10

So I'm on Marshmallow and have formatted my SD card as internal storage. Its filesystem got corrupt two weeks later for some reason.

Plugging it to GParted, I see 16MB of FAT32 and the rest is an unrecognized filesystem. It's not unformatted, just unrecognized.

GParted is giving the "Unable to read the contents of the fileystem." error for both partitions, though the FAT32 partition is accessible from File Browser flawlessly.

It's a Samsung i9505 running on nightly built Cyanogenmod 13.

EDIT: I found out the unrecognized partitions is a static AES-128 bit encrypted ext4. Now I will try to decrypt it and recover whatever.

EDIT2: I changed my mind and won't bother. Formatting as external storage this time.

  • How common is this? – William Feb 27 '17 at 21:55
9

Even it does not fully answer the question, here's a guide to decrypt the external storage formatted as internal. You do need to be root on your phone, however.

The gist is that we search for strings including the keyword expand and ending with .key within vold using:

$ strings vold|grep -i expand
--change-name=0:android_expand
%s/expand_%s.key
/mnt/expand/%s

It returns a 16-byte key.

expand_8838e738a18746b6e435bb0d04c15ccd.key

Then you pass the key into this bad boy:

# dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt \
aes-cbc-essiv:sha256 00010203040506070809010a0b0c0d0e0f 0 /dev/sdb2 0"

And mount that in:

# mount -t ext4 /dev/mapper/crypt1 /mnt/1/
# cd /mnt/1
# find ./ -type d

Now you can cp everything elsewhere and hopefully save some data. Remember to exclude any key-related data (grep) when doing so, in case you want to reformat as ınternal again and put your stuff back in.

  • 2
    You can use hexdump -e '1/1 "%.2x"' expand_8838e738a18746b6e435bb0d04c15ccd.key to convert binary to hex. – Dzwiedziu-nkg Aug 23 '16 at 16:01
  • Where exactly do you run those command? – Royi Mar 7 '17 at 10:55
  • @Royi You plug your SD card to a Linux computer. – Doruk Karınca Mar 9 '17 at 23:01
  • To be exact, the expanded storage key of named expand_8838e738a18746b6e435bb0d04c15ccd.key (the actual hex number depends on your expanded storage device) needs to be fetched or read from the phone. The file is usually located in directory /data/misc/vold and the directory may contain multiple keys if multiple SD cards have been used. Note that you have to have root access to your phone to see the contents of the key files and extract the required encryption key. – Mikko Rantalainen Aug 3 at 12:00

protected by Community Nov 2 '16 at 17:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.