I need to be able to make an iso file of the /mnt/sdcard and /data/ directories on both rooted and nonrooted phones(for forensic analysis). Older phones I can mount to my linux machine and run mkisofs and it works perfect. However on newer devices I can't seem to mount the devices.

Android has dd built into the shell so I can use that to create an iso of the directories as well. However besides the sdcard I can't find anywhere that I have write access on the system for non rooted phones.

So my question is where on an android system can I get write access while in the shell other than the sdcard and the data directores. A broader question would be to solve the problem of either mounting the device or making the iso file from outside android's shell.

  • Sorry to break this to you, but you cannot make any part of the system root writeable without root.
    – Liam W
    Dec 21, 2012 at 16:13

1 Answer 1


No way to do that without root, for good reasons (security). I recommend you to take a look into Andrew Hoogs Android Forensics book, where you'll get a lot of insight not only in this speecial context, but for other Forensics related issues as well as general background information on Android devices and the Android system itself.

Without root, you will not be able to access all directories on internal storage -- most of them will be denied to you even for reading, let alone writing. If access would be that easy, all security would be gone, as apps could freely access everything. However, there are a few directories you could get write access to (probably to install some forensics tool I guess?), such as temp directories. Not being at home I currently cannot check which ones this might be (try e.g. /data/local, which is what the playstore app uses as temp folder for app installations, or check with the mount command which mount points use tmpfs -- though not all tmpfs file systems may grant you full access).

A fully detailed description would be beyond the scope of this site, as we focus on end-user problems; forensic specific problems are rather not end-user related.

  • mount tmpfs is an interesting approach. However receiving error: operation not permitted---even on the sdcard itself. I did try all the the temp folders I could find (there's a few scattered throughout the system) and none of them yielded a write access
    – KDEx
    Dec 21, 2012 at 16:55
  • I didn't say "mount it" -- this only root can do. Again only root. What I meant was: try to access it without root when it already is mounted. This should for sure be possible with /data/local (according to above mentioned book).
    – Izzy
    Dec 21, 2012 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .