By Doruk Karınca


2016-01-31 12:11:31 8 Comments

So I'm on Marshmallow and have formatted my SD card as internal storage. Its filesystem got corrupt two weeks later for some reason.

Plugging it to GParted, I see 16MB of FAT32 and the rest is an unrecognized filesystem. It's not unformatted, just unrecognized.

GParted is giving the "Unable to read the contents of the fileystem." error for both partitions, though the FAT32 partition is accessible from File Browser flawlessly.

It's a Samsung i9505 running on nightly built Cyanogenmod 13.

EDIT: I found out the unrecognized partitions is a static AES-128 bit encrypted ext4. Now I will try to decrypt it and recover whatever.

EDIT2: I changed my mind and won't bother. Formatting as external storage this time.

1 comments

@Doruk Karınca 2016-01-31 21:14:45

Even it does not fully answer the question, here's a guide to decrypt the external storage formatted as internal. You do need to be root on your phone, however.

The gist is that we search for strings including the keyword expand and ending with .key within vold using:

$ strings vold|grep -i expand
--change-name=0:android_expand
%s/expand_%s.key
/mnt/expand/%s

It returns a 16-byte key.

expand_8838e738a18746b6e435bb0d04c15ccd.key

Then you pass the key into this bad boy:

# dmsetup create crypt1 --table "0 `blockdev --getsize /dev/sdb2` crypt \
aes-cbc-essiv:sha256 00010203040506070809010a0b0c0d0e0f 0 /dev/sdb2 0"

And mount that in:

# mount -t ext4 /dev/mapper/crypt1 /mnt/1/
# cd /mnt/1
# find ./ -type d

Now you can cp everything elsewhere and hopefully save some data. Remember to exclude any key-related data (grep) when doing so, in case you want to reformat as ınternal again and put your stuff back in.

@Dzwiedziu-nkg 2016-08-23 16:01:11

You can use hexdump -e '1/1 "%.2x"' expand_8838e738a18746b6e435bb0d04c15ccd.key to convert binary to hex.

@Royi 2017-03-07 10:55:52

Where exactly do you run those command?

@Doruk Karınca 2017-03-09 23:01:17

@Royi You plug your SD card to a Linux computer.

@Mikko Rantalainen 2019-08-03 12:00:00

To be exact, the expanded storage key of named expand_8838e738a18746b6e435bb0d04c15ccd.key (the actual hex number depends on your expanded storage device) needs to be fetched or read from the phone. The file is usually located in directory /data/misc/vold and the directory may contain multiple keys if multiple SD cards have been used. Note that you have to have root access to your phone to see the contents of the key files and extract the required encryption key.

Related Questions

Sponsored Content

1 Answered Questions

Corrupt Internal Storage File System

1 Answered Questions

1 Answered Questions

Sponsored Content