[Q] [CM10]Encrypt sdcard - HTC One S

Hey folks,
I am thinking of improving security of my HOS and thought of encrypting it. I do know of the encryption feature provided by android but this seems to only encrypt the "internal" storage, namely the /data partition. I'd like to encrypt the sdcard as well but did not find a solution yet.
I had a few ideas on how to achieve this of which one was to use Cryptonite for encryption. This app uses EncFS to encrypt directorys on the fly by mounting the encrypted dir into another dir. I thought it could be used to encrypt the whole sdcard, mount this encrypted content to another dir and tell android to uses this new dir (the encrypted fs mount point) as sdcard (maybe with a symlink). I think I know much about android and linux but at this point I am stuck.
Does anybody have an idea about solving my problem?
Thanks
Max

Related

[CONCEPT] Single Partition No-Format Apps2SD

So I was using Slax. Great LiveCD/USB linux, extremely customizable, modular, fast, and small, and has the capability of either:
- saving changes to its rootfs onto an AUFS mounted on a non-linux FS (FAT32, NTFS) using posixovl (POSIX Overlay FS) with metadata (permissions, etc.) being held in files
- saving changes to a fixed-size loop mount image.
This got me thinking.
If we could insert all the necessary modules, code, etc. for posixovl into the Android linux, and make a modified a2sd script that takes advantage of posixovl, we could effectively do away with the requirement for crazy partitioning.
It should be simple enough for ROM devs to implement, assuming it's ready and installed:
1. Create folder on main partition if it doesn't exist, something like /sdcard/system/[app, app-private, dalvik-cache, app_s]
2. In the init scripts, before the a2sd stuff, mount /sdcard/system with posixovl on /system/sd
3. Run a2sd as normal, it should automatically just work.
I'll hopefully test this once I get my phone to a stable development/testing stage, and I don't need to make phone calls for a while. Anyone else is welcome to try to implement this idea.
My current test environment:
- HTC Dream (T-mo G1) with the deadly SPL of doom
- Cyanogen Experimental, latest build
- Amon_RA's modded recovery
- Wipe /data, move all existing apps to backup, remove a2sd partition, Backup for Root Users to restore some settings and data
Anyone with ideas or improvements, please let me know.
To be tested:
- Feasibility (can it work?)
- Functionality (does it work?)
- Portability (Can it work on other ROMs and devices like Hero, Pulse, Blur etc.? If so, will likely be moved to XDA's new Android board)
- Stability (Will everything Force Close on boot? Does it run fast enough? Does anything get corrupted over time?)
Links:
- http://sourceforge.net/projects/posixovl - Sourceforge page for posixovl
In desktop linux you can create a file with the touch command, and mount the file to a mountpoint after formatting it to ext4 for example.
Maybe this is the easier way?
I have done this about 5 years ago, but I will try it today and report if it worked.
edit: ok done already:
1. create a file of the desired size, eg: dd if=/dev/zero of=filename bs=filesize count=1
2. use mke2fs to format the file
3. create a mountpoint and mount the file
thats all. Now I have a 128MB file on my PC, mountable and usable like a partition.
Archont said:
In desktop linux you can create a file with the touch command, and mount the file to a mountpoint after formatting it to ext4 for example.
Maybe this is the easier way?
I have done this about 5 years ago, but I will try it today and report if it worked.
Click to expand...
Click to collapse
As far as I know, you can do that on the mobile Android, too, and that does work in theory. This technique involves mounting a loop filesystem, and it too will allow one-partition apps2sd, but it's less flexible, and I would think slower, than the overlay method.
For a 512MB apps image:
Create empty 512MB file
# dd if=/dev/zero of=/sdcard/apps.img bs=1024k count=512
Format it to Ext2
# mke2fs -L Apps2SD /sdcard/apps.img
Unmount existing a2sd
