Hi All,
How can we image the internal memory of mobile which have only MTP or PTP connection availeable.
Since on windows they act as portable device and no drive letter is alloted to them it is difficullt to use FTK or Encase6.19.
Regards
Muk
Have you looked to see if the smartphone has jtag connections?
One of your options is to use one of the mobile forensic tools that are available.
This is of course if the specific mobile phone is supported by the tool.
Ron
A couple of years ago, I had a similar problem with a Garmin GPS that mounted as an MTP device. I used a forensic build of Linux (Paladin or Raptor possibly, don't recall), which mounted the device more or less as a normal drive. I then used DCFLDD or DC3DD to pull the image off. Not sure if this would work in your particular case since you would probably just be mounting the USB Storage, not the entire device's file system. But if that's what you're looking for, have at it.
Incidentally, that particular Garmin is now supported just fine by Cellebrite UFED.
Greg's (trewmte) suggestion of JTAG may also be a fine idea if support exists for the particular model. That will give you the greatest chance of pulling more or less all the data if the phone isn't supported by the mainstream mobile-forensic tools.
Kim Thomson
H-11 Digital Forensics
tremwte's solution has the highest chance of getting most off of data off the device.