Flash phone with recovery image (TWRP)

Every Android phone has a "recovery“ partition which is by default used for performing factory resets using an OEM’s preloaded tools. However, this partition can be modified in order to replace the default tools by third-party recovery tools such as  TWRP.

These recoveries are (unlike the stock ones) capable of modifying all the internal system partitions of your phone or tablet (they need this capability in order to flash custom firmware).

TWRP even comes with a built-in file manager with unlimited root access so you can modify, add or delete any system files manually. This process allows you to gain physical image, therefore bypass the otherwise locked device´s protection.

However, if the image is encrypted by the system itself, we are only able to get the encrypted physical image.

The device has to have its bootloader unlocked in order to proceed with this method.

Before we start this procedure, be aware that everything you do is at your own risk, every device does behave differently.

1.      Download TWRP for your device (you can use for example a page: twrp.me)

2.     Once you will have the .img file, load MOBILedit Forensic Express and navigate to the "Hack phone section" and select "Flash phone with recovery image".

3.     Set the device to the download/fastboot mode and connect it to the PC.

(you should see something similar like this)

4.      Click next and select "Custom" and import the .img file 

5.      Proceed with the installation.

6.      If the phone did not boot into TWRP right away, access it manually by holding vol. UP + Power + Home button .

If you see this on your device, you have done everything correctly

And on PC you should see something like this:

7.      Now you can just proceed as you would do a normal extraction. If you want to just extract information into pdf.

Where to find the physical image for later use

We suggest clicking on the "Create physical image" button. Our software will determine which of the file in your device is the physical image and will begin creating.

If the button will not appear then:

1.      Click the "Browse phone" button

If a pop-up message appears with a warning that you have an old connector just click no

2.     Navigate through internal (raw0) > dev > block

There you should see a file called  mmcblk0 , copy that file to whatever folder you want by pressing F5 or the copy button 

If you do not see the file mmcblk0 then there is a possibility that the physical image might be called differently, if that would occur please contact our customer support.

(on the right side you can choose the destination)   

3.      After the copying is finished, you should see the file in the desired folder 

If you would like to analyze this file later, then you need to click on the "Import data" button in MOBILedit Forensic Express and choose the "Physical image". Keep in mind that you need to select all files in the bottom right corner for mmcblk0 to show up, as seen in the screenshot below.

DISCLAIMER: procedures like this may cause irreversible harm to your device, please proceed with extra caution.
Feel free to contact us if you are not sure, we cannot take responsibility for the wrong image or any damage caused during this procedure.

• Related Articles

• How to boot into recovery (Android)

  Why do I need to boot into recovery?  Recovery is a tool used to perform factory reset and install system updates by default.  However, there are many custom recoveries (CWM, TWRP, etc.) made especially to flash custom ROMs (unofficial builds of ...

• How to flash TWRP on non-Samsung devices (CMD method)

  Requirements: Your Android device  Unlocked bootloader  ADB and Fastboot installed on your PC  Computer with Windows 7 and above or Linux  All the correct drivers for your phone installed  TWRP image file for your device (ends with ".IMG") Steps: If ...

• How to flash TWRP on Samsung devices (ODIN method)

  Requirements: Your Samsung device  All the correct drivers for your phone installed  Computer with Windows 8 or newer  Odin 3.09 or newer  ADB installed on your PC TWRP image file for your device in TAR archive (download from here) Steps: Make sure ...

• Android recovery data acquisition

  Every Android phone has a "recovery“ partition which is by default used for performing factory resets using an OEM’s preloaded tools. However, this partition can be modified in order to replace the default tools by third-party recovery tools such as ...

• Recovery mode

  This page contains information about how to use a recovery mode in order to extract more data from an Android device. Main values of this feature are: Extraction from both rooted and non-rooted devices without knowing their screen lock password ...