Is there a way to r...
 
Notifications
Clear all

Is there a way to root Samsung Galaxy S8+(SM-G955F) ?  

Page 1 / 2
  RSS
Thomass30
(@thomass30)
Active Member

Hello Experts…
I have Samsung Galaxy S8+ (SM-G955F) and I have to recover deleted movie files and other data.
In order to recover i have to root this phone but unfortunately i can't find any useful link how to do it (even on xda developers site).

Is there any possible way to root that phone without losing existing data ? ?

Thanks for any replies.

Quote
Posted : 26/01/2018 11:23 pm
Bolo
 Bolo
(@bolo)
Member

You will not recover deleted photos/media even if you will root or get physical dump from this phone…..

ReplyQuote
Posted : 27/01/2018 9:02 am
Thomass30
(@thomass30)
Active Member

Bolo thanks for reply .. but could you explain why not ?

Ive got several phones to examine. I rooted every single one of them which was necessary to recover data.

I've got samsung galaxy s6 edge Android 7.0 and there was no problem with rooting it and recover data.

The phone I'm talking about here - S8+ (SM-G955F) has also Android 7.0.

I know this is quite new phone (2017) but what is the problem ? Please could you tell me why I cant recover data from it, even if I somehow rooted it ?

Its very important to me..

Thanks..

ReplyQuote
Posted : 27/01/2018 9:57 am
Bolo
 Bolo
(@bolo)
Member

Im talking about media as photos and videos… not databases/files. Reason phone is encrypted by default

P.S
Few words about rooting which are mainly used I don't like and don't use Rooting since is not a way of recover deleted data in my point of view. If you are working on phone where you need to recover deleted data rooting will/will not replace some of deleted information. Depends where overwritten file for getting SU will be stored in NAND… from physical point of view in block of memory and their logical block numbers connection there are no difference if rooting affect only system partition or data because it's still changes data in NAND cells……

ReplyQuote
Posted : 27/01/2018 10:33 am
Thomass30
(@thomass30)
Active Member

Ok thanks .. so encrypted are only media? not databases/files ?

And about that encryption by default …this depends on android version or device model ?
For example in Galaxy S6 the media wasn't encrypted ?

You are surely right - rooting can overwrite some data .. but what method instead do you suggest to recover data?

ReplyQuote
Posted : 27/01/2018 1:10 pm
Thomass30
(@thomass30)
Active Member

one more thing … on galaxy s8+ isnt encryption only enable when the phone is locked py password ?

When i unlock the phone by typing the PIN I automatically decrypt the data, am i right ?

The phone i'm talking aboout isnt protected by any password. I have full access to that phone so it means it isnt encrypted ?

ReplyQuote
Posted : 27/01/2018 4:50 pm
Mreza
(@mreza)
Member

Is there any possible way to root that phone without losing existing data ? ?

Thanks for any replies.

For rooting, try to find SM-G955F ENG ROOT file. Root without tripping knox, but no guarantee of success.

Example with Samsung Galaxy S7

https://www.youtube.com/watch?v=2KsCBQ-aOjM

ReplyQuote
Posted : 27/01/2018 6:48 pm
arcaine2
(@arcaine2)
Active Member

one more thing … on galaxy s8+ isnt encryption only enable when the phone is locked py password ?

When i unlock the phone by typing the PIN I automatically decrypt the data, am i right ?

The phone i'm talking aboout isnt protected by any password. I have full access to that phone so it means it isnt encrypted ?

No. Most modern phones are encrypted by default and they don't need any kind of password to be set. It was introduced with Android 6 and every phone that was released with 6 (released, not updated to) should be encrypted. S6 wasn't, S7 already is etc.

ReplyQuote
Posted : 27/01/2018 7:01 pm
Thomass30
(@thomass30)
Active Member

… I really dont understand this right now 😯 (

By encryption I mean that my phone has protected / unreadable data and I need to somehow decrypt it - by typing the password (pin, pattern, etc).

Typing the correct password should decrypt data.

In my situation when the phone isnt protected by any password… what does it mean it is encrypted by default ? Right now anybody could take the phone, boot it because it has no password ang get access to all data (photos, movies, sms, etc).

ReplyQuote
Posted : 27/01/2018 9:10 pm
arcaine2
(@arcaine2)
Active Member

In my situation when the phone isnt protected by any password… what does it mean it is encrypted by default ? Right now anybody could take the phone, boot it because it has no password ang get access to all data (photos, movies, sms, etc).

Yes, but data is still encrypted and if you make physical dump you'll only see encrypted userdata partition and your data will be unreadable. Same goes for data recovery for anything other, than logical analysis done directly on the device. Currently, if you enter setttings, then security and look for encrypt device option you should see that it's already encrypted. Setting a password will re-encrypt those data with your new password.

By default, the decryption key is stored in the hardware-backed storage using Trusted Execution Environment’s (TEE) signing capability (such as in a TrustZone). The data partition is decrypted with that key automatically once the device reboots. While this may sound lame (what’s the purpose of encryption anyway if the data can be decrypted without user interaction?), bear in mind that extracting the decryption key via chip-off or any other low-level method is not possible, so if you do a chip-off you won’t get the decryption key and won’t be able to decrypt the data.

Read more here https://blog.elcomsoft.com/2017/05/android-encryption-demystified/

ReplyQuote
Posted : 28/01/2018 10:46 am
Thomass30
(@thomass30)
Active Member

Thanks Arcaine2 this is very usefull what you said and that link you shared.

so well..these are hard times.. more and more devices are running Android 6+ from factory..

What is the solution for forensics examiners when they have device like that ? (encrypted)
They cant take physical image and recover data. What they can do about that ? only logical extraction ?

Is it possible to root encrypted device without losing existing data ?

And in my case .. i see there isnt much I can do to recover deleted media.
Any good software that I can run to recover deleted media, sms and calls on unrooted galaxy s8+?

ReplyQuote
Posted : 28/01/2018 4:07 pm
Thomass30
(@thomass30)
Active Member

I don''t know if I understand this correctly… ?

It is written in article " The data partition is decrypted with that key automatically once the device reboots. "

So if encrypted device like mine is running and would be rooted (somehow P ) , I can use for example MobilEdit Forensic Express to create phsyical image on running phone and all the data would be readable, Yes ? or am I completely missing something idea

ReplyQuote
Posted : 29/01/2018 7:43 am
droopy
(@droopy)
Active Member

Try magisk works on almost all android devices )

ReplyQuote
Posted : 29/01/2018 12:58 pm
mcman
(@mcman)
Active Member

So if encrypted device like mine is running and would be rooted (somehow P ) , I can use for example MobilEdit Forensic Express to create phsyical image on running phone and all the data would be readable, Yes ? or am I completely missing something idea

I think your biggest confusion is just terminology. A lot of people think physical/logical just like the terms that are used for computer HDD forensics and it's not exactly the same. A physical image from tools don't always mean every sector like a computer HDD. They may get the entire file system but call it physical, technically that's just a logical image. If your tool gets a true physical of all the blocks (mmcblk0), it could still be encrypted like others have said.

Booting the phone and doing a software root could get you the entire file system and a lot of good data since it will be live and decrypted but it's not the same as doing a recovery/bootloader method and accessing the data at the block level which would be a true physical acquisition bypassing the OS completely.

It doesn't matter which tool you use, just make sure you're consistent with your terminology. I actually like Cellebrite's definition on logical/file system/physical as it accurately describes the type of data you get with each and how it is accessed
http//smarterforensics.com/wp-content/uploads/2014/06/Explaining-Cellebrite-UFED-Data-Extraction-Processes-final.pdf

ReplyQuote
Posted : 29/01/2018 2:22 pm
Thomass30
(@thomass30)
Active Member

OK thanks for all your replies.. it really explain few things to me about encryption..

So.. right now my only option is logical extraction ? (from S8+ G955F) ?

Did any of you had the similar situation to examine Galaxy S8 ?

ReplyQuote
Posted : 30/01/2018 9:40 am
Page 1 / 2
Share: