My friend asked me why she could not find some important files in a physical image acquired from an Android phone. She took the evidence tree of an Android 6.0 physical image acquired from LG G3 for example as below, she’s used to see /data/data in a physical image.

I took a look at this phone. This phone is Huawei Mate 9 and its model is MHA-L29. The OS is Android 7.0 and it’s rooted already. She could retrieve some interesting files in /data/data/ , but the problem was she did not see those same files in the physical image. She’s just curious about what happened to the physical image. Let me show you what the image acquired from Mate 9 looks like.

Take a look at its log file activity_log.txt and some error messages draw my attention. It looks like that it’s not a full physical image…Maybe that’s the reason why she could not get those same files in /data/data.  I will use another tools to acquire this phone and find out what's wrong with it.

Fotrunately UFED4PC solved this problem and extract those files in /data/data/ or /data/system/.

Is it a full physical image???的更多相关文章

  1. ORACLE 11gR2 DG(Physical Standby)日常维护01

    环境:RHEL 6.4 + Oracle 11.2.0.4 一.主备手工切换 1.1 主库,切换成备库并启动到mount 1.2 备库,切换成主库并启动到open 1.3 新的备库启动日志应用 二.重 ...

  2. ORACLE 11gR2 DG(Physical Standby)日常维护02

    环境:RHEL 6.5 + Oracle 11.2.0.4 三.监控DG的状态 3.1监控DG备库的状态 3.2监控主库传输日志链路的状态 四.备库切换为snapshot standby 4.1备库切 ...

  3. Unable to open the physical file xxxx. Operating system error 2

    在新UAT服务器上,需要将tempdb放置在SSD(固态硬盘)上.由于SSD(固态硬盘)特性,所以tempdb的文件只能放置在D盘下面,而不能是D盘下的某一个目录下面. ALTER  DATABASE ...

  4. [转]Part1: Understanding !PTE , Part 1: Let’s get physical

    http://blogs.msdn.com/b/ntdebugging/archive/2010/02/05/understanding-pte-part-1-let-s-get-physical.a ...

  5. PowerDesigner从Physical Data Model转Excel

    参考资料:http://www.cnblogs.com/hggc/archive/2013/10/15/3369857.html 由于有把ER图转Excel的需求,幸运地找到一个可用脚本,稍做修改完成 ...

  6. [DFNews] Cellebrite UFED Logical/Physical Analyzer 3.8.1 维护性更新

    Maintenance Release             Cellebrite has released a maintenance version of UFED Physical / Log ...

  7. [DFNews] Cellebrite UFED Physical Analyzer 3.8

    Cellebrite 两周前正式发布了UFED设备所附带的Physical Analyzer和Logical Analyzer软件,更新后版本为3.8 下载地址已更新至置顶资源下载页面. 主要更新如下 ...

  8. 11g Physical Standby配置

    一,准备   Database DB_UNIQUE_NAME Oracle Net Service Name Primary PROD PROD Physical standby PRODDG PRO ...

  9. is running beyond physical memory limits. Current usage: 2.0 GB of 2 GB physical memory used; 2.6 GB of 40 GB virtual memory used

    昨天使用hadoop跑五一的数据,发现报错: Container [pid=,containerID=container_1453101066555_4130018_01_000067] GB phy ...

  10. 【原】Configuring Oracle Data Guard In Physical Standby Database

    作者:david_zhang@sh [转载时请以超链接形式标明文章] http://www.cnblogs.com/david-zhang-index/p/5042640.html参照文档:https ...

随机推荐

  1. List中的set方法和add方法

    public class TestList {public static void main(String[] args){   List l1 = new LinkedList();   for(i ...

  2. mybatis以及预编译如何防止SQL注入

    SQL注入是一种代码注入技术,用于攻击数据驱动的应用,恶意的SQL语句被插入到执行的实体字段中(例如,为了转储数据库内容给攻击者).[摘自] SQL injection - Wikipedia SQL ...

  3. Python笔记【6】_函数

    #!/usr/bin/env/python #-*-coding:utf-8-*- #Author:LingChongShi #查看源码Ctrl+左键 ''' def:函数是一段可以重复调用的代码,通 ...

  4. ceph-fuse客户端问题排查流程

    本文讲述了ceph-fuse客户端问题排查基本流程:) 首先查看集群的整体情况 ceph -s 是否有osd挂掉,是否有pg非active ceph-fuse进程是否存在? ps -ef |grep ...

  5. 使用JMH做Benchmark基准测试

    目录 BenchMark介绍 开始前的步骤 例子 代码 报告 注解介绍 @BenchmarkMode @OutputTimeUnit @Iteration @WarmUp @State @Fork @ ...

  6. Codeforces 781A：Andryusha and Colored Balloons（DFS染色）

    http://codeforces.com/contest/782/problem/C 题意:给一棵树染最少的颜色,使得相邻距离为2的点都是不同的颜色,问最少是多少种颜色并输出每个点的颜色. 思路:比 ...

  7. cocopods新建或者更新远端库主要操作步骤

    1.搭建远程仓库(私有或者公有项目): 2.使用sourceTree拉去远程仓库: 3.打开拉去的项目仓库Finder,构建pod lib项目:pod lib create AFNetworking( ...

  8. 深入理解Java虚拟机一 阅读笔记

    xl_echo编辑整理.欢迎添加echo微信(微信号:t2421499075)交流学习. 百战不败,依不自称常胜,百败不颓,依能奋力前行.--这才是真正的堪称强大!! --- > 以下内容摘抄自 ...

  9. 【不带权图算法之拓扑排序】-C++

    拓扑排序算法主要由以下两步循环执行,直到不存在入度为 的顶点为止. 选择一个入度为 的顶点并将它输出: 删除从该顶点连出的所有边. 循环结束,若输出的顶点数小于图中的顶点数,则表示该图中存在回路,也就 ...

  10. [原创]wireshark&xterm安装、配置和使用

    --wireshark && xterm--一.安装wireshark: #apt-get install wireshark二.启动wireshark: #wireshark 或者 ...