Conclusion: The files are encrypted with Android’s file-based encryption. The SD card is broken.

The SD card is broken. The internet says it is typical for SD cards to go read-only as a symptom of fail. Trying to rsync or ddrescue the card’s contents using a separate devices led to stalls and read errors.

I might be able to salvage some of the files by using Android’s share functionality but there was nothing important on the card so I won’t bother trying. The card is broken beyond repair and all files are lost.

---

I want to backup my Android SD card so I inserted it to my computer (tried multiple ones by now). I can see the file tree and browse it just fine. But if I try to read a file, it fails because instead of the actual file contents, all I get is some gibberish. Weirdly enough, the file header is partially identical between different files and contains the words “whatever” and “CONSOLE”. When inserted in my phone I can read and use those files just fine. The phone is a Sony Xperia XZ1 Compact.

Here are some example hexdumps of the file headers from some JPG and OPUS files:

00000000  00 00 00 00 00 37 d5 23  d8 c3 44 86 e4 42 f3 73  |.....7.#..D..B.s|
00000010  03 00 00 02 00 00 10 00  00 02 8c 2d 04 09 03 01  |...........-....|
00000020  77 68 61 74 65 76 65 72  60 ed 60 a5 16 dd d0 08  |whatever`.`.....|
00000030  34 0d 25 2b 87 d1 df 18  94 8a f8 cf f0 fd 83 d9  |4.%+............|
00000040  06 5a 4e 48 8c a1 b9 51  98 ed 16 62 08 5f 43 4f  |.ZNH...Q...b._CO|
00000050  4e 53 4f 4c 45 00 00 00  00 60 40 2d b1 41 51 c1  |NSOLE....`@-.AQ.|
00000060  10 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002000  c7 27 3f d6 7e 99 3d 6b  d3 dc 0a a7 c9 28 37 d5  |.'?.~.=k.....(7.|
00002010  59 09 8b 4b 3e 1b 20 54  a8 87 fc 90 fd 31 05 5b  |Y..K>. T.....1.[|
...
0037ffe0  f1 9a 2d fa fd a1 4b 2a  22 dc ce 29 9d 83 3a 5a  |..-...K*"..)..:Z|
0037fff0  dc 97 e0 e9 15 d7 16 55  82 a6 57 6b 7f b0 32 7d  |.......U..Wk..2}|
00380000

00000000  00 00 00 00 00 03 5d 1d  aa ab 3d 85 96 2a 8a 70  |......]...=..*.p|
00000010  03 00 00 02 00 00 10 00  00 02 8c 2d 04 09 03 01  |...........-....|
00000020  77 68 61 74 65 76 65 72  60 90 17 d4 8b ef 31 35  |whatever`.....15|
00000030  22 b9 b3 05 59 37 3b 71  7e e1 4a 6e af a2 07 b2  |"...Y7;q~.Jn....|
00000040  4b 9a bb 7e 6a 46 18 70  29 ed 16 62 08 5f 43 4f  |K..~jF.p)..b._CO|
00000050  4e 53 4f 4c 45 00 00 00  00 60 40 2d b1 41 51 c1  |NSOLE....`@-.AQ.|
00000060  10 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002000  32 23 5d 69 cb 14 d0 75  8a 9c 2e 64 67 26 1a fc  |2#]i...u...dg&..|
00002010  12 77 ad 48 9b f4 9e d4  d5 08 48 33 cb 45 6b 90  |.w.H......H3.Ek.|
...
00037fe0  87 09 0c 80 6c 4b 6a 54  fb c2 70 13 bc 0a c9 ab  |....lKjT..p.....|
00037ff0  89 3b 52 40 f2 cc df f4  d3 65 e1 c4 0d e3 74 ea  |.;R@.....e....t.|
00038000

00000000  00 00 00 00 00 01 78 41  33 26 6e 9c 0f a7 d9 69  |......xA3&n....i|
00000010  03 00 00 02 00 00 10 00  00 02 8c 2d 04 09 03 01  |...........-....|
00000020  77 68 61 74 65 76 65 72  60 2e 2d e8 1b cd 47 11  |whatever`.-...G.|
00000030  7e b6 e7 e2 95 84 85 75  81 42 0f 5c 54 48 3e 4b  |~......u.B.\TH>K|
00000040  c7 3c f6 cf 16 ec 9f 6b  51 ed 16 62 08 5f 43 4f  |.<.....kQ..b._CO|
00000050  4e 53 4f 4c 45 00 00 00  00 60 40 2d b1 41 51 c1  |NSOLE....`@-.AQ.|
00000060  10 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002000  97 9d 44 91 25 8e b4 e0  07 31 31 bc cc c0 44 13  |..D.%....11...D.|
00002010  62 0e 6d c1 49 8d 87 fe  5d c7 ff c0 cc b5 4c 08  |b.m.I...].....L.|
...
00019fe0  ae 2b d1 04 db d2 9c 9e  e7 cd 3a 06 aa 5a 85 5f  |.+........:..Z._|
00019ff0  d3 7a 30 33 f2 3a b1 2f  73 40 50 f7 a9 a6 d7 fa  |.z03.:./s@P.....|
0001a000

fdisk shows the partition as “W95 FAT32 (LBA)“.

What’s going on?

I found some mentions of this issue on the web:

https://old.reddit.com/r/techsupport/comments/f88bd7/files_on_sd_card_taken_out_of_phone_wont_open/ posted “iu>i'Õè Œ- whatever`P‘Ã@C“Žâ=ë q¸ÌÔ9rÊ ¯Ø¶Þ¨Kíb_CONSOLE ]ŽÒ[Ó_” without a solution.

https://www.computerbase.de/forum/threads/videodatei-samsung-a-3-2016-am-pc-abspielen.1737550/ posted “@Âù©õš•Bo   Œ- 
`»Üž¸½\ht1Oc.ä9á²5Ñé’Ž<žŸ9Ûßíb_CONSOLE Øþ«fQ¿É“, also without a solution. The phone involved was a Samsung A3 2016.

https://www.nikon-fotografie.de/community/threads/jpg-dateien-pl%C3%B6tztlich-nicht-mehr-lesbar.281280/ posted “#µ=Äõ¶
EBC   Œ- 
"3DUfw`â￾Lü4OOŸ-›·j.^aÌ?–ôaÚ ”YÜíb_CONSOLE .øŒ¤Èœ«é ‰'ñÏÆísÿä‰â¢THû´/Ò†´<bb·7iìÕ“, also without a solution.

https://superuser.com/questions/975695/reading-encrypted-files-from-android-microsd-card posted three examples, all also having at least the “b._CONSOLE” portion, Samsung Galaxy S3 device. No solution but a user commenting that “This is related to Samsung Knox and these signatures are Samsung specific” which seems unlikely as I am using a Sony device…

^ See the top of the post for my conclusion ^