ogmini - Exploration of DFIR

Having fun while learning about and pivoting into the world of DFIR.

---

About Blog Posts by Tags Research CTF/Challenge GitHub RSS

11 September 2025

Pixel 7 - Data Acquisition

by ogmini

Previous Post

Currently on a train heading somewhere fun and I will be disconnected from everything. It is important in this day and age to decompress and go touch grass. There will be no posts after this one until I get back.

I spent some time reading up on options to acquire forensically sound images or backups from Android devices. I do not have access to any of the commercial options such as:

• https://www.magnetforensics.com/resources/magnet-acquire/ - I gather I could request access; but I don’t qualify.
• https://belkasoft.com/android

There are free/open source options such as:

• Android Triage
  • https://github.com/RealityNet/android_triage
  • https://dfir.science/2021/10/Android-logical-acquisition-with-android_triage.html
• netcat/dd
  • https://dfir.science/2017/04/Imaging-Android-with-root-netcat-and-dd.html
  • https://andreafortuna.org/2018/12/03/android-forensics-imaging-android-file-system-using-adb-and-dd/
• andriller
  • https://github.com/den4uk/andriller

I plan on giving these a shot when I get back at some point starting with netcat/dd followed by using Android Triage.

tags: #Android #Root

Previous Post