1

I have a broken HTC Sensation with a forensics lab who are trying to recover the data from the phone's internal memory chip. The technician says he is unable to recover the data on the chip because the chip itself is MMC password protected. This is the first time he has ever encountered this on an internal memory chip. He added that he was mystified as to how an internal memory chip could become MMC password protected in the first place.

I should add that this phone belongs to me. It is not nor was it ever password protected.

Can anyone here offer any guidance on solving this problem? I simply refuse to believe that HTC have for the first time in the history of civilisation, created a perfect security measure and then installed it into a mid-price mobile phone handset.

Many thanks

Improve this question
5
  • bits-please.blogspot.com/2016/06/… for older devices: forensicswiki.org/wiki/…
    – alecxs
    Commented Aug 13, 2019 at 16:43
  • I'm not sure what he means by password protected but yes, most of the newer Android devices are encrypted with default_password on first use. So even if user doesn't enter a password on boot, memory is encrypted (FDE/FBE). Memory is encrypted with a key which is stored in footer of partition, key is in turn encrypted with default_password (or user provided password). Additionally starting with Android 5.0 encryption is hardware-backed. So an off-the-device decryption is almost impossible.
    – Irfan Latif
    Commented Aug 13, 2019 at 19:51
  • 1
    its an old device check the version major/minor crypto footer - if it is < 1.3 it is possible to bruteforce nelenkov.blogspot.com/2014/10/… here is the script santoku-linux.com/howto/mobile-forensics/…
    – alecxs
    Commented Aug 13, 2019 at 20:29
  • 1
    Okay, I've found a little more information as follows: the chip is a standard BGA 162 SKHynix(?) chip with no unusual markings. The technician who is dealing with my phone went on to write: Due to the age of the device there won't be any FDE on it. We basically have a hardware based lock within the memory chip itself, a fault we cannot overcome (without a special "Erase" command - as the name suggests this would wipe the data). I am struggling to think why this chip has an MMC lock but when I researched it, there tends to only be a small number of phones and chips out there with this issue.
    – JRAP
    Commented Aug 16, 2019 at 16:53
  • thanks for clarifying this is a hardware issue (not related to encryption)
    – alecxs
    Commented Aug 18, 2019 at 22:54

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .