Mount Android 10 dd image of /sda internal memory

0

Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (sda19), same error.

mmls sda.dd 
Cannot determine partition type

Some information about :

Disk /dev/loop9: 234.26 GiB, 251532365824 bytes, 491274152 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Trying to mount:

sudo losetup /dev/loop9 sda.dd
sudo mount -o ro /dev/loop9 /mnt/temp1
mount: /mnt/temp1: wrong fs type, bad option, bad superblock on /dev/loop9, missing codepage or helper program, or other error.


mkfs.vfat -v sda.dd
mkfs.fat 4.1 (2017-01-24)
Auto-selecting FAT32 for large filesystem
sda.dd has 255 heads and 63 sectors per track,
hidden sectors 0x0000;
logical sector size is 512,
using 0xf8 media descriptor, with 491274152 sectors;
drive number 0x80;
filesystem has 2 32-bit FATs and 64 sectors per cluster.
FAT size is 59968 sectors, and provides 7674283 clusters.
There are 64 reserved sectors.
Volume ID is a0fea9a1, no volume label.

Trying to convert from sparse:

./simg2img
Invalid sparse file format at header magic
Failed to read sparse file

e2fsck

e2fsck -f /dev/loop9
e2fsck 1.45.4 (23-Sep-2019)
ext2fs_open2: Bad magic number in super-block
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/loop9

The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193
or
e2fsck -b 32768

fsstat

fsstat sda.dd
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32

OEM Name: mkfs.fat
Volume ID: 0xa0fea9a1
Volume Label (Boot Sector): NO NAME    
Volume Label (Root Directory):
File System Type Label: FAT32   
Next Free Sector (FS Info): 120000
Free Sector Count (FS Info): 491154048

Sectors before file system: 0

File System Layout (in sectors)
Total Range: 0 - 491274151
* Reserved: 0 - 63
 Boot Sector: 0
 FS Info Sector: 1
 Backup Boot Sector: 6
* FAT 0: 64 - 60031
* FAT 1: 60032 - 119999
* Data Area: 120000 - 491274151
 Cluster Area: 120000 - 491274111
*** Root Directory: 120000 - 120063
** Non-clustered: 491274112 - 491274151

METADATA INFORMATION
--------------------------------------------
Range: 2 - 7858466438
Root Directory: 2

CONTENT INFORMATION
--------------------------------------------
Sector Size: 512
Cluster Size: 32768
Total Cluster Range: 2 - 7674284

FAT CONTENTS (in sectors)
--------------------------------------------
120000-120063 (64) -> EOF

Autopsy is detecting partition with fs type as raw but can't do anything with them.

Any suggestions? Thanks!

mount
android
data-recovery
disk-image
forensics
asked on Super User Dec 1, 2019 by Vladmir • edited Dec 1, 2019 by Vladmir

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0