1

A friend of mine gave me his Samsung Galaxy S2 with Cyanogenmod 10.1.3 installed and Full Disk Encryption enabled because it bootlooped.

I made a dump of mmcblk0 (the internal Flash memory) just for safety. While dumping the phone died completely and now only shoes the first bootscreen and doesn't go anywhere.

Now I am trying to recover everything possible from the flashdump but testdisk does only see 3 partitions:

GUID Partition Table (EFI) Offset Sector: 0 Units are in 512-byte sectors

Slot    Start        End          Length       Description

00: Meta 0000000000 0000000000 0000000001 Safety Table 01: ----- 0000000000 0000008191 0000008192 Unallocated 02: Meta 0000000001 0000000001 0000000001 GPT Header 03: Meta 0000000002 0000000033 0000000032 Partition Table 04: 00 0000008192 0000049151 0000040960
05: ----- 0000049152 0000106495 0000057344 Unallocated 06: 01 0000106496 0000311295 0000204800
07: ----- 0000311296 0000344063 0000032768 Unallocated 08: 02 0000344064 0001392639 0001048576
09: ----- 0001392640 0027419439 0026026800 Unallocated

is there any way to find the encryption keys and decrypt the data that got copied to my pc before the phone died?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.