Develop Bugs

taking a system image using "dd" command for

Hi, bit of a noob - not sure if i have the terminology right but i have a Note II N7100 and need to do some forensics for a pal whos wife is possibly having an affair and hides it thru kik online chat not txts. I am planning to take an image to a 32gb microsd, move to PC,run winhex and finally testdisc over the resulting drive to hopefully recover some deleted sqlite db's!
I am going off this guide - forensicfocus.com/2012/09/12/android-forensics/ - I have rooted the phone all fine. But i am having a job with the "dd" command for example
dd if=/dev/block/mmcblk0p16 of=/extSdCard/image.img
This returns "/extSdCard/image.img - cannot open for write. No such file or directory"
Or dd if=/dev/block/mmcblk0p16 of=/dev/block/vold/179:33/image.img
returns "/dev/block/vold/179:33/image.img - cannot open for write. Not a directory"
Ive used "diskdigger" to look for images and devices are:
/system 2gb (/dev/block/mmcblk0p16)
/efs 20mb (/dev/block/mmcblk0p3)
/cache 1.34gb (/dev/block/mmcblk0p12)
/data 10.6gb (/dev/block/mmcblk0p16)
/storage/extSdCard, 29gb (dev/block/vold/179:33)
Any help or links on the syntax appreciated greatly

Off the top of my head the first thing I would try is sending the dd image to the internal sdcard first, then moving it to the external later. Might be that it's having trouble going the extra step away from the device.
You could always just plug it into a computer and use adb to pull the dd image(s) directly to the computer and skip putting them on the phone at all. It's what I would do to minimize my residual impact on the device at hand.
Also, try naming them as the mmcblk.img corresponding to what partition you are pulling, makes it easier to go through later.

Try this:
Code:
dd if=/dev/block/mmcblk0p13 of=/storage/extSdCard/system.img bs=4096
This should give you a dd of /system (which is /dev/block/mmcblk0p13, not /dev/block/mmcblk0p16).

dwitherell said:
Try this:
Code:
dd if=/dev/block/mmcblk0p13 of=/storage/extSdCard/system.img bs=4096
This should give you a dd of /system (which is /dev/block/mmcblk0p13, not /dev/block/mmcblk0p16).
Click to expand...
Click to collapse
ah you are a hero! :good::good::good:

G2 Mini
dwitherell said:
Try this:
Code:
dd if=/dev/block/mmcblk0p13 of=/storage/extSdCard/system.img bs=4096
This should give you a dd of /system (which is /dev/block/mmcblk0p13, not /dev/block/mmcblk0p16).
Click to expand...
Click to collapse
Thanks dude! you saved my ass with the D620!

Backup files

Hi people! I need backups from your phone F180L. Those who have F180L phone please make a backup. Go to the terminal emulator and type:
su
cd /sdcard
mkdir 123
cd /123
dd if=/dev/block/mmcblk0p1 of=modem.img
dd if=/dev/block/mmcblk0p15 of=drm.img
dd if=/dev/block/mmcblk0p12 of=m9kefs1.img
dd if=/dev/block/mmcblk0p13 of=m9kefs2.img
dd if=/dev/block/mmcblk0p26 of=persist.img
Please Share a link to files that are in the /123

mazahaka1997 said:
Hi people! I need backups from your phone F180L. Those who have F180L phone please make a backup. Go to the terminal emulator and type:
su
cd /sdcard
mkdir 123
cd /123
dd if=/dev/block/mmcblk0p1 of=modem.img
dd if=/dev/block/mmcblk0p15 of=drm.img
dd if=/dev/block/mmcblk0p12 of=m9kefs1.img
dd if=/dev/block/mmcblk0p13 of=m9kefs2.img
dd if=/dev/block/mmcblk0p26 of=persist.img
Please Share a link to files that are in the /123
Click to expand...
Click to collapse
Those who know what this is about, need no explanations. Those who are not so sure, be aware that by doing this (specifically the line in red), you will be sharing your phone's identity. Nothing's wrong with that, as long as you know it.

What's in drm and persist images?
Sent from my LG-E975 using Tapatalk

davevinci said:
What's in drm and persist images?
Click to expand...
Click to collapse
For these two, I don't know... Since I am not familiar with nuts and bolts of the DRM implementation on Android, I don't know what exactly is stored on that partition. As for persist, I was trying to get some info on it quite a while ago, for a different phone that is long gone, but couldn't find much.

efs backup

I can't seem to find if the following script needs any changes or i can just copy/ paste it to back up my efs
Backup:
adb shell
su
dd if=/dev/block/platform/msm_sdcc.1/by-name/modemst1 of=/sdcard/modemst1.img
dd if=/dev/block/platform/msm_sdcc.1/by-name/modemst2 of=/sdcard/modemst2.img
Could anyone confirm if i can just copy paste it?
Kind regards

v521 Bootloop after upgrading to TWRP 3.1.1-0, flashing latest Lineage

So it's been a while since I played with ROMs on my v521, but i just upgraded to TWRP 3.1.1-0, and tried to update lineage to the newest nightly. I'm not swuck in a boot-loop.
I've run the commands in terminal that fixed the issue last time I ran into it:
Code:
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/fota
dd if=/dev/zero of=/dev/block/platform/msm_sdcc.1/by-name/misc
To no avail - terminal says it can't find the files.
I've wiped everything, reformatted data, reinstalled TWRP, etc.
What's next? How can I break out of the loop?

I fixed it. Grabbed the wrong bookmark. Should have run:
Code:
dd if=/dev/zero of=/dev/block/bootdevice/by-name/fota
dd if=/dev/zero of=/dev/block/bootdevice/by-name/misc

Xerloq said:
I fixed it. Grabbed the wrong bookmark. Should have run:
Code:
dd if=/dev/zero of=/dev/block/bootdevice/by-name/fota
dd if=/dev/zero of=/dev/block/bootdevice/by-name/misc
Click to expand...
Click to collapse
I recently ran into this issue. Thanks for posting the fix!

You saved my butt with this, OP! Thank you!
For those who stumble onto this, the "terminal" he's referring to is the TWRP terminal that is accessible in TWRP>>Advanced>>Terminal.

Thanks for this fix! Could someone please tell me how to type an equal sign (=) in the TWRP terminal keyboard? I can't find it anywhere. I managed to give the tablet these commands with the adb shell.

How to upgrading 3.1.1-0?
How to upgrading 3.1.1-0?

yangseunghwan said:
How to upgrading 3.1.1-0?
Click to expand...
Click to collapse
I am using 3.1.1-0.

Thanks, this worked perfectly! I'm running TWRP-V521-3.0.2.0

How to type an "=" sign in TWRP terminal kb
channeledbymodem said:
Thanks for this fix! Could someone please tell me how to type an equal sign (=) in the TWRP terminal keyboard? I can't find it anywhere. I managed to give the tablet these commands with the adb shell.
Click to expand...
Click to collapse
I'll answer my own question in case someone comes here looking for the answer:
in twrp terminal keyboard to type "=" sign, tap ?123, then ~\{ for special characters including "="

Xerloq said:
I fixed it. Grabbed the wrong bookmark. Should have run:
Code:
dd if=/dev/zero of=/dev/block/bootdevice/by-name/fota
dd if=/dev/zero of=/dev/block/bootdevice/by-name/misc
Click to expand...
Click to collapse
I have been stuck on this issue for over 5 hours thank you so mucn

Is there anyway to delete files on "bootdevice" file with TWRP Terminal?

So today I was trying to backup my EFS/IMEI and found that I could do so using the TWRP Terminal commands:
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/modemst1.emmc.win
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/modemst2.emmc.win
Click to expand...
Click to collapse
However I typed it wrong, doing this:
dd if=/dev/block/bootdevice/by-name/modemst1 of=/dev/block/bootdevice/by-name/modemst1emmc.win
dd if=/dev/block/bootdevice/by-name/modemst2 of=/dev/block/bootdevice/by-name/modemst2.emmc.win
Click to expand...
Click to collapse
This resulted in having the backups inside the bootdevice file, is there any way I can delete these files with a TWRP terminal command?