First of all I want to thank you for this fantastic course. I searched here in the forum but found no answer. The question is as follows. I have an Android without root and with the bootloader blocked, to create a complete physical image (folder \ data) I have to root, but to root I have to unlock the bootloader, but if I create the bootloader socket. … automatically all data will be lost. How can I do? Also, if you’ve had a rooted Android, the \ data folder will still be encrypted, right? To get a readable image of the folder, I will have to mount the \ data folder and make an image with the device turned on. Quite right?
Others here may be able to help more, but this is outside of what Autopsy can do. I suggest googling how to image an android phone.
Thanks for the answer, yes I know that the image cannot be created with Autopsy. I hope someone can help me, I have seen a lot on google, but I can’t find it. I finished the course and it was really nice !! Thanks again for the opportunity to take this certificate.
Hello.
It depends on your make/model/OS version of the phone. You are correct that if you unlock the bootloader that your userdata will be erased. If you have a Qualcomm based device you might be able to use EDL mode to get a physical extraction. For some Android devices you might be able to find an ENG root which can get you raw access and then you can get a physical extraction. Getting data off via JTAG may also be an option. If this is a phone that you have full access to and can place in Developer Mode, and have access to some commercial tools, then perhaps a “Smart ADB” option may exist. It all depends on the device!
I thank you for the exhaustive answer. Just yesterday evening he was reading about these methods including jtag.
https://resources.infosecinstitute.com/category/computerforensics/introduction/mobile-forensics/the-mobile-forensics-process-steps-types/#gref