How to make an EFS backup on Samsung Galaxy S3 using the one-click method. Recovering EFS encrypted files and folders Recovering efs

EFS on Qualcomm devices, backup, recovery

You can share your experience or ask a question at.
This instruction is devoted to how to use the program " QFIL"make a backup" EFS"on PC, as well as the process of restoring a backup copy" EFS" to device: " Lenovo based on Qualcomm".

Preparation

• Follow the instructions: .
• Open the folder of the installed software package" QPST", and run " QFIL.exe".

• Make sure that the program has detected the device in the mode: " Lenovo HS-USB Diagnostics".

• In the top menu of the program " QFIL" choose " Tools" -> "QCN Backup Restore".

Creating an EFS Backup

Backup QCN" and wait for the backup process to complete. By default, the backup is (file 00000000.qcn) will be saved in the folder " C:\temp\", it is better not to change the save location and name of the backup copy. If the device is dual-SIM, then check the "Enable Multi-SIM" option. Backup " EFS"It is advisable to copy it to a couple of safe places.

Log of a successfully created backup:

Process Index:0 Start Download QCN COM Port number:7 Checking if phone is connected... IsPhoneConnected: Passed. Phone is connected Sent SPC code to the phone successfully Downloading QCN file: C:\temp\00000000.qcn Done downloading the qcn file: C:\temp\00000000.qcn Finish Backup QCN

Restoring EFS from a backup

In the window that opens, click on the button " Browse", specify the path to the file " 00000000.qcn" and press " Open". If the device is dual-SIM, then check the "Enable Multi-SIM" option.
Click on the " Restore QCN" and wait for the recovery process to complete.

Log of a successfully restored backup

Process Index:0 Start Restore QCN COM Port number:7 Uploading QCN file: C:\temp\00000000.qcn Checking if phone is connected... Done uploading the QCN file: C:\temp\00000000.qcn Finish Restore QCN

IMEI sometimes “flies” when flashing the gadget, after which the latter stops working correctly, losing the ability to make calls and go online. Note that some Chinese devices can operate without an identification number, but such devices are in the minority. Therefore, we will tell you how to restore IMEI on Android, as well as how to change it if necessary.

To make sure that it is the lost identifier that is causing problems with the gadget, enter the characters *#06# in the dialing field. If the code of your device does not appear on the display after this, then the problem has been identified correctly - you need to restore the IMEI. Keep in mind that a phone with two SIM cards must also have two IDs.

Let's describe how to restore IMEI on Android after flashing the firmware using Samsung as an example:

1. Remove the SIM card from the device.
2. , for which in the field for entering the number, write the combination *#*#4636#*# or *#*#8255#*# if the first code is incorrect.
3. Open the “CDS Information” section, then “Radio Information” and go to the “Phone 1” subsection.
4. In the top line where it says “AT+”, enter the command EGMR=1.7. Next, in quotation marks, we write the fifteen-digit code corresponding to your IMEI.

Please note that the codes for entering the engineering menu differ on different devices. For Samsung they are already given above. Therefore, before changing IMEI, check this information. For other gadgets they may be as follows:

• *#*#2846579#*# - for Huawei gadgets;
• *#*#3646633#*# - for Alcatel, Philips and Fly devices;
• *#*#8255#*#, *#*#3424#*# - for HTC;
• *#*#7378423#*# - for Sony.

You can restore the ID not only manually, but also using various utilities that allow you to enter the engineering menu without entering a code. For this, for example, the MTK Engineering Mode program, available even on Google Play, can be used. True, it only works with MediaTek processors.

Let us immediately note that changing the device identifier is not legal, since it will be very difficult to find a lost or stolen gadget using IMEI. Let's describe how the Android IMEI is changed if, for example, you find someone else's device:

After this, all you have to do is dial *#06# to make sure that the identifier has really changed. If you want to return your old imei and don’t know how to find the fifteen-digit code, then if you have the device itself, it’s very easy to do. The codes are located on the box and in the gadget itself on a sticker under the battery.

