5 ms·
Forensic tools used by law enforcement and intelligence organisations don't modify the system partition; in fact, modifying anything on the phone is highly unde
by ikonst 13y ago
Forensic tools used by law enforcement and intelligence organisations don't modify the system partition; in fact, modifying anything on the phone is highly undesirable, from a forensics point of view.
Re needing to wipe the disk:
1) Modern Android has 'adb backup' so if your phone is not locked, someone who got ahold of your phone can use it to dump your data from a non-rooted phone.
2) Law enforcement and intelligence organisations may or may not have tools to dump your data directly off a (desoldered) flash memory chip. You need to enable disk encryption (* ) to protect against this.
(* ) I'm assuming a disk encryption that's not rigged, i.e. has no key escrow available to law enforcement.
- aray 13y agoIf your phone is not locked, and it's physically compromised, then you're hosed already. If this is something you care about, you probably should lock your phone, and keep it physically secure. If your phone is locked, and there aren't any available root exploits for the system (why is why I'd agree with tytso about getting an unlockable phone -- less incentive for the community to collaborate on what are essentially weaponizeable root exploits) then a physical compromise that installs a persistent rootkit must wipe the device beforehand. (Which gets rid of your data, and is easily noticeable)
- ikonst 13y agoOh, you're talking about persistent rootkit. I was talking about making a one-off backup of your phone, then returning it to your shelf.