MRW file from Andro...
 
Notifications
Clear all

MRW file from Android SD card  

  RSS
Agent47
(@agent47)
Junior Member

Hello,

am I new at digital forensics. I took SD card from Android phone. And I use R-STUDIO tool for image and data recovery.

Results from data recovery is one file size 16,8GB in mrw file format.

Are by any chance in this file any important data? And how can I open this file?

Quote
Posted : 19/10/2019 1:30 pm
arcaine2
(@arcaine2)
Active Member

Without any more information i would assume that this SD card was encrypted (maybe set as adoptable storage?). You should get much more data out of an SD card from Android based phone than just a single .mrw file.

ReplyQuote
Posted : 19/10/2019 7:43 pm
Agent47
(@agent47)
Junior Member

Yes SD card was set up us adoptable storage. So I can get more data from SD card?

ReplyQuote
Posted : 20/10/2019 12:50 pm
arcaine2
(@arcaine2)
Active Member

No, unless you're able to extract the key used to encrypt that card from the device it was used in.

ReplyQuote
Posted : 20/10/2019 9:04 pm
Agent47
(@agent47)
Junior Member

I have access to the phone and phone is working fine.

So is there any method to extract encrypt key?

ReplyQuote
Posted : 21/10/2019 11:26 am
arcaine2
(@arcaine2)
Active Member

You need to copy the key from /data/misc/vold (root or physical dump required to access this location). Then follow this https://nelenkov.blogspot.com/2015/06/decrypting-android-m-adopted-storage.html

ReplyQuote
Posted : 21/10/2019 8:46 pm
Share: