1

So let's assume I am on Android 9 and have the encrypted FDE /data partition and the full /system partition - except for locksettings.db. I also know the pass code used to decrypt/unlock the device after rebooting. On a fresh installation it looks like the database only contains the identifier of the key but the key seems to be located in a file within the /system partition, which is intact.

Now my question is: Is there any way to decrypt the partition or reconstruct the locksettings.db file? I would be very grateful for any help with the issue.

Thank you!

3
  • It booted, unlocked without a code, but displayed the "Phone is starting up..." message it usually shows for a few seconds when decrypting - forever.
    – aequabit
    Sep 15 at 3:27
  • Does this answer your question? How exactly does FBE's key derivation work?
    – alecxs
    Sep 16 at 5:04
  • OnePlus 5T is running FBE file-based encryption, below answer does not apply
    – alecxs
    Sep 16 at 5:16
1

There is no way to decrypt userdata partition offline. Android encryption is hardware-backed with RSA-2048 masterkey in TEE that is burned to chip. Furthermore encryption is bonded to

VENDOR_PATCH_LEVEL
BOOT_PATCH_LEVEL
OS_PATCH_LEVEL
OS_VERSION

and
bootloader state
to ensure rollback protection and tamper protection.

If your bootloader is already unlocked, crypto-footer is present in EFS/metadata and userdata is encrypted with "default_password" it is possible to decrypt from custom recovery TWRP without locksettings.db at all (except Samsung)

1
  • That is interesting information I didn't see before. I will try reproducing the exact same environment (firmware, ROM etc.) and see if I'm successful in decrypting the partition without locksettings.db. I'm using a OnePlus 5T, so maybe there was another issue last time I tried.
    – aequabit
    Sep 16 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.