Mobile forensic on locked bootloader
I am new to the forum and I hope to find useful advice ... I have been approaching this forensic branch for a few months and I should recover some data from a Samsung A51 but with the bootloader locked ... as software I use magnet axiom ... obviously unlocking the bootloader will have a system restore ... do you think by making a backup via adb and then, after having done the root, testore the backup, will I be able to find some more data? or is it completely useless? the only way would be some hardware tool?
Axiom won't help here. You'll need a tool that can exploit the phone at bootloader level to bypass the locked bootloader. Other, big forensic tools can do that. ADB backup is not very useful when it comes to recovering deleted informations. It doesn't include crucial database files and many apps are execluded as well.
Regarding "recovering some data". This is FBE based device. Recovering deleted files is not really possible for years now. It's very uncommon to recover many SMS as well from those devices.
@Colder1989, Why bother to unlock bootloader? It's too dangerous and unnecessary. If this android phone is unlocked. all you have to do is to conduct "APK downgrade extraction" to extract data from Apps such as WhatsApp, Telegram..etc. Some forensic tools support this method and some don't.
Frankly speaking you could do it manually no matter an App is based on single apk or split apks. As long as you understand the details , no doubt you could complete this mission. Take a look at my blog as below link, wish you success.