although StackExchange sites have helped me a lot in the past, it's now the first time to actively post a question here.
I have an issue with my Motorola Moto G which is running with Android 7.1.1 (Lineage OS) - I was searching throughout the whole Internet but w/o success.
I want to do some forensic work on the memory of this device. It has an internal flash, and an external SDcard, which is formatted in a way to extend the internal memory as well. I think, since Android Marshmallow there is this option to do that.
I can dump the internal userdata partition and mount on my Linux PC w/o problems:
# ADB Shell: -> ls -l /dev/block/platform/msm_sdcc.1/by-name/ ... userdata -> /dev/block/mmcblk0p42 # Host PC: -> adb pull /dev/block/mmcblk0p42 mmcblk0p42.img -> sudo mount -o loop mmcblk0p42.img mmcblk0p42 -> ls mmcblk0p42 adb app-ephemeral backup ...
I am trying the same with the external SD-Card formatted as internal:
# ADB Shell: -> ls -la /dev/block/platform/soc.0/7864900.sdhci/by-name/ ... android_expand -> /dev/block/mmcblk1p2 # Host PC: -> adb pull /dev/block/mmcblk1p2 mmcblk1p2.img -> sudo mount -o loop mmcblk1p2.img mmcblk1p2 mount: wrong fs type, bad option, bad superblock on /dev/loop1, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so.
What is wrong here? If I put the SDcard to a card reader then the partition are recognized but cannot be mounted due to unknown file system.
Any help is very appreciated. Jens