Unable to recover partition/data on half-decrypted SD card

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
spano
Posts: 3
Joined: 29 Nov 2014, 01:44

Unable to recover partition/data on half-decrypted SD card

#1 Post by spano »

Hello all,

First time poster here and I am not sure if this is the right location for this post but it should at least partially apply. Let me begin by telling my story.

So I just bought a new blackberry passport and wanted to put the previous media (sd) card from my blackberry z10 into it. The media card on the z10 was encrypted by the device. In order for me to be able to put the card in my passport I needed to decrypt the card and then re-encrypt it on the new device. So, I began the process. Unfortunately about half way through the decryption process it failed. I was not sure what had happened so I tried to put the card into my passport to see if I could view the files. This was a mistake. The passport, for one reason or another didn't properly read the card and decided to write its own top level default directory structure in a new partition (at least it seems this way). So now, not only were half of my files still encrypted but also the partition has been damaged. I knew the data (for the most part) is still around as I can see that in windows it reports ~7GB of
space being used on the card.

To shine a little light on my story, I was able to use this great tool, photorec, to scan the entire drive and recover the files which the device managed to decrypt. Unfortunately most of these were music and the photos were mostly ones I already have a back up for.

I have been trying to use TestDisk to try and recover the original partition so that I can somehow put the media card back into my z10 device and continue the decryption process (if it actually can continue). I do know the keys should still be on the device and decryption should technically be possible. Although I am not so sure of the latter as I do not know the encryption scheme used.

When doing a deep scan analysis I notice that TestDisk will find two partitions (shown below). Unfortunately when I try to list the files on the second partition the message No file found, filesystem may be damaged appears. This is where I am stuck. Is there a way to repair this file system to remove the added directories of the passport and attempt to get the original files listing again? Note: I say original files listing because the device does not encrypt the file system but rather the content of each file. As a result, you can view the directory/file structure but when you open any of the files the content is not 'viewable' as it is encrypted.

Any help would be greatly appreciated. Thanks.
after deep analysis
after deep analysis
td1.png (23.97 KiB) Viewed 1759 times
trying to list the files in the 7GB partition
trying to list the files in the 7GB partition
td2.png (17.77 KiB) Viewed 1759 times

spano
Posts: 3
Joined: 29 Nov 2014, 01:44

Re: Unable to recover partition/data on half-decrypted SD ca

#2 Post by spano »

I see that a lot of people have read this post. Thank you for that. It looks like no one has posted anything though. Is this because my situation looks hopeless?

Is there any other sorts of analysis that I can do to determine more info about my case?

Once again any and all advice is very much appreciated.

Locked