# umount /system/sd
mount new a2sd image
# mount -t ext2 -o loop /sdcard/apps.img /system/sd
Make the usual directories, and a mountpoint for the old a2sd partition
# mkdir /system/sd/app; mkdir /system/sd/app-private; mkdir /system/sd/dalvik-cache; mkdir /system/sd/apps-tmp
Mount the old a2sd partition
# mount -t ext2 /dev/mmcblk0p2 /system/sd/apps-tmp/
Move all files from the old partition to the image file
# mv /system/sd/apps-tmp/* /system/sd/
Unmount and remove the mountpoint, we don't need it anymore
# umount /system/sd/apps-tmp
# rmdir /system/sd/apps-tmp
Finally, you add the following line to the init script where the a2sd auto mount happens, and comment out the old line.
Code:
[...]
mount -t ext2 -o loop /sdcard/apps.img /system/sd
#mount -t ext2 /dev/mmcblk0p2 /system/sd/
[...]
This should do what you described, in theory. I can't say whether it will work or not. I can't tell whether it will or won't screw up your phone, I can't be held responsible if you screw something up or overlook the details. Either of us might have made a typo somewhere; apply common sense before doing anything.
This sounds great! I think this would also be usefull for someone like me, who has a sd card that doesn't want to be partitioned anymore (cross-linked files??). Only thing possible is fat32 or ntfs.
Am I correct with my assumption?
This sounds a lot harder and more complicated then partioning. Your also talking about a lot of work needing to be done just so people can avoid doing a simple thing like partioning a sd card. I would say it would be very difficult alone to get the os to run a virtual mounting service especially since that will take up resources and slow down the phone. There is a reason they only use this technique on live cds is it works but its slow. most of the computers they are running on have 1gig of ram and 2ghz cpu's. i really dont think the g1 can push this.
I do not think that this is great, it definitely is slower than a ext4 partition on a good class 6 microSD card. And it is more vulnerable to data loss since 2 different filesystems including a 20 year old non-journaling fs at the base of this construct are involved.
Another problem that came to my mind: when you mount your SD card as external USB device to a PC, the file containing your apps will no longer be accessible, or Android will make using the phone as external data storage impossible.
Interesting.
There is, however, a major problem: What happens when you unmount the fat partition on the phone in order to connect with a computer using UMS? Answer: everything on the phone will crash and burn since the apps filesystem will suddenly disappear = BAD.
posixovl is a nice find though...
Note that aufs, loopmount linux filesystems, etc., wouldn't be needed with this since posixovl appears to be vfat with posix extensions, so you should be able to just use posixovl directly on the sdcard.
There are several problems with that though... i.e. how reliable is posixovl regarding users tampering with it?
In any case, a prerequisite for use of it would be certain other changes being planned...
You might want to contribute to this thread:
http://forum.xda-developers.com/showthread.php?t=577941
(note: the thread links to a thread at android-platform, the one here has, as expected, gone off on a tangent... just ignore the junk.)
TylTru said:
So I was using Slax. Great LiveCD/USB linux, extremely customizable, modular, fast, and small, and has the capability of either:
- saving changes to its rootfs onto an AUFS mounted on a non-linux FS (FAT32, NTFS) using posixovl (POSIX Overlay FS) with metadata (permissions, etc.) being held in files
- saving changes to a fixed-size loop mount image.
This got me thinking.
If we could insert all the necessary modules, code, etc. for posixovl into the Android linux, and make a modified a2sd script that takes advantage of posixovl, we could effectively do away with the requirement for crazy partitioning.
It should be simple enough for ROM devs to implement, assuming it's ready and installed:
1. Create folder on main partition if it doesn't exist, something like /sdcard/system/[app, app-private, dalvik-cache, app_s]
2. In the init scripts, before the a2sd stuff, mount /sdcard/system with posixovl on /system/sd
3. Run a2sd as normal, it should automatically just work.
I'll hopefully test this once I get my phone to a stable development/testing stage, and I don't need to make phone calls for a while. Anyone else is welcome to try to implement this idea.
My current test environment:
- HTC Dream (T-mo G1) with the deadly SPL of doom
- Cyanogen Experimental, latest build
- Amon_RA's modded recovery
- Wipe /data, move all existing apps to backup, remove a2sd partition, Backup for Root Users to restore some settings and data
Anyone with ideas or improvements, please let me know.
To be tested:
- Feasibility (can it work?)
- Functionality (does it work?)
- Portability (Can it work on other ROMs and devices like Hero, Pulse, Blur etc.? If so, will likely be moved to XDA's new Android board)
- Stability (Will everything Force Close on boot? Does it run fast enough? Does anything get corrupted over time?)
Links:
- http://sourceforge.net/projects/posixovl - Sourceforge page for posixovl
Click to expand...
Click to collapse
lbcoder said:
Interesting.
There is, however, a major problem: What happens when you unmount the fat partition on the phone in order to connect with a computer using UMS? Answer: everything on the phone will crash and burn since the apps filesystem will suddenly disappear = BAD.
Click to expand...
Click to collapse
I kinda overlooked that point. Oops.
Though this same problem does exist on regular apps2sd when you remove the card without dismounting it, killing all apps and their processes, and freezing Dalvik's method of autostarting some apps.
I do tend to swap cards every now and then, but only after a reboot. Dalvik re-enumerates and caches dex, which makes for a slow boot, but it seems to just work in most cases that the apk install doesn't drop the app's functional payload (helper Linux/shell utils, libraries, NDK .so's) in /data/data (like some emulators, the Android Scripting Environment)
lbcoder said:
There are several problems with that though... i.e. how reliable is posixovl regarding users tampering with it?
Click to expand...
Click to collapse
As far as I know, the metadata files are marked as hidden and system files, and begin with a '.'. And I haven't tried this, but I think modifying the actual files under Windows has no negative effects, but moving, deleting, or copying files would likely be a no-no.
Also, I don't think there's a 'fsck' for posixovl, meaning that if any metadata files were screwed with the wrong way, the entire overlay FS would be trashed.
lbcoder said:
In any case, a prerequisite for use of it would be certain other changes being planned...
You might want to contribute to this thread:
http://forum.xda-developers.com/showthread.php?t=577941
(note: the thread links to a thread at android-platform, the one here has, as expected, gone off on a tangent... just ignore the junk.)
Click to expand...
Click to collapse
I checked that out. It was actually a small inspiration for what I was thinking of.
In any case, Android's package management system needs an overhaul. The package storage needs to be de-Linuxified, as all it is is a bunch of .apk files and .dex/.odex files, the UIDs of apps are in the AndroidManifest.xml, right?
In a somewhat unrelated note, app data needs to be moved to a specified folder structure on the sdcard. My card is full of folders in the root directory with random names.
If I'm understanding you correctly, you're talking about storing an image file on the normal SD card partition(which has to be FAT32 as far as I've seen) and then mounting it, correct? This idea has been talked about at length before on at least 3 separate occasions(2 of which were on this very forum) and found to be a bad idea due primarily to massive security risks since FAT32 has no permissions.
Also, I believe cyanogen ended up dumping unionfs/aufs due to rampant memory issues.
