I've recently been getting into more security cautious habits with encryption and what not, due to this whole NSA/Big-brother is watching business... But I have a question (more may pop up as this discussion goes on). Sorry if I seem noob-y, I am still getting a hang of all this encryption business. But here's my first round (regarding just the files being backed up):
If I go ahead and do a full phone encryption with my GN2 where will I stand as far as backups to Dropbox/Copy/Google Drive/etc.?
I currently have photos and such backing up to copy, and I often move backups made through recovery to Dropbox and such. If I were to have photos automatically sync to copy or move system backups to dropbox wouldn't that render them basically useless as I am assuming they move out of the phone encrypted (not being decrypted as they exit).
The photos would be unusable anywhere besides my phone right? So moving them off my phone to share vacation photos for instance would be impossible, and if my phone were to crash they'd be irretrievable? Making the backup process pointless.
Wouldn't the back up be rendered useless as well, exactly when I might need said backup? If my phone were to ever crash or die for some reason, I would lose the encryption key, would even be able to do a full system restore through the recovery? It would seem that the encryption key wouldn't be kept with those back up files, so while it might place everything back in its correct place, it would still be unreadable. Or does it maybe keep the key in system files somewhere so that a full backup would restore the key as well?
And my second round of questions (regarding recoveries and what not):
I am also under the impression that I would not be able to flash through custom recovery either as the internal SD would be inaccessible from the recovery being it doesn't have the encryption key. I am currently running OmniROM and it is in a nightly stage still for my phone. I wouldn't be able to update nightly would I? I am assuming since it basically flashes/overwrites system each time, that I would be losing my encryption key and making everything besides system unusable then right?
And what about downloading ROMs to flash/update directly to my phone? As I download them from in browser or another app and they go to the default /downloads folder they would be encrypted. They wouldn't be accessible from there in recovery, but if I were to try and move them out of internal SD to the external SD they would retain encryption and still be inaccessible? So the only way to download ROMs and updates would be from PC and only move them to the external SD?
Overall, this seems to be crippling a lot of the way I use my phone...
Bump?
Sorry, this is already getting buried and I kinda want to know what's going on before I go ahead and do this...
Zombtastic said:
I've recently been getting into more security cautious habits with encryption and what not, due to this whole NSA/Big-brother is watching business... But I have a question (more may pop up as this discussion goes on). Sorry if I seem noob-y, I am still getting a hang of all this encryption business. But here's my first round (regarding just the files being backed up):
If I go ahead and do a full phone encryption with my GN2 where will I stand as far as backups to Dropbox/Copy/Google Drive/etc.?
Click to expand...
Click to collapse
I'm not (yet) an expert on this, but when you've encrypted your device, it encrypts the file system on your internal memory and SD card. You have to enter a PIN/password when you turn on your device (and when it times out) to gain access. When the correct PIN is entered at boot time, the file system is available as normal - the underlying data is still encrypted, but the file system can unencrypt it in "real time" for use by apps and the system.
So that means that Dropbox et al all see your files as normal, and any copying you do from your device to something on the net (Drive, Dropbox, a server, etc.) works as normal - the data appears normal to the apps and is copied as normal. So photos would copy across as photos, music as music, etc.
Think of it like this: You can't speak Urdu, only English. There is a book you own that is written in Urdu that you want to tell someone about. You find a translator to read the book and tell you what it says. He reads the first page in Urdu, translates it in his head to English, and tells you what it says. You then tell your friend what it says (in English, of course). Your friend writes down what you told him, in English, then tells you something in reply. You tell your Urdu translator what your friend said (again, in English). Your Urdu translator then translates (in his head) what you said from English to Urdu, and writes it down in the book in Urdu.
At no time do you understand Urdu, nor does your friend. Your friend doesn't even know the book is written in Urdu and doesn't care. He never sees it or accesses it directly. If anyone ever steals your book, they can't read it unless they can read Urdu. The book is only useful to you and your friends if you have an Urdu translator sitting there in the loop. (the analogy is imperfect and incomplete but you get the idea).
So, getting back to your phone, if you have it encrypted, the underlying file system deals with translating things on the fly if you've given it the correct password at boot and login time. No apps ever know about the encryption - they just see data as normal (unencrypted). So any app that wants to copy a photo to Dropbox just sees a normal photo - it never sees the underlying encrypted data. But if you don't enter the correct password at boot time, the phone can't boot, and anyone trying to access the data on the phone won't be able to read it unless they know the password.
Does that help or confuse?
Zombtastic said:
I currently have photos and such backing up to copy, and I often move backups made through recovery to Dropbox and such. If I were to have photos automatically sync to copy or move system backups to Dropbox wouldn't that render them basically useless as I am assuming they move out of the phone encrypted (not being decrypted as they exit).
Click to expand...
Click to collapse
Hmm, this does my head in a bit but lets untangle it:
- you boot into Recovery. The Recovery you're using (obviously) understands encrypted file systems (some versions of CWM do, some versions of TWRM don't for instance - see near the end of this post for a bit more on this). So when you boot into Recovery and enter your PIN/password, it can then read your file system. You can then do a Recovery-based backup of your file system (or individual files, though I'm not aware that you can do this). The backup it creates is written to the encrypted file system and thus encrypted with the same encryption keys used for everything else.
- You boot the phone back up as normal and enter your PIN/password, and start up Android. You then use Dropbox to copy the Recovery backup files to the cloud. So the question is, "Are these files encrypted?" and I think the answer is, "No". Why? Read the rest of this post and hopefully you'll work out the same conclusion. But I'm pretty sure that the data that ends up on the Cloud is not encrypted.
One general comment worth pointing out as an aside (sorry, this paragraph isn't really related to the above but I wanted to point this out somewhere and its still useful) is that each time you encrypt your phone, it creates a unique encryption key - even if you give it the same PIN/password to use. So if you're forced to rebuild/reflash/wipe your phone in the future, it won't be able to access any data that is still on there (in internal or SD memory) since it won't know the previous encryption key. So you'll have to wipe all data and start again. And at that point, if you choose to encrypt your fresh, newly initialized phone, it will have a new, unique encryption key that won't work on any encrypted data from previous. So if for instance, you plug in an SD card that was encrypted on your phone in an earlier ROM, it won't be readable even if you know the correct PIN/password, since your phone will be using a different underlying unique key.
Zombtastic said:
The photos would be unusable anywhere besides my phone right? So moving them off my phone to share vacation photos for instance would be impossible, and if my phone were to crash they'd be irretrievable? Making the backup process pointless.
Click to expand...
Click to collapse
So, if you're following this, you'll now understand that moving your photos off your phone could be done two ways:
- while you're using the phone as normal (ie. you've booted it, entered your PIN/password, and copying your photos to Dropbox via an app while you're logged on. If you do it this way, you're simply copying photos as normal that can be viewed as normal in Dropbox.
- by copying backups generated while in Recovery. But Recovery will be firstly mounting the encrypted file system successfully (if you gave it the right PIN/password and your version of Recovery supports encryption), which means it can read your photos as normal files, then backs them up into its own normal Recovery file/folder structure and writes them to your encrypted file system, so the underlying data is encrypted unbeknownst to Recovery. Then when you boot up your phone and log in successfully to Android, you can access that data as normal (and unencrypted). So when you then copy it to Dropbox, all you're copying is normal Recovery-created backup files. The copied data won't be encrypted (unless Recovery encrypts them itself, independently, which I don't think it does). So you could copy this data to anybody's phone, so long as they were using a compatible Recovery version and probably compatible ROM.
Zombtastic said:
Wouldn't the back up be rendered useless as well, exactly when I might need said backup? If my phone were to ever crash or die for some reason, I would lose the encryption key, would even be able to do a full system restore through the recovery? It would seem that the encryption key wouldn't be kept with those back up files, so while it might place everything back in its correct place, it would still be unreadable. Or does it maybe keep the key in system files somewhere so that a full backup would restore the key as well?
Click to expand...
Click to collapse
I'm not 100% sure on this, but I think your logic is correct. The backup would be useless if the phone loses the encryption key, which it would do if you re-initialized your phone and/or did a new encryption. So you can only recover your backed up data if you haven't done either of those things. A solution to this is to use backup software that runs on your phone (Titanium Backup) that gives you the option to encrypt your data. Some caveats to this approach should be obvious:
- you firstly need to decide if you trust your backup software's encryption
- you need to use a strong password and be able to recall it months/years from now when you go to restore your data
- you need to copy your backups off your phone (such as onto your SD card, cloud, dropbox, etc.) in case you lose your phone.
Zombtastic said:
And my second round of questions (regarding recoveries and what not):
I am also under the impression that I would not be able to flash through custom recovery either as the internal SD would be inaccessible from the recovery being it doesn't have the encryption key. I am currently running OmniROM and it is in a nightly stage still for my phone. I wouldn't be able to update nightly would I? I am assuming since it basically flashes/overwrites system each time, that I would be losing my encryption key and making everything besides system unusable then right?
Click to expand...
Click to collapse
Tricky - if you flash/update your phone with a new ROM, you will probably be OK so long as you haven't wiped the part of your phone's storage that holds the encryption information. I don't know where this is. But the nightly updates I do to my phone don't normally touch my data - all my apps are still there and it boots identically to the way it did before I updated it. HOWEVER, its possible that an update may force me to wipe my phone for some reason - the update may fail, it may contain significant changes, or I might screw something up. I probably end up completely wiping my phone at least once every 2 months just because I like to play with the latest and greatest ROMs, or I screw something up. So if that happens, I'm going to lose the encryption information and thus would lose everything on the phone.
Of course, I can always restore my apps and data via Titanium Backup, since I back up my stuff quite often and then copy it to Dropbox.
Zombtastic said:
And what about downloading ROMs to flash/update directly to my phone? As I download them from in browser or another app and they go to the default /downloads folder they would be encrypted. They wouldn't be accessible from there in recovery, but if I were to try and move them out of internal SD to the external SD they would retain encryption and still be inaccessible? So the only way to download ROMs and updates would be from PC and only move them to the external SD?
Click to expand...
Click to collapse
Hmmm - good question. A simpler question is, "Is my encrypted file system accessible while in Recovery?" I believe the answer is, "Yes, if you use CWM, No if you use TWRM". But I say that because from what I've been reading, some versions of CWM/TWRM can/can't handle encrypted devices. But you'll already have sorted this out at the time you're trying to encrypt your device anyway since the encryption process involves rebooting your phone into recovery I believe - and if you're not using the correct supported Recovery, this step will fail. But if you are using a supported recovery, this step will work, and therefore logically I'd assume that you can access your encrypted file system while in Recovery in the future. I'd imagine Recovery would prompt you for your PIN/password in order to mount the encrypted file system.
So assuming the above is correct, you would be able to access the newly-downloaded ROMs while in Recovery and thus can flash them. But of course, Caveat Emptor with flashing the new ROM - if it forces you to wipe anything, you may end up unable to access any of the data.
Zombtastic said:
Overall, this seems to be crippling a lot of the way I use my phone...
Click to expand...
Click to collapse
From what I've been researching, you won't have a problem anyway, because I haven't come across anyone that has successfully encrypted their phone using a custom ROM. Strangely, this ability seems to be unwanted by XDA people. My tinfoil hat tells me that there are people ensuring that this ability continues to not work on custom ROMs until/unless a backdoor capability is found. Hopefully I'm wrong on many counts.
douginoz said:
From what I've been researching, you won't have a problem anyway, because I haven't come across anyone that has successfully encrypted their phone using a custom ROM. Strangely, this ability seems to be unwanted by XDA people. My tinfoil hat tells me that there are people ensuring that this ability continues to not work on custom ROMs until/unless a backdoor capability is found. Hopefully I'm wrong on many counts.
Click to expand...
Click to collapse
Amazing post by the way! It does seem very helpful.
BUT it's very funny you mention it not working. Because that's exactly what happened. After not getting a response here or in the ROM's forum for a few days, I decided to just take the plunge and do it. I was just planning on testing everything out my self and figuring it out as I went. The first time it seemed fine, the encryption went through it seemed.
Being as I didn't know any of the info you just enlightened me with, I did fear that nothing was truly encrypted though. Everything was transferring to my computer with a drag and drop and working fine, so I was afraid (without evidence) that nothing was truly encrypted. I asked on the ROM's forum again (still waiting for an answer).
That night, my phone was left plugged in charging, yet some how had turned off in the night. I awake to my phone asking for an encryption key. I enter my key in to no avail. Nothing works and my phone is left unable to boot. It was utterly denying my password. I had to reflash. I asked about that in the forums as well, whether that was normal or if encryption was maybe not implemented yet, etc. The dev running the nightlies for my device has responded to the forum multiple times but not to me. Another user mentioned it might be that it is now merged together as a Galaxy Note 2 ROM and not specifically a T-mobile Galaxy Note 2 ROM (might be possible. Idk.).
Now, I have tried to re-encrypt. Multiple times. But I cannot for the life of me get it to even start now. Every time I go to start the encryption process it shows me the fullscreen image of the android unzipped horizontally (at which point it is supposed to reboot and start encrypting) and it hangs/sits there forever. Not rebooting, not anything. If I hit the back button, the image disappears and it goes back to my phone. Working perfectly fine, like it never even started doing anything. I am not doing anything differently. I don't know what could be happening to stop it from even getting as far as it did last time. Unless the devs maybe started working on it and have disabled it for the time being/screwed it up worse, I dunno.
Not you got me crafting a tin-foil hat...
I stupidly trusted the "transfer to SD card" function and now my Z5 Compact has moved a big chunk of my photos from internal storage to… nowhere. They've been deleted and I'm not sure if I can get them back. I've managed to recover the thumbnails using FonePaw so I'm assuming the original full resolution files are still hanging around somewhere in the internal storage.
All the "recovery" tools I've found require your phone to be rooted in order to recover the deleted files from the internal storage. I'm aware that, in order to root the phone, the bootloader needs to be unlocked but that there are issues with losing DRM keys and the impact of that on some of the phone’s functions (specifically a number of the camera features). Given the camera was the primary reason I purchased this phone, I am reluctant to do something that messes with that, especially since this is the second handset as the first one was replaced under warranty after only three months (and this one still has 4 months of warranty left and has been having intermittent issues). There is also the issue that unlocking the bootloader factory resets the phone and therefore wipes all the data.
I know there is a bit of a workaround in that I can downgrade the firmware from Marshmallow to Lollipop and temporarily root the phone in order to backup the TA partition so I can restore the DRM keys et al after unlocking the bootloader and rooting the phone. Again, as I understand it the firmware downgrade will wipe my phone.
Normally wiping my phone wouldn’t bother me beyond being a pain to reinstall apps etc. What concerns me is that, given my missing files are likely floating somewhere in the internal storage ether, would a factory reset completely wipe those files from the phone permanently? Or would I likely still be able to recover them using appropriate software even after the reset, downgrade, unlocking of bootloader, and rooting?
I don't know much about it (and I’m willing to find out more for myself) but Is it possible to use something like adb backup to back up the whole phone and restore that to the phone after rooting in order to recover the missing files? Or will that also only work on a rooted phone?
If it's unlikely that my missing files would survive the repeated resets during the rooting process then I will probably just take this as a lesson learned the hard way and not bother trying to recover the files. Given the way my luck has been going, this handset will also fail before 12 months and I’ll have no warranty – and still no files!
Thank you in advance for any light you can help shed on this dilemma
Today I learned that hotplugging SIM cards is not a good idea.
"It's just a SIM card, what could possibly go wrong?"
I did this today and after about one minute my h850 rebooted (soft reboot). Since then it continues to freeze for a moment after boot and then reboots. It doesn't matter if the SIM-card is inserted or not. This phone is running the official LOS 20170704 weekly and TWRP (fortunately).
I could reproduce this on a falcon also running LOS from June or July. Restoring the data partition from a backup resolved the bootloop on this phone and it is running fine with the SIM for several hours now.
This means that inserting the SIM while booted must have messed with something on the data partition.
Unfortunately the backup on my h850 is quite a few days old, and more importantly I got a few SMS (from the last few days) right before the bootloop started. Because of this, restoring from the backup is not very inviting and I decided to try to find the source of the bootloop and fix it.
At first I will try to grab some logfiles (logcat & kmesg) - however this is only possible on the falcon for now, because the h850 is not authenticated. I thought about other ways to solve this riddle in case this doesn't show where I have to look.
Since I can reproduce the issue on a second phone I thought about doing a backup right before and another one afterwards. Since the bootloop occurs due to a change on the data partition it must be visible if I compare both backups. I have a simple problem with this though: I don't know how to compare them. Thus, my first question: Which tool can I use to do this?
If this is not feasible for some reason I would like to rescue some of the data a least. Since I can boot into TWRP I can access the internal storage from my computer. I would also like to save SMS (at the very least) and application data (nice to have). What's the best way to do this? Where are the SMS located? Copying everything to the internal storage and then to the computer would certainly be possible, but also mess up permissions big time.
Thanks for taking your time to read this and help me. I hope I really learned my lesson about impatience, regular backups and taking extra precautions and this will not happen again.
Update: For whatever reason I can't get my falcon to bootloop anymore.
My brother passed recently. I am in possession of his s9+ and want to either remove the lock screen PIN (preferable) or just retrieve the pictures (if all else fails). This is very important to me. It is a Verizon phone.
If the images are stored on an SD card and the card is not encrypted you can just take the SD card out and use it from a computer.
If the phone was configured to backup photos to samsung cloud you can try logging into that using the appropriate credentials. The URL for samsung cloud login is https://support.samsungcloud.com/#/login
If the images are stored on the internal storage you are most likely gonna have too contact samsung for help. I honestly don't know if there is a way to do this considering the phone is unrootable and what your asking is to break/remove the phone's security features.
In case it has twrp installed ,you can use it
a_t_21002000 said:
In case it has twrp installed ,you can use it
Click to expand...
Click to collapse
The G965U and G965U1 are unrootable at the moment... So any options for the OP that involve rooting the phone is not going to do much good
Recover file from G965U1
I have a G965U1 from which I want to recover a deleted video. I don't care if I brick the phone. I simply want the video. I'm tempted to rip open the phone, pull the memory and solder on a USB reader. Can you give me any good options prior to the rip.
stevearas said:
I have a G965U1 from which I want to recover a deleted video. I don't care if I brick the phone. I simply want the video. I'm tempted to rip open the phone, pull the memory and solder on a USB reader. Can you give me any good options prior to the rip.
Click to expand...
Click to collapse
Best suggestion (not just to you, this is in general for everyone who has this issue) is that in the future if there is a file you want to keep or is of great value to you make a backup of it elsewhere. I do this with what pics/videos I take on my phone for this very reason. There isn't a reason why no one can't make a backup of an important pic/video with this phone... It has a removable SD card, you can transfer files to a computer or use cloud backup.
Other suggestions:
Did you check the gallery trash to see if it is in there? When you delete a file using Gallery it ends up in the "trash" (essentially acts like the recycle bin on windows). In the gallery app look for the 3 dots that run vertically at the top right corner. Pressing on those will show a menu, the word "trash" will be listed.
Pressing the option to access the trash will show you what is able to be restored on the phone. Files you delete will be sent to the trash and remain there until you empty the trash or 15 days pass since the deletion. If you have the phone backing up the files to Samsung cloud you might be able to access the file(s) from the cloud using the link I posted previously.
If the gallery and cloud storage don't help:
I am afraid there really is no other good option.. The software I can find which does data recovery requires root access (which we can not do). Google searches pretty much yield the same result. There are some that say you can without root, but further reading into them show it's a misleading statement and that root is still needed. You may be able to find a software recovery service locally that might be able to do what you want... And I would suggest (unless you have the tools, software and ability) you go that route first before you try to CSI cyber your way to accessing that data. Please don't take this the wrong way, I do not believe what your thinking of doing will even work... Assuming the location where the video was has not been overwritten by data already (if it was then your SOL unfortunately), removing the memory and placing it onto a USB reader will most likely not resolve/remove any permission based issues.
This is a drawback of not having root ability on our phone
scottusa2008 said:
I am afraid there really is no other good option.. The software I can find which does data recovery requires root access (which we can not do). Google searches pretty much yield the same result. There are some that say you can without root, but further reading into them show it's a misleading statement and that root is still needed. You may be able to find a software recovery service locally that might be able to do what you want... And I would suggest (unless you have the tools, software and ability) you go that route first before you try to CSI cyber your way to accessing that data. Please don't take this the wrong way, I do not believe what your thinking of doing will even work... Assuming the location where the video was has not been overwritten by data already (if it was then your SOL unfortunately), removing the memory and placing it onto a USB reader will most likely not resolve/remove any permission based issues.
Click to expand...
Click to collapse
While this is older topic and probably it doesn't really matter anymore, i might add something. First of all, those phones are factory encrypted. Second, ability to recover deleted files from modern phones in nonexistent in practice. You may find that there was such file but it's already empty inside or not find any leftover that it was even there. You don't have to fully overwrite the space it occupied like on SD cards or HDDs for this to happen. There are mechanisms, like TRIM that take care of deleted content to maintain storage chip performance. It is possible to recover deleted data stored inside database files, like contacts, texts, chats, notes etc.
In general, there's no harm in trying but this requires you to create a decrypted memory chip dump and this either requires root or some fancy exploit, for example to boot custom kernel image with adb and root permissions that won't tamper with data. Achieving root on those devices without factory reset is not really possible for the time being, and enabling OEM unlocking (requires for TWRP and Magisk) itself triggers factory reset (there's a warning so that's good).
Desoldering memory chip and dumping it directly also won't work. First of all due to factory encryption, so no there won't be any useful data and it can't be decrypted outside that specific phone. Second, it's an UFS type memory and this requires expensive reader. The cheapest on the market is currently easy-jtag plus with adapters for UFS, but this still ~$1000 and i'm not sure it supports chips used in S9+.
Hey Every One
I have a Galaxy A 21s on wich I broke the Screen.
Now a few Yeas later I replaced the LCD but forgot my Password.
-Usb Debuging is Disabled.
-No Custom ROM installed, so i cant delete the Password File.
-oem Unlock is alsoe disabled.
-Find my Phone is deactivated and Google recovery also.
I have now tried a lot of ways to get to my Data but nothing worked so far.
My last resorts are trying to get a full Backup of the Phone and use it in an Android Emulator to Brutforce my Passcode.
or install Custom Recovery, restor my Backup and delete the Password File or get in with adb.
Hence my question woud it be possible to Make a Complet Backup, wit example Odin and use it in an Emulator or restore it on a Rooted Phone?
If any one knows further ways of getting back my Data im open to try things out.
Thanks for the Help.
Edit: I found that i could use adb Sideload to install Apps from stock Recovery. The only Problem i woud need to spoof the signature of the .zip im trying to instal, maybe any one knows a way wit that method?
If you can't access it you can't copy anything.
A data recovery specialist that works with Samsung's might be able to.
I never set a lock on mobile phones or PC bios because you are the one most likely to get locked out! Security is physical, one will pay with blood for trying to steal my phone.
I redundantly back up all critical data often and keep backups in separate locations. Never encrypt backup drives. Hdds are best, flash for quick "dirty" backups. I use my 1tb SD card as a data drive then back that up. Also use two .5th OTG flashsticks.
Phone is always cased. Don't put yourself in the predicament again. Think it through and tie up the loose ends before they trip you. I've lost entire, irreplaceable databases before, not fun.
There's no such thing as overkill when it comes to backing up critical data. Digital data is otherwise very fragile.
Hi, I am in the same situation as you. I forgot the pattern but I really need to recover some data before restoring the phone. With the stock recovery were you able to remove any protection via adb sideload? Thanks