Mobile Uncle is another small utility that can be used to change IMEI if you have Root rights. It is available on Google Play and has a long name there “Launch the MTK engineering menu”.

From the name it is clear that the application works correctly only with MTK processors. We will describe how to restore IMEI on Android using this utility if the installer did not enter the code correctly:

Note that these methods describe how to restore IMEI on Android after flashing, that is, if it was lost after unsuccessful user actions. It is required to register a new one only in cases of an attempt to conceal illegal actions with the gadget. Moreover, there is a very high probability that if you change the “native” identifier to a changed one, the smartphone will turn into “ ”, losing the ability to access the Internet, make calls, send messages, etc.

But even if you cannot find out the IMEI, for example, in the event of a gadget theft, it is easy to obtain it in your Google account to transfer information to law enforcement agencies. This method works if the device is connected to a Google account. All smartphone data is automatically saved on the server, and to get it, you need to go to the Google account settings section in the “Personal Account” subsection or immediately follow the link

When working with Windows XP/Vista/7 operating systems and recovering passwords for mail and Internet sites. The next task that often occurs when investigating incidents is recovering passwords for archives, email clients, and EFS (Encrypting File System). This will be discussed in this article.

EFS Key Recovery

In fact, the best thing to do in this situation is to recover the user's password. Then decrypting EFS will be much easier, we will return to this later. However, you need to understand that even if you do not have a password, you can still try to decrypt the corresponding files and folders. This is what Advanced EFS Data Recovery software is designed for.

In this software, for the convenience of the user, a corresponding Advanced EFS Data Recovery wizard has been created, with which you can go through the entire decryption process step by step. Or you can use "Expert Mode" to perform the actions yourself.

In my opinion, if a person using Advanced EFS Data Recovery does not feel confident, it is much more convenient to use the Advanced EFS Data Recovery Wizard. Let's look at this mode in more detail.

At the first stage of the Advanced EFS Data Recovery wizard, the system will request a personal certificate used for EFS.

Let's assume you have such a certificate (this is an extremely rare situation, because for some reason users either neglect to export certificates or simply forget where they exported it). In this case, everything is quite simple. You are required to select the certificate file and enter the certificate password. Next, a search is made for all folders and files encrypted with its help on local partitions. You receive a list of files encrypted with this certificate that you can decrypt. Naturally, if you examine your computer, you will have to decrypt it onto another hard drive or external storage device so as not to damage anything.

But what if you don't have a certificate? In this case, the Advanced EFS Data Recovery wizard will prompt you to search for it on your hard drive. Please note that you can search for a certificate not only among existing files, but also among deleted ones. But to do this, you need to enable the "Scan sector by sector" checkbox. It is recommended to enable this mode when rescanning if you did not find the required certificates on the first pass.

Next, it will take you some time to find the keys. As a result of the search, a wizard window will be displayed. If the keys are not found, you must enter the username (EFS owner) and his password or, as a last resort, a HEX code. How to obtain a user password was described in the previous article.

If you know the user's password, you enter the appropriate account name and password and click Next. Next, the found folders and files encrypted using EFS are decrypted. As you can see, even if you reinstalled the operating system, this does not mean that you have lost the data encrypted with EFS.

Don't forget that if you know the name and password of the account under which encryption was carried out, the decryption process will take much less time. Otherwise, you can try to decrypt using expert mode. Although it must be admitted that the probability of a positive result in this case is noticeably lower. You will be prompted to add a password from the dictionary. Naturally, it is assumed that you have the dictionary files.

I would like to note the following. As we can see, today there are quite powerful tools for recovering (cracking) passwords. Therefore, to ensure their durability we have three options:

1. Further increase in length and complexity (in my opinion, the path is a dead end, because sooner or later users begin to get confused, forget passwords, use the same one for all occasions, etc.).
2. Use of biometric authentication tools.
3. Use of multi-factor authentication and certificates. This path, again, in my opinion, is much more promising, but it is worth considering that the proposed solutions, of course, cost money, and sometimes quite a lot.

The choice, of course, is yours.

