We ended Section 1 talking about ADB.
And it's worth mentioning again in Section 2.
The Android Debug Bridge is the method for us
to communicate with the device to our forensic workstation.
It is a command line utility that
is leveraged by a lot of the commercial tools.
It is going to enable you to push and pull commands
to and from that Android.
Now, many people get nervous.
The first common misconception is
that you're going to accidentally push data
to your Android and ruin it.
If you type the word push, you are at risk.
If you never type that word, there's no risk.
Just don't type the word push, and everything is fine.
You could attempt to pull data from your Android all day long.
And the worst-case scenario is you
will get that it is not successful,
that it is not valid, or you don't have access to do that.
This is going to require USB debugging.
So something I do recommend is if you go into your Settings
on your Android and scroll down to Developer Options.
You can actually go down and do revoke USB debugging
authorizations.
That's sometimes helps refresh the device if you're
having issues connecting to it.
Something else you want to make sure
is that USB debugging is actually enabled.
I've had many cases where the device rebooted,
and USB debugging turned off.
Make sure it's turned on.
Finally, what I want to mention on this slide--
you can see in the screenshot here that I'm looking at data.
In order to pull the data partition
or to access some system files, you
are going to need root access.
So this is why when we talk about some
of the generic acquisition methods that are available.
You're not going to be able to do that.
You're not going to be able to pull that user data partition
unless you have root.
If you think back to Section 1.4,
the device that was in the backup,
we would have complete success pulling that data partition
through ADB.
We have complete success accessing most
if not all files because we had root level access.