Hello Guys,
Yesterday my phone (Samsung S7) fell and the screen and touchscreen is not working since then. Not surprised given that it is shuttered XD.
Anyway, I had an sd card in the phone with all the photos saved on it, without cloud backups. Not remembering that the card was encrypted, I have simply connected the phone to my pc and copy pasted all photos to a pc folder. The sd card has then been inserted into a new Samsung A20e and fast formatted.
My problem is that now I have all the photos on my desktop which are encrypted and can't be opened. As soon as I realized this I have removed the sd card from the A20e to avoid overwriting data in case it can be recovered.
I would gladly appreciate if any of you could tell me if there is a way to recover this data.
I can access the USB debugging mode on the S7 and navigate its files.
My inexperienced ideas were:
1. Is it possible to recover the encryption key from the files in the phone and then use this do de-encrypt the photos on the pc?
2. If I insert the sd card back into the S7, format it, encrypt it (through a pc screen mirrowing tool), copy the photos form the pc into the card would the phone be able to read them? This could be possible if the phone uses always the same encryption key without changing it.
3. Is there any use in trying to use one of those data recovery tools on the sd card? The data I would get will still be encrypted.
Thanks to anyone who'd be willing to help.
upuupupupup
Galbanino0 said:
Hello Guys,
Yesterday my phone (Samsung S7) fell and the screen and touchscreen is not working since then. Not surprised given that it is shuttered XD.
Anyway, I had an sd card in the phone with all the photos saved on it, without cloud backups. Not remembering that the card was encrypted, I have simply connected the phone to my pc and copy pasted all photos to a pc folder. The sd card has then been inserted into a new Samsung A20e and fast formatted.
My problem is that now I have all the photos on my desktop which are encrypted and can't be opened. As soon as I realized this I have removed the sd card from the A20e to avoid overwriting data in case it can be recovered.
I would gladly appreciate if any of you could tell me if there is a way to recover this data.
I can access the USB debugging mode on the S7 and navigate its files.
My inexperienced ideas were:
1. Is it possible to recover the encryption key from the files in the phone and then use this do de-encrypt the photos on the pc?
2. If I insert the sd card back into the S7, format it, encrypt it (through a pc screen mirrowing tool), copy the photos form the pc into the card would the phone be able to read them? This could be possible if the phone uses always the same encryption key without changing it.
3. Is there any use in trying to use one of those data recovery tools on the sd card? The data I would get will still be encrypted.
Thanks to anyone who'd be willing to help.
Click to expand...
Click to collapse
If it has been formatted, it is gone. Recovering data that has been deleted is quite possible. Recovering data that has been formatted is not likely. And even if you did manage to recover any of the data, it would be very fragmented and incomplete, in other words, there wouldn't be enough left behind to recover anything that is a complete or useable file, all you would have are incomplete pieces of files.
However, it is possible to decrypt your encrypted backup but I don't know the best method to do so.
I only posted to give you an idea of what is possible and what isn't.
Sent from my SM-S767VL using Tapatalk
Droidriven said:
If it has been formatted, it is gone. Recovering data that has been deleted is quite possible. Recovering data that has been formatted is not likely. And even if you did manage to recover any of the data, it would be very fragmented and incomplete, in other words, there wouldn't be enough left behind to recover anything that is a complete or useable file, all you would have are incomplete pieces of files.
However, it is possible to decrypt your encrypted backup but I don't know the best method to do so.
I only posted to give you an idea of what is possible and what isn't.
Sent from my SM-S767VL using Tapatalk
Click to expand...
Click to collapse
Thanks for the reply.
At least if you say that is possible to decrypt the files there is some hope for them. Have you got any idea of where I could understand more on how to do it?
Related
i have heard many people complain to me that they just format their memory card accidentally on which a lot of important files have been saved. they are so upset because of the data loss that regret for a long time. i myself also have formatted the memory card by error and felt terrible when knowing all information have been lost. and it was more than one time, actually. i have tried to find out many ways to get those files back from the formatted memory card[/URL]. Finally, i got how to complete that task. i want to share it with you guys:
We can get back those lost files with data recovery tool from the accidental or intentional formatted memory card. Data recovery software could retrieve that data within a shore time. Here are its steps as follows to show you how to perform:
Step1. Download and mount the data recovery software on the computer.
Step2. Insert the formatted memory card to a card reader and then connect them to the computer on which the data recovery tool installed.
Step3. Double click the data retrieval program and choose the recovery model. Then select the object disk to scan.
Step4. You can preview the restorable contents in the list after the scan. Preview them and choose the wanted to recover.
Step5. Select one of the computer hard disks as the location to save the files to be restored.
there are precaution to avoid such data loss trouble, in fact. that is to back up those files regularly.
