5

My phone was out of my possession for two days. I would like to save an image of the entire phone and run it in an emulator to be able to debug/reverse it so I can check it out for malware or any other software that may have been introduced. How would I be able to save everything as is to be able to emulate the phone? Is this even possible?

I have a Droid X2 running Android 2.3.4, no root, no custom ROM. I'm factory default b/c of warranty (Verizon).

Matthew Read
  • 50,567
  • 30
  • 145
  • 273
Digital fire
  • 105
  • 2
  • 9
  • Potentially relevant info here: Clone Android Device – eldarerathis May 04 '12 at 19:43
  • @eldarerathis I don't think that anything from there is applicable here. That question is about the fastest way to restore more than 60 devices. –  May 04 '12 at 19:50
  • @RichardBorcsik: Sure, but if you can clone 1 to 60 you can clone 1 to 1, which is effectively what this is (when considering the emulator as a "device"). Could be useful for creating the images. – eldarerathis May 04 '12 at 19:51
  • I highly, highly doubt an unaltered image of this device would work in the emulator. Driver problems mostly -- the Android emulator might provide generic simulated hardware, but not simulated X2 hardware. – Matthew Read May 04 '12 at 22:01
  • 1
    @Matthew Integrity of system could be checked by comparing a hash (something more secure than md5) of every file on system against the matching file from the same firmware version. But since it's not rooted there's no point doing that. The emulator could be used to check what's going on in the data partition. –  May 04 '12 at 22:17
  • @RichardBorcsik Hmm, that's an interesting idea. – Matthew Read May 04 '12 at 22:52

2 Answers2

1

As you said your phone is unrooted, which has two implications.

  1. You can't, without altering the phone thoroughly check whether it was tampered with.
  2. It makes it harder to tamper with the device.

So what you're asking for is not possible without possibly destroying evidence of tampering. If you're afraid what they might have done to it I suggest two options: either do a factory reset or buy a new phone.

Even if you could look for evidence of tampering be aware that you can never be sure. Checksums and modification dates can be faked.

If I was you I'd ditch that phone. I could never feel safe knowing that someone I don't know access to it for two days.

Prevention is another thing though. If you want to make sure that this doesn't happen again watch out for these things:

  • Screen lock. Use at least a complicated pattern lock makes an attacker harder to access your data. Even better set a pass phrase.
  • Root This gives complete control to anyone who has physical access to your device. Plant fake call logs? Done! Fake Text messages? Done! Install undetectable surveillance software? Done! You get the idea. Superuser (the de facto standard app for managing root access) has an option to require a passcode as a prerequisite to granting root. Use it.
  • Disable USB debugging While it's not too dangerous in itself if coupled with root it can provide access to the entire contents of your device even if you have a screen lock.
  • Encryption If your device is running android 3.0 or later you have acces to full device encryption. Use it.
  • Backup apps Apps like Titanium Backup can backup sensitive data to your sdcard. Even if you did all of the above, all an attacker would have to do is take out your sdcard an voila! Full access to everything! Make sure that your backups are encrypted with the strongest possible encryption.
  • I suggest you edit this to remove the portions that aren't relevant to the Android problem. I've edited the question to hopefully push the focus away from the particular circumstances driving this question. – Matthew Read May 04 '12 at 21:58
0

I don't have experience with Droid X2 in particular, so your results might be different, but I'd suggest to find custom recovery boot image for your phone (ClockWorkMod is recommended), then boot it with fastboot boot custom_recovery_you_found command and proceed with full nandroid backup of your phone. There might be some additional steps necessary to enable fastboot to work on your phone, usually they are described on the page you get your custom recovery from.

Regarding the malware that might be installed, you'll never be sure. Factory wipe only wipes your data from the phone, but does not touch system applications. If you are really afraid of someone introducing malware to your phone, I'd recommend to root it and install a custom ROM, which will totally overwrite boot and system partitions, effectively destroying any possible modifications.

lenik
  • 661
  • 3
  • 5