Android Forensics
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
To start extracting data from an Android device it has to be unlocked. If it's locked you can:
Check if the device has debugging via USB activated.
Check for a possible
Try with
Create an and extract it using : java -jar abe.jar unpack file.backup file.tar
cat /proc/partitions
(search the path to the flash memory, generally the first entry is mmcblk0 and corresponds to the whole flash memory).
df /data
(Discover the block size of the system).
dd if=/dev/block/mmcblk0 of=/sdcard/blk0.img bs=4096 (execute it with the information gathered from the block size).
Use Linux Memory Extractor (LiME) to extract the RAM information. It's a kernel extension that should be loaded via adb.
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.