Recovery - Get physical dump from recovery

This page contains information about how to use a recovery mode in order to extract more data from an Android device.

Main benefits:

Extraction from both rooted and non-rooted devices without knowing their screen lock password
Creation of the device's physical image and reusing/reanalyzing it multiple times in the future to get better results without the need of having the device present
Screen lock protection bypass - for more information go to “Use TWRP to bypass Android lockscreen”

For this method, TWRP or another custom recovery flashed into the device is required.

How to set the phone to recovery mode

More information about recovery mode is available in the article “How to boot into recovery on Android”.

To install a custom recovery on Samsung devices please read “ODIN mode”.

A guide on how to install the custom recovery on non-Samsung devices is available at “CMD method - Flashing TWRP on non-Samsung devices”.

After you have prepared your device, simply open MOBILedit Forensic and connect the phone with a cable.

Choose whether you want to create a physical image, browse the phone, or perform an extraction.

All other settings are the same as when you connect the phone to the device mode.