Learning Android Forensics - Second Edition

adb pull

As discussed in Chapter 2, Setting Up the Android Forensic Environment, adb pull is used to transfer files from the device to the local workstation. The following show the format for the adb pull command:

adb pull [-p] [-a] <remote> [<local>]

The optional –p flag shows the transfer's progress, while the optional –a flag will copy the file's timestamp and mode. The <remote> parameter is the exact path to the file on the device. The optional <local> parameter is the path where the file will be written on the examiner's workstation. If no local path is specified, the file will be written to the current working directory. An example adb pull command may look like the following:

adb pull –p /sdcard/Pictures/1.png D:\Test

Let's look at ...