Make iso of sdcard + data directory

Question

I need to be able to make an iso file of the /mnt/sdcard and /data/ directories on both rooted and nonrooted phones(for forensic analysis). Older phones I can mount to my linux machine and run mkisofs and it works perfect. However on newer devices I can't seem to mount the devices.

Android has dd built into the shell so I can use that to create an iso of the directories as well. However besides the sdcard I can't find anywhere that I have write access on the system for non rooted phones.

So my question is where on an android system can I get write access while in the shell other than the sdcard and the data directores. A broader question would be to solve the problem of either mounting the device or making the iso file from outside android's shell.

Answer 1

No way to do that without root, for good reasons (security). I recommend you to take a look into Andrew Hoogs Android Forensics book, where you'll get a lot of insight not only in this speecial context, but for other Forensics related issues as well as general background information on Android devices and the Android system itself.

Without root, you will not be able to access all directories on internal storage -- most of them will be denied to you even for reading, let alone writing. If access would be that easy, all security would be gone, as apps could freely access everything. However, there are a few directories you could get write access to (probably to install some forensics tool I guess?), such as temp directories. Not being at home I currently cannot check which ones this might be (try e.g. /data/local, which is what the playstore app uses as temp folder for app installations, or check with the mount command which mount points use tmpfs -- though not all tmpfs file systems may grant you full access).

A fully detailed description would be beyond the scope of this site, as we focus on end-user problems; forensic specific problems are rather not end-user related.