigator workstation when you deal with Android devices. ADB is the tool that will help you get data off of your device, but you need to get used to using it. It is worthwhile to spend time "playing" with ADB since Android is not going away.

So, after you have adb installed, just try to run "adb devices" to see if the device is visible.

There are many resources on the Internet to help you with ADB usage and I can put together a short tutorial as well if needed.  
 
  

OxygenForensics
Senior Member
 

Re: Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: May 22, 15 13:52

If you manage to see this device as ADB in Device Manager and enable USB debugging in device options (as advised in the previous post) you can really try to extract data in Oxygen Forensic Suite. Though this device is not officially supported.  
 
  

sam305754
Member
 

Re: Mini PC Android RIKOMAGIC MK802IIIS

Post Posted: May 22, 15 17:41

Hi all,

Thank you for replies. We couldn't get any data with our mobile forensic tool. So due to deadline we treat it manually as there were not a lot of data in it.
Will see if we get some time to test ADB next time.

Regards  
 

Page 1 of 1