• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Question Extract memory of Samsung Galaxy A52

Search This thread

afferl

New member
Sep 28, 2021
4
1
Huawei P10 Lite
LG G8
Hello everyone!
For my bachelor's thesis, I am currently trying to correctly back up the data of a Samsung Galaxy A52 forensically. I created a first backup with adb backup. However, I would also like to create a physical one. To do this, I applied twrp-3.5.2_10-0-a52q.img.tar to the device using Odin. Afterwards I was able to extract the entire memory (~124GB) using "dd if=/dev/sda ..." and ncat. Is there a possibility to analyse this image further on? I tried it with Autopsy, but the result was not satisfactory.
Or would it be possible to create the image in another way? Rooting is no longer possible in this case, as I do not want to delete the memory.
Thank you very much for your help.
 

Simon1511

Recognized Developer
Did you dd the full sda device?
If so, you should just dd the data partition instead. Also, if your data partition is still encrypted (Stock ROM does that automatically) you won't be able to access your data.
If the data partition is mountable in TWRP and you can access files in it then you're not encrypted.
So if you then successfully dd the data partition to a .img file you should easily be able to mount it if you're running Linux on your Computer. I'm not sure whether it would be extract-able with e.g. 7zip on Windows, guess you'll have to figure that out on your own.
 

afferl

New member
Sep 28, 2021
4
1
Huawei P10 Lite
LG G8
i did dd the full sda.
The data partition is still encrypted in the twrp. The only thing I can do for my further work is to back up everything else.

Is there a way to extract the encryption keys and decrypt the files manually? e.g. with Lime, if the keys are stored in the ram.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    thank you very much. This is enough information for my further work.