Context: full-disk encryption in Android 6.0, specifically key derivation and storage.
I have a device running Android 6.0 with full disk encryption. I need to make a backup of the device, wipe the device, use it in the wiped state for a little bit, then restore from the backup.
I am running a custom recovery (TWRP), but unfortunately it cannot make a nandroid backup of /data because I guess it is very confused by the fact that /data is encrypted.
I was going to make a backup by just running "dd if=/dev/mmcblk0 of=/sdcard/image.img ..." in recovery in order to make a byte-level copy of the entire internal storage, with the intention of later restoring it by doing the same in reverse.
However, I am afraid that the hardware-bound key, which is stored in the TEE and used to encrypt the disk encryption key, is stored outside /dev/mmcblk0 and will be deleted when I perform a wipe. Thus, even though I'll succeed in restoring the image, Android will no longer be able to derive the same encryption key and thus will fail to decrypt my data.
Thus, my questions are:
- is this correct?
- if so, what are my options? if the key is actually wiped, I understand that it wouldn't make any sense for it to be possible to backup and restore it. However, perhaps there's a more roundabout way to wipe the device of my private information without deleting the TEE key?