Question Extract memory of Samsung Galaxy A52 - Samsung Galaxy A52 4G

Hello everyone!
For my bachelor's thesis, I am currently trying to correctly back up the data of a Samsung Galaxy A52 forensically. I created a first backup with adb backup. However, I would also like to create a physical one. To do this, I applied twrp-3.5.2_10-0-a52q.img.tar to the device using Odin. Afterwards I was able to extract the entire memory (~124GB) using "dd if=/dev/sda ..." and ncat. Is there a possibility to analyse this image further on? I tried it with Autopsy, but the result was not satisfactory.
Or would it be possible to create the image in another way? Rooting is no longer possible in this case, as I do not want to delete the memory.
Thank you very much for your help.

Did you dd the full sda device?
If so, you should just dd the data partition instead. Also, if your data partition is still encrypted (Stock ROM does that automatically) you won't be able to access your data.
If the data partition is mountable in TWRP and you can access files in it then you're not encrypted.
So if you then successfully dd the data partition to a .img file you should easily be able to mount it if you're running Linux on your Computer. I'm not sure whether it would be extract-able with e.g. 7zip on Windows, guess you'll have to figure that out on your own.

i did dd the full sda.
The data partition is still encrypted in the twrp. The only thing I can do for my further work is to back up everything else.
Is there a way to extract the encryption keys and decrypt the files manually? e.g. with Lime, if the keys are stored in the ram.

If your data partition is still encrypted then there's no chance of accessing your data through TWRP or even decrypting it. Only stock ROM can read your data if it's encrypted. That's why you usually format your data partition and patch the fstab after unlocking the bootloader.

thank you very much. This is enough information for my further work.

Related

[Q] Undo data wipe/undo changing FS

Hello everyone,
so I accidentally wiped my /data/media on my OnePlus One where all my backups where in because I wanted to try out F2FS . I didn't have in mind, that for doing that TWRP would have to format the whole userdata partition instead of just using rm for everything except /data/media like in normal wiping :silly:.
Now I wondered if there was any way to recover at least the last deleted backup, because I guess it's still lying around somewhere in the flash cells. I know that there are plenty of programs for PCs to accomplish that, but does anyone perhaps have an idea about how to do it on a phone, preferably without having to boot into Android, as it might overwrite the data when setting up? I thought about pulling an image of the partition via adb in recovery and try to recover the files from that on the PC, but I have no idea on how to get the image to my pc without storing it on the phone first, which would obviously definitely overwrite all the data. And also I don't know if that image would actually contain all the data because I couldn't find out if the flash uses wear leveling.
If anyone has got any idea I would really appreciate to hear it, even if it only says that it's impossible.
Many thanks in advance .

[Q] [HELP] Accidentally formatted data partition

I wanted to do a factory reset (i.e. remove everything from /data except /data/media/0), but ended up formatting the partition, partly because the Materialised Theme rearranges the buttons, partly because I am a bit dumb seemingly...
After I realized what I just did, I immediately piped the whole partition onto my PC using dd and netcat. I hoped to be able to recover my photos and the /data TWRP backup I did before using photorec, but it couldn't find a single file :crying:
So does TWRP reset every bit of the partition to zero when formatting it?
Or could there be another explanation on why photorec doesn't find anything? Could there be any chance that I'll see my data again?
It's flash memory, tricks that would work on a physical hard disk WILL NOT recover any data. I am sorry but it is not possible, by ANY means, to recover your data.
It sucks I know but please take this as a learning experience on the value of off-device backups. You can upload twrp backups to Google drive directly from the phone for easy secure storage and recovery.
Also Google will sync and backup your photos if you enable it, for the future.

