Conclusion: The files are encrypted with Android’s file-based encryption. The SD card is broken.
The SD card is broken. The internet says it is typical for SD cards to go read-only as a symptom of fail. Trying to rsync
or ddrescue
the card’s contents using a separate devices led to stalls and read errors.
I might be able to salvage some of the files by using Android’s share functionality but there was nothing important on the card so I won’t bother trying. The card is broken beyond repair and all files are lost.
I want to backup my Android SD card so I inserted it to my computer (tried multiple ones by now). I can see the file tree and browse it just fine. But if I try to read a file, it fails because instead of the actual file contents, all I get is some gibberish. Weirdly enough, the file header is partially identical between different files and contains the words “whatever” and “CONSOLE”. When inserted in my phone I can read and use those files just fine. The phone is a Sony Xperia XZ1 Compact.
Here are some example hexdumps of the file headers from some JPG and OPUS files:
00000000 00 00 00 00 00 37 d5 23 d8 c3 44 86 e4 42 f3 73 |.....7.#..D..B.s|
00000010 03 00 00 02 00 00 10 00 00 02 8c 2d 04 09 03 01 |...........-....|
00000020 77 68 61 74 65 76 65 72 60 ed 60 a5 16 dd d0 08 |whatever`.`.....|
00000030 34 0d 25 2b 87 d1 df 18 94 8a f8 cf f0 fd 83 d9 |4.%+............|
00000040 06 5a 4e 48 8c a1 b9 51 98 ed 16 62 08 5f 43 4f |.ZNH...Q...b._CO|
00000050 4e 53 4f 4c 45 00 00 00 00 60 40 2d b1 41 51 c1 |NSOLE....`@-.AQ.|
00000060 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00002000 c7 27 3f d6 7e 99 3d 6b d3 dc 0a a7 c9 28 37 d5 |.'?.~.=k.....(7.|
00002010 59 09 8b 4b 3e 1b 20 54 a8 87 fc 90 fd 31 05 5b |Y..K>. T.....1.[|
...
0037ffe0 f1 9a 2d fa fd a1 4b 2a 22 dc ce 29 9d 83 3a 5a |..-...K*"..)..:Z|
0037fff0 dc 97 e0 e9 15 d7 16 55 82 a6 57 6b 7f b0 32 7d |.......U..Wk..2}|
00380000
00000000 00 00 00 00 00 03 5d 1d aa ab 3d 85 96 2a 8a 70 |......]...=..*.p|
00000010 03 00 00 02 00 00 10 00 00 02 8c 2d 04 09 03 01 |...........-....|
00000020 77 68 61 74 65 76 65 72 60 90 17 d4 8b ef 31 35 |whatever`.....15|
00000030 22 b9 b3 05 59 37 3b 71 7e e1 4a 6e af a2 07 b2 |"...Y7;q~.Jn....|
00000040 4b 9a bb 7e 6a 46 18 70 29 ed 16 62 08 5f 43 4f |K..~jF.p)..b._CO|
00000050 4e 53 4f 4c 45 00 00 00 00 60 40 2d b1 41 51 c1 |NSOLE....`@-.AQ.|
00000060 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00002000 32 23 5d 69 cb 14 d0 75 8a 9c 2e 64 67 26 1a fc |2#]i...u...dg&..|
00002010 12 77 ad 48 9b f4 9e d4 d5 08 48 33 cb 45 6b 90 |.w.H......H3.Ek.|
...
00037fe0 87 09 0c 80 6c 4b 6a 54 fb c2 70 13 bc 0a c9 ab |....lKjT..p.....|
00037ff0 89 3b 52 40 f2 cc df f4 d3 65 e1 c4 0d e3 74 ea |.;R@.....e....t.|
00038000
00000000 00 00 00 00 00 01 78 41 33 26 6e 9c 0f a7 d9 69 |......xA3&n....i|
00000010 03 00 00 02 00 00 10 00 00 02 8c 2d 04 09 03 01 |...........-....|
00000020 77 68 61 74 65 76 65 72 60 2e 2d e8 1b cd 47 11 |whatever`.-...G.|
00000030 7e b6 e7 e2 95 84 85 75 81 42 0f 5c 54 48 3e 4b |~......u.B.\TH>K|
00000040 c7 3c f6 cf 16 ec 9f 6b 51 ed 16 62 08 5f 43 4f |.<.....kQ..b._CO|
00000050 4e 53 4f 4c 45 00 00 00 00 60 40 2d b1 41 51 c1 |NSOLE....`@-.AQ.|
00000060 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00002000 97 9d 44 91 25 8e b4 e0 07 31 31 bc cc c0 44 13 |..D.%....11...D.|
00002010 62 0e 6d c1 49 8d 87 fe 5d c7 ff c0 cc b5 4c 08 |b.m.I...].....L.|
...
00019fe0 ae 2b d1 04 db d2 9c 9e e7 cd 3a 06 aa 5a 85 5f |.+........:..Z._|
00019ff0 d3 7a 30 33 f2 3a b1 2f 73 40 50 f7 a9 a6 d7 fa |.z03.:./s@P.....|
0001a000
fdisk
shows the partition as “W95 FAT32 (LBA)
“.
What’s going on?
I found some mentions of this issue on the web:
https://old.reddit.com/r/techsupport/comments/f88bd7/files_on_sd_card_taken_out_of_phone_wont_open/ posted “iu>i'Õè Œ- whatever`P‘Ã@C“Žâ=ë q¸ÌÔ9rÊ ¯Ø¶Þ¨Kíb_CONSOLE ]ŽÒ[Ó_
” without a solution.
https://www.computerbase.de/forum/threads/videodatei-samsung-a-3-2016-am-pc-abspielen.1737550/ posted “@Âù©õš•Bo Œ- `»Üž¸½\ht1Oc.ä9á²5Ñé’Ž<žŸ9Ûßíb_CONSOLE Øþ«fQ¿É
“, also without a solution. The phone involved was a Samsung A3 2016.
https://www.nikon-fotografie.de/community/threads/jpg-dateien-pl%C3%B6tztlich-nicht-mehr-lesbar.281280/ posted “#µ=Äõ¶EBC Œ- "3DUfw`âLü4OOŸ-›·j.^aÌ?–ôaÚ ”YÜíb_CONSOLE .øŒ¤Èœ«é ‰'ñÏÆísÿä‰â¢THû´/Ò†´<bb·7iìÕ
“, also without a solution.
https://superuser.com/questions/975695/reading-encrypted-files-from-android-microsd-card posted three examples, all also having at least the “b._CONSOLE
” portion, Samsung Galaxy S3 device. No solution but a user commenting that “This is related to Samsung Knox and these signatures are Samsung specific” which seems unlikely as I am using a Sony device…
^ See the top of the post for my conclusion ^