So after a failed attempt to upgrade from CyanogenMod 10.1.3 to 10.2, I was unable to access /data or /sdcard because both systems were encrypted. I ended up having to factory reset my phone because it refused to co-operate or let me access my files. However, before I did that, I was able to run
Code:
adb shell "dd if=/dev/block/mmcblk0p2" > data.img
and
Code:
adb shell "dd if=/dev/block/mmcblk0p3" > sdcard.img
, which appears to have copied the raw partition images from the phone (at least, they're the right sizes).
According to my reading, Android (and, I'm inferring, CyanogenMod) encrypts filesystems using dm-crypt, with a AES-CBC ESSIV:SHA256 cipher, with the key being derived from the password using PBKDF2. Knowing the precious little I do about encrypted file systems, my guess is that if I configure the image in cryptsetup to create a drive mapping, I can mount the mapped drive and recover the data from the images.
According to /fstab.herring on my ahem, fresh, install of Android, the /data partition is in ext4 format whereas the /sdcard partition is vFAT. So, once I've gotten through the encryption on the partition images, they should mount normally, right?
I know that dm-crypt accepts plain, LUKS, LoopAES and TrueCrypt device formats. I'm inferring from the PBKDF2 extension that Android goes the LUKS route for encrypting. Is this conclusion correct?
Could someone explain whether it's possible to decrypt a dumped android image? I'm really hoping that the cypher information is stored on the file system and not on some key file that I nuked in the factory reset. If it can, in theory, be decrypted, am I using the right tools to approach the matter? If so, I'll continue fiddling with cryptsetup and mount, but no sense in wasting time if it's an impossible task.
Never did get a response to this question, so I'll try it again, but start with a simpler question:
If someone dds an Android (specifically Cyanogenmod 10.x) partition to an img file, is there any way to read that image from, say a Linux laptop? I dumped the contents of the /system partition using
Code:
adb shell "dd if=/dev/block/mmcblk0p1" > system.img
I expected system.img to be a normal ext4 partition. However, attempting to loopback mount it with
Code:
sudo mount -t ext4 -o loop,ro system.img ~/android/system
Gave me errors about corrupt group descriptors, bad magic numbers and other maladies indicative of a thoroughly corrupted file system. I'm assuming that:
/data has the same ext4 partition structure as /system; and
The process to mount /storage would be no different to mounting /system with the exception that the former uses vFAT as its file system
However, as my Android is currently working normally (well, as well as one can hope for Android to work), I know I don't have a corrupted file system.
So what's going on? Does Android use a special version of ext4 that other Linuxes don't recognise? Am I not dd-ing correctly? Is there a block-size issue I ignored to my peril?
Borden Rhodes said:
So after a failed attempt to upgrade from CyanogenMod 10.1.3 to 10.2, I was unable to access /data or /sdcard because both systems were encrypted. I ended up having to factory reset my phone because it refused to co-operate or let me access my files. However, before I did that, I was able to run
Code:
adb shell "dd if=/dev/block/mmcblk0p2" > data.img
and
Code:
adb shell "dd if=/dev/block/mmcblk0p3" > sdcard.img
, which appears to have copied the raw partition images from the phone (at least, they're the right sizes).
According to my reading, Android (and, I'm inferring, CyanogenMod) encrypts filesystems using dm-crypt, with a AES-CBC ESSIV:SHA256 cipher, with the key being derived from the password using PBKDF2. Knowing the precious little I do about encrypted file systems, my guess is that if I configure the image in cryptsetup to create a drive mapping, I can mount the mapped drive and recover the data from the images.
According to /fstab.herring on my ahem, fresh, install of Android, the /data partition is in ext4 format whereas the /sdcard partition is vFAT. So, once I've gotten through the encryption on the partition images, they should mount normally, right?
I know that dm-crypt accepts plain, LUKS, LoopAES and TrueCrypt device formats. I'm inferring from the PBKDF2 extension that Android goes the LUKS route for encrypting. Is this conclusion correct?
Could someone explain whether it's possible to decrypt a dumped android image? I'm really hoping that the cypher information is stored on the file system and not on some key file that I nuked in the factory reset. If it can, in theory, be decrypted, am I using the right tools to approach the matter? If so, I'll continue fiddling with cryptsetup and mount, but no sense in wasting time if it's an impossible task.
Click to expand...
Click to collapse
Can you give the result of the "file sdcard.img" and "file data.img" commands?
You are quite right. With regular LUKS container/partition, you would do (being root) the following. With the following commands, you can create a container named "safe", setup it, then format its content in ext3 and mount the partition:
Code:
dd if=/dev/zero bs=1M count=50 of=safe
losetup /dev/loop0 safe
cryptsetup luksFormat -c aes -h sha256 /dev/loop0
cryptsetup luksOpen /dev/loop0 safe
mkfs.ext3 /dev/mapper/safe
(losetup /dev/loop0 safe)
(cryptsetup luksOpen /dev/loop0 safe)
mkdir mnt
mount -t ext3 /dev/mapper/safe mnt
//HERE: do whatever you want in your mounted encrypted filesystem
umount mnt
cryptsetup luksClose safe
losetup -d /dev/loop0
For details, you can go there: http://blog.theglu.org/index.php/20...-couteau-suisse-du-chiffrement-de-partitions/
Sorry, the article is in French but you can translate it if you need to.
Here, using "hexdump", you can see the "safe" file has a LUKS magic at the beginning. And doing a "file safe" command, you can check it detects it as a "LUKS encrypted file".
If doing "file" on your .img files does not give you the same result, you may not be able to directly use the "cryptsetup" command and need to adapt it.
Finally: usually in Android the header containing the key is stored on another partition so you may have lost it when wiping your phone, sorry.
---------- Post added at 02:44 PM ---------- Previous post was at 02:41 PM ----------
Borden Rhodes said:
Never did get a response to this question, so I'll try it again, but start with a simpler question:
If someone dds an Android (specifically Cyanogenmod 10.x) partition to an img file, is there any way to read that image from, say a Linux laptop? I dumped the contents of the /system partition using
Code:
adb shell "dd if=/dev/block/mmcblk0p1" > system.img
I expected system.img to be a normal ext4 partition. However, attempting to loopback mount it with
Code:
sudo mount -t ext4 -o loop,ro system.img ~/android/system
Gave me errors about corrupt group descriptors, bad magic numbers and other maladies indicative of a thoroughly corrupted file system. I'm assuming that:
/data has the same ext4 partition structure as /system; and
The process to mount /storage would be no different to mounting /system with the exception that the former uses vFAT as its file system
However, as my Android is currently working normally (well, as well as one can hope for Android to work), I know I don't have a corrupted file system.
So what's going on? Does Android use a special version of ext4 that other Linuxes don't recognise? Am I not dd-ing correctly? Is there a block-size issue I ignored to my peril?
Click to expand...
Click to collapse
Can you give the result of the "file system.img" command?
Thanks, saidlike, for your reply:
saidelike said:
Can you give the result of the "file sdcard.img"...
Click to expand...
Click to collapse
sdcardPartitionDump.img: data
saidelike said:
... and "file data.img" commands?
Click to expand...
Click to collapse
data.img: data
saidelike said:
Can you give the result of the "file system.img" command?
Click to expand...
Click to collapse
system.img: Linux rev 1.0 ext4 filesystem data, UUID=57f8f4bc-abf4-655f-bf67-946fc0f9f25b (needs journal recovery) (extents) (large files)
Again, attempting to run
Code:
mount -t ext4 -o loop systemimg mountpoint/
yields
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
Click to expand...
Click to collapse
Ignoring the results of data.img and sdcard.img for the time being, the fresh dump of the system partition shows that it's an EXT4 filesystem, but that it's heavily corrupted. fsck.ext4 on that partition basically asks me to fix every single inode, so it's not a simple unclean journal issue. Therefore, is it fair to conclude that CyanogenMod (and maybe AOSP too) have modified the ext4 partiiton type?
@Borden Rhodes
Maybe, my reply is too late, but you could try to make the same experiment with backup of your current data.
If you get the same results as with the old pre-wipe backup, then you still have a hope.
Hello,
I encrypted the phone, but found out in a painfull way (missed) that "wake up on alarm" does not work with encryption.
Have a problem though trying to do a factory wipe/reset via twrp recovery to de-crypt it.
Booting to recover -> Wipe -> Standard wipe (data, cache, dalvik) gives me
Code:
E:Unable to mount '/data'
E:Unable to recreate /data/media folder
Updating partition details...
E:Unable to mount '/data'
E:Unable to mount storage.
E:Unable to mount /data/media during GUI startup.
Finished running boot script.
E:Unable to mount /data/media/TWRP/.twrps when trying to read settings
E:Unable to mount '/data'
Formatting cache using mke2fs...
Done.
E:Unable to mount '/data'
Updating partition details...
E:Unable to mount '/data'
E:Unable to mount storage
... and a big, red FAILED on factory reset. I can't do a backup or restore a backup (shows empty storage), probably for exacly the same reason (can't mount /data). Tried flashing recovery twice already, once manually, once via GooManager.
This is on HTC ONE X+ (Int) running stock ROM, rooted with TWRP 2.6.3.0, hboot 1.72.0000.
Any suggestion would be of great help.
fbielejec said:
Hello,
I encrypted the phone, but found out in a painfull way (missed) that "wake up on alarm" does not work with encryption.
Have a problem though trying to do a factory wipe/reset via twrp recovery to de-crypt it.
Booting to recover -> Wipe -> Standard wipe (data, cache, dalvik) gives me
Code:
E:Unable to mount '/data'
E:Unable to recreate /data/media folder
Updating partition details...
E:Unable to mount '/data'
E:Unable to mount storage.
E:Unable to mount /data/media during GUI startup.
Finished running boot script.
E:Unable to mount /data/media/TWRP/.twrps when trying to read settings
E:Unable to mount '/data'
Formatting cache using mke2fs...
Done.
E:Unable to mount '/data'
Updating partition details...
E:Unable to mount '/data'
E:Unable to mount storage
... and a big, red FAILED on factory reset. I can't do a backup or restore a backup (shows empty storage), probably for exacly the same reason (can't mount /data). Tried flashing recovery twice already, once manually, once via GooManager.
This is on HTC ONE X+ (Int) running stock ROM, rooted with TWRP 2.6.3.0, hboot 1.72.0000.
Any suggestion would be of great help.
Click to expand...
Click to collapse
try erasing it from fastboot
Code:
fastboot erase system
fastboot erase userdata
fastboot erase cache
Thanks for a prompt answer. That gives me:
@silver ~/Dropbox/HTC $ sudo ./fastboot erase system
erasing 'system'... FAILED (remote: not allowed)
@silver ~/Dropbox/HTC $ sudo ./fastboot erase userdata
erasing 'userdata'... FAILED (remote: not allowed)
@silver ~/Dropbox/HTC $ sudo ./fastboot erase cache
erasing 'cache'... OKAY
Click to expand...
Click to collapse
so a no-go unfortunately. In TWRp there's format option for /data, but if he can't mount it, probably won't format either?
Is this problem solved?
if yes, how did you do that?
ll_love22000 said:
Is this problem solved?
if yes, how did you do that?
Click to expand...
Click to collapse
you need to format data in TWRP which will cause you to lose EVERYTHING on the internal sd too
Format data, it will delete only internal storage
Couple months ago, I tried to flash Android 6.0 on my S2 i9100 but it only recognized the first partition (2gb ) but the rest 14gb no. [ Sure, I did wipe cache partition, dalvik cache, data ]
So, I did some format with adb shell ( I deleted FactoryFS, Data, UMS partitions and change the format type to Fat32) and copied to internal storage. When I install it ( it takes like 3-5 minutes) and get this error
|Warning: No file_contextsdetected filesysstem ext4 for /dev/block/mmcblk0p9
| mount: failed to mount /dev/block/mmcblk0p9 at /system: Device or resource busy
| detected filesystem ext4 for /dev/block/mmcblk0p9 It stuck here for a while
ApplyParsedPerms: lsetfilecon of /system/lost+found to ubject_r: system_file: s0 failed: Operation on not supported on transport endpoint
set_metadata_recursive: some changes failed
E: Error in /emmc/cm12.... (status 7)
Installation aborted
press any key to continue.
After that, I tried again with Odin, I used Stock PIT and 12gb PIT ver to install Rom, still get the error above. Even when I use Odin to flash new Rom, Odin get stopped working.
[ I have tried many versions of CWM, Philz, TWRP,... but still Can't mount /sdcard ]
So how can I fix this problem?
Thanks for reading and helping me. Also sorry for my bad English.
I need to flash a ROM on my device to root my VFD600, but can't flash it due to this message always showing up. How to fix it?
Android Recovery
Vodafone/VFD600/P809V50
6.0.1/MMB29M/20160927.133420
user/test-keys
Use volume up/down and power.
Supported API: 3
E:try to mount "/dev/block/mmcblk1p1" partition at "/sdcard" with exFAT filesystem
E:vfat mount failed, try to mount with fuse exfat
E:/sbin/mount.exfat failed with status 1
E:fangjun failed to mount /sdcard (No such file or directory)
-- Couldn't mount /sdcard.
Installation aborted.
Neither applying from ADB sideload or Fastboot commands other than "fastboot devices" work for me, so I can't even unlock the bootloader.
Hi all,
I'm very new here and I hope you all can help me unbutton my phone.
So I have a Samsung S3 I9300, with CM 13.0 installed, I'm using CW recovery v2.7.0.0
I have installed many custom ROMs for this device over the last few years without any problem, each time formatting and cleaning the Dalvik cache etc.
Today my phone restarted randomly and a message came that my phone failed to encrypt and cleared all my data and that I had to restart on recovery to perform a factory reset.
A bit random I thought .. So I rebooted in recovery and did a "reset to default" in CW .. this was successful, however I noticed some problems on the terminal screen ...
Code:
E: Can not find partition size for / boot
E: can not find partition size for / recovery
E: Primary block device / dev / block / mmcblk0p12 to the mount point is not present!
E: Internal storage can not be mounted
E: Unable to mount / data / media during GUI initialization
E: can not mount / cache
SELinux full support is present
E: can not mount / cache
E: can not mount / cache
E: Can not mount /data/media/TWRP/.twrps when trying to read the settings file
E: Can not mount / data
Updating partition details ...
E: can not mount / efs
E: Can not mount / data
E: Can not mount / data
E: can not mount / cache
E: Unable to mount / system
E: Can not mount / data
E: Can not mount / pre-load
E: Internal storage can not be mounted
I tried to format but it fails.
I can not install another ROM because both the internal memory and the SD card show 0MB.
I plugged the SD card into my computer and there are still files on the card.
I had a look online and found that typing a command in the terminal should fix it, however, nothing happens ..
I get an error that mmcblk0p12 does not exist.
Code:
mke2fs / dev / block / mmcblk0p12