In this course, we used to break down
all of these differences here and teach you how to do it.
Sadly, some of them are kind of a trend that are going away.
So if we look at the bottom, JTAG, ISP, and Chip-off.
This is a "use it or lose it" skill.
I took my training from Teel Tech,
and Bob Elder taught me amazing things.
However, it is literally use it or lose it.
Keep that in mind.
If it's not something you're doing every day,
it's not going to be relevant.
Also, there are a lot of phones where this does not pertain
anymore because of encryption.
If it's file-based encryption on that device,
the decryption must happen on the device or not at all.
But let's talk through some of these other ones.
Bootloader extractions.
These may also not be available on newer Android devices.
So keep that in mind.
But if you enter your make and model into your forensic tool
of choice and it says, hey, I can do a bootloader extraction,
what this means is a custom bootloader
is going to be injected into RAM or the memory of that device
before it boots.
And it lets you get, usually, physical acquisition
support for it.
Custom recovery images.
This one is only supported on Android devices that
are older and not encrypted.
That's rare, if you think about it.
Most Androids do have either full disk
encryption or file-based encryption
enabled on that handset.
But if you come across an older one, you can try this.
If you read the notes of this page,
AXIOM's really good at recovery images,
on letting you download and install your own on the device.
Just be careful with it.
Emergency download mode.
This is a way that you could do it
through keystrokes on the device or with specialized cable
to put the device in a low-level access mode that provides
direct access to that chipset to get a more physical acquisition
of that device.
There is a group on day five, MDFA, the Mobile Device
Forensic Analysis Group, that you can join.
There is amazing information put out there by Scott
on how to get devices into EDL mode and what is supported.
Now, EDL mode should not be disruptive to the device.
Bootloader extractions can be.
And the reason I'm mentioning this custom recovery images
and bootloader--
if you try to push something to a device that's
not the correct model, you could brick or ruin that evidence.
So be very careful.
Make sure you're doing device-specific
and know that these are additional extraction methods.
These should kind of be used toward the end,
like, you've exhausted all other options.
So for bootloader, custom recovery, and EDL,
you've tried other extraction methods.
For JTAG, ISP, Chip-off-- that's typically
your last step anyway.
But then we have these three in between.
And these are going to be unique to UFED
at the time of writing this.
So Qualcomm Live, Huawei--
which is going to be called Kirin live,
I believe-- and MTK Live.
Depending on the chip that's on that device, what it does is
it puts it into a state where you
may be able to get a full file system acquisition
of modern Android devices.
It's awesome.
So if it can work, make sure you're leveraging that.
In Section 2, I will talk you through using
some of the Qualcomm Live, Kirin Live, and MTK--
Live methods.