Learning Android Forensics

Summary

This chapter discussed several techniques used for physically imaging internal memory or SD cards and some of the common problems associated with them:

Technique	Problems associated
dd	Usually pre-installed on device May not work on MTD blocks Does not obtain Out-of-Band area
nanddump	Not commonly found on the device, must be pushed to device Works well with MTD blocks May obtain Out-of-Band area, based on options in the binary used

Additionally, each imaging technique can be used to either save the image on the device (typically on the SD card), or used with netcat to write the file to the examiner's computer:

Technique	Features
Writing to SD card	Easy, doesn't require additional binaries to be pushed to the device Familiar to most ...