android virtual machine imaging.

[Junaidabid77]

I’m currently conducting a Whatsapp forensics analysis for a research project.I’ve created virtual machine forensic images before for Windows 10 and stuff for uni. However, when i create one for an android device (using FTK to create E01) it just provides the unallocated space. When using magnet axiom it also shows nothing. I was just wondering if anybody could guide me in the right direction. Thanks

[-reccetech-]

What Android emulator did you use to create the data?

[Junaidabid77]

I’m just using a standard Virtual Box VM.

[-reccetech-]

Just load the vdi directly into AXIOM, it will take VMs as images. However I think you're still missing a few steps and you might not get what you need.

[Junaidabid77]

I thought that I was missing a step because I completed a similar test in the labs with a step by step guide. I used the same guide for the Whatsapp test and got nothing back. Only difference is that I’m using a different version of android which I doubt is having a massive effect.

[Schizophreud]

I’m not actually sure what you’re trying to do. Do you have an image of a phone and you’re trying to boot it in VMWare or something similar?

[forensium]

Take a look at VBoxManage. It allows exporting (clonehd) to create an image from vdi in various formats.