4

After installing the latest LineageOS update on my phone, unfortunately, my phone boot looped, so I made a backup using TWRP, and I did a clean install of the latest version of LineageOS, attempting to restore the backup TWRP had made, but only for my phone to be boot looped yet again. Unluckily for me, I had to "restore" my apps by simply downloading them (through the Google Play Store) and logging into them. Sadly though, one of my necessary apps/accounts requires two-factor authentication, which is a problem because my two-factor authentication app ("Microsoft Authenticator") had gotten wiped, and although it is backed up in TWRP, I don't know what I can do with it. Also to note, there are no other "additional" methods of logging in for this account of mine. Now I am stumped, as to what I could possibly do to be able to recover either #1 My keys + all of my Microsoft Authenticator app data or #2 Be able to find out what other accounts were linked to my Microsoft Authenticator app.

I am aware that I'm able to extract TWRP's files (each has some sort of "win" extension) by renaming their extension to ".tar" and opening them with a file archiver like 7zip/WinRAR. However, my question is, what would I have to do to be able to possibly restore my Microsoft authenticator app data to my phone, without having to restore the entire data partition of my TWRP backup (Because if I were to restore the entire data partition, my phone would boot loop again).

Sources I checked out:

Restore-apps-from-a-nandroid-backup-using-titanium-backup - Titanium Backup doesn't work well on the more up-to-date versions of Android (Particularly Android 11, since that's what I have right now), the same thing with Nandroid Manager (Nandroid Manager isn't maintained for the time being)

Twrp-manual-restore -- Seems old and unlikely to work on Android 11 (But it might)

Restore-app-data-without-restoring-the-whole-image -- Could be a plausible solution, but I don't know where I'd paste the data/data file (I don't even know what the data/datafile looks like) to, cause I don't have anything similar to "sd/ext.SD", and I don't know what'd be considered my "readable memory."

Restore-data-of-a-specific-app-from-a-twrp-backup -- Asked 8 days ago, a remarkably similar issue to me. However, I don't think I can replicate the steps since I found two com.azure.authenticator's, each in separate "win" files (One has the base.apk, another has some other files, an image of me combining them is shown) enter image description here

TLDR: How can I recover solely my Microsoft Authenticator data from my TWRP Backup?

Notes:

  • I use Microsoft Authenticator as my 2-factor-authentication app, and sadly, I did not enable cloud backup for it at the time of my factory reset
  • I did not export my codes/OTP from Microsoft Authenticator, as there is no option for that
  • My phone is rooted, and I have TWRP installed

Any help would be much appreciated, thank you!

1
  • 1
    The Microsoft Authenticator app uses AndroidKeystore for storing an RSA key (seems to be some sort of master key that is required to decrypt something, used on Android 4.2+). If that key is really required and your LineageOS system uses hardware security then recovery will be imossible. – Robert Apr 12 at 7:12
3

With much thanks to @Robert and especially @Firelord I was able to resolve my problem, and with relative ease.

Below contains all of the steps I had to take to recover the necessary information I required from the Microsoft Authenticator folder.

Pre-requirement steps:

  1. I had to have access to my entire TWRP backup, with all of the data partition files (I transferred my TWRP backup from my SD card to my PC to be able to access it with conveniency/effiency)

enter image description here

  1. Then I had to change all of the data partition file extensions to .tar (The easiest way to do this was to just rename the files, and add .tar at the end)

enter image description here

Microsoft Authenticator Recovery Steps:

  1. Next, I had to look through all of the ".tar"(s) and find the one that had the _\data\data\ directory, from there, I found the com.azure.authenticator folder

enter image description here

  1. I opened the com.azure.authenticator folder, and then found and opened the databases folder

Me finding the "databases" folder

  1. Then I looked for the PhoneFactor database file which contained all OTP related information for Microsoft Authenticator (I made sure it's not the cached verison -> I was able to tell which was the cached version by comparing the two PhoneFactor files and determining which is bigger, the bigger one is the "actual" file --- It seems all of the "cached" files have a size of 72 bytes)

Me opening the "databases" folder

  1. I extracted the PhoneFactor file to an accessible location -> downloaded a SQLite Viewer application (I chose DB Browser for SQLite) -> I proceeded to open the PhoneFactor file with the SQLite viewer

  2. Then I clicked the Browse Data button (The highlighted red boxes on the left side of the image are solely to indicate what I was looking for, which is all of the OTP information - On the right side, the highlighted red box is meant to display where you have to click to actually get the information) enter image description here

  3. You should now see all the information related to your Microsoft Authenticator app, including all of your OTPs and the names you assigned to them, the usernames you set to them, and most importantly, their oath_secret_key(s)

  4. Now, you can either manually type in the oath_secret_key(s) alongside their name(s)/username(s) into Microsoft Authenticator, or any other 2-factor-authentication app you prefer

Boom, you have now successfully recovered the OTP information from Microsoft Authenticator

1
  • 1
    +1. Worked out neatly for you. And thank you, for coming back and taking the effort to self-answer your post. :) – Firelord Apr 13 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.