Timeline for How to get data off a completely dead Android phone?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 22, 2019 at 18:03 | comment | added | Irfan Latif | @Firelord yeah that was the actual story behind famous Apple vs. FBI case. | |
| Aug 22, 2019 at 15:29 | comment | added | Firelord♦ | I see. I didn't know about RSA key. I only thought that user credentials with a random salt were processed into a key for encryption, hence asked about brute force. Now it all makes sense that if the device is encrypted and dead all hope is lost to recover data from it. | |
| Aug 22, 2019 at 14:06 | comment | added | Irfan Latif | KeyMaster module runs in a secure environment, e.g. TEE, which uses main CPU but is completely isolated from main OS. ARM's TZ is an implementation of TEE. Qcomm's implementation of TZ is QSEE in which KeyMaster runs. Ideally KeyMaster should not leak any cryptographic information, but it's been hacked, though only useful if device is working. For off the device attacks user password as well as RSA key is to be brute forced. And the later seems impossible. So this approach doesn't look like a matter of time. That's what my understanding is. | |
| Aug 22, 2019 at 14:00 | comment | added | Irfan Latif |
@Firelord interesting. To decrypt the whole partition (FDE) or whole filesystem (FBE), master key is required which is encrypted with another middle key, and stored at crypto footer or in /data/misc/vold/user_keys/[ce|de]/<User_ID>/. An encrypted private RSA key is also stored along with master key, which is provided to KeyMaster, which decrypts RSA key and then uses it to sign the middle key. Middle key in turn is derived from user credentials and a random salt also stored along with master key. So we need two things: user credentials and unencrypted RSA key; later only known to KeyMaster.
|
|
| Aug 22, 2019 at 3:39 | comment | added | Firelord♦ | Hypothetical: would it be worth it for a person to somehow manage to get data out of emmc (encrypted it is), wait for a couple of years or probably a decade to have serious advancements in affordable parallel processing hardware (like gpu), and then brute force the way out of that encrypted data? I see bruteforce the only method (unless social engineering gives us the result) if decryption key cannot be chipped off. | |
| Aug 6, 2019 at 1:42 | history | edited | Irfan Latif | CC BY-SA 4.0 |
added 103 characters in body
|
| Aug 4, 2019 at 23:51 | history | bounty ended | Roel Van de Paar | ||
| Aug 4, 2019 at 23:50 | vote | accept | Roel Van de Paar | ||
| Aug 4, 2019 at 12:05 | history | edited | Irfan Latif | CC BY-SA 4.0 |
deleted 1 character in body
|
| Aug 4, 2019 at 11:57 | history | answered | Irfan Latif | CC BY-SA 4.0 |