Making sense of Android eMMC Dump - Page 1
Forum section: electronics / general

author: Robert.Adams
author_rank: Contributor
timestamp: November 06, 2024, 01:12:02 pm
content: Hello,I have a very old phone (Sky Devices GCSKY40D that was presumably running Android 4 or earlier => no data encryption) that I disassembled, removed the SanDisk eMMC(SD7DP24C-4G) from, and dumped with Xgpro and a T56.Xgpro puts out4 different binariesECSD_CSD.BINBOOT1.BINBOOT2.BINUserData.BINUserData.BIN seems to be exactly what it sounds like and is 3.68GB large. I can point tools like photorec at it and extract some images, but commands like binwalk -e just end up filling my harddrive with 1TB+ of uninterpretable junk.I don't know much about phone forensics tools like Autopsy, but they also don't do well with interpreting the binary. (can't figure it out, probably because no partitions show up when checking UserData.bin with parted). binwalk can find some EXT4 partitions, which at least one of them can be interpreted with Autopsy and finds the regular list of e-mails, notices, etc associated with some SW packages that are in it.Does anyone know how I can go about recovering the useful data from this phone (contacts, text messages, Installed app list, etc)?

author: amyk
author_rank: Super Contributor
timestamp: November 07, 2024, 03:13:10 am
content: Was it unbootable? A quick search shows that it uses the MT6572 SoC, which wasverycommon around a decade ago and there are multiple tools for it and related platforms.The UserData partition is indeed what you'll need to look into. It's ext4 so should mount easily on any Linux system. data/com.android.providers.contacts/databases/ , data/com.android.email/databases/ , data/com.android.providers.telephony/databases will have what you're looking for. In fact everything in data/ will be useful to look through.Note that in some cases contacts and texts may be stored on the SIM card instead.

author: fzabkar
author_rank: Super Contributor
timestamp: November 07, 2024, 03:37:15 am
content: Try the free version of DMDE.https://dmde.com/

author: RoGeorge
author_rank: Super Contributor
timestamp: November 07, 2024, 04:28:55 am
content: You may want to read about Android partitions in general. Might vary slightly from one version of Android to another, and from one manufacturer to another.For example, there are 4 distinct files to flash for Samsung:- BL - Bootloader- AP (formerly named PDA) - Android Processor - the bigger of all 4 images to flash with Odin- CP (formerly named PDA) - Core Processor - modem.img- CSC - 'Consumer Software Customization' or 'Country Specific Code'. The CSC binary contains the Samsung PIT file, too (Partition Information Table - not the partition table, but a description of how to partition the internal memory of the phone).Here's a brief parallel between the Android and the Linux boot, a bird-eye view in the premise of replacing Android with Linux on a mobile platform:https://forum.xda-developers.com/t/info-android-device-partitions-and-filesystems.3586565/https://forum.xda-developers.com/t/info-boot-process-android-vs-linux.3785254/https://forum.xda-developers.com/t/info-is-it-possible-to-install-windows-ios-or-linux-on-android-device.3763961/

author: Robert.Adams
author_rank: Contributor
timestamp: November 07, 2024, 11:30:26 am
content: Quote from: amyk on November 07, 2024, 03:13:10 amYes, unbootable - this is part of my "Project Trash Pile" where I bought 5 lbs of scrap devices to teardown and investigate. (See here:https://www.bobadams5.com/posts/trashpile1/)Quote from: RoGeorge on November 07, 2024, 04:28:55 amI've started to read about this, for example here they describe a "Project Treble" that changed how things worked in Android 8:https://dmfrpro.medium.com/android-partition-tables-520d88115fe5On my UserData.BIN I can use binwalk and find the attached 7 EXT4 partitions, and of the data that Autopsy can parse out of there is some interesting information (like an accounts.xml that includes which accounts were linked to the phone for things like Google, Twitter, etc). I've just been struggling with making this extraction process a little smoother and a lot more thorough (notably the messages, contacts etc). I believe contacts are stored in an sqlite database, so I might start just extracting all of those I can find and feeding them into Autopsy to interpret.Quote from: amyk on November 07, 2024, 03:13:10 amThe SIM card thing is interesting, maybe I achieved everything I can on this one. The EXT4 partitions I've pulled out and looked through don't have any of the standard looking paths that you mention.

author: amyk
author_rank: Super Contributor
timestamp: November 08, 2024, 04:57:23 am
content: If you could find accounts.xml, that's inside the data partition in system/sync/accounts.xmlThe partition layout is hardcoded:http://www.lieberbiber.de/2015/07/04/mediatek-details-partitions-and-preloader/You can search online for various tools designed to retrieve the partition table from an eMMC dump for MTK devices, and that will let you cut and mount the desired partition directly to access the data contained in it.

author: Robert.Adams
author_rank: Contributor
timestamp: November 20, 2024, 01:32:21 pm
content: Quote from: amyk on November 08, 2024, 04:57:23 amAs far as I can tell it is hardcoded but varies by device manufacturer. Someone else on Discord had recommended trying to find the scatter.txt file, which I think I could get from SP Flash Tool if I had a working device (which I don't).Additional discussion happened athttps://xdaforums.com/t/q-how-can-i-get-scatter-txt-file-for-my-phone.1909923/over a decade ago. If I get some time I might try to see if I can find it in the eMMC dump, but binwalk didn't clearly report any files along the lines of scatter.txt

author: fzabkar
author_rank: Super Contributor
timestamp: November 20, 2024, 06:54:00 pm
content: Can you upload the first few sectors of UserData.BIN, assuming they don't contain any personal info?