Learning Android Forensics - Second Edition

Summary

In this chapter, we discussed several techniques that are used for physically imaging internal memory or SD cards, and some of the common problems associated with them:

Technique	Problems associated
dd	Usually preinstalled on device May not work on MTD blocks Does not obtain the out-of-band area
nanddump	Not commonly found on the device, must be pushed to device Works well with MTD blocks May obtain the out-of-band area, based on options in the binary used

Additionally, each imaging technique can be used to either save the image on the device (typically on the SD card), or used with netcat to write the file to the examiner's computer:

Technique	Features
Writing to SD card	Easy, doesn't ...