Android Forensics: How To Bypass The Android Phone Pattern Lock

Introduction

Android is an open source operating system based on the Linux kernel, initially developed by Android Inc., which Google bought in 2005. Initially, Android was developed to support touch screen devices like smartphones. These devices support different types of screen locks, like swipe lock, PIN lock, pattern lock, gesture lock, facial lock, etc.

Swipe lock unlocks the screen just by swiping a defined area on the screen with your fingertips. PIN lock is when you enter a correct pin, the screen will be unlocked. Pattern lock unlocks the screen when the user creates a pattern by joining nine circles on the screen, which is already saved on your system. This article is only based on the pattern locking system and does not cover biometric locking systems available on the phones.

Understanding Android Pattern Locks

Figure 1: Android Pattern lock with numbering

Patterns are nothing but the path traced by the fingers on the nine circles with the number starting from 1 to 9 from top-left corner to the right bottom corner as shown in the figure above. If we select a pattern 1478, the pattern would look as shown in Figure 2.

Figure 2: Pattern for 1478

This pattern is saved with a 20-byte SHA-1 Hash. So the SHA-1 hash for 1478 will be “06CF96F30A7283FF7258FCEF5CF587ED51156C37” which is stored in a file named gesture.key in /data/system folder in Android’s internal memory.

The Catch

The catch to change the pattern is replace this file with a known pattern gesture.key file.

Prerequisite

1. Debugging mode should be enabled.
2. Android adb (Android Debugger Bridge) tool.
3. AVD (Android Virtual Device) Manager Tool.
4. Device USB Cable
5. Device whose password needed to be changed

Methodology

Step 1

Start an AVD (Android Virtual Device), and create a pattern in the AVD. Open a command prompt. Execute the following command to check whether the AVD has been connected to the debugger or not.

1. adb devices

The output of the command should look as shown in Figure 3. If you see the name of your emulator on the screen, then your device is perfectly connected.

Figure 3: Output of adb devices

Step 2

Now pull out the gesture.key file from the AVD. For this execute the command that is mentioned below. This file is located in /data/system.

1. adb pull /data/system/gesture.key gesture.key

The gesture.key file will be pulled to your current working directory. Here the syntax of command is adb pull . Here my current working directory is my home folder. So the gesture.key file will be pulled out in my local file system in my home directory.

The output of the command is as shown n Figure 4.

Figure 4: Pulling out gesture.key file

Step 3

Now connect the other device, whose password is to be changed and close the AVD. For my example I will be using the same AVD. So now my password in my AVD is 1478 according to the pattern cell numbers. Figure 5 illustrates the pattern.

Figure 5: Current pattern of the Device

In next step, it will be shown how to change the pattern of new device to a known pattern from the previous AVD which was 1236. Figure 6 illustrates the new pattern.

Figure 6: The new pattern which is not stored in the AVD

Step 4

Now to change the password with a known pattern, we will push our known pattern file to the new device. The command for pushing a file into an android system is shown below. This file has to be pushed into /data/system of the new device.

adb push gesture.key /data/system/gesture.key

The gesture.key file will be pushed into the Android’s file system replacing the previous file. So now android will be having a new gesture file which contains a known password, and when we use this pattern to unlock the screen, the screen will be unlocked. The syntax for pushing a file into an Android system is adb push .

The output of the command is shown in Figure 7.

Figure 7: Pushing the known pattern file into the android system

Now this changes the pattern of the new device with a known pattern. Figure 8 illustrates the known pattern unlock.

Figure 8: Pattern replaced with a known pattern

Limitations

• The device should be rooted
• The device should have USB debugging mode enabled

3 Best methods to Hack Wi-fi using Android Phones

The use of Wifi Network is common to all android users, and it's also avaliable on all android phones. Wifi network is actually a helpful tool for wireless connection to the internet with the use of radiowave of 2.4Ghz and 5GHz SHF. Wi-fi can also be known as any wireless local area network (WLAN) product which is actually based on the Institute of Electrical and Electronics Engineering (IEEE) that is of 802.11 standard.

Today's stroll, I would brief you guys on the 3 Best methods to Hack Wi-fi using Android Phones.





Weeks back ago, I got lots of mails from most of my blog readers requesting for apps that could make them hack into any vulnerable wi-fi network amongst their area through the use of their android phones. With the tips I would be breifing you on, bet me, there is a 99.9% chance for any password protected Wi-fi network to be hacked.



3 Best methods to Hack Wi-fi using Android Phones




Method 1: Hacking of WPA2 WPS Routers

Step 1: Firstly, if your android phone isn't rooted, try to root it, and also make sure that such android phone have a Broadcom bcm4329 or bcm 4330 chipest unlike the Nexus 7, Galaxy S1/S2, Nuxus 1, Htc Desire HD, etc. The presence of Cyanogen ROM on your device can be of use to make the bcmon app work through.


Recommended: Do you wish to root your android device? Root it here


Step 2: Then download and install bcmon, it's essential because it helps monitor mode on your broadcom chipest that helps in the PIN Cracking.


Step 3: After installation, run the app and tap "monitor mode" option.


Step 4: Download and Install Reaver app which helps to crack the WPS Pin to retrieve the WPA2 passphrase.


Step 5: After installation of reaver app, launch it and do an on-screen comfirmation, which is, comfirmint that you're not using it for illegal purpose, then tap the APN or access poin you'd wish to crack and continue. Most times, you might need to verify monitor mode to proceed, and this would cause the bcmon to open again. 


Step 6: Verify your settings and also make sure that you've checked the Automatic Advanced settings" box.


Step 7: Finally, start cracking process by tapping start attack, at this final stage, it can take 2-10hrs for the cracking of WPS to be successful.



Method 2: Hacking of WEP Routers


Step 1: Firstly, if your android phone isn't rooted, try to root it, and also make sure that such android phone have a Broadcom bcm4329 or bcm 4330 chipest unlike the Nexus 7, Galaxy S1/S2, Nuxus 1, Htc Desire HD, etc. The presence of Cyanogen ROM on your device can be of use to make the bcmon app work through.


Step 2: Then download and install bcmon, it's essential because it helps monitor mode on your broadcom chipest that helps in the PIN Cracking.


Step 3: After installation, run the app and tap "monitor mode" option.


Step 4: Then tap the "Run bcmon terminal" option and type "airodump-ng" and Enter. Once the airodump loads finish, you would be directed to the prompt command in which you're to type "airodump-ng wlan0" then tap the Enter button.


Step 5: In this stage, a Mac address would appear, in which you're to jot down.


Step 6: Start scanning the channel by collecting information from the access point before attempting to crack the password, then type, "airodump-ng -cchannel#--bssidMAC address-w output ath0" and tap enter, then it would start scanning, try scanning till it reaches 20,000 - 30,000 packets.


Data usage- 5 Best tips to reduce High data usage on Android Phones


Step 7: To finally crack the password, return to the terminal, but make sure you've reached the suitable number of packets, then type "aircrack-ng output*.cap" and tap enter at the terminal.


Step 8: Once the password is cracked successfully, you would recieve a message alerting, 'Key Found' and would display the key in hexidecimal form. So when entering the key, make sure you eliminate the dots '.' or double dots ':', i.e if it displays 12:34:56:78:90, then enter 1234567890 as the code.






Method 3: Through the use of Osmino Wi-fi

The use of osmino wifi app seems to be the best any easiest method when hacking into a wifi network. Actually, it doesn't do any hacking but it serve as help to retrieve the already hacked password by someone else. It also tracks down the location of such vulnerability and gets connected it's network.
To download osmino wifi app, click here.


Disclaimer: Please I won't be held responsible for any illegal activity this tips is used for, it's just for knowledge sake.

How to Hack an iPhone's Passcode

Ever wanted to unlock an iPhone when you did not know the passcode? This article tells you how to hack an iPhone's passcode. This will open the contacts app from which you will be able to browse, edit, email any contact.

Step 1:

Tap the "Emergency call" button on the lock screen.

Step 2:

Then, enter "####".

Step 3:

As soon as you enter"####" tap the dial button.

Step 4:

Immediately, press the lock button which is on top of the iPhone.

Step 5:

Ta-daa! you have unlocked the iPhone. However, you will only be able to call, edit and email any contact.

Data recovery from accidentally deleted files or crashed drives in Redhat, CentOS and Fedora Linux

Version 2.0 

This tutorial will help you to recover data from accidentally deleted data from Linux-file systems. This is a very drastic mistake by any user/admin which costs for huge penalties. This script will be a boon for newbies/expert for data management. I will be using TestDisk for data-recovery. Here I have simplified the task with the help of a script.

