1

I have this situation where I had my internal storage encrypted and then by using twrp I formatted only my data( booted into twrp > advance wipe > selected data and Dalvic cache > swiped to wipe . I didn't checked internal storage) ( dumb right ) now when I am booting into twrp it doesn't ask me for password to decrypt data but i can see my encrypted internal storage in file manager

I tryed to copy encrypted content to my pc ( hoping that i can decrypt it because i know the password by which it was encrypted ) but not able to do so

what I tried is

  1. using adb pull it gives me error remote open failed: Required key not available
  2. using MTP it is also giving me error
  3. twrp decrypt <my password> it fails

can i somehow recover my data ( i know the password )

Tripurari Shankar
  • 111
  • 5
  • if you formatted /data partition your internal storage /data/media is formatted, can't be true. in any case you wiped your encryption credentials all data is lost forever. this is not expected behaviour for data wipe, claim this to your twrp maintainer – alecxs Feb 08 '20 at 07:00
  • https://android.stackexchange.com/q/216155 – alecxs Feb 08 '20 at 07:06
  • @alecxs maybe I did't said right I booted into twrp > advance wipe > selected data and Dalvic cache > swiped to wipe – Tripurari Shankar Feb 08 '20 at 08:32
  • I did't checked internal storage – Tripurari Shankar Feb 08 '20 at 08:32
  • from my understanding if you select data then twrp will only wipe your app data and apps that user have installed not the internal storage maybe I am wrong here – Tripurari Shankar Feb 08 '20 at 08:41
  • true if you wipe /data then everything except /data/media is just deleted (no formatting). unfortunately the credentials in /data/system are deleted with this. looks like a serious issue with twrp – alecxs Feb 08 '20 at 09:20
  • @IrfanLatif yes my data exist in /sdcard encrepted but the problem is neither I can copy it in pc nor I am able to decrypt it – Tripurari Shankar Feb 08 '20 at 09:22
  • @IrfanLatif I was using Lineage os 16 ( which is Android 9 ) not sure about FDE/FBE but my guess is it's Full Disk Encryption – Tripurari Shankar Feb 08 '20 at 09:23
  • If it's FBE, as @alecxs said, your encryption keys are wiped and you won't be able to decrypt your remaining data. If it's FDE, you should not be able see anything in /sdcard until it's not decrypted. Your situation is quite vague. More information is needed. – Irfan Latif Feb 08 '20 at 09:26
  • adb pull the whole encrypted userdata partition (~ 1 h) and analyse the dump, maybe you can recover locksettings.db https://android.stackexchange.com/q/208106 – alecxs Feb 08 '20 at 09:27
  • @alecxs, @Irfan Thanks a lot to both of you but the problem is I am not able to copy using adb pull error is remote open failed: Required key not available – Tripurari Shankar Feb 08 '20 at 09:29
  • @alecxs ok I got it will try to follow the link you gave me if you want you can post answer and I will accept it – Tripurari Shankar Feb 08 '20 at 09:36
  • your password is just a little piece of the puzzle. decryption only works on the device itself, you can't decrypt on pc. you must look for credentials only (see linked question) adb pull /dev/block/bootdevice/by-name/userdata will work. run extundelete and binwalk or search with hexeditor.. but there is less hope – alecxs Feb 08 '20 at 18:58
  • @alecxs running mount | grep 'on /data' gives me the output of /dev/block/sda17 is this the block I want to pull ??? forgot to tell earlier I am using oneplus 6T – Tripurari Shankar Feb 09 '20 at 03:52
  • yes. if not sure check ls -l $(find /dev/block -name by-name)/* – alecxs Feb 09 '20 at 07:14

0 Answers0