4

After installing the latest LineageOS update on my phone, unfortunately, my phone boot looped, so I made a backup using TWRP, and I did a clean install of the latest version of LineageOS, attempting to restore the backup TWRP had made, but only for my phone to be boot looped yet again. Unluckily for me, I had to "restore" my apps by simply downloading them (through the Google Play Store) and logging into them. Sadly though, one of my necessary apps/accounts requires two-factor authentication, which is a problem because my two-factor authentication app ("Microsoft Authenticator") had gotten wiped, and although it is backed up in TWRP, I don't know what I can do with it. Also to note, there are no other "additional" methods of logging in for this account of mine. Now I am stumped, as to what I could possibly do to be able to recover either:

  1. My keys + all of my Microsoft Authenticator app data, or
  2. Be able to find out what other accounts were linked to my Microsoft Authenticator app.

I am aware that I'm able to extract TWRP's files (each has some sort of win extension) by renaming their extension to .tar and opening them with a file archiver like 7-Zip/WinRAR. However, my question is, what would I have to do to be able to possibly restore my Microsoft authenticator app data to my phone, without having to restore the entire data partition of my TWRP backup (Because if I were to restore the entire data partition, my phone would boot loop again).

Sources I checked out:

  • Restore-apps-from-a-nandroid-backup-using-titanium-backup - Titanium Backup doesn't work well on the more up-to-date versions of Android (Particularly Android 11, since that's what I have right now), the same thing with Nandroid Manager (Nandroid Manager isn't maintained for the time being)

  • Twrp-manual-restore -- Seems old and unlikely to work on Android 11 (But it might)

  • Restore-app-data-without-restoring-the-whole-image -- Could be a plausible solution, but I don't know where I'd paste the data/data file (I don't even know what the data/datafile looks like) to, cause I don't have anything similar to "sd/ext.SD", and I don't know what'd be considered my "readable memory."

  • Restore-data-of-a-specific-app-from-a-twrp-backup -- Asked 8 days ago, a remarkably similar issue to me. However, I don't think I can replicate the steps since I found two com.azure.authenticator's, each in separate win files (One has the base.apk, another has some other files, and an image of me combining them is shown)

TL;DR: How can I recover solely my Microsoft Authenticator data from my TWRP Backup?

Notes:

  • I use Microsoft Authenticator as my 2-factor-authentication app, and sadly, I did not enable cloud backup for it at the time of my factory reset
  • I did not export my codes/OTP from Microsoft Authenticator, as there is no option for that
  • My phone is rooted, and I have TWRP installed

Any help would be much appreciated, thank you!

Improve this question
1
  • 2
    The Microsoft Authenticator app uses AndroidKeystore for storing an RSA key (seems to be some sort of master key that is required to decrypt something, used on Android 4.2+). If that key is really required and your LineageOS system uses hardware security then recovery will be imossible.
    – Robert
    Commented Apr 12, 2021 at 7:12

1 Answer 1

Reset to default
4

With much thanks to @Robert and especially @Firelord, I was able to resolve my problem, and with relative ease.

Below contains all of the steps I had to take to recover the necessary information I required from the Microsoft Authenticator folder.

Pre-requirement steps:

  1. I had to have access to my entire TWRP backup, with all of the data partition files (I transferred my TWRP backup from my SD card to my PC to be able to access it with convenience/efficiency)

  2. Then I had to change all of the data partition file extensions to .tar (The easiest way to do this was to just rename the files, and add .tar at the end)

Microsoft Authenticator Recovery Steps:

  1. Next, I had to look through all of the ".tar"(s) and find the one that had the _\data\data\ directory, from there, I found the com.azure.authenticator folder

  2. I opened the com.azure.authenticator folder, and then found and opened the databases folder

    Me finding the "databases" folder

  3. Then I looked for the PhoneFactor database file which contained all OTP-related information for Microsoft Authenticator (I made sure it was not the cached version -> I was able to tell which was the cached version by comparing the two PhoneFactor files and determining which is bigger, the bigger one is the "actual" file --- It seems all of the "cached" files have a size of 72 bytes)

    Me opening the "databases" folder

  4. I extracted the PhoneFactor file to an accessible location -> downloaded an SQLite Viewer application (I chose DB Browser for SQLite) -> and proceeded to open the PhoneFactor file with the SQLite viewer

  5. Then I clicked the "Browse Data" button (The highlighted red boxes on the left side of the image are solely to indicate what I was looking for, which is all of the OTP information - On the right side, the highlighted red box is meant to display where you have to click to actually get the information)

  6. You should now see all the information related to your Microsoft Authenticator app, including all of your OTPs and the names you assigned to them, the usernames you set to them, and most importantly, their oath_secret_key(s)

  7. Now, you can either manually type in the oath_secret_key(s) alongside their name(s)/username(s) into Microsoft Authenticator, or any other 2-factor-authentication app you prefer

Boom, you have now successfully recovered the OTP information from Microsoft Authenticator.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .