1

I did format the userdata partition while installing a new ROM accidentally. But after formating and installing a new ROM, I did backup full userdata partition within TWRP with dd method for data recovery purpose. I tried testdik, photorec and other data recovery tools. They all found something but not useful/meaningfull because, all directories/filenames are weird, I mean in UTF8 format (although there are some meaningfull files but not I'm interested in :( ). My phone is OnePuls 6T running Android 10 on it and I know FDE and FBE concepts. But while backing up my userdata even it is encrypted, TWRP works well and decrypt partition before work with my password.

So, why some files are in well situaition and others not. If there is encryption issues shouldn't be the same for all files.

Is there any comment? Thanks.

4341474F
  • 11
  • 1
  • for FBE some files aren't encrypted that files can be recovered in theory. but i doubt you did format userdata, it is not possible to recover files from formatted previously encrypted partition. TWRP wipe option does not format it just deletes files with rm https://android.stackexchange.com/q/213275 – alecxs May 06 '20 at 10:09
  • 1
    @alecxs with FBE too, just like FDE, all files are encrypted (though FBE allows adding an exclusion list to AOSP code). The main difference is that some files are Credential Encrypted (CE; decrypted using user credentials) while others are Device Encrypted (DE; decrypted using only hardware-backed credentials). So the DE files are auto-decrypted on boot (that's how Direct Boot aware apps work). But if one performs a factory reset, DE files too won't be decryptable because keystore state is reset on factory reset. Just to clarify. – Irfan Latif May 06 '20 at 11:09
  • I thought that I'm not facing encryption issue when I decrypt it with TWRP and took a clean backup. Then there is no need to deal with it. – 4341474F May 06 '20 at 11:17
  • 1
    @IrfanLatif with "some files" i tought about /data/unencrypted folder (which is magisk testing for getting encryption state) or /data/misc /data/system (where keystore and credentials are stored) - i never used FBE and didn't know that, thx for clarifying – alecxs May 06 '20 at 11:24

0 Answers0