My friend asked me why she could not find some important files in a physical image acquired from an Android phone. She took the evidence tree of an Android 6.0 physical image acquired from LG G3 for example as below, she’s used to see /data/data in a physical image.

I took a look at this phone. This phone is Huawei Mate 9 and its model is MHA-L29. The OS is Android 7.0 and it’s rooted already. She could retrieve some interesting files in /data/data/ , but the problem was she did not see those same files in the physical image. She’s just curious about what happened to the physical image. Let me show you what the image acquired from Mate 9 looks like.

Take a look at its log file activity_log.txt and some error messages draw my attention. It looks like that it’s not a full physical image…Maybe that’s the reason why she could not get those same files in /data/data.  I will use another tools to acquire this phone and find out what's wrong with it.

Fotrunately UFED4PC solved this problem and extract those files in /data/data/ or /data/system/.

Is it a full physical image???的更多相关文章

  1. ORACLE 11gR2 DG(Physical Standby)日常维护01

    环境:RHEL 6.4 + Oracle 11.2.0.4 一.主备手工切换 1.1 主库,切换成备库并启动到mount 1.2 备库,切换成主库并启动到open 1.3 新的备库启动日志应用 二.重 ...

  2. ORACLE 11gR2 DG(Physical Standby)日常维护02

    环境:RHEL 6.5 + Oracle 11.2.0.4 三.监控DG的状态 3.1监控DG备库的状态 3.2监控主库传输日志链路的状态 四.备库切换为snapshot standby 4.1备库切 ...

  3. Unable to open the physical file xxxx. Operating system error 2

    在新UAT服务器上,需要将tempdb放置在SSD(固态硬盘)上.由于SSD(固态硬盘)特性,所以tempdb的文件只能放置在D盘下面,而不能是D盘下的某一个目录下面. ALTER  DATABASE ...

  4. [转]Part1: Understanding !PTE , Part 1: Let’s get physical

    http://blogs.msdn.com/b/ntdebugging/archive/2010/02/05/understanding-pte-part-1-let-s-get-physical.a ...

  5. PowerDesigner从Physical Data Model转Excel

    参考资料:http://www.cnblogs.com/hggc/archive/2013/10/15/3369857.html 由于有把ER图转Excel的需求,幸运地找到一个可用脚本,稍做修改完成 ...

  6. [DFNews] Cellebrite UFED Logical/Physical Analyzer 3.8.1 维护性更新

    Maintenance Release             Cellebrite has released a maintenance version of UFED Physical / Log ...

  7. [DFNews] Cellebrite UFED Physical Analyzer 3.8

    Cellebrite 两周前正式发布了UFED设备所附带的Physical Analyzer和Logical Analyzer软件,更新后版本为3.8 下载地址已更新至置顶资源下载页面. 主要更新如下 ...

  8. 11g Physical Standby配置

    一,准备   Database DB_UNIQUE_NAME Oracle Net Service Name Primary PROD PROD Physical standby PRODDG PRO ...

  9. is running beyond physical memory limits. Current usage: 2.0 GB of 2 GB physical memory used; 2.6 GB of 40 GB virtual memory used

    昨天使用hadoop跑五一的数据,发现报错: Container [pid=,containerID=container_1453101066555_4130018_01_000067] GB phy ...

  10. 【原】Configuring Oracle Data Guard In Physical Standby Database

    作者:david_zhang@sh [转载时请以超链接形式标明文章] http://www.cnblogs.com/david-zhang-index/p/5042640.html参照文档:https ...

随机推荐

  1. 【jar包管理】Maven BOM

    BOM Alibaba Spring Boot Dependencies is a Maven BOM used to manage the versions of most used Alibaba ...

  2. 开源joda-time使用demo

    开源joda-time 1.maven中引入 <dependency> <groupId>joda-time</groupId> <artifactId> ...

  3. 4.shell编程-文本处理三剑客之sed

    4.1.sed的选项 sed,流编辑器.对标准输出或文件进行逐行处理. 语法格式 第一种:stdout | sed [option] "pattern command" 第二种:s ...

  4. mongoshell 执行JavaScript文件获取数据库实例基本信息

    由于MongoDB没有关系型数据中强大的数据字典.因此,如果需要汇总统计一些内部信息,包括数据量,基本元信息,集群架构,状态信息.则需要自己写脚本统计.为日后工作方便,本人在此将一些统计信息通过Jav ...

  5. 2018.8.17 2018暑假集训 关于dp的一些感想（以目前的知识水平）

    学了这么长时间的dp似乎还是不怎么样 谨以此篇文字记录一年以来与dp斗智斗勇的各种经历 关于dp(也就是动态规划)似乎对于每个OIer来说都是一个永远的噩梦. 刚刚开始学dp的时候完全搞不明白(只是觉 ...

  6. Codeforces Gym101097I：Sticks （思维）

    http://codeforces.com/gym/101097/attachments 题意:现在有k种颜色的木棍,每种颜色有ni根木棍,每根木棍有一个长度,问是否有三根木棍可以组成三角形,并且这三 ...

  7. HDU 1398：Just a Hook（线段树区间更新）

    http://acm.hdu.edu.cn/showproblem.php?pid=1698 Just a Hook Problem Description   In the game of DotA ...

  8. django基础知识之自连接:

    自连接 对于地区信息,属于一对多关系,使用一张表,存储所有的信息 类似的表结构还应用于分类信息,可以实现无限级分类 新建模型AreaInfo,生成迁移 class AreaInfo(models.Mo ...

  9. Linux命令学习-history命令

    Linux中,history命令的作用是显示历史记录和执行过的命令. 查看历史所有命令执行记录 history 查看最近的13条历史执行命令 history 13 执行历史记录中,序号为123的命令 ...

  10. SQL Server 函数的定义及使用

    一.定义函数 1. 标量值函数: 返回一个确定类型的标量值,例如:int,char,bit等 --创建标量值函数 create function func_1(@func_parameter_1 in ...