±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 36205
New Yesterday: 1 Visitors: 220

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

MRW file from Android SD card

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Agent47
Member
 

MRW file from Android SD card

Post Posted: Oct 19, 19 12:30

Hello,

am I new at digital forensics. I took SD card from Android phone. And I use R-STUDIO tool for image and data recovery.

Results from data recovery is one file size: 16,8GB in mrw file format.

Are by any chance in this file any important data? And how can I open this file?  
 
  

arcaine2
Senior Member
 

Re: MRW file from Android SD card

Post Posted: Oct 19, 19 18:43

Without any more information i would assume that this SD card was encrypted (maybe set as adoptable storage?). You should get much more data out of an SD card from Android based phone than just a single .mrw file.  
 
  

Agent47
Member
 

Re: MRW file from Android SD card

Post Posted: Oct 20, 19 11:50

Yes SD card was set up us adoptable storage. So I can get more data from SD card?  
 
  

arcaine2
Senior Member
 

Re: MRW file from Android SD card

Post Posted: Oct 20, 19 20:04

No, unless you're able to extract the key used to encrypt that card from the device it was used in.  
 
  

Agent47
Member
 

Re: MRW file from Android SD card

Post Posted: Oct 21, 19 10:26

I have access to the phone and phone is working fine.

So is there any method to extract encrypt key?  
 
  

arcaine2
Senior Member
 

Re: MRW file from Android SD card

Post Posted: Oct 21, 19 19:46

You need to copy the key from /data/misc/vold (root or physical dump required to access this location). Then follow this: nelenkov.blogspot.com/...orage.html  
 

Page 1 of 1