Working on recovering data from phones newer than Android 8.1. The situation is this:

  • Customer forgot the lock (pattern/pin/...)
  • Because lock screen can't be opened, OEM is locked.
  • Can't install custom recovery (such as cwn, twrp) due to OEM lock.

It seems that the only way is to mount the hard disk which seems to be encrypted by default.

So what should be done in this situation?

  • 2
    Nothing........ – Irfan Latif Jul 27 '20 at 12:10
  • 1
    You can do is try to brute-force the lock screen pattern/pin. – Robert Jul 27 '20 at 12:24

data recovery and screen lock by-pass are two different things. both should impossible due security reasons

Android provides official unlock solution via google account. bonded google account is requirement for using Google Play App Store, most likely every costumer will have

google account itself has several forgotten password options, it's up to customer to get it work, not yours

you already have mentioned some workarounds which might have worked on some (older) devices, let me explain a little more

data recovery from factory reset is not possible because of encryption

data recovery from FRP lock is not possible because of factory reset

data recovery via unlocking is not possible because the bootlader unlock triggers factory reset

reset screen lock is not possible because login credentials are partially involved in calculating encryption keys, deleted locksettings.db will destroy encryption

off-chip recovery is not possible because encryption is hardware bound

However, some cracking is possible for some devices under certain conditions

data partition can be decrypted when

  • device uses FDE full-disk encryption
  • full-disk encryption uses default_password
  • decryption is performed on this unique source device itself

screen lock can be deleted when

  • data partition is decrypted
  • encryption doesn't rely on login credentials

dump partitions on locked bootloader is possible via

  • Qualcomm EDL mode when OEM signed factory loader is leaked
  • Mediatek SP Flash Tool with proper Secure boot Download Agent and authentification files

flashing on locked bootloader is possible when

  • boot/recovery image is AVBv1 signed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.