1. Background

TestDisk is a powerful free data recovery software. Suppose you have a ext3/ext4 drive which got crashed/deleted withrm -rf or shift+delete like commands, with the help of TestDisk you can recover the data/file.
TestDisk can be used to 

• Fix partition table
• Undelete files from FAT, exFAT, NTFS and ext2/ext3/ext4 partitions

Beside these functions TesdDisk have several functionality for the data maintenance/management

2. Requirement 

I am using CentOS on which I will be installing the TestDisk & implement the data recovery script on a crashed drive. This script works fine with the CentOS/Fedora/Redhat. Even if it happens that any of the harddisk gets deleted just connect the harddisk with the CentOS machine & run the script to recover the data.

3. Script

#!/bin/bash
#######################################################################################################
#######################################################################################################
#######################################################################################################
######                                                                                          #######
######                                                                                          #######
######                 This script will help you to recover the accidentally                    #######
######                     deleted data from crashed linux file systems                         #######
######                                     Version-2                                            #######
######                          Script created by (Srijan Kishore)                              #######
######                                                                                          #######
######                                                                                          #######
#######################################################################################################                                                                                       
#######################################################################################################
#######################################################################################################


# User Check

if [ "$USER" = 'root' ]
    then

whiptail --title "User check" --msgbox "User is root, you can execute the script successfully." 8 78
             
        echo "User is root, you can execute the script successfully"
    else
whiptail --title "User check" --msgbox "User is not Root. Please run the script as root user." 8 78

        
        echo "User is not Root. Please run the script as root user."
        exit 1
fi


# Check your operating system

cat /etc/redhat-release >> /dev/null 
if [ "$?" = 0 ]
    then

whiptail --title "Your OS" --msgbox "You are using CentOS/Redhat/Fedora" 8 78
echo "You are using CentOS/Redhat/Fedora"

    else

whiptail --title "Your OS" --msgbox "You are not using CentOS/Redhat/Fedora.You can download the TestDisk from this link http://www.cgsecurity.org/wiki/TestDisk_Download" 8 78

    echo "You are not using CentOS/Redhat/Fedora.You can download the TestDisk from this link http://www.cgsecurity.org/wiki/TestDisk_Download"
    exit 1        
fi

#adding repo
ver=`cat /etc/redhat-release | cut -d " " -f3 | cut -d "." -f1`
ls -l /etc/yum.repos.d/rpmforge*

if [ "$?" != 0 ]
    
    then
    whiptail --title "Repository requirement" --msgbox "You need to add rpmforge repository to install testdisk" 8 78
        if [[ `uname -i` = 'i386' && $ver = 6 ]]
            then 
            echo "you are running i386 with 6 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.i686.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 6 ]]
            then 
            echo "you are running i386 with 6 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
        fi

        if [[ `uname -i` = 'i386' && $ver = 5 ]]
            then 
            echo "you are running i386 with 5 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el5.rf.i386.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 5 ]]
            then 
            echo "you are running x86_64 with 5 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el5.rf.x86_64.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 4 ]]
            then 
            echo "you are running i386 with 4 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el4.rf.i386.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 4 ]]
            then 
            echo "you are running x86_64 with 4 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el4.rf.x86_64.rpm
        fi
else
whiptail --title "Repository requirement" --msgbox "You already have TestDisk repos configured" 8 78
echo "You already have TestDisk repos configured"
fi


# TestDisk installation
testdisk --version >> /dev/null
if [ "$?" = 0 ]
    then
    whiptail --title "Info" --msgbox "Testdisk already installed" 8 78
    echo "Testdisk already installed"
    else
    whiptail --title "Info" --msgbox "Testdisk not installed, installing Testdisk" 8 78
        echo "Testdisk not installed, installing Testdisk"

    yum install -y testdisk
fi
   

#Recovery part of deleted files


ls -l /root/result/lostfiles
if [ $? != 0 ]
    then
    mkdir -p /root/result/lostfiles
    whiptail --title "Data recovery" --msgbox "You are proceeding towards recovering the data from the lost drive. Please select the affected drive to get the data recovered" 8 78
    photorec /d /root/result/lostfiles

    else        
    whiptail --title "Folder Exists" --msgbox "There is already an existing folder viz /root/result/lostfiles, you are adviced to rename/remove the folder to allow the data recovery process" 8 78        
exit 2
fi

