-
Book Overview & Buying
-
Table Of Contents
Mastering Mobile Forensics
By :
Acquiring the physical image of any device means extracting an exact bit-by-bit copy of the original device's flash memory. In contrast to logical acquisition, physically acquired images hold unallocated space, files, and the volume stack, in addition to the extraction of data remnants present in the memory.
In the Android context, we need to root the device to obtain a superuser privilege to fully access the ADB shell. A physical acquisition can be performed via a custom bootloader, by changing the custom recovery image or using flashing tools. We even have hardware-based acquisition techniques including JTAG and chip-off. Physically acquiring a device means that you have indirectly acquired everything within the device.
Linux-based operating systems include a built-in command-line tool called dd, used (by definition) to copy from source to destination, block-by-block, regardless of their filesystem type or operating system. This utility is included in Android...
Change the font size
Change margin width
Change background colour