±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 0 Visitors: 112

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

cant mount userdata from TWRP

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

qassam22222
Senior Member
 

cant mount userdata from TWRP

Post Posted: Oct 14, 18 15:39

hey all ...
i got a new phone locked with passwords ...
phone model is : SM-g532f ... i upload twrp but i cant mount the userdata Sad how i can solve this issue and why this happens ....

photos :


 
 
  

passcodeunlock
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 14, 18 17:08

You can't mount it because the userdata partition is encrypted.

Solving the issue is by creating a decrypted physical acquisition Smile
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

qassam22222
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 14, 18 18:30

- passcodeunlock
You can't mount it because the userdata partition is encrypted.

Solving the issue is by creating a decrypted physical acquisition Smile

What this mean !! If i create a full dump by dd can i tead the userdata !! Or i should make a dump for userdata only
Need more details please
Thanks u  
 
  

Thomass30
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 14, 18 20:26

in either way you get encrypted dump Rolling Eyes  
 
  

UnallocatedClusters
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 14, 18 23:58

QAssam

In order to acquire a physical image, the phone must be rooted. Basically rooting means changing all of the locks on the file cabinet that phones are. Once you root a phone and change all of the locks, your forensic tool can then open and extract the formerly locked (encrypted) drawer.

However, the partition in your photo might not be encrypted but rather the tool you are using to view that partition is not configured correctly to display files and folders. For example, trying to look at Mac APFS folders and files on a Windows computer will not work; not because the APFS volume is encrypted but because Windows only understands FAT/exFAT/NTFS.

Also after using fdisk to determine the drive geometry, you should be able to mount the image of your phone using testdisk. If you enter in the correct drive geometry CHS, TestDisk will allow you to “export folders and files” from the user data partition.

Could be encrypted as well in which case you need to “change the locks” on the file cabinet and then extract folders and files from the newly unlocked file cabinet drawer.  
 
  

qassam22222
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 15, 18 06:46

i think its encrypted !! can u explain in more about this step ?

- UnallocatedClusters
QAssam

Could be encrypted as well in which case you need to “change the locks” on the file cabinet and then extract folders and files from the newly unlocked file cabinet drawer.


photos :



in part number 1 : fdisk shows nothing
in part number 2 : i cant read any clear text by hexeditor
in part number 3 : i cant find anything by testdisk

Shocked Shocked Shocked Shocked  
 
  

passcodeunlock
Senior Member
 

Re: cant mount userdata from TWRP

Post Posted: Oct 15, 18 13:31

I gave the answer about the situation regarding encryption and what has to be done to have a decrypted dump, I don't get what else are you asking for ?!

If you don't got the right tools or the knowledge needed for this task to be done right, that's something else.

If it is really important, we can do it in-lab for 3999 EUR if needed.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 2
Page 1, 2  Next