2

I'm a little new to the Android file system, I'm doing a project for a digital forensics class and I want to create a bit-for-bit image of my Nexus 5 running 4.4.4 stock, rooted. The normal way I would do this on a Linux system would be with dd like so.

dd if=/dev/sda of=/dev/sdb

As I have no removable SD card, I was planning on doing this with a terminal emulator and writing to a flash drive over the micro USB port. I need to be able to mount the image and browse the files from the device once the image is created. I'm specifically looking at GPS data and where it is stored, or unknowingly stored, from apps or the system. I'll sort that out myself once I have an image, I have some scripts I've written that will search through all directories and files looking for latitude and longitude strings. Although those probably won't find anything in the databases for android, I'll have to find another way to script/look through those.

Is there a good way to create the type of image I'm describing?

Thanks for any help!

2

You could do that using dd directly on the device, making sure the output goes to a partition you can afford to be modified. I will not "rank" here from a forensics point of view (where of course it is best to have nothing modified on the device, which is not always possible, etc.), but simply list options. As you are looking for data written by apps, you're most likely after the /data partition, so this is the most important to remain unchanged (though it already is subject to changes with the Android system booted):

  • attach an external drive via OTG (might apply minor changes to /data for mounting information)
  • write to an existing internal partition (e.g. the internal SD if you plan to "dump" /data)

Now let's check for an alternative. Assuming you've got a custom recovery installed, you could simply boot into that (something you'd probably check first). In recovery, by default most partitions (especially /data) are not mounted, so no modifications are done. Moreover, a custom recovery offers you the possibility to create a backup – which basically is a dump of all file systems (usually except the SD card(s)), each in a separate file. These dumps would go to the SD card (here: the internal one, as a Nexus has no external). You could adb pull those images to your computer even while still being in recovery mode.

  • Thank you for the reply! Is /data a partition? Not a directory? I assumed it was a directory of a partition on the device. If I'm browsing root I have; /acct, /cache, /config, /d, /data, /dev, /etc, /mnt, /proc, /root, /sbin, /sdcard, etc.. Normal linux directories. Which on a linux system would typically be on something like sda1, sda2, depending on how many partitions you have, if you wanted the whole disk, it would be sda. Is there an equivalent of this for android devices? And a way to image that, recovery isn't always an option, and doesn't it wipe the phone? – jracine Oct 29 '14 at 18:27
  • You might wish to see my answer on Android Folder Hierarchy, which should explain most of this. Feel free to ask then if something's left unclear. – Izzy Oct 29 '14 at 20:01
  • Ahh, that cleared everything up, thank you! That's a difference I wasn't expecting, coming from a Linux back ground. – jracine Oct 29 '14 at 20:07
  • Things are not that different (see e.g. /proc and /sys and all that). Android just adds a little to it (/data, /cache, /system, /recovery, and some more). Glad we got that resolved – good luck with your tests/experiments! Btw: Andrew Hoog's Android Forensics might come in handy, though no longer that fresh (I've translated the book to German for my publisher, so I know to recommend it ;) A bit pricey (Elsevier, yeah), but maybe you can get hold of a "used copy" at least. – Izzy Oct 29 '14 at 21:05
  • A late update: As you're using Linux, you might be interested in taking a look at my project Adebar – which a.o. generates you shell scripts with all required commands to pull dd images of all partitions from your device (not modifying the device in any way; it simply "pipes" its output back to the "issuer", so the images are stored directly on your Linux machine). – Izzy Jun 5 '15 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.