Hallo
Device: Asus I002D
CPU: SD8250
Android: 11
image extracted: Physical
Extraction size: 117gb
Â
not managed to extract userdata\photos.
Any software support this extraction?
Â
Â
It is possible the "userdata\photos" data resides in an encrypted partition within your Physical Image.
I recommend opening and examining the 117GB Physical Image file you created using multiple analysis tools to confirm if your image contains any encrypted partitions.
Here is a free to use tool which can ingest and analyze the 117GB Physical Image:
https://www.sleuthkit.org/autopsy/
Autopsy can see partitions within the Physical Image and help you determine if your Physical Image contains an encrypted partition, which will prevent one from viewing the encyrpted partition's contents.
Autopsy also can parse Android SMS messages and more.
If you have US $99.00 in your budget, I recommend purchasing a single phone license of Compelson's MOBILedit Forensic:
https://www.mobiledit.com/online-store/forensic-express
You can ingest the 117GB Physical Image directly into MOBILedit Forensic, or re-image your phone. Â
QUESTIONS:
1. What tool did you use originally to image the phone?
2. Was the phone rooted?
3. What is the 117GB Physical Image file's full file name? Example= 111.BIN
Â
It should use FBE (file based encryption) so physical extraction like this is useless when it comes to data. You should look to obtain full filesystem extraction. Qualcomm Live method in UFED may work.