±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 35119
New Yesterday: 3 Visitors: 192

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Encrypted Samsung Galaxy S9

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 

Re: Encrypted Samsung Galaxy S9

Post Posted: Sat Jan 19, 2019 3:52 pm

Happy holiday :-))  

Senior Member

Re: Encrypted Samsung Galaxy S9

Post Posted: Sun Jan 20, 2019 3:14 pm


Data after factory reset can be recovered using NAND protocol - we performed many of such task which fully positive results and recovered many data even when reading over ISP, SD protocol (ChipOff) brings no results at all but we tried this right now on NOT encrypted phones. Yours phones are encrypted out of box......

Performing factory reset on phone which is encrypted complicate a lot this but it's NOT impossible as @Passcode writes. While normal approach of encrypted device will be decrypting those similar need to be done after recovery over NAND but....... there is one trick . This can be done ONLY if we will get full logicial structure so perfectly reconstructed NAND image recovery which is not always possible - in case we will get partial RAW it will be very hard or almost impossible to apply decryption key on fragmented data to decrypt those correctly.
Multi-COM - Bogusław Rzepka

Senior Member

Re: Encrypted Samsung Galaxy S9

Post Posted: Mon Jan 21, 2019 3:01 am

I would like to thank the members who helped me with this. The information you provide is very important to me. This information contributed a lot to our work.  


Re: Encrypted Samsung Galaxy S9

Post Posted: Mon Jan 21, 2019 2:26 pm

@Bolo, of course, but recovering from NAND is lower level and destructive. Still, even after reviving the phone by using a different UFS memory chip and rooting there's no guarantee that you'll be able to recover encryption key that was used before. Or there some new discoveries on that field as well?  

Senior Member

Re: Encrypted Samsung Galaxy S9

Post Posted: Tue Jan 22, 2019 6:17 am

Yes - recovery over NAND is low level memory access which is destructive where you access directlly cells without using controller as a bridge.... there are no guarantee what we will get after this since nobody knows how GB mechanism works/when system send clear command , how often etc.. If Trim CMD was send then there can be no Garbage blocks at all so there are nothing to read or decrypt.... many factors but.... if someone tell me: data is important no metter at what cost then its worth a try Wink As Alexander Great says "There are no impossible things, they are only difficult to do"  

Senior Member

Page 2 of 2
Go to page Previous  1, 2