December 2018
Beginner to intermediate
328 pages
8h 29m
English
Now that the backup has been converted into a .tar file and then extracted, the examiner can view the data contained in the backup. In our example, there are two directories found in the root of the backup:
apps: Contains data from /data/data for applications that were included in the backup
shared: Contains all data from the SD card; only present if the shared argument was passed at the command line
Note that the files within the apps directory are stored in directories by their package name (just as seen in /data/data from within adb shell), and the shared directory is exactly what the user would see if they accessed the SD card by plugging it into a computer. For a benign example of user data that ...
Read now
Unlock full access