HELP PLZ...Orangefox/twrp backups

I keep trying to do backups but it gets about half way through and the error 255. I don't understand what I'm doing wrong. Is it not possible to backup through twrp on xt1955-5. If not any suggestions on other means. Something that would include my accounts as well would be great. I have an google acct that google refuses to give back. Be cause they say can't verify. I know password but 2sv got messed up. Which is a bunch of bs. They track everything. I would prefer to never have to go through this again. Any help would be great.
First question. What all are you trying to backup? Second, to where? Third, do you have adequate space for said backup?
Also, if you have a pin or code enabled for access to the device I would disable it for the backup process.
I'm trying to back up system and data only to my ext sd with 50g avail but only needing 12g
Pbsipher1 said:
I'm trying to back up system and data only to my ext sd with 50g avail but only needing 12g
Click to expand...
Click to collapse
I was able to use TWRP to create a backup on an SD card. I'm running Android 10 and rom RR.
You might try other avenues like titanium or migrate. A quick internet search might lead you to a better procedure and app.
I've been having the same trouble. I just restored my XT1955-5 to stock RETAIL. Then installed TWRP and Magisk. I set my phone up as I like it, and want to back it up - everything I can possibly backup - boot, data, system, system image, efs, persist1, persist2, fsg, vendor, vendor image, dsp, and boot logo.
Before I tried to backup anything, I made sure that I mounted all of the partitions in TWRP.
The first few times I tried to back them all up at once, I got the error 255. So I started backing up the partitions one by one. The only partition that would NOT backup was the data partition. I still get the error 255 on the data partition backup. But all the others worked fine. I even went back and selected all the partitions except the data partition, and it backed up in one large backup just fine. So I don't know what the deal is with the data partition, but I can grab it with adb pull, so I guess I'm good to go.
I even booted back into the system and turned off the screen lock PIN - changed it to none. But I still couldn't backup the data partition via TWRP.
This should work for you from adb to backup your data partition:
Code:
adb push mmcblk0p64-data.img /dev/block/mmcblk0p64
Thanks tom2112 I'll give it a try what can it hurt. I also heard u have to be decrypted in order to backup data but can't seem to get decryption to stick
i was no able to backup using that command got
adb: error: stat failed when trying to push to /dev/block/mmcblk0p64: permission deni
Tom2112 said:
I've been having the same trouble. I just restored my XT1955-5 to stock RETAIL. Then installed TWRP and Magisk. I set my phone up as I like it, and want to back it up - everything I can possibly backup - boot, data, system, system image, efs, persist1, persist2, fsg, vendor, vendor image, dsp, and boot logo.
Before I tried to backup anything, I made sure that I mounted all of the partitions in TWRP.
The first few times I tried to back them all up at once, I got the error 255. So I started backing up the partitions one by one. The only partition that would NOT backup was the data partition. I still get the error 255 on the data partition backup. But all the others worked fine. I even went back and selected all the partitions except the data partition, and it backed up in one large backup just fine. So I don't know what the deal is with the data partition, but I can grab it with adb pull, so I guess I'm good to go.
I even booted back into the system and turned off the screen lock PIN - changed it to none. But I still couldn't backup the data partition via TWRP.
This should work for you from adb to backup your data partition:
Code:
adb push mmcblk0p64-data.img /dev/block/mmcblk0p64
Click to expand...
Click to collapse
ed
Hmm... if it is "permission denied" that sounds like you need root permissions to back it up. I'm sorry, but I'm not good enough with ADB to tell you how to get higher privs. Maybe ADB SHELL then SU, but I don't honestly know.

Can I recover encrypted data with a restore?

Hello
I wanted to install Syberia A12 from stock A11 and I got stuck somewhere in the process.
So I'm stuck with the internal storage on the phone (not backed up) that is inaccessible since it's encrypted and the rest of the partitions backed up on the pc using adb backup (a single .ab file).
In theory I should restore the partitions to the phone and I should be able to access everything and boot as it was before, right? However now I have the syberia ROM installed and I'm not rooted anymore (and won't boot).
Can I restore /system like this?
What I care about is access the internal storage, what can I do?
I tried restoring the entire .ab file, however it gets stuck at "restoring efs2" and I should only try to restore /data and /system but I can't select specific partitions being a adb backup with twrp.
All tools I tried to extract the content fails.

Clone a phone?

Hello,
i wonder if it's possible to clone everything from Android phone A to phone B with TWRP.
Meaning saving the (encrypted) data partition and the others on SD via TWRP, put that SD into another (identical) phone and restore.
Regards,
DocMAX
DocMAX said:
Hello,
i wonder if it's possible to clone everything from Android phone A to phone B with TWRP.
Meaning saving the (encrypted) data partition and the others on SD via TWRP, put that SD into another (identical) phone and restore.
Regards,
DocMAX
Click to expand...
Click to collapse
Typicaly, if the two devices are identical, you can backup one and restore on the other, but, I'm not certain whether encrypted data would restore correctly.
If Android on device A and device B is rooted then you can create a NANDroid backup of A and restore it to B utilizing Android's dd shell command.

Categories

Resources