DFS101: 11.2 Mobile Device Acquisition

Поділитися
Вставка
  • Опубліковано 7 січ 2025

КОМЕНТАРІ • 17

  • @ravan01d
    @ravan01d 3 роки тому +4

    How would you do this on a android mobile device with broken screen and no usb debugging enabled.

  • @mayer1861
    @mayer1861 7 місяців тому

    Is there way to resume when I interrupt the progress?
    Like DD can resume with seek or skip, but need `of=` option, which is different location from android and the destination image if we use this method

  • @jampinkoigomezgomez1297
    @jampinkoigomezgomez1297 2 роки тому +1

    Hi. After successfully creating an image of my Android, i noticed that folders in userdata are encrypted (random letters), I believe ny device has File Based Encryption. What if I remove my lockscreen password and other security measures such as fingerprint lock, will I be able to have a decrypted backup? I am currently trying to backup my userdata partition as I have accidentaly deleted a bunch of files in my device. Thank you.

  • @Benedict00_MankoMuncher
    @Benedict00_MankoMuncher 3 роки тому +1

    I keep getting an error when trying to install busybox... it goes to the phone but when i open it on the phone and hit install.. it says it wasnt installed ..
    what do I do? Please

  • @jampinkoigomezgomez1297
    @jampinkoigomezgomez1297 2 роки тому +2

    Hi when acquiring physical image, should the phone be turned off?

    • @DFIRScience
      @DFIRScience  2 роки тому +2

      Modern phones will need to be turned on while making the image, unfortunately. That's one reason phone acquisitions are so difficult.

    • @jampinkoigomezgomez1297
      @jampinkoigomezgomez1297 2 роки тому +1

      @@DFIRScience Thank you so much, I followed the instructions above and I was able to sucessfully create an image of my userdata (.dd), f2fs format, however I can't seem view the contents using sleuthkit. I believe because it's encrypted? I am using Poco x3 nfc by the way. Do you have any idea how I should image my userdata to have a decrypted image? Userdata path is in dev/block/sda16

    • @DFIRScience
      @DFIRScience  2 роки тому

      @@jampinkoigomezgomez1297 I'd recommend this method instead: ua-cam.com/video/jRRH2YWSnhE/v-deo.html
      You'll get a more consistent logical acquisition.

  • @wrighttracie5175
    @wrighttracie5175 Рік тому

    how to bild a tecknow side like arigenul on my so kold phone/computer or laptop but seance ot wasnt from hoom them are but to take my sides upstruckted compermashion,up loaded attack on me,my identity or what qustionabel between life sides believeabel processed patirn untill one or nore me any that is correct of connectshons on whatll thayll do for apucealietly procced or deteckd/epstrackd/unconneckted/platform to then makeing untopshional optane/controll by my tecknalagys untill im not withen any all so wen what pospone throw time,death,speaicheal then as time trying too caputalizeing then trying over run then brakeing inblackment-meaning to completely unabel my typ of over thinken about any other then makeing look as thay care then strikein proponein thoo time but make as im standen alone but ill do like i always or trying to ,look away then captulizeing processed thoo timed spearitcheal or on one minny or all or one pucifik life streem on to/then as trying too make so regretabel 4 minny or all but im doing is takeing death from one but not what u think ❤

  • @trushabhavsar6054
    @trushabhavsar6054 3 роки тому

    I followed same steps and done exact same things to aquire an image of my andorid but m still having problem extracting into sleuth kit autopsy. How can I solve that?

    • @DFIRScience
      @DFIRScience  3 роки тому

      Were you able to download data from the phone?

    • @trushabhavsar6054
      @trushabhavsar6054 3 роки тому

      @@DFIRScience Yes I got 60gb image file from my 64gb phone

  • @sarathreddy844
    @sarathreddy844 4 роки тому +2

    Try to create more videos

    • @DFIRScience
      @DFIRScience  4 роки тому +1

      Working on it. Do you have anything specific you would like to see?

    • @EGBOWKER
      @EGBOWKER 3 роки тому

      @@DFIRScience Hi your videos are great very explained.. can you please show a full video about recovering files from a formatted android phone, from accessing the device > getting permissions > creating an image and recovering the data ? THNX!

  • @ospoint7689
    @ospoint7689 4 роки тому

    kingoroot? xD Sorry man, is not a new device, true? Because a root in new device not a simple and a requisite is a wipe ...

    • @DFIRScience
      @DFIRScience  4 роки тому +1

      Yeah - that one is older but simple. You might look at something like Magisk. www.howtogeek.com/312404/how-to-root-your-android-phone-with-magisk/