Practical Mobile Forensics - Third Edition

ADB pull data extraction

As seen earlier, adb is a command-line tool that helps you communicate with the device to retrieve information. Using adb, you can extract data from all the files on the device or just the relevant files in which you are interested.

To access an Android device through adb, it's necessary that the USB debugging option is enabled. From Android 4.2.2, due to secure USB debugging, the host connecting to the device should also be authorized. If the device is locked and USB debugging is not enabled, try to bypass the screen lock using the techniques explained in Chapter 8, Android Forensic Setup and Pre-Data Extraction Techniques.

As a forensic examiner, it's important to know how the data is stored on the Android device ...