Dear all,
These day we have got a Vivo X9 with android 6.0.1 to do examing.
because the device is android 6.0.1 and hard to root so we decide to get the physical dump with 9008 mode,and finally we succeed.
But when we put it in Physical Analyzer or WINHEX, it can't show any Data partition and can't parsing any data.Does it mean the Data partition of X9 is encrypted?and how to solve this problem?
Any thoughts/ will be much appreciated,
Thanks.
But when we put it in Physical Analyzer or WINHEX, it can't show any Data partition and can't parsing any data.
Do you see system partitions?
But when we put it in Physical Analyzer or WINHEX, it can't show any Data partition and can't parsing any data.
Do you see system partitions?
Yep,It has the "system partitions" ,here is screenshot in UFED 
and here is "data partitions" screenshot in Winhex
IS it encrypted?Igor, Any suggestion D
But when we put it in Physical Analyzer or WINHEX, it can't show any Data partition and can't parsing any data.
Do you see system partitions?
here you can see the partition 51,the "data partitions"
and the partition50,the "system partitions"
Is there anyway to decrypt the "data partitions" use key find in system partitions?
Thanks.
Yes it looks like your device is encrypted. You can easily check it on the device, just go to the Security Settings. If you have the option of encrypting the phone, it is not yet encrypted. If that option doesn't show, then the phone is already encrypted.
Did you try the Advanced ADB Method in UFED? It should work if the security patch level is older than December 2016.
This reads the user partition while Android is up and running, so encryption is not the issue.
If the security patch level is newer, then you need to root the phone yourself in order to get a physical.
Yes it looks like your device is encrypted. You can easily check it on the device, just go to the Security Settings. If you have the option of encrypting the phone, it is not yet encrypted. If that option doesn't show, then the phone is already encrypted.
Did you try the Advanced ADB Method in UFED? It should work if the security patch level is older than December 2016.
This reads the user partition while Android is up and running, so encryption is not the issue.If the security patch level is newer, then you need to root the phone yourself in order to get a physical.
@SamBrown,
The problem hasn't been solved yet.But thank you for your advise Mr.SamBrown!