If you are talking about mounting an image from the FAT32 partition, please don't endorse this. We don't want to be throwing in security bugs into android, especially ones such as this which can't be plugged up.
As a modification to what I said: If you're suggesting doing this(or something similar) on a separate filesystem, after that project to change the AOSP to support one with permissions is finished, then I'm in full support.
If you want to go for a single partition on the sd card, why don't you just make the entire card use ext4? Your linux desktop reads it anyway, it uses journaling and so on, I guess it would be faster compared to fat32 and it is definitely safer to use.
And i guess it is not too complicated to mount this partition and use it for pictures, music and so on.
I have not tried this (yet) and I go to bed in 20 minutes, but maybe I will start testing something in that direction tomorrow.
[email protected] said:
If I'm understanding you correctly, you're talking about storing an image file on the normal SD card partition(which has to be FAT32 as far as I've seen) and then mounting it, correct? This idea has been talked about at length before on at least 3 separate occasions(2 of which were on this very forum) and found to be a bad idea due primarily to massive security risks since FAT32 has no permissions.
Also, I believe cyanogen ended up dumping unionfs/aufs due to rampant memory issues.
If you are talking about mounting an image from the FAT32 partition, please don't endorse this. We don't want to be throwing in security bugs into android, especially ones such as this which can't be plugged up.
As a modification to what I said: If you're suggesting doing this(or something similar) on a separate filesystem, after that project to change the AOSP to support one with permissions is finished, then I'm in full support.
Click to expand...
Click to collapse
UNIX permissions don't do anything in the way of "security" unless you have no access to the actual storage device from another computer (as is the case with the unrooted Dream's internal memory), or unless encryption is used. The posixovl driver OVERLAYS Unix permissions over Fat32 filesystems. But even still, with Unix permissions, nothing's stopping someone else from mounting the Ext2 partition and using chown and chmod.
And the image file on the SD card's Fat32 partition is a complete Ext2 partition complete with Permissions. Nothing is lost.
Archont said:
If you want to go for a single partition on the sd card, why don't you just make the entire card use ext4? Your linux desktop reads it anyway, it uses journaling and so on, I guess it would be faster compared to fat32 and it is definitely safer to use.
And i guess it is not too complicated to mount this partition and use it for pictures, music and so on.
I have not tried this (yet) and I go to bed in 20 minutes, but maybe I will start testing something in that direction tomorrow.
Click to expand...
Click to collapse
We'd just have to find the part in the Android that mounts /sdcard/, and change 'vfat' to 'ext2'. The only reason I wouldn't do this, is because it would immediately make it incompatible with Windows and Mac's default FS drivers. As far as I know, the only FS's that are supported universally within Linux, Mac, and Windows, are FAT and NTFS. And NTFS can be made to have crude support for permissions through security descriptors. Although, the Dream SPL, the Recovery images, and most of Android only uses FAT32.
This is discussed in android-platform Group :
http://groups.google.com/group/andr...read/thread/bf0709c157451cd9/f6aee1830c84620f
The goal is to be able to integrate this in android.
And not having to partition the SDCard is one of the requirements so far...
Unix permissions are not stored using fat or vfat, and ntfs is not really supported in desktop linux and i guess it cannot be used in android linux.
I would not use windows anyway so this is no problem to me, and there are drivers around to mount ext systems in windows. As Mac OS is based on unix there will be a solution for this too.
Access usind adb push and pull, via ftp and so on is not touched by using ext4 on the entire sd card I guess.
And if you don't go the easy way using gparted on a live cd or usb device to create 2 partitions, you will have to live with some disadvantages anyway.
Finally I want to say that my ideas are far from being perfect or usable at all, I see this thread as a kind of brainstorming.
im not as linux or android savvy as probably any of you but before the current method of creating a swap partition became the "standard", people used a swap file on the sdcard and linked that. seems similar to what you are suggesting here.
ofcourse when mounting the fat partition elsewhere (ums in windows for example) that swap file could no longer be used within android. i dont see a way to get passed the same issue, but worse here, due to android not having crucial apps when the fat partition is mounted.
then again, i am pretty much over my head in this conversation and could be over looking something...
I'm kind of fascinated by the FUSE + posixovl method of doing this. In the long run I have a feeling that it's going to perform like ****, but I think it's worth testing.
I managed to get both libfuse and mount.posixovl built and running on Android.
posix-overlay(/sdcard/fuse) on /sdcard/fuse type fuse.posixovl (rw,nosuid,user_id=0,group_id=0,default_permissions)
Giving this a little testing now, it definitely works.
Code:
/sdcard/fuse # ls -l
drwxr-xr-x 2 1000 1000 4096 Nov 5 17:17 test
TylTru said:
UNIX permissions don't do anything in the way of "security" unless you have no access to the actual storage device from another computer (as is the case with the unrooted Dream's internal memory), or unless encryption is used. The posixovl driver OVERLAYS Unix permissions over Fat32 filesystems. But even still, with Unix permissions, nothing's stopping someone else from mounting the Ext2 partition and using chown and chmod.
And the image file on the SD card's Fat32 partition is a complete Ext2 partition complete with Permissions. Nothing is lost.
We'd just have to find the part in the Android that mounts /sdcard/, and change 'vfat' to 'ext2'. The only reason I wouldn't do this, is because it would immediately make it incompatible with Windows and Mac's default FS drivers. As far as I know, the only FS's that are supported universally within Linux, Mac, and Windows, are FAT and NTFS. And NTFS can be made to have crude support for permissions through security descriptors. Although, the Dream SPL, the Recovery images, and most of Android only uses FAT32.
Click to expand...
Click to collapse
Ya, I meant more from the standpoint of a rogue app. Since FAT32 has no permissions, what would prevent such an app from modifying the stored image file to, say, change a trusted app with superuser permissions to some new code of its own making to, for example, watch for credit card numbers and send them back to the person who made the original rogue app? I'm always hesitant with any ideas that suggest storing an image file on the sdcard for appstosd for this reason.
Forget it, it's useless.
An overlay filesystem prevents you from enabling USB storage.
If you want to play around with FUSE on Android, here's a repository for my port of libfuse..
http://github.com/cyanogen/android_external_fuse
Hi,
I have an idea. I used symbian S60 of Nokia, Symbian can install app to sdcard. I see that when I mount sdcard to PC, my phone immediately hold all activations of all applications on my phone. And they have a PC sync software that help us access sdcard but not mount sdcard (like that we copy file from computer to sdcard via debug mode on android).
I think we should find out how symbian can do it and we will use their way .
I'm not a developer, I'm just an user.
I talked to a few people about this, and some deep kernel voodoo is going to be needed for this to really happen without partitioning.
Another idea is to forge ahead with this, and ditch the "unmount fs for usb storage" and use RNDIS + Samba or something like that instead to access files on SD. I kind of like this idea.

[Q] ICS Encryption method for System and SD-Card

Hi,
a rather short search (i have to admit) here and in google didn't give me some usefull information about it. Anyone can give me a source for detailed infos about encyption method, algorithm, etc.? Basically I'm interessted if this is really trustworthy or just some proprietary encryption with backdors and everything.
ICS Encryption method for System and SD-Card
Hi
you can't encrypt the sdcard at the moment, because ics doesn't support that.
for the new encryption feature in ics it encrypts your /data partion with dmcrypt-luks essiv:cbc:128 this is the same encryption which is used in all minor linux distrubition for FDE. so i think it's trust worthy. On Linux the difference is that they use as default essiv:cbc:256 so on ICS the encryption isn't that hard, but i think it is still enough. And any why at this encryption the weakest point is you password!
more about dmcrypt und luks can be find in the internet. wikipedia linuxes..
if you wan't encrypted data on a sd card you can install LuksManager and create a container it uses the same technic and creates a encrypted container..

[Q] Has anyone found an App to SD solution?

I've looked through the big development thread and haven't found a clear answer but has anyone found an app to sd solution that works?
This stupid SdCard / ExtSdCard arrangement is making me pull my hair out. I just realized my titanium backups weren't really backups since they were being stored on my internal memory.
I managed to change my backup folder and free up some space by moving all my backups to the SD card, but for some reason I cannot move apps to SD through Titanium or any other app I've tried.
Does anyone know how to do this? Is there a setting in titanium I need to change or is this just something we have to deal with forever short of flashing a custom rom?
SDCARD binary
Galahad_Knight said:
I've looked through the big development thread and haven't found a clear answer but has anyone found an app to sd solution that works?
This stupid SdCard / ExtSdCard arrangement is making me pull my hair out. I just realized my titanium backups weren't really backups since they were being stored on my internal memory.
I managed to change my backup folder and free up some space by moving all my backups to the SD card, but for some reason I cannot move apps to SD through Titanium or any other app I've tried.
Does anyone know how to do this? Is there a setting in titanium I need to change or is this just something we have to deal with forever short of flashing a custom rom?
Click to expand...
Click to collapse
I've found the real problem, but not the solution.
My Relay runs ICS. It is rooted, and you have to root to even touch any of this. The phone has a binary, /system/bin/sdcard that controls the internal memory and your SDcard. now, I have found that if you are rooted, you can chmod this binary (or use rooted ES File explorer to remove all executable properties) so that it can no longer run, then reboot. then you can run, as superuser "mount -o rw,bind /mnt/extSdCard /mnt/sdcard"
Seems great... Except vfat doesn't like to be bound in such a fashion, and you quickly lose write access and it starts mangling your files.
vfat just doesn't seem to work for us in this case. I've changed mine back, and reformatted my SDcard to be NTFS and mounted with paragon NTFS/HFS, which has completely stabilized my filesystem. only problem is, I can't get this to mount -o bind worth a damn.
I'm toying with the idea of reformatting my SDCard part vfat and either part NTFS or EXT4. maybe I get get the phone to natively recognize ext4 for the sdcard (even if I have to create a script myself)
keypoints I've found in this process:
1. the sdcard binary only allows access to 1023 files at once on either the SDcard, or the memory block it is using as the SDcard. too many pictures in your gallery? so sorry... can't load them all.
2. the physical device for your sdcard is /dev/block/mmcblk1. the partitions are mmcblk1p* (starting with 1)
3. the phone will not allow the sdcard binary to be killed manually. removing the executable permission and then rebooting the phone seems to be the only way to get it to stop.
4. vfat is prone to errors, and android seems to love screwing with the card. getting off vfat seems to be crucial to this process.
As you've gotten no other replies, and this is a gigantic concern for me as well, I'm going to keep working on this myself, in the hopes that I can get the phone to actually use the SDcard the way we hope it can be used.

Path to Mounted EncFs

Forgive me if this is in the wrong place.
I'm using EDS Lite to mount an EncFs directory. That works fine. I can access the directory from file managers when it's mounted. That's fine. I don't have any trouble accessing the encrypted files when I want them.
BUT:
Suppose I'm using a program that doesn't have one of those simple sidebars that lets you access different things. A program like App2SD. Suppose I can access any directory from the Root, but I don't have a nice shortcut that takes me directly to a mounted file system. So the important question is:
What is the path to the mounted EncFs system?
With other mounted file systems, I know a couple ways to get there. For example, I can get to the SD card from Root/storage/###-####, or from Root/mnt/media_rw/####-####. With the second partition on my SD card, I can get there using Root/data/sdext2. But now, what about the mounted EncFs file system I have? How could I reach that from the root directory? How could I get there?

retrieving files from internal memory ?

I am a newbie at fone hacking.
I put a new Kingston 128G SD card in my Moto E40 phone. Android (v11) offered to help me by moving my pictures to the empty SD card and freeing up internal memory. Great.
Except then the SD card died - it is not visible (doesn't mount) in the phone or in my PC - I assume that it's fried ?
Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?
And, is there any way to resurrect the SD card ?
Please and thanks for any help... Ray
SilverCraftRay said:
...
Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?
...
Click to expand...
Click to collapse
If phone is succesfully got paired with PC ( read: ADB connection ), if phone's Android got successfully rooted, if phone's internal storage where photos are stored by default isn't got encrypted and isn't got overwritten by new data, then it's theoretically possible to retrieve the deleted photos.
If I use Magisk to get root access, the tutorial says that it will wipe my data.
How would I get my files back if the rooting process wipes my data ?
Can I root my phone without losing all it's data ?
Noone needs Magisk to root a phone's Android: that's a nurse fairy tale.
To root Android all you have to do is to create a copy of SU-binary in Android's filesystem and make it executable. After that you can run all Linux commands alike
mount and dd etc.pp. as ROOT.
Example - using ADB
Code:
adb devices
adb push <LOCATION-OF-SUITABLE-SU-BINARY-ON-PC-HERE> /data/local/tmp/
adb shell "cd /data/local/tmp & chmod 2776 su"
what will 1. connect the Android device to your desktop computer and 2. upload the su binary in the Android device temporary directory always available for the user.
Thanks. adb is very powerful.
Where can I find the suitable SU-binary for this phone? Is it in another system directory on the phone? Or in the internet based on my particular phone?
Once it is pushed, will my phone tools use it automatically? It seems that su is a manual command. Or will it be found automatically since it is in the /data/local/tmp directory ?
you can't root Android 5+ like that. the only nurse fairy tale is post #4 as discussed here.
even with root access it's impossible to recover deleted files from FBE file-based encryption (which is enforced on devices shipped Android 10+)
you can try to recover files from Kingston MicroSD Card with card reader on PC
https://www.z-a-recovery.com
Wrong
FBE ( what is significantly more insecure than FDE ) was introduced with Android 7 ( read: Nougat ) in August 2016.
Having elevated rights ( AKA SU ) you can dd a phone's internal memory via ADB to PC.
BTW: The FBE key of a file is stored directly in the ext4 file-system "dentry" of each file.
"For new devices running Android 10 and higher, file-based encryption is required."
(that means if device shipped on Android 9 it may receive update to Android 10 but is still running FDE btw)
while on FDE the DEK is ciphered with TEE static master key, FBE encryption keys are ciphered with random generated DEK in TEE keystore (which is flushed on factory reset). what you see in file metadata is KEK + DEK ciphered per-file-key (hash), where KEK is ciphered with lock screen credentials.
each files metadata is deleted when file is deleted, so the key is gone forever. as of the nature of encryption, file carving methods cannot understand what's left on disk and cannot restore any deleted files.
Now imagine, FBI forensics do a full dump of disk and find a method to magically restore each single byte of inode + dentry (for one single file), still they cannot decrypt that file without DEK.
FDE is encrypted with default_password without any lock screen pin at all (even if you set pin), which is common for most devices. that allows to bypass screen lock (impossible on FBE).
further the whole block partition is decrypted at once, so undeleting files (at least on ext4) is (in theory) possible.
if userdata and crypto-footer is dumped off the phone, that backup (on PC) will even survive factory reset, it can be restored afterwards and still it's possible to decrypt (online), as the static master key is burned to chip.
if one of the encryption methods is significantly more insecure then it's clearly FDE. to overcome this one should enable Secure Start-up.
btw modern devices (like OnePlus) combine both encryption methods FBE + FDE = metadata encryption (devices launched with Android 11+)
This intellectual outpouring is all well and good, but it completely misses the point: this thread is about data recovery from internal storage memory, OP was: "Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?". The answer is YES: retrieve and restore are different operations!
FYI: I know the difference between FBE and FDE, know how to lever out both locks.
the answer is NO. Moto E40 uses metadata encryption.
jwoegerbauer said:
FYI: I know the difference between FBE and FDE, know how to lever out both locks.
Click to expand...
Click to collapse
Obviously you don't.
I pay you 100 € if you show any proof. just rm a file and try to recover on FBE encrypted flash storage.
or explain in what way retrieving of deleted files differs from restore?
wait... so you're the same guy who don't understand how SUID bit works and still claim we can place "suitable" SU-binary in /data/local/tmp?
well we shouldn't expect any proof then lol

Categories

Resources