While it's nice that you decided to spend the time to write a guide, this thread will probably get buried extremely soon unless if it's stickied.
on a computer, deleted files can be still be recovered via tools like recuva or disk digger. Not unless you use a program to overwrite fee space a number of times. Is it the same with android devices?
i have another scenario though, i have a tablet that i plugged a micro sd card to to view files. I dont save those files to the tablet, just view them. Then just eject the card when done. If someone were to somehow gain possession of my tablet, can they find out what the file is and somehow get a copy of that file via the temporary folder or something?
I would appreciate it if experts can answer and give advice on my rather uncommon questions.
Thanks
t-rayms said:
on a computer, deleted files can be still be recovered via tools like recuva or disk digger. Not unless you use a program to overwrite fee space a number of times. Is it the same with android devices?
i have another scenario though, i have a tablet that i plugged a micro sd card to to view files. I dont save those files to the tablet, just view them. Then just eject the card when done. If someone were to somehow gain possession of my tablet, can they find out what the file is and somehow get a copy of that file via the temporary folder or something?
I would appreciate it if experts can answer and give advice on my rather uncommon questions.
Thanks
Click to expand...
Click to collapse
Files deleted in android are not actually deleted, the space the file is in is marked as free space but the data remains there ignored by the system until that space is overwritten or is formatted.
When viewing files from sdcard, some data that was viewed is cached and can be found/recovered later possibly if cache is not cleared but the data recovered might not be enough to tell them anything.
Sent from my SM-S903VL using Tapatalk
Hello,
I unexpectedly had to do a factory reset on my S7 while the SD card was encrypted, as result the SD was not obviously readable afterward.
I saved part of the encrypted content of the SD card (basically the pictures) before formatting it and starting using it again, however I'm not able to recover this content.
I tried with the procedure I found on internet:
- saving the encrypted data
- format the SD card
- encrypt of it
- copy of the saved content back to the SD
- decrypt
However, at the decrypt state the phone don't move from an 'Analyzing SD card' phase.
Any idea? I'm afraid I should have saved all the content of the SD card...
Thank you
You should plug the SD card on to your PC using an SD Card reader. Open up CMD, and type diskpart.
After which, type list volume, and you will see the "drive letter" of your SD Card, type clean and afterwards...
Proceed to typing create partition primary size = "insert capacity of SD card here (mb" *w/o the quotation marks*
After which, type assign letter=F
It should work fine after this hopefully.
When you encrypt the SD card, Android makes a unique key that is stored in the Android trust store. When you factory reset the device, that key is lost. Permanently. Remember, the whole point of encryption is so malicious parties cannot access your data. If you could just read it again after factory resetting then there isn't much point is there? Your only option is brute-forcing it.
Always backup. Always.
CurtisMJ said:
When you encrypt the SD card, Android makes a unique key that is stored in the Android trust store. When you factory reset the device, that key is lost. Permanently. Remember, the whole point of encryption is so malicious parties cannot access your data. If you could just read it again after factory resetting then there isn't much point is there? Your only option is brute-forcing it.
Always backup. Always.
Click to expand...
Click to collapse
Thank you
I do have a backup, however it was more convenient to restore the 20GB of photos from the SD rather than from the cloud.
I was reading some guides on internet with this procedure that's why I tried.
I will survive, thank you both for your answer
Mone181 said:
Thank you
I do have a backup, however it was more convenient to restore the 20GB of photos from the SD rather than from the cloud.
I was reading some guides on internet with this procedure that's why I tried.
I will survive, thank you both for your answer
Click to expand...
Click to collapse
If somehow it was possible to backup the encryption key which is generated randomly on each phone then it would be possible to decrypt it on your PC even if the phone was damaged using your password and encryption key. For some stupid reason this is not implemented in Android (but it was doable for some devices), for example TrueCrypt or Microsoft Bitlocker allow it.
difto said:
If somehow it was possible to backup the encryption key which is generated randomly on each phone then it would be possible to decrypt it on your PC even if the phone was damaged using your password and encryption key. For some stupid reason this is not implemented in Android (but it was doable for some devices), for example TrueCrypt or Microsoft Bitlocker allow it.
Click to expand...
Click to collapse
Yes, I thought the encryption was based on pin of the phone actually.
Lesson learned
Hello,
I have similar problem, but with Sony Xperia Z5 Compact. I made factory reset but didn't decrypt SD card before. SD card was ejected before reset, so I have all the datas, but cannot open them.
Is there any chance that I may recover my photos and videos if I don't have any backup?
Best regards.
Anyone?
Hi everyone
I kinda have the same problem. But the difference in my case is that I didn't reset the phone. While operating normally, one day it gave me a notification that encryption has failed. When I touched it, a page opened with the button of decrypt SD card at the bottom. I thought a restart would fix the issue. But when restarted, the contents of my SD cannot be accessed. I tried to decrypt it manually but in the settings, it thinks that the SD is unencrypted and only gives me the option to encrypt it, which obviously fails after every try. I was wondering if there is any way to trigger the decryption manually? Because I didn't reset the phone or anything and the data is still there. The phone just fails to see it.
Thanks in advance
Hey! I can confirm for 1000% the method you said worked for me:
- saving the encrypted data
- format the SD card
- encrypt of it
- copy of the saved content back to the SD
- decrypt
I deleted a video was able to retrieve it using Diskdigger on my pc. But then I was unable to open it because it was encrypted. So than I decrypted the SD in my phone only to find out the files were than unrecoverable deleted!?! Luckily I copied the files to my pc before decrypting!!! I used ur method and it worked decrypted it and everything played fine! Must say I was on the same os same phone(s8) so that must've been why it worked anyway still it worked. I'm happy, I acquired parental responsibility because of u?
I have made a similar stupid mistake I rooted my galaxy s8 and forgot to decrypt the SD card... now can anyone help me with the steps that I can fallow to decrypt the camera folder...
I to have a same problum ..
please any one find out the result of that data recover from encripted sd card from samsung a50
Hello guys, I have a S8+ 955U version tmobile. I was on oreo beta and wanted to revert back to 7.0 latest which is G955USQS2BRB1. I odin the files but it caused me to format my internal memory. i lost all my photos of my newborn.
How can I get them back?
I've tried a few programs but I have to be rooted which I'm not.
I found a thread SAMPWNED to root device but I can't downfrade that far back.
Any help would be appreciated.
P.S. no i did not have an sd card in the phone, all files were saved on internal.
It's really difficult to recover photos from a formatted internal SD card. Best option, I think, would be try some other recovery apps, so see if they have access to your phone, though I don't think they will have that type of low-level access.
Another possibility might be to use ADB and if you can, pre-system/security startup, enable ADB within the phone, and then you might be able to do a recovery scan of the phone partitions.
There are a few (vague?) how to's on using ADB to enter the phone pre-system/security. Search 'sonnettie', the author of one method, and you will likely find other author off-shoots of the same type of method. If I don't stay current with a thing, I forget most of the details, but that was his original(?) method, which as I was told, came to be used by others to get into the phone pre-system startup/security. It might have been obviated by the Oreo update with a bug fix.
Did you have Samsung backup configured? If so it should have uploaded the photos and you would be able to restore them. If you don't make a backup your photos are already lost, you never know when your phone might die, be stolen or in this case get formatted. Google photos is a good alternative to keep your photos backing up.
Some people have incorrectly stated that it is possible to recover the photos after formatting internal storage. The data partition is encrypted by default and unless you are able to recover both, encryption key (it was most likely overwritten during first boot after factory reset) and the part of the partition containing the photos, you cannot get your photos back. Also, I have not seen any commercial data recovery software, which is capable of finding encryption keys and deciphering corrupted data partition.
Exactly, the phone is encrypted, not remotely possible to recover the photos scanning the memory
sergioslk said:
Exactly, the phone is encrypted, not remotely possible to recover the photos scanning the memory
Click to expand...
Click to collapse
good to know.
Thanks everyone for your input. After spending countless hours trying to root phone so I could get a data recovery program on it, I gave up. Turns out I had google photos and Samsung cloud turned on and it synced all my media. I got all my media back on my phone.
Thanks guys
@OP
i want to remind you that if you are doing like updating, flashing, modifying, always make a back up thank god samsung cloud is doing that for you., but i always make a hard copy to my sd card always you newer know right. i am happy for you that you got your data back
Hi everybody, I think the title is quite self-explaining but here is the whole story... I had to do a factory reset of my Xperia Z5 due to some slowdowns, and I left the encrypted SD card inside while resetting because I had done this way before and never had any problem. This time though, after reset, many of the files on the SD card have become unreadable, mostly photos and audio files. Searching for a possible solution, I found that maybe i should have unencrypted the SD card BEFORE the factory reset but now I can't undo that so I have to figure out a way to recover the files.
The files are not completely unreadable, since the file manager can see them, and using some apps I have been able to recover some photo, but only the ones that were sent to me, not the ones I took with the camera. The few photos that survived can't be moved nor copied anywhere.
The phone is not rooted and I have no idea how to root it (i know the procedure but reading the forum I noticed that with Z5 there are some DRM problems I wouldn't like to face...). If there is some way to safely root it without losing more data I can consider it.
I tried with Linux forensic apps (like scalpel, foremost etc.) but they have an I/O problem and aren't able to recover the files.
The best solution for me would be to decrypt the SD card somehow... can anyone tell me if there is a way?
Thanks in advance
Never encrypt data drives... and never trust one data drive for critical data.
With no encryption key those encrypted files are lost. If the phone generates a random key (likely) then you be boned.