Huawei Mtk extracti...
 
Notifications
Clear all

Huawei Mtk extraction

4 Posts
3 Users
2 Reactions
2,115 Views
(@frensics)
Eminent Member
Joined: 3 years ago
Posts: 11
Topic starter  

hallo

device: MRD-L21A 9.1.0.415

cpu: MT6761

storage type: EMMC

extraction phisical, full emmc with spflashtool, file ROM.bin

need to extract photos, owner not remember pattern,

i not managed to extract with oxygen and Pa, what i can try?

This topic was modified 3 years ago 4 times by Frensics

   
Quote
(@frensics)
Eminent Member
Joined: 3 years ago
Posts: 11
Topic starter  


   
ReplyQuote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

Is the "vol 46" user data partition encyrpted?  It says encrypted in your photo example which would be the reason you cannot access the contents of the partition.


   
Frensics reacted
ReplyQuote
(@arcaine2)
Estimable Member
Joined: 9 years ago
Posts: 239
 

MRD-L21A uses file based encryption. Physical extraction like this is useless and no tool supports decrypting physical MTK dumps, and extrating proper encryption keys. FBE also means that you cannot bypass the passcode. It's required to properly decrypt user data. It's also F2FS partition, which Autopsy doesn't support.

 

If you had the passcode, you could take a look at upgraded MTK Live method in UFED (beta), but looks like this chipset is not supported yet.


   
Frensics reacted
ReplyQuote
Share: