Get physical dump from ADB

This method can be used on unlocked Android devices with root permissions and USB debugging enabled. It acquires a complete physical image of the device. This comprehensive approach allows users to gain deeper insight into the device's data and system, allowing for more extensive analysis and forensic investigation.

The physical image may be encrypted depending on the version of Android:

From Android 7 - FDE (Full disc encryption)

From Android 10 - FBE (File-based encryption).

MOBILedit Forensic can extract unencrypted physical images of a device using this method, even if the device is using FDE. As long as it is an unlocked device with root access and the device is connected via USB with debugging enabled.