Vladimir BEZMALY

A smartphone without connection to an operator, what could be worse? Without communication, we just get a player with the function of playing music, video and other little things. Communication is the soul of a smartphone; that’s what it was created for. There may be several reasons for the lack of communication with the operator: problems on the part of the operator, the SIM card needs to be replaced, a hardware defect in the smartphone, etc.

But there is another reason when the phone does not connect to the network - your phone does not have an IMEI (International Mobile Equipment Identity). IMEI and cellular communications are closely intertwined and therefore the vast majority of phones from major manufacturers have IMEI. There are Chinese phones with two/three/ten SIM cards that somehow work without IMEI, but if you have a smartphone from a large manufacturer, it will not register on the network without the correct IMEI.

In simple terms, losing IMEI is your smartphone's worst nightmare. And as practice shows, this happens with Samsung phones much more often than with other manufacturers. In fact, the IMEI of Galaxy series smartphones is stored in a separate section - EFS in the root of the flash memory. Sometimes, for a variety of reasons, this partition is erased or the data in it is damaged. As a result, your phone does not have an IMEI and cannot register on the network.

Reasons for missing IMEI:

1. Firmware update via OTA or other method
2. Installing official firmware (yes, official)
3. Installing third-party firmware

These are the three most common reasons for missing IMEI or damaged EFS partition on Samsung Galaxy series smartphones. Many custom firmwares already include a script for backing up the EFS partition to external media during firmware installation. But this is all good only if you have root access. What if he is not there?

Saving IMEI on Samsung Galaxy series phones

1. You must have access to phoneutil menu. The default is *#7284# . If this code does not fit, then you need to find the appropriate one for your model. All necessary drivers for the phone must also be installed.
2. Download NV-Items_Reader_Writer_Tool.zip - 2.43 MB
3. Enable USB debugging on your phone.
4. We are recruiting *#7284# .
5. Let's go to Qualcomm USB Settings and choose RMNET + DM + MODEM.
6. Now we connect the phone to the computer, run NV-items_reader_writer.exe as administrator.
7. Save the block Range (Dec) 550-550. The block must be preserved 00550 . This will be yours IMEI.
8. We are recruiting *#7284# . Let's go to Qualcomm USB Settings and choose MTP+ADB.
9. Ready:)

Repairing IMEI on Samsung Galaxy series phones

1. Find IMEI your phone, for example by battery.
2. Create a backup block with IMEI according to the instructions above, even if it is damaged. And open it with the editor NotePad++.
3. Divide your name into blocks of two numbers, leaving the first number separately. For example 35516705558781901 divide by 3 55 16 70 55 58 78 19 01
4. Adding Latin A after the first digit, and swap all the rest. Add 08 to the begining IMEI. We get the following 08 3A 55 61 07 55 85 87 91 10
5. Now in a text editor NotePad++(we already opened this file earlier) replace the first nine blocks with our correct one IMEI, which we received in the last step.
6. Let's write it down IMEI back to phone button Write V NV-items_reader_writer.
7. Reboot the phone.

If you sew very often or are sewing your Android smartphone or tablet from Samsung for the first time, then you need to take care of the safety of the IMEI. In the article How to save and restore IMEI on Samsung you will learn how to do this in 2 ways.

Method No. 1 Save and restore IMEI

1. Install the free Android Terminal Emulator application on your Android Device

2. Go to this application and type the commands:

su dd if=dev/block/xxxxxx of=sdcard/efs.img

In order to repair IMEI:

su dd if=/sdcard/efs.img of=/dev/block/xxxxxxx

Where xxxxxxx this is the name of the EFS block.

How to find out the EFS block name

Go to the Android Terminal Emulator application and type the command:

mount

then find the section and its name (in my case the name mmcblk0p1)

su dd if=dev/block/mmcblk0p1 of=sdcard/efs.img su dd if=/sdcard/efs.img of=/dev/block/mmcblk0p1

Method No. 2 Save and restore IMEI

That’s all for the detailed article on backup and restoration of efs android, don’t lose your IMEI!