tag:blogger.com,1999:blog-6748555274835706450.post5536822089732627573..comments2024-03-27T01:42:58.621-07:00Comments on Free Android Forensics: The differences between a physical image and a logical extractionMark Lohrumhttp://www.blogger.com/profile/07077867576734525405noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-6748555274835706450.post-81263264458570388322018-11-07T05:36:39.588-08:002018-11-07T05:36:39.588-08:00A little late to comment but my understanding is t...A little late to comment but my understanding is that the record is orphaned in a database, making it not visible to the user but still remains there until the database is flushed or overwritten. This is why we perform a filesystem extraction and a physical extraction. <br />Gazz6767https://www.blogger.com/profile/12636674245411552179noreply@blogger.comtag:blogger.com,1999:blog-6748555274835706450.post-59017813279535927492018-11-07T05:32:59.851-08:002018-11-07T05:32:59.851-08:00This comment has been removed by the author.Gazz6767https://www.blogger.com/profile/12636674245411552179noreply@blogger.comtag:blogger.com,1999:blog-6748555274835706450.post-18060583290197730162015-09-18T04:09:34.162-07:002015-09-18T04:09:34.162-07:00Hans,
I'm sorry, these things happen sometime...Hans,<br /><br />I'm sorry, these things happen sometimes! First things first - do not use the phone and image it. Preserve the device as is. The more the device is used, the more chances of old data being overwritten.<br /><br />Android's factory reset method is not considered secure - check out this article for some encouragement .... https://blog.avast.com/2014/07/08/tens-of-thousands-of-americans-sell-themselves-online-every-day/. So once you've got the phone imaged, you can try data carving using scalpel (may or may not be successful) or look for other data carving methods.<br /><br />FTK Imager won't be of any real help recovering old photos. I'll be honest, putting together deleted data is difficult. The automated tools like scalpel do their best but it is a difficult task to put together deleted data that could be stored in all areas of the device successfully. But it's worth a shot.<br /><br />So give it a try. Image the device, run scalpel or any other data carver against the image, see if you have some luck. All the best,<br />MarkMark Lohrumhttps://www.blogger.com/profile/07077867576734525405noreply@blogger.comtag:blogger.com,1999:blog-6748555274835706450.post-70859165182101199912015-09-17T19:44:41.878-07:002015-09-17T19:44:41.878-07:00Dear Mark,
I accidentally factory reset my wife&#...Dear Mark,<br /><br />I accidentally factory reset my wife's Samsung Grand duos and failed to locate photos/ images from the clouds. Could I recover the photos using only FTK imager to analyze and extract them or I will need other tools to extract and recover and how? Thanks in advance for the advice Anonymoushttps://www.blogger.com/profile/06705224061878940790noreply@blogger.com