Recovery mode

Recovery mode

This page contains information about how to use a recovery mode in order to extract more data from an Android device.
Main values of this feature are:
  • Extraction from both rooted and non-rooted devices without knowing their screen lock password
  • Creation of the device's physical image and reusing/reanalyzing it multiple times in the future to get better results without the need of having the device present
  • Screen lock protection bypass - more instructions are available here.
                    
How to set the phone to recovery mode
More information about recovery mode is available here.
How to install the custom recovery is available here (for Samsung devices) and here (for non-Samsung devices).

Connecting the phone
After you have prepared your device, simply open MOBILedit Forensic Express and connect the phone by cable.

Choose whether you want to create a physical image, browse phone or standard extraction.


All other settings are the same as when you connect the phone in a device mode.

    • Related Articles

    • How to boot into recovery (Android)

      Why do I need to boot into recovery?  Recovery is a tool used to perform factory reset and install system updates by default.  However, there are many custom recoveries (CWM, TWRP, etc.) made especially to flash custom ROMs (unofficial builds of ...

    • Flash phone with recovery image (TWRP)

      Every Android phone has a "recovery“ partition which is by default used for performing factory resets using an OEM’s preloaded tools. However, this partition can be modified in order to replace the default tools by third-party recovery tools such ...

    • Android recovery data acquisition

      Every Android phone has a "recovery“ partition which is by default used for performing factory resets using an OEM’s preloaded tools. However, this partition can be modified in order to replace the default tools by third-party recovery tools such as ...

    • How deleted data recovery works

      There are three files associated with database which may contain deleted records. The database file - <database name> (https://www.sqlite.org/fileformat2.html#section_1) The rollback journal - <database name>-journal ...

    • Connecting in MTP mode

      Some phones tend to automatically connect in "charge only" mode. To ensure the fastest possible communication speed and transfer speed, please change the connection mode to MTP (Media Device). You can follow these steps in order to do it. 1. Swipe ...