Is it a full physical image???

发布时间:2017-7-9 7:17:18编辑:www.fx114.net 分享查询网我要评论
本篇文章主要介绍了"Is it a full physical image??? ",主要涉及到Is it a full physical image??? 方面的内容,对于Is it a full physical image??? 感兴趣的同学可以参考一下。

My friend asked me why she could not find some important files in a physical image acquired from an Android phone. She took the evidence tree of an Android 6.0 physical image acquired from LG G3 for example as below, she’s used to see /data/data in a physical image.

I took a look at this phone. This phone is Huawei Mate 9 and its model is MHA-L29. The OS is Android 7.0 and it’s rooted already. She could retrieve some interesting files in /data/data/ , but the problem was she did not see those same files in the physical image. She’s just curious about what happened to the physical image. Let me show you what the image acquired from Mate 9 looks like.

Take a look at its log file activity_log.txt and some error messages draw my attention. It looks like that it’s not a full physical image…Maybe that’s the reason why she could not get those same files in /data/data.  I will use another tools to acquire this phone and find out what's wrong with it.

 Fotrunately UFED4PC solved this problem and extract those files in /data/data/ or /data/system/.


上一篇:Python连接MySQL数据库
下一篇:(考研)(精华)二叉树的知识结构图以及各种特殊的二叉树

相关文章

相关评论

本站评论功能暂时取消,后续此功能例行通知。

一、不得利用本站危害国家安全、泄露国家秘密,不得侵犯国家社会集体的和公民的合法权益,不得利用本站制作、复制和传播不法有害信息!

二、互相尊重,对自己的言论和行为负责。

好贷网好贷款