1

although StackExchange sites have helped me a lot in the past, it's now the first time to actively post a question here.

I have an issue with my Motorola Moto G which is running with Android 7.1.1 (Lineage OS) - I was searching throughout the whole Internet but w/o success.

I want to do some forensic work on the memory of this device. It has an internal flash, and an external SDcard, which is formatted in a way to extend the internal memory as well. I think, since Android Marshmallow there is this option to do that.

I can dump the internal userdata partition and mount on my Linux PC w/o problems:

# ADB Shell:
-> ls -l /dev/block/platform/msm_sdcc.1/by-name/ 
      ... userdata -> /dev/block/mmcblk0p42 
# Host PC:
-> adb pull /dev/block/mmcblk0p42 mmcblk0p42.img
-> sudo mount -o loop mmcblk0p42.img mmcblk0p42
-> ls mmcblk0p42
       adb app-ephemeral backup ...

I am trying the same with the external SD-Card formatted as internal:

# ADB Shell:
-> ls -la /dev/block/platform/soc.0/7864900.sdhci/by-name/ 
      ... android_expand -> /dev/block/mmcblk1p2
# Host PC:
-> adb pull /dev/block/mmcblk1p2  mmcblk1p2.img
-> sudo mount -o loop mmcblk1p2.img mmcblk1p2
       mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail or so.

What is wrong here? If I put the SDcard to a card reader then the partition are recognized but cannot be mounted due to unknown file system.

Any help is very appreciated. Jens

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.