How to mount encrypted /data partition in recovery mode?

/e/OS Devices Fairphone
, ,
21

Can I somehow copy all of it to my Ubuntu? There I could probably decrypt it.

22

part of the encryption schemes on Android involve a device-key, stored with the TEE (trusted exec environ)ā€¦ so your pin unlocks the device-key, and the device-key (or both together) encrypt data. So if you grab that data, youā€™ll also need to extract the TEE key. Iā€™m sure the forensic toolkit for this exists ā€¦ but itā€™s easier to throw a bit of data away?

go into /mnt/userdata/media (and data) and exec a ā€œdu -cs . | sort -nā€ to see where there is potential? in my experience, videos received via messengers comprise a large portion of smartphone storage.

2 Likes
23

I donā€™t know if the find command is available (canā€™t check presently). If it is, then maybe this helps:

find . -type f -size +10M
2 Likes
24

It worked!!! Thank you both so much! It is possible to see the type of a file. So I could simply delete some videos and /e/OS would boot normally again!

1|FP3:/mnt/userdata/media/0/wIQzCnKK9bp7ZKlZTZC9yB # ls -l                                                                                                                                                
total 340124
drwxrwxr-x 2 media_rw media_rw        4096 2022-11-09 11:38 7ZeokuV,R3Ql3iEToWKOSC
-rw-rw-r-- 1 media_rw media_video 15933812 2020-12-20 17:01 B,wdUX7x,T60iwFvPWDIoQrxTkwgxQYhSilb,A
-rw-rw-r-- 1 media_rw media_video 23049127 2021-04-17 07:57 HHFLEXY4CcLwD,pjhK5HS1P,Gc9hFVakwpAXKA

I think /e/OS should ensure that it can always boot (if thatā€™s possible), no matter how much memory is used. I think user applications should not be able to polute the system so much that /e/OS cannot be booted anymore. Maybe an issue can be opened for this?

3 Likes
25

so I havenā€™t read about code that controls this - but my guess is that your device did have enough storage for the OTA zip and the unpack ā†’ but had insufficient space at first boot when creating the dalvik cache, as this one is with the userdata partition on the FP3.

The update mechanism would need to calculate some extra space for the dalvik-cache before update. Depending on amount of apps installed the size requirements can be different.

The teamwin recovery (twrp) has menu options to clear that directory. Could be implemented with the lineage/e-recovery menu too for users that have locked devices.

Why dalvik cache? after an update all dex classes of apps and system are regenerated. Thatā€™s bytecode optimization for the java apps running in the android jvm (aka dalvik).

Edit: and nice that Android shows the file-group for encrypted files, makes it easier to pick them out. It cannot infer the filetype at that point, but file ownership gives it away interestingly

1 Like
26

Hi everyone, Iā€™m in the same situation as 2t8 but when i try this line:
mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
it says ā€œneed -tā€, and when I do:
mount -t /dev/block/bootdevice/by-name/userdata /mnt/userdata/
it says
mount: ā€˜/mnt/userdata/ā€™ not in fstab
yet, ā€˜/mnt/userdata/ā€™ exists.
Any suggestion? Thanks!

27

if you need for whatever reasons supply -t it needs a filesystem type: itā€™s either ext4 or f2fs:

mkdir -pv /mnt/userdata/
mount -t ext4 /dev/block/bootdevice/by-name/userdata /mnt/userdata/
28

Thank you for the quick reply after all this time!
When I try the ā€˜mountā€™ line with ext4 or f2fs it now says:
mount: ā€˜/dev/block/bootdevice/by-name/userdataā€™ ā†’ ā€˜/mnt/userdata/ā€™: Invalid argument
I forgot to mention that itā€™s a Pixel 5, if that makes a difference

29

redfins common-tree is redbull with that fstab layout, weird it doesnā€™t work. Whatā€™s the output of plain ā€œmountā€ ?

30

it is:
mount: /dev/block/bootdevice/by-name/userdata: need -t

31

plain ā€œmountā€ will output a list of currently mounted paths - if it doesnā€™t, youā€™re somwhere or in some context that I do not expect. What is your full command line inputs and outputs when going about the method described in this thread?

please use triple-backticks if you can for things commandline to avoid autoformatting by the forum software

32 
>adb shell
redfin:/ # ls /dev/block/bootdevice/by-name/userdata
/dev/block/bootdevice/by-name/userdata
redfin:/ # mkdir -p /mnt/userdata
redfin:/ # mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: /dev/block/bootdevice/by-name/userdata: need -t
1|redfin:/ #
1|redfin:/ #
1|redfin:/ # mount -t /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: '/mnt/userdata/' not in fstab
1|redfin:/ # mkdir -pv /mnt/userdata/
redfin:/ # mount -t ext4 /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: '/dev/block/bootdevice/by-name/userdata'->'/mnt/userdata/': Invalid argument
1|redfin:/ # mount -t f2fs /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: '/dev/block/bootdevice/by-name/userdata'->'/mnt/userdata/': Invalid argument
1|redfin:/ #
1|redfin:/ # mount
rootfs on / type rootfs (rw,seclabel,size=3657996k,nr_inodes=914499)
tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,size=3819980k,nr_inodes=954995,mode=755)
devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000)
proc on /proc type proc (rw,relatime,gid=3009,hidepid=2)
sysfs on /sys type sysfs (rw,seclabel,relatime)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=3819980k,nr_inodes=954995,mode=755,gid=1000)
tmpfs on /apex type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755)
tmpfs on /linkerconfig type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755)
tmpfs on /mnt/installer type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=3819980k,nr_inodes=954995,mode=755,gid=1000)
tmpfs on /mnt/androidwritable type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=3819980k,nr_inodes=954995,mode=755,gid=1000)
none on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime)
tmpfs on /tmp type tmpfs (rw,seclabel,relatime)
tmpfs on /storage type tmpfs (rw,seclabel,relatime,mode=050,gid=1028)
binder on /dev/binderfs type binder (rw,relatime,max=1048576,stats=global)
pstore on /sys/fs/pstore type pstore (rw,seclabel,relatime)
none on /config type configfs (rw,relatime)
adb on /dev/usb-ffs/adb type functionfs (rw,relatime)
fastboot on /dev/usb-ffs/fastboot type functionfs (rw,relatime)
/dev/block/sda15 on /metadata type ext4 (rw,seclabel,relatime,discard,nodelalloc,commit=1,data=journal)
redfin:/ #
33

from my fairphone3ā€¦ can you skip by-name and try to mount by mmc partition? (the mmcblk path will differ on your device)

$ ls -l /dev/block/by-name/userdata
/dev/block/by-name/userdata -> /dev/block/mmcblk0p62
$ mount -t auto /dev/block/mmcblk0p62 /mnt/userdata

and if you can - Iā€™d be interested in a

cat /etc/fstab
34

Thank you so much for your patience. Iā€™m sorry I have zero knowledge in this so that makes it complicated.

redfin:/ # cat /etc/fstab
/dev/block/by-name/metadata /metadata ext4 discard,data=journal,commit=1 0 0
/dev/block/bootdevice/by-name/modem_a /vendor/firmware_mnt vfat shortname=lower,uid=0,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0 0 0
/dev/block/bootdevice/by-name/userdata /data f2fs discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,inlinecrypt 0 0
redfin:/ #
redfin:/ # ls -l /dev/block/by-name/userdata
lrwxrwxrwx 1 root root 16 1970-08-20 11:40 /dev/block/by-name/userdata -> /dev/block/sda19
redfin:/ # mount -t auto /dev/block/sda19 /mnt/userdata
mount: /dev/block/sda19: need -t
35

we could be all blind chickensā€¦ you could just do a

mount /data

that should work with that fstab, then navigate to /data/media/0/

36 
redfin:/ # ls /dev/block/bootdevice/by-name/userdata
/dev/block/bootdevice/by-name/userdata
redfin:/ # mkdir -p /mnt/userdata
redfin:/ # mount /data
mount: '/dev/block/bootdevice/by-name/userdata'->'/data': Invalid argument
1|redfin:/ # mount /data/
mount: '/data/' not in fstab
1|redfin:/ #
37

(sorry for prior edit) - not sure whatā€™s going on, the commands I posted work in the FP3 recovery. Iā€™d need to sit in front of the shell myself

38

I understand. Thank you so much already for taking the time to help!

1 Like
39

if the system is bootloader unlocked, you could go with booting into twrp (not flashing) and try their tools - but I guess the reason you ended up in this thread is you havenā€™t your bootloader unlocked?

1 Like
40

Yes exactly. In the end thatā€™s not e/osā€™ fault anyway, which I enjoy a lot, but entirely mine for ignoring the limited space warnings. Thanks so much to you and the great community