Hello,
am I new at digital forensics. I took SD card from Android phone. And I use R-STUDIO tool for image and data recovery.
Results from data recovery is one file size 16,8GB in mrw file format.
Are by any chance in this file any important data? And how can I open this file?
Without any more information i would assume that this SD card was encrypted (maybe set as adoptable storage?). You should get much more data out of an SD card from Android based phone than just a single .mrw file.
Yes SD card was set up us adoptable storage. So I can get more data from SD card?
No, unless you're able to extract the key used to encrypt that card from the device it was used in.
I have access to the phone and phone is working fine.
So is there any method to extract encrypt key?
You need to copy the key from /data/misc/vold (root or physical dump required to access this location). Then follow this https://