-2

For several days now I have tried to recover the key for an encrypted android-container (android_expand, used as internal storage) without success. As all kinds of stuff of the past years is on that card. As all other attempts failed I will try to break it with brute-force.

Yet I struggle to get the information on how the partition is actually encrypted. I took a dd image of the whole SD-card and try now to figure out what's the best way to try brute-force using bruteforce-luks as apparently it's an encrypted LUKS-container.

How do I obtain more information on how the container is encrypted? And what would be the best way to decrypt it?

Disk ANDRO.bin - 63 GB / 59 GiB - CHS 7765 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 P Unknown                     2048   are   34815      32768 [android_meta]
 2 P Unknown                    34816  124735454  124700639 [android_expand]
  • You could try but it will probably fails. AES 128 which was in use ... will be very hard (almost impossible) to decipher. – Kiwy Sep 11 '18 at 12:45
  • Seems there are some known flaws about Android full encryption. Could that relate to the Internal Memory too? theregister.co.uk/2016/07/01/… – Qohelet Sep 12 '18 at 21:16
4

Android uses a 128-bit key to encrypt its adoptable SD cards. It's pseudorandom, not derived from the user's password. Brute-forcing a pseudorandom 128-bit key is hopeless.

If you somehow had access to the key (it's saved in /data/misc/vold/ on the device), it's easy to use that to decrypt it. https://android.stackexchange.com/questions/145443/how-to-decrypt-adopted-storage explains how you do that. But if you don't have access to that key, you have no way to even hope to decrypt it.

| improve this answer | |
  • The key was deleted for some reason. I only have the name of the keyfile and some files in the bench-folder I'm able to restore – Qohelet Sep 8 '18 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.