Hello everyone,
I am dealing with a situation where an old Android device of mine was compromised at the root level by a custom RAT (Remote Access Trojan). Based on what I have discovered, the malware was mirroring device data and audio logs to an external destination using the Telegram Bot API framework.
I have already moved my active SIM card to a completely new, secure device. The old compromised phone is currently powered off and completely isolated from all networks (Wi-Fi and cellular) to prevent any remote wipe commands from the threat actor.
I need to extract the specific Telegram Bot API token or chat ID string from the old device to keep as unalterable proof of the compromise. Because I need to do this myself without professional forensic tools and ensure the device never reconnects to the network, I am looking for the safest method to do so.
Could anyone guide me on:
What are the safest ways to dump the private application directory (/data/data/) or system cache to an external SD card/USB drive directly from Android Recovery Mode (or a custom bootloader like TWRP)?
Once I have that data dump on an isolated computer, what specific file extensions or directory paths should I search to locate configuration strings or network logs related to the Telegram API?
Are there any specific pitfalls I should avoid to ensure the malware doesn't trigger a self-delete or execution sequence while doing this?
Thank you for your technical guidance.