如何提取Android模拟器的用户数据分区？
如何提取我的Android模拟器（AVD）的（未加密且完整的）用户数据分区？
由于一些研究，我想提取模拟器的用户数据和系统分区。这样做有几种可能性，但是我无法提取完整且未加密的用户数据分区。我尝试了以下操作：
- 使用ADB拉动：
adb pult/dev/block/dm-x destinaty_path。结果能够使用尸检分析分区。图像似乎是半完整的，因为重要的文件夹存在，但基本上是空的（我正在使用SANS数字取证＆Amp;事件响应海报查找最重要的数据）。 - 使用ABD Shell提取：
adb shell“ su root dd如果=/dev/block/dm-x”＆gt; destination_path。图像似乎损坏。 “文件系统损坏（Extxfs_group_load：第1组描述符位置在字节偏移4128处太大）”，根据FSSTAT。 - 通过文件系统访问分区：
c：\ users \ user \ .android \ avd \ emulation_device_name \ userdata-qemu.img。图像似乎不完整，因为只有几个文件夹要分析。
真正令人困惑的是三个分区userdata.img，userdata-qemu.img 和userdata-qemu.img.img.img.qcow2位于3中的文件夹中。根据模拟器帮助页（仿真-HELP-DISK-IMAGES），userData.img是“ 初始数据分区图像”。 userdata-qemu.img是“持久数据分区图像”。没有有关userdata-qemu.img.qcow2的信息。似乎初始启动后的任何数据都将保存在userdata-qemu.img.qcow2中。我还尝试使用QEMU -IMG -F QCOW2 -O RAW USERDATA -QEMU.IMG.IMG.QCOW2 USERDATA.IMG将此文件转换为RAW文件格式（ADB PULL（方法1））） ，可以使用尸检对其进行分析。但是，由于熵很高，输出似乎被加密了，并且您无法使用XXD/HXD检测任何数据。
我在Android 11和Android 12植根和仿真设备（Google Play API）上进行了测试。
提前致谢！
How can i extract the (unencrypted and complete) userdata partition of my android emulator (AVD)?
Due to some research i want to extract the userdata and system partition of my emulator. There are several possibilities to do so, yet i was unable to extract a complete and unencrypted userdata partition. I tried the following:
- Extract using adb pull:
adb pull /dev/block/dm-X DESTINATION_PATH. Results in being able to analyze the partition using autopsy. The image seems semi-complete as the important folders exist but are basically empty (i am using the SANS digital forensics & incident response poster to look up the most important data). - Extract using abd shell:
adb shell "su root dd if=/dev/block/dm-X" > DESTINATION_PATH. The image seems corrupt. "File system is corrupt (extXfs_group_load: Group 1 descriptor block locations too large at byte offset 4128)" according to fsstat. - Access the partition via the file system:
C:\Users\USER\.android\avd\EMULATED_DEVICE_NAME\userdata-qemu.img. The image seems incomplete as there are only a few folders to analyze.
What's really confusing to me are the three partitions userdata.img, userdata-qemu.img and userdata-qemu.img.qcow2 located in the folder stated in 3). According to the emulator help-page (emulator -help-disk-images), userdata.img is "the initial data partition image". userdata-qemu.img is "the persistent data partition image". There is no information about the userdata-qemu.img.qcow2. It seems that any data after the initial bootup will be saved in userdata-qemu.img.qcow2. I also tried to convert this file using qemu-img -f qcow2 -O raw userdata-qemu.img.qcow2 userdata.img to a raw file format (backing file from adb pull (method 1)), which can be analyzed using autopsy. However, the output seemes encrypted as the entropie is very high and you cannot detect any data using xxd/HxD.
I tested this on Android 11 and Android 12 rooted and emulated devices (Google Play API).
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论