Restoring deleted videos

einarkuusk

It depends on the app that you deleted the video with. Check the app for a trash folder of some sort. If it was with the Files app, then I am pretty sure there's no way to recover the file.

other8026 Files are overwritten with random data when deleted?

Unless the user profile was deleted or the whole phone was factory reset, there is a chance to restore your video. Stop using the phone and take it to a forensics shop. It's gonna cost but should be recoverable.

DeletedUser115 Unless the user profile was deleted or the whole phone was factory reset, there is a chance to restore your video.

Here is the basis for my concern (I added the emphasis):

File data is encrypted with AES-256-XTS and file names with AES-256-CTS. A unique key is derived using HKDF-SHA512 for each regular file, directory and symbolic link from the per-profile encryption keys, or the global encryption key for non-sensitive data stored outside of profiles. [source]

But a forensics expert's opinion would be useful.

de0u I am not a forensics expert by any means but the per-file key should be derived from something (secrets stored in Titan M2 per-profile and unlocked with your passcode).

I asked Daniel that question before and he confirmed unless profile is deleted or phone is factory reset, deleted files could be recovered.

DeletedUser115 I am not a forensics expert by any means but the per-file key should be derived from something (secrets stored in Titan M2 per-profile and unlocked with your passcode).

OK, I can imagine it might be reproducible, e.g., include the inode # or equivalent.

DeletedUser115 I asked Daniel that question before and he confirmed unless profile is deleted or phone is factory reset, deleted files could be recovered.

I still feel as if a step is missing. Let's say I wanted to extract the clear-text contents of all files from my phone, and am willing to unlock it. Without root, how do I get the raw (encrypted) contents of the file system, and how do I get the secure element to derive the filesystem keys from my passcode?

de0u I still feel as if a step is missing. Let's say I wanted to extract the clear-text contents of all files from my phone, and am willing to unlock it. Without root, how do I get the raw (encrypted) contents of the file system, and how do I get the secure element to derive the filesystem keys from my passcode?

Rather than getting encrypted content and then trying to decrypt it yourself, it's probably easier to just let the OS do it for you. For example by using your phone as normal you can already see all your files unencrypted.

The original question about a deleted file is trickier, I can think of a few ways forensics could use to "undelete" the file:

• adb
• installing a userspace app and giving it elevated permissions
• rooting the phone
• using a known exploit
• accessing physical flash storage (obviously very hard and expensive, not practical for the original use case)