Using DD to image s...
 
Notifications
Clear all

Using DD to image smartphones

18 Posts
6 Users
0 Reactions
5,339 Views
CopyRight
(@copyright)
Estimable Member
Joined: 13 years ago
Posts: 184
Topic starter  

Hey guys,

can we come up with commands on DD to image smartphones, like take the entire image including system and user data, i know the commands with defer according the phone..

or maybe an article on how to use DD on smartphones and so on.

cheers


   
Quote
(@bitstorm)
Trusted Member
Joined: 14 years ago
Posts: 53
 

I used in an occasion with a Smasung S4 mini the following command
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096adb pull /sdcard/userdata.img c\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

which recovery image did you use?

a custom one?

since the memory is eMMC on this specific samsung device i'm fairly confident that you can simply do adb pull directly on the block device.


   
ReplyQuote
(@zergling)
Eminent Member
Joined: 13 years ago
Posts: 38
 

Some time ago i came across this website and it helped alot. A good place to start at least

https://viaforensics.com/resources/reports/android-forensics/physical-techniques/

Although filepathes might be different for different phones, the basic approach is usable on many occasions wink


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing


   
ReplyQuote
(@zergling)
Eminent Member
Joined: 13 years ago
Posts: 38
 

the AFPhysical toolchain isn't available for download tho.

i guess?

i'll try to gather the sources of different tools and build my toolchain for some testing

The link was intended to present some technical background wink the described techniques work with simple adb-commands and free binaries like "nanddump" or "busybox".

The tricky part is getting root access in order to mount all the logical partitions. But sites like xda-developers provide a solution for a majority of devices in this case 8)


   
ReplyQuote
jhup
 jhup
(@jhup)
Noble Member
Joined: 16 years ago
Posts: 1442
 

How would you achieve this without root & debug on?

Can you give a more detail SOP for both your adb and ODIN methods?

I used in an occasion with a Smasung S4 mini the following command
adb shell dd=/dev/block/mmcblk0p24 of=/sdcard/userdata.img bs=4096adb pull /sdcard/userdata.img c\userdata.img

Iused in front of able to dd the device an alternate recovery image (use ODIN 1.85) to be able to have full access and used android-tools-fastboot/adb to connect to the device. The namings of the partitions differs between al models. You've to find out what's the name of the partitions.

Luks encryption can be handled with the tool Luks Crack.


   
ReplyQuote
CopyRight
(@copyright)
Estimable Member
Joined: 13 years ago
Posts: 184
Topic starter  

JHUP, you need to use the fastboot boot (custom rom) which will temporarly enable USB debugging for that particular (switch on), then once the device is restated it boots the stock ROM.

But that fastboot command does not work on all makes such as Samsung.


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
 

Depending upon your requirements dd can be useful but doesn't produce a complete image as it is known dd omits OOB (out-of-band) metadata etc.

There are other trade off methods. One that might be useful to know, which I am aware that doesn't require dd, such as using adb and overwriting the recovery partition with extract and harvesting software followed by a device reboot and directing the target device into recovery mode. Using this method and excuting the new software an image can be obtained plus the OOB metadata can be recovered too; but as said this method is at the expense of overwriting existing software in recovery partition. It is noted that very often there is no evidence in the recovery partition, which usually contains software that might be used for performing maintenance tasks.


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
 

JHUP, you need to use the fastboot boot (custom rom) which will temporarly enable USB debugging for that particular (switch on), then once the device is restated it boots the stock ROM.

But that fastboot command does not work on all makes such as Samsung.

Hello
can you please articulate more about this subject? any documentation i can take a look at?

i mean, about volatile stuff


   
ReplyQuote
Page 1 / 2
Share: