Way how I got to this point is that my phone somehow had restarted in my pocket and was asking for password which I entered but upon entering password it restarted so I was basically stuck in bootloop. So I went into adb through recovery and pulled all partitions of the phone so they are on my pc right now. The question is how can I decrypt them. I tried looking around how is 4.4.2 encrypted but didnt find any good answer. I only understood that key is stored in footer of it which I did find there but then arises question of how you derive the encryption key from it? I'm so confused. Also how is sdcard encrypted as I looked at files from sd card they seem to be file-based encrypted?

1 Answer 1


Okay so I got more info about how Samsungs encryption works from this video and was able to decrypt my userdata partition with tool called Sandy. As for SD card I just pulled out eds_p_sd file from /efs partition from my dd dump and put it back into factory reset phone and it worked like a charm. But SD card decryption can also be achieved with the Sandy framework you just need to have eds_p_sd file and right ECryptFS version so the keys work otherwise you will run into problems.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .