My friend asked me why she could not find some important files in a physical image acquired from an Android phone. She took the evidence tree of an Android 6.0 physical image acquired from LG G3 for example as below, she’s used to see /data/data in a physical image.

I took a look at this phone. This phone is Huawei Mate 9 and its model is MHA-L29. The OS is Android 7.0 and it’s rooted already. She could retrieve some interesting files in /data/data/ , but the problem was she did not see those same files in the physical image. She’s just curious about what happened to the physical image. Let me show you what the image acquired from Mate 9 looks like.

Take a look at its log file activity_log.txt and some error messages draw my attention. It looks like that it’s not a full physical image…Maybe that’s the reason why she could not get those same files in /data/data.  I will use another tools to acquire this phone and find out what's wrong with it.

Fotrunately UFED4PC solved this problem and extract those files in /data/data/ or /data/system/.

Is it a full physical image???的更多相关文章

  1. ORACLE 11gR2 DG(Physical Standby)日常维护01

    环境:RHEL 6.4 + Oracle 11.2.0.4 一.主备手工切换 1.1 主库,切换成备库并启动到mount 1.2 备库,切换成主库并启动到open 1.3 新的备库启动日志应用 二.重 ...

  2. ORACLE 11gR2 DG(Physical Standby)日常维护02

    环境:RHEL 6.5 + Oracle 11.2.0.4 三.监控DG的状态 3.1监控DG备库的状态 3.2监控主库传输日志链路的状态 四.备库切换为snapshot standby 4.1备库切 ...

  3. Unable to open the physical file xxxx. Operating system error 2

    在新UAT服务器上,需要将tempdb放置在SSD(固态硬盘)上.由于SSD(固态硬盘)特性,所以tempdb的文件只能放置在D盘下面,而不能是D盘下的某一个目录下面. ALTER  DATABASE ...

  4. [转]Part1: Understanding !PTE , Part 1: Let’s get physical

    http://blogs.msdn.com/b/ntdebugging/archive/2010/02/05/understanding-pte-part-1-let-s-get-physical.a ...

  5. PowerDesigner从Physical Data Model转Excel

    参考资料:http://www.cnblogs.com/hggc/archive/2013/10/15/3369857.html 由于有把ER图转Excel的需求,幸运地找到一个可用脚本,稍做修改完成 ...

  6. [DFNews] Cellebrite UFED Logical/Physical Analyzer 3.8.1 维护性更新

    Maintenance Release             Cellebrite has released a maintenance version of UFED Physical / Log ...

  7. [DFNews] Cellebrite UFED Physical Analyzer 3.8

    Cellebrite 两周前正式发布了UFED设备所附带的Physical Analyzer和Logical Analyzer软件,更新后版本为3.8 下载地址已更新至置顶资源下载页面. 主要更新如下 ...

  8. 11g Physical Standby配置

    一,准备   Database DB_UNIQUE_NAME Oracle Net Service Name Primary PROD PROD Physical standby PRODDG PRO ...

  9. is running beyond physical memory limits. Current usage: 2.0 GB of 2 GB physical memory used; 2.6 GB of 40 GB virtual memory used

    昨天使用hadoop跑五一的数据,发现报错: Container [pid=,containerID=container_1453101066555_4130018_01_000067] GB phy ...

  10. 【原】Configuring Oracle Data Guard In Physical Standby Database

    作者:david_zhang@sh [转载时请以超链接形式标明文章] http://www.cnblogs.com/david-zhang-index/p/5042640.html参照文档:https ...

随机推荐

  1. 【maven 】jar包冲突-记一次冲突解决

    方法一:根据mvn提示一个一个排除 1.请到pom.xml文件所在的目录(包含父子目录)下分别执行下面的命令排查是什么原因导致fastjson版本不正确: mvn dependency:tree -D ...

  2. Unity Shader 屏幕后效果——边缘检测

    关于屏幕后效果的控制类详细见之前写的另一篇博客: https://www.cnblogs.com/koshio0219/p/11131619.html 这篇主要是基于之前的控制类,实现另一种常见的屏幕 ...

  3. python函数之enumerate()

    enumrate 语法: # enumerate(sequence, [start=]) 参数:# sequence -- 一个序列.迭代器或其他支持迭代对象.# start -- 下标起始位置. 使 ...

  4. There is no getter for property named 'username' in 'class Model1.User'-----报错解决

    There is no getter for property named 'username' in 'class Model1.User' -----Model Model1.User'中没有名为 ...

  5. C++学习书籍推荐《More Exceptional C++》下载

    百度云及其他网盘下载地址:点我 编辑推荐 <More Exceptional C++:40个新的工程难题.编程疑问及解决方法(中文版)>作为广为人知的<Exceptional C++ ...

  6. 串门赛： NOIP2016模拟赛——By Marvolo 丢脸记

    前几天liu_runda来机房颓废,顺便扔给我们一个网址,说这上面有模拟赛,让我们感兴趣的去打一打.一开始还是没打算去看一下的,但是听std说好多人都打,想了一下,还是打一打吧,打着玩,然后就丢脸了. ...

  7. NDK_OVERVIEW翻译

    Android NDK Overview Introduction: The Android NDK is a set of tools that allows Android application ...

  8. GitHub使用整理——从开始到上传项目

    前期准备 首先是github官网: https://github.com/ 下载github工具: https://git-for-windows.github.io/ 进入github创建一个新的项 ...

  9. java面试题库(长期)

    本文内容来自互联网各种面试实例,以及自己的面试经历,主要是中级开发的面试题 初中级java面试主要分为几个部分: 0.序 1.java基础 2. java多线程 3. jvm知识 4. spring等 ...

  10. C#中用WMI实现对驱动的查询

    using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; usin ...