MRW file from Andro...
 
Notifications
Clear all

MRW file from Android SD card

6 Posts
2 Users
0 Likes
1,286 Views
Agent47
(@agent47)
Posts: 32
Eminent Member
Topic starter
 

Hello,

am I new at digital forensics. I took SD card from Android phone. And I use R-STUDIO tool for image and data recovery.

Results from data recovery is one file size 16,8GB in mrw file format.

Are by any chance in this file any important data? And how can I open this file?

 
Posted : 19/10/2019 12:30 pm
(@arcaine2)
Posts: 235
Estimable Member
 

Without any more information i would assume that this SD card was encrypted (maybe set as adoptable storage?). You should get much more data out of an SD card from Android based phone than just a single .mrw file.

 
Posted : 19/10/2019 6:43 pm
Agent47
(@agent47)
Posts: 32
Eminent Member
Topic starter
 

Yes SD card was set up us adoptable storage. So I can get more data from SD card?

 
Posted : 20/10/2019 11:50 am
(@arcaine2)
Posts: 235
Estimable Member
 

No, unless you're able to extract the key used to encrypt that card from the device it was used in.

 
Posted : 20/10/2019 8:04 pm
Agent47
(@agent47)
Posts: 32
Eminent Member
Topic starter
 

I have access to the phone and phone is working fine.

So is there any method to extract encrypt key?

 
Posted : 21/10/2019 10:26 am
(@arcaine2)
Posts: 235
Estimable Member
 

You need to copy the key from /data/misc/vold (root or physical dump required to access this location). Then follow this https://nelenkov.blogspot.com/2015/06/decrypting-android-m-adopted-storage.html

 
Posted : 21/10/2019 7:46 pm
Share: