EFS on Qualcomm devices, backup, recovery
You can share your experience or ask a question in.
This manual is devoted to how, using the program " QFIL" back up " EFS"on a PC, as well as the process of restoring a backup" EFS"to device: " Lenovo based on Qualcomm".
Training
- Follow instructions: .
- Open the folder of the installed software package " QPST", and run " QFIL.exe".
- Make sure that the program has detected the device in the mode: " Lenovo HS-USB Diagnostics".
- In the top menu of the program QFIL" choose " Tools" -> "QCN Backup Restore".
Create an EFS backup
Backup QCN" and wait for the backup process to finish. By default, a backup (file 00000000.qcn) will be saved in the folder " c:\temp\", it is better not to change the save location and the name of the backup copy. If the device is dual-symbol, then check the "Enable Multi-SIM" option. Backup " EFS"it is advisable to copy to a couple of reliable places.
Successfully created backup log:
Process Index:0 Start Download QCN COM Port number:7 Checking if phone is connected... IsPhoneConnected: Passed. Phone is connected Sent SPC code to the phone successfully Downloading QCN file: C:\temp\00000000.qcn Done downloading the qcn file: C:\temp\00000000.qcn Finish Backup QCN
Restoring EFS from a backup
In the window that opens, click on the button " Browse", specify the path to the file " 00000000.qcn" and press " Open". If the device is dual-sim, then check the "Enable Multi-SIM" option.
Click on the button " Restore QCN and wait for the recovery process to finish.
Successfully restored backup log
Process Index:0 Start Restore QCN COM Port number:7 Uploading QCN file: C:\temp\00000000.qcn Checking if phone is connected... Done uploading the QCN file: C:\temp\00000000.qcn Finish Restore QCN
This article is about recovery
encrypted file system (efs) health, import
keys from the old user profile to
new system for accessing
encrypted information. To start
let's figure out what you can do to start
try a number of existing utilities for
of this work, the work produced in the article
requires certain knowledge and skills.
- Our favorite elcomsoft offers advanced
efs data recovery for 2K/XP for $99
available demo. - Our beloved Microsoft also has in its
arsenal recovery program
reccerts.exe, which can be obtained via
paid support service. - Well, unknown to us Passware offers efskey ,
which is said to be slower
aefsdr, but it costs exactly the same - 95 conditional
raccoons.
Let's get back to our sheep. Default names
efs in XP are colored green. When everything fails
keys are naturally lost, and when you open
file, an empty document is created with
error description. For example:
- notepad: cannot open the c:\documents and settings\foo\my
documents\report.txt - file: make sure a disk is in the drive you specified.
- wordpad: access to c:\docume~1\foo\mydocu~1\report.txt was denied.
The occurrence of such an error is usually
indicates that for all
users who had access to the file,
The wrong encryption key is being used.
There may be several reasons for this -
the most common is reinstallation
systems.
Recommended to everyone before the first
using efs to do the export
public and private keys, and
preferably on another medium (cipher /?) - these
keys are randomly generated upon creation and
when reinstalling the system
naturally do not repeat. Surprisingly, and
maybe on purpose, at the first
using efs no warnings
the valiant Microsoft does not give out and there is a real
the danger is to completely forget about it.
In 2K and XP, data on efs is here:
c:\documents and settings\user\application data\microsoft\crypto\ -
private key
c:\documents and settings\user\application data\microsoft\protect\ -
password entry to the private key
c:\documents and settings\user\application data\microsoft\systemcertificates\ -
public key. In general, not so
important.
Let's say the files are saved and you need them
use. To work with file
the system requires the same account with the same
computer number, which was originally.
You can find this data here:
c:\documents and settings\%username%\application data\microsoft\crypto\rsa\s-1-5-21-1078081533-
1606980848-854245398-1003
Computer number: 1078081533-1606980848-854245398
User number: 1003
In hex respectively: fd374240 f094c85f 16c0ea32 and 3eb.
Go to hklm\sam\sam\domains\account\users\%usernumbers% and
check if there is an account with this number in
system. If there is, then you need to find the name
user and create a profile with
original password. If not, create
before changing hklm\sam\sam\domains\account\f to
offset 48 to the required number, and add
it to the admin group. Next: in
hklm\sam\sam\domains\builtin\aliases\00000220\c change machine SID
to the original. We do the following and
here: hklm\sam\sam\domains\account\v. From hklm\software\microsoft\windows
nt\currentversion\profilelist\ export the key,
describing the car number with a suffix from
user number, change to
original numbers and import back.
Copy folders with keys to c:\documents and
settings\%username%\application data\microsoft\, reboot...
and everything should work.
In the next part, we will consider the situation
where there are no key files.
Today we will talk about an application developed by the guys from XDA. It can be installed on any phone Samsung. Thus creating a backup for a folder EFS will not be difficult, which will enable you to install custom ROM and recovery images on a smartphone without fear for the presence or absence of access to the network. Folder EFS contains important information about your phone, such as the IMEI number. Also, every time you decide to update your android samsung device with a new custom or beta firmware, it can be destroyed, which in turn leads to a loss of network connectivity, and the smartphone becomes useless. For this reason, we strongly recommend that you make a backup EFS along with other important data stored on your device. Backup is always installed without problems, so feel free to do it before any changes to your gadget.
Now, as we have previously noted, to make a backup EFS for anyone Samsung device you will need to download, install and use a special application - EFS Pro. But to use it you need root access(and OS Android). Before proceeding to download, make sure you have root access, if it is missing, then work on getting it. And don't forget that this always voids the warranty. You can return it only by restoring the stock ROM or installing official updates from Samsung. When lost EFS you can follow the same steps to restore.
To carry out this operation, you will need a PC (on Windows XP, Vista, 7), your Samsung device and USB cable. Recall once again that your smartphone must have root access. The computer must be installed Microsoft .NET Framework 4.0, otherwise EFS Pro will not work. After downloading the file, unzip it and install it on your PC. Then connect your device to your computer. Now you can backup EFS using the app EFS Pro. For more details go to THIS link (you can also download EFS Pro app).
That's it, now you know how to do it EFS backup for your Samsung device, but do not forget that there are other ways, and the one indicated in the article is the easiest.
How to restore EFS for any Android Samsung device:
rating 80 out of 80 based on 80 ratings.
There are 80 reviews in total.
When working with operating systems Windows XP / Vista / 7 and recovering passwords for mail and Internet sites. The next task that often has to be dealt with when investigating incidents is the recovery of passwords for archives, mail clients and EFS (Encrypting File System). This will be discussed in this article.
Recovery of EFS keys
In fact, the most correct thing in this situation is to recover the user's password. Then it will be much easier to decrypt EFS, we will return to this later. However, you need to understand that even if you do not have a password, you can still try to decrypt the corresponding files and folders. The Advanced EFS Data Recovery software is designed for this.
In this software, for the convenience of the user, a corresponding Advanced EFS Data Recovery wizard has been created, with which you can walk through the entire decryption process step by step. Or you can use the "Expert Mode" in order to perform the actions yourself.
In my opinion, if a person using Advanced EFS Data Recovery does not feel confident, it is much more convenient to use the Advanced EFS Data Recovery Wizard. Let's consider this mode in more detail.
During the first step of the Advanced EFS Data Recovery wizard, the system will request the personal certificate that was used for EFS.
Suppose you have such a certificate (the situation is extremely rare, because for some reason users either neglect the export of certificates, or simply forget where they exported it to). In this case, everything is quite simple. You are required to select a certificate file and enter the certificate password. Next, a search is made for all folders and files encrypted with it on local partitions. You get a list of files encrypted with this certificate that you can decrypt. Naturally, in the case of examining a computer, you will have to decrypt to another hard drive or external media, so as not to damage anything.
But what if you don't have a certificate? In this case, the Advanced EFS Data Recovery wizard will prompt you to search for it on your hard drive. Note that you can search for a certificate not only among existing files, but also among deleted ones. But for this you need to enable the "Scan by sector" checkbox. It is recommended to enable this mode when rescanning if you did not find the required certificates on the first pass.
Then it will take you some time to search for the keys itself. As a result of the search, the wizard window will be displayed. If the keys are not found, you must enter the username (EFS owner) and password, or in extreme cases the HEX code. How to get the user's password was described in the previous article.
If you know the user's password, you enter the appropriate account name and password and click the "Go" button. Next, the found folders and files encrypted with EFS are decrypted. As you can see, even if you reinstalled the operating system, this does not mean that you have lost data encrypted with EFS.
Do not forget that if you know the name and password of the account under which the encryption was carried out, the decryption process will take much less time. Otherwise, you can try to decrypt using expert mode. Although it must be admitted that the probability of a positive result in this case is much lower. You will be prompted to add a password from the dictionary. Naturally, it is assumed that you have dictionary files.
I would like to note the following. As we can see, today there are quite powerful tools for recovering (cracking) passwords. Therefore, to ensure their durability, we have three ways:
- Further increase in length and complexity (in my opinion, the path is a dead end, because sooner or later users start to get confused, forget passwords, use the same one for all occasions, etc.).
- Use of biometric means of authentication.
- Using multi-factor authentication and certificates. This way, again, in my opinion, is much more promising, but it is worth considering that the proposed solutions, of course, cost money, and sometimes a lot.
The choice, of course, is yours.
Vladimir BEZMALY
The /efs folder contains the smartphone's IMEI, which is part of the system that identifies the phone and the network it connects to. From time to time they are removed due to various wipes and / or installation of custom firmware. If you want the /efs directory not to be deleted, it must be kept as a backup. For Samsung Galaxy S3, it is now very easy to backup the /efs folder using the tool provided by the XDA developer.
EFS Backup/Restore is a very simple tool that can be used from a computer. This is an executable script that extracts data from the EFS phone and saves it on the computer as an image file. If you need it later, you can restore using a similar script. When restoring, make sure that the image file is in the same folder as the other files.
This method works flawlessly. If you use it, you can test various firmware with virtually no risk. If you encounter an error, you will need to install a new version of ADB in advance. This is in case you have not updated the program in advance.
This guide will show you how to backup Galaxy S3 EMEI and /efs folder.
Warning!
These instructions are for use with the Galaxy S3 and its variants only. If you use this manual with other smartphones, it may lead to the most undesirable results.
The information contained in this manual is intended as a reference and for educational purposes only. There is no guarantee that this manual will work with your smartphone and in your particular situation.
You use this manual at your own risk. We are not responsible for anything that may happen to your smartphone as a result of using the information in this manual.
Read and understand the manual before actually following the instructions.
Technical requirements:
- Root your Samsung Galaxy S3 using any method:
1. Method number 1.
2. Method number 2. - Computer with Windows and installed archiver WinRAR, 7-Zip or similar.
- Installed USB drivers. They are usually installed along with the Kies installation.
- Download the EFS Backup/Restore tool for Galaxy S3 to your computer.
- Make sure you charge your Galaxy S3 battery to 70% otherwise you might get a chance to abort the procedure.
- Make a backup copy of all contacts, sms, mms, internet settings, wi-fi passwords, because such data may be lost after the procedure. We recommend syncing with a cloud service or creating a local copy of your mobile data.
Instruction:
- 1. Open the RAR file and extract its contents to a folder.
- 2. On the Galaxy S3, enable "USB debugging" in Settings > Developer Options > USB debugging.
- 3. Connect your smartphone to your computer.
- 4.
On the computer, go to the folder with the unzipped data and double-click to run the BAT script:
- To backup /efs, run Backup_EFS.bat. The script will create a saved backup file in the same folder named efs.img.
- To restore from a /efs backup, run the Restore_EFS.bat script. Check in advance that the efs.img file is also located in the same folder.
Congratulations! You have just backed up Samsung Galaxy S3 EFS data using the backup and restore tool.
Found an error? Select it and press Ctrl+Enter
