3

My wife had a Samsung Galaxy S3 which she just traded in for a new phone. I would like to get some of the files off of the micro SD card if possible but it was encrypted.

I have tried using cryptsetup on my Linux machine, hoping that this answer would work, but it doesn't appear to be a LUKS device.

In hopes that it would help provide some kind of path forward, I took a hex dump of several files of different types. Here are the first ten lines of the dumps from a few of them:

JPEG 1:

00000000: 0000 0000 0022 8ac4 5282 b84f 6e03 0fba  ....."..R..On...
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 60bc 3f25 69ef 529c  ........`.?%i.R.
00000030: 42e6 84a4 9b77 8acc bbff ebd2 bf4f 091f  B....w.......O..
00000040: 8d6a 675b f2ca 954f 05ed 1662 085f 434f  .jg[...O...b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

JPEG 2:

00000000: 0000 0000 0020 0d83 f7b2 3960 cb33 8e95  ..... ....9`.3..
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 6037 fe30 1a9a 587d  ........`7.0..X}
00000030: ee25 b522 312e 4a8b 2e19 7311 e015 85ef  .%."1.J...s.....
00000040: e2ca 7adb 9c96 7d95 cced 1662 085f 434f  ..z...}....b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

MP3:

00000000: 0000 0000 0007 1ac5 ba01 eb4a 8680 5cbf  ...........J..\.
00000010: 0300 0002 0000 1000 0002 8c2d 0409 0301  ...........-....
00000020: 0000 0000 0000 0000 60f4 5e28 b606 e462  ........`.^(...b
00000030: 3cbf f809 0f3b 212f 7d25 7ecc 116d 2456  <....;!/}%~..m$V
00000040: f66a 736d 6875 3dde 3bed 1662 085f 434f  .jsmhu=.;..b._CO
00000050: 4e53 4f4c 4500 0000 0012 1c67 4e5c db56  NSOLE......gN\.V
00000060: a100 0000 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................

There are definitely some similarities, for example:

  • They start with 5 null bytes
  • The string "b._CONSOLE" (and the following bytes, up to the nulls) appears in all of them, followed by a large number of null bytes
  • The null bytes go on much longer than these lines would suggest

I'm hoping this will help trigger someone's knowledge of how this encryption might work. I can't find anything about what this format might be. We still have the SD card but I'm slightly worried we might need the phone to decrypt the files.

Any suggestions on how we can access these files?

  • From other answers: Have you tried installing encdroid or boxcrypt on a 2nd phone and try to decrypt on it? – larkey Sep 20 '15 at 22:43
  • atterer.org/linux-remove-disable-luks-encryption-password-on-disk-partition-crypttab-initrd – BlueBerry - Vignesh4303 Sep 21 '15 at 5:46
  • @larkey I unfortunately don't have another phone that accepts an SD card. I was hoping for something I could do on my PC. Are there any Linux tools that might work equivalently? – thesquaregroot Sep 21 '15 at 14:17
  • @BlueBerry I'm not 100% sure how to adapt this to solve the problem. I'm not looking to avoid using the password, but to encrypt the files on another device. Also, had some trouble with copy-and-pasting your link, this worked, though I'm not sure why: atterer.org/… – thesquaregroot Sep 21 '15 at 14:18
  • @thesquaregroot Phew, this is difficult. The only idea I have is to run the Android emulator (and I'm not even sure this works). No idea how to decrypt this. It's ofc. possible, but I don't know any program, sorry :/ – larkey Sep 21 '15 at 15:18
-1

I know the OP is probably moved on from this, but I may have made some progress on this, but not all the way solved.

First of all, my card was formatted in exfat, so I needed to install that [apt-get install exfat-fuse]

Next, I couldn't get the Luks decryption to work, but through trial and error I found that it works with the plain type...

sudo unmount /media/user/sdb1

sudo cryptsetup --type plain /dev/sdb1 sdcard

At this point you enter your password and it decrypts the filesystem (or seems to).

The last step should be mounting the filesystem this creates, but I run into an error when I put in:

sudo mount /mnt/mapper/sdcard /media/user/sdcard

It requires to know the filesystem, and I have tried entering every type of filesystem, but cannot get the mapped filesystem to mount. So frustrating because it just feels like I'm on the cusp of solving it.

  • Chances are you're nowhere near the cusp of solving it. The mounting problems are most likely caused by a failed decryption. I'd expect the password you enter on the phone to be sent through a password stretching algorithm before it is fed into cryptsetup (this is why unlocking the sd card on phone reboot takes so long). If you don't repeat this, you'll never get a correct decryption. – Pascal Aug 19 '17 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.