Mobile Forensics De...
 
Notifications
Clear all

Mobile Forensics Decrypt

6 Posts
4 Users
0 Reactions
1,741 Views
Beleka
(@beleka)
Eminent Member
Joined: 8 years ago
Posts: 29
Topic starter  

Hello, i got an image from a encrypted mobile phone. I investigated about that but only found information about old versions of Android and old mobile phones where you can get the encryption key from the device image, but i think it's impossible nowadays.

Is there any way to decrypt an image from encrypted mobile phone if i don't know the pin/password? and… is there any way to decrypt the image from encrypted mobile phone if i got the password?

I searched in the forums but didn't find anything about this, i hope you can help me. Thank you everyone for your time and sry for my english.


   
Quote
kastajamah
(@kastajamah)
Estimable Member
Joined: 8 years ago
Posts: 113
 

Is there any way to decrypt an image from encrypted mobile phone if i don't know the pin/password? and… is there any way to decrypt the image from encrypted mobile phone if i got the password?

If you have the phone and have the password/PIN code/swipe pattern you should be able to extract the data off the phone if your forensic software supports the make and model number of the phone.


   
ReplyQuote
passcodeunlock
(@passcodeunlock)
Prominent Member
Joined: 9 years ago
Posts: 792
 

It really depends on the device you got.

In some situations decrypting the user data is possible even without the device, no matter on Android version.


   
ReplyQuote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

It really depends on the device you got.

We have few ways for decrypting the images. But some times, it is possible.


   
ReplyQuote
Beleka
(@beleka)
Eminent Member
Joined: 8 years ago
Posts: 29
Topic starter  

If you have the phone and have the password/PIN code/swipe pattern you should be able to extract the data off the phone if your forensic software supports the make and model number of the phone.

My doubt is when i have no access to the phone. I have the pin/password of the encrypted phone and the phone image. Is there any way to decrypt in that situation? And could you recommend me any software if possible? Thank you for your time.


   
ReplyQuote
passcodeunlock
(@passcodeunlock)
Prominent Member
Joined: 9 years ago
Posts: 792
 

Sometimes it is possible, sometimes it is not, it really depends on the device model.

In some cases you need to extract the decryption keys from the device itself, which are in the Trusted Zone, so if you don't got physical access to the device, you are at a dead-end, unless you know a way to decrypt AES256 in this lifetime )

In other cases it is possible to capture the decryption keys from the device's RAM, which if you don't got physical access to the device, you are at a dead-end again.

Still, in many cases, there are ways to access the encrypted user data partition, but don't expect a software to do it in a few clicks, it is more or less in-lab work.


   
ReplyQuote
Share: