Way how I got to this point is that my phone somehow had restarted in my pocket and was asking for password which I entered but upon entering password it restarted so I was basically stuck in bootloop. So I went into adb through recovery and pulled all partitions of the phone so they are on my pc right now. The question is how can I decrypt them. I tried looking around how is 4.4.2 encrypted but didnt find any good answer. I only understood that key is stored in footer of it which I did find there but then arises question of how you derive the encryption key from it? I'm so confused. Also how is sdcard encrypted as I looked at files from sd card they seem to be file-based encrypted?
1 Answer
Okay so I got more info about how Samsungs encryption works from this video and was able to decrypt my userdata partition with tool called Sandy. As for SD card I just pulled out eds_p_sd file from /efs partition from my dd dump and put it back into factory reset phone and it worked like a charm. But SD card decryption can also be achieved with the Sandy framework you just need to have eds_p_sd file and right ECryptFS version so the keys work otherwise you will run into problems.
