Asus Qualcomm Andro...
 
Notifications
Clear all

Asus Qualcomm Android 11

3 Posts
3 Users
0 Reactions
1,668 Views
(@frensics)
Eminent Member
Joined: 3 years ago
Posts: 11
Topic starter  

Hallo

Device: Asus I002D

CPU: SD8250

Android: 11

image extracted: Physical

Extraction size: 117gb

 

not managed to extract userdata\photos.

Any software support this extraction?

 

 

This topic was modified 3 years ago by Frensics

   
Quote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

It is possible the "userdata\photos" data resides in an encrypted partition within your Physical Image.

I recommend opening and examining the 117GB Physical Image file you created using multiple analysis tools to confirm if your image contains any encrypted partitions.

Here is a free to use tool which can ingest and analyze the 117GB Physical Image:

https://www.sleuthkit.org/autopsy/

Autopsy can see partitions within the Physical Image and help you determine if your Physical Image contains an encrypted partition, which will prevent one from viewing the encyrpted partition's contents.

Autopsy also can parse Android SMS messages and more.

If you have US $99.00 in your budget, I recommend purchasing a single phone license of Compelson's MOBILedit Forensic:

https://www.mobiledit.com/online-store/forensic-express

You can ingest the 117GB Physical Image directly into MOBILedit Forensic, or re-image your phone.  

QUESTIONS:

1.  What tool did you use originally to image the phone?

2.  Was the phone rooted?

3.  What is the 117GB Physical Image file's full file name?  Example=  111.BIN

 


   
ReplyQuote
(@arcaine2)
Estimable Member
Joined: 9 years ago
Posts: 239
 

It should use FBE (file based encryption) so physical extraction like this is useless when it comes to data. You should look to obtain full filesystem extraction. Qualcomm Live method in UFED may work.


   
ReplyQuote
Share: