3

My wife had a Samsung Galaxy S3 which she just traded in for a new phone. I would like to get some of the files off of the micro SD card if possible but it was encrypted.

I have tried using cryptsetup on my Linux machine, hoping that this answer would work, but it doesn't appear to be a LUKS device.

In hopes that it would help provide some kind of path forward, I took a hex dump of several files of different types. Here are the first ten lines of the dumps from a few of them:

JPEG 1:

00000000: 0000 0000 0022 8ac4 5282 b84f 6e03 0fba  ....."..R..On...
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 60bc 3f25 69ef 529c  ........`.?%i.R.
00000030: 42e6 84a4 9b77 8acc bbff ebd2 bf4f 091f  B....w.......O..
00000040: 8d6a 675b f2ca 954f 05ed 1662 085f 434f  .jg[...O...b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

JPEG 2:

00000000: 0000 0000 0020 0d83 f7b2 3960 cb33 8e95  ..... ....9`.3..
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 6037 fe30 1a9a 587d  ........`7.0..X}
00000030: ee25 b522 312e 4a8b 2e19 7311 e015 85ef  .%."1.J...s.....
00000040: e2ca 7adb 9c96 7d95 cced 1662 085f 434f  ..z...}....b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

MP3:

00000000: 0000 0000 0007 1ac5 ba01 eb4a 8680 5cbf  ...........J..\.
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 60f4 5e28 b606 e462  ........`.^(...b
00000030: 3cbf f809 0f3b 212f 7d25 7ecc 116d 2456  <....;!/}%~..m$V
00000040: f66a 736d 6875 3dde 3bed 1662 085f 434f  .jsmhu=.;..b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

There are definitely some similarities, for example:

  • They start with 5 null bytes
  • The string "b._CONSOLE" (and the following bytes, up to the nulls) appears in all of them, followed by a large number of null bytes
  • The null bytes go on much longer than these lines would suggest

I'm hoping this will help trigger someone's knowledge of how this encryption might work. I can't find anything about what this format might be. We still have the SD card but I'm slightly worried we might need the phone to decrypt the files.

Any suggestions on how we can access these files?

8
  • From other answers: Have you tried installing encdroid or boxcrypt on a 2nd phone and try to decrypt on it?
    – ljrk
    Sep 20, 2015 at 22:43
  • atterer.org/linux-remove-disable-luks-encryption-password-on-disk-partition-crypttab-initrd Sep 21, 2015 at 5:46
  • @larkey I unfortunately don't have another phone that accepts an SD card. I was hoping for something I could do on my PC. Are there any Linux tools that might work equivalently? Sep 21, 2015 at 14:17
  • @BlueBerry I'm not 100% sure how to adapt this to solve the problem. I'm not looking to avoid using the password, but to encrypt the files on another device. Also, had some trouble with copy-and-pasting your link, this worked, though I'm not sure why: atterer.org/… Sep 21, 2015 at 14:18
  • 1
    This is related to Samsung Knox and these signatures are Samsung specific. I am on a crusade to get my data which is similarly encrypted back. It appears there is no non-proprietary method of simply decrypting the data. Additionally, even though we both know the pass, key stretching is used and it may even be device specific. If I ever figure it out, I'll post the answer of how I did it. Until then, these two links may help: docs.samsungknox.com/admin/knox-platform-for-enterprise/kbas/… and source.android.com/security/encryption/file-based.html Jun 3, 2021 at 1:08

1 Answer 1

-1

I know the OP is probably moved on from this, but I may have made some progress on this, but not all the way solved.

First of all, my card was formatted in exfat, so I needed to install that [apt-get install exfat-fuse]

Next, I couldn't get the Luks decryption to work, but through trial and error I found that it works with the plain type...

sudo unmount /media/user/sdb1

sudo cryptsetup --type plain /dev/sdb1 sdcard

At this point you enter your password and it decrypts the filesystem (or seems to).

The last step should be mounting the filesystem this creates, but I run into an error when I put in:

sudo mount /mnt/mapper/sdcard /media/user/sdcard

It requires to know the filesystem, and I have tried entering every type of filesystem, but cannot get the mapped filesystem to mount. So frustrating because it just feels like I'm on the cusp of solving it.

1
  • Chances are you're nowhere near the cusp of solving it. The mounting problems are most likely caused by a failed decryption. I'd expect the password you enter on the phone to be sent through a password stretching algorithm before it is fed into cryptsetup (this is why unlocking the sd card on phone reboot takes so long). If you don't repeat this, you'll never get a correct decryption.
    – Pascal
    Aug 19, 2017 at 11:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .