zoukankan      html  css  js  c++  java
  • Is it a full physical image???

    My friend asked me why she could not find some important files in a physical image acquired from an Android phone. She took the evidence tree of an Android 6.0 physical image acquired from LG G3 for example as below, she’s used to see /data/data in a physical image.

    I took a look at this phone. This phone is Huawei Mate 9 and its model is MHA-L29. The OS is Android 7.0 and it’s rooted already. She could retrieve some interesting files in /data/data/ , but the problem was she did not see those same files in the physical image. She’s just curious about what happened to the physical image. Let me show you what the image acquired from Mate 9 looks like.

    Take a look at its log file activity_log.txt and some error messages draw my attention. It looks like that it’s not a full physical image…Maybe that’s the reason why she could not get those same files in /data/data.  I will use another tools to acquire this phone and find out what's wrong with it.

     Fotrunately UFED4PC solved this problem and extract those files in /data/data/ or /data/system/.

  • 相关阅读:
    myeclipse连接并运行sql文件
    搜集的一些常用的方法
    使用SolrJ代码导入,发布搜索服务
    solr客户端的使用
    Ubuntu搭建solr搜索服务器
    Intersecting Lines(叉积,方程)
    Labyrinth(记忆化BFS)
    Segments(叉积)
    TOYS(叉积)
    Treasures and Vikings(两次搜索)
  • 原文地址:https://www.cnblogs.com/pieces0310/p/7119033.html
Copyright © 2011-2022 走看看