How to decrypt the corrupt SD card formatted as internal storage?

Question

So I'm on Marshmallow and have formatted my SD card as internal storage. Its filesystem got corrupt two weeks later for some reason.

Plugging it to GParted, I see 16MB of FAT32 and the rest is an unrecognized filesystem. It's not unformatted, just unrecognized.

GParted is giving the "Unable to read the contents of the fileystem." error for both partitions, though the FAT32 partition is accessible from File Browser flawlessly.

It's a Samsung i9505 running on nightly built Cyanogenmod 13.

EDIT: I found out the unrecognized partitions is a static AES-128 bit encrypted ext4. Now I will try to decrypt it and recover whatever.

EDIT2: I changed my mind and won't bother. Formatting as external storage this time.

Answer 1

Even it does not fully answer the question, here's a guide to decrypt the external storage formatted as internal. You do need to be root on your phone, however.

The gist is that we search for strings including the keyword expand and ending with .key within vold using:

$ strings vold|grep -i expand
--change-name=0:android_expand
%s/expand_%s.key
/mnt/expand/%s

It returns a 16-byte key.

expand_8838e738a18746b6e435bb0d04c15ccd.key

Then you pass the key into this bad boy:

# dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt \
aes-cbc-essiv:sha256 00010203040506070809010a0b0c0d0e0f 0 /dev/sdb2 0"

And mount that in:

# mount -t ext4 /dev/mapper/crypt1 /mnt/1/
# cd /mnt/1
# find ./ -type d

Now you can cp everything elsewhere and hopefully save some data. Remember to exclude any key-related data (grep) when doing so, in case you want to reformat as ınternal again and put your stuff back in.