#File filtering
 
user=`ps aux | grep gnome-session | grep -v grep | head -1 | cut -d " " -f1`
mkdir "/home/recovered_output"
mkdir "/home/recovered_output/Debians"
mkdir "/home/recovered_output/rpms"
mkdir "/home/recovered_output/conf_files"
mkdir "/home/recovered_output/exe"
mkdir "/home/recovered_output/binaries"
mkdir "/home/recovered_output/Docs"
mkdir "/home/recovered_output/Pdfs"
mkdir "/home/recovered_output/Mbox"
mkdir "/home/recovered_output/Images"
mkdir "/home/recovered_output/Videos"
mkdir "/home/recovered_output/Sound"
mkdir "/home/recovered_output/ISO"
mkdir "/home/recovered_output/Excel"
mkdir "/home/recovered_output/Presentation"
mkdir "/home/recovered_output/Web_Files"
mkdir "/home/recovered_output/Archives"
mkdir "/home/recovered_output/Others"


#Sorting the Recovered data


find /root/result/ -name "*.doc"    -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.docx"   -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.odt"    -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.pdf"    -type f  -exec mv {} "/home/recovered_output/Pdfs/" \;
find /root/result/ -name "*.mbox"   -type f  -exec mv {} "/home/recovered_output/Mbox/"  \;
find /root/result/ -name "*.png"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.jpg"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.jpeg"   -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.gif"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.avi"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mpeg"   -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mp4"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mkv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.webm"   -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.wmv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.flv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mp3"    -type f  -exec mv {} "/home/recovered_output/Sound/" \;
find /root/result/ -name "*.wav"    -type f  -exec mv {} "/home/recovered_output/Sound/" \;
find /root/result/ -name "*.deb"    -type f  -exec mv {} "/home/recovered_output/Debians/" \;
find /root/result/ -name "*.bin"    -type f  -exec mv {} "/home/recovered_output/binaries/" \;
find /root/result/ -name "*.exe"    -type f  -exec mv {} "/home/recovered_output/exe/" \;
find /root/result/ -name "*.rpm"    -type f  -exec mv {} "/home/recovered_output/rpms/" \;
find /root/result/ -name "*.conf"   -type f  -exec mv {} "/home/recovered_output/conf_files" \;
find /root/result/ -name "*.iso"    -type f  -exec mv {} "/home/recovered_output/ISO/" \;
find /root/result/ -name "*.xls"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.xlsx"   -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.csv"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.ods"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.ppt"    -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.pptx"   -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.odp"    -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.html"   -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.htm"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.jsp"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.xml"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.css"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.js"     -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.zip"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.tar"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.rar"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.gzip"   -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.tar.gz" -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.7z"     -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.bz"     -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.bz2"    -type f  -exec mv {} "/home/recovered_output/Archives" \;
find /root/result/ -name "*.*"      -type f  -exec mv {} "/home/recovered_output/Others/" \;

#Finalization
whiptail --title "Congratulations" --msgbox "You have successfully recovered your data in folder /home/recovered_output cheers :)" 8 78
echo "You have successfully recovered your data in folder /home/recovered_output cheers :)"
exit 0
      

4. Script Execution

Simply copy the above script & paste in file viz. script.sh & give the execute  permissions to the script.

chmod +x script.sh

Note: Please run the script with root by using the command

su -                                        #### Put your root password##########

Run the script & it will guide you further.

sh script.sh

5. Finalization

Firstly script will confirm that whether the user running the script is root, then it will check for the TestDisk tool installation which includes automatic repository addition. It will redirect you to the drive selection page for the data recovery.

It will check your OS.

Script will automatically verify & add the required repository for TestDisk.

Script will check the installation for the TestDisk.

Select the drive which you want to recover.

After process completion, quit on the screen.

Cheers you have recovered your data.

Laptop Data Recovery Software for Mac and Windows 8/7

Is it possible to recover lost files from a Laptop?

My friend removed her laptop hard drive because the laptop was fried and put it into her desktop as a secondary. I am not here with her so I am just going by what she has told me but she can not access here documnents, pictures, music, videos, etc..The hard drive says it is only 15GB but she said it is a lot larger than that. I googled around a bit and still have no idea on how to access these hidden files. Any help would be amazing! Thanks!

To be honest, data recovery for laptop hard drive is much more difficult than recovery for a desktop computer. The main reason is that all the components in a laptop are much smaller and harder to operate than the components in a desktop computer. Some people are required to take off the hard drive from the laptop and send it to a disk recovery repair shop and repairman will connect the hard drive to the motherboard of a large desktop PC to perform the data recovery. Along with the development of technology, we can make things much easier now! Read on to get the solution for how to get through the recovery task in one click.

Recovering lost or deleted data from laptop hard drive could be as easy as pie if you know the basic acknowledgement of data loss issue that these lost files are just invisible and inaccessible on your laptