Continuing the series from last year, I am making publicly available an image of an Android 10 device, which was created using a rooted Pixel 3. For those who may not know, there have been some major changes in the partition layout in Android 10. These changes affect the Pixel 3 & 4 series and new phones that ship with Android 10, but not necessarily those phones that upgrade to 10 from a previous version. You can read about the changes here. This new layout prevented me from getting an overall image of the device, so hopefully a file system extraction will suffice.
This image contains a lot of the same apps as the previous images, along with a few new ones: Discord, Imgur, MeWe, TorBrowser, and Venmo. There is also a second user profile on the device with its own apps and a small amount of activity. As always, documentation comes with the image. An Excel spreadsheet is also included that contains SMS data.
There are two versions of the same extraction. The first version is the extraction as it came from Cellebrite UFED 4PC (in the folder Cellebrite Extraction). The .ufd file is included with the extraction.
The second version is for those that may not be able to ingest the Cellebrite extraction. It is in a .zip folder (in the folder Non-Cellebrite Extraction). It was created by using 7-Zip to decompress the Cellebrite .z archive files and the Cellebrite .zip file. During the decompression there were 44 errors, but the errors were on a few .vdex, .tmp, and a couple of .jpg asset files, so nothing major. To test it, I imported the .zip file into Physical Analyzer, version 7.29.0, and things worked just fine. The data is there for examination and testing.
As always, this image is freely available to anyone who wants it for training, education, testing, or research.
For those of you who link to the image, please link to this page, not the image URL. I plan on moving the image in the future, and I’d hate for your link to break.
Everything is contained in a single .zip file, which is found here (Google Drive – will sometimes exceed a quota) or here (OneDrive – not sure about the quota). The hash values for the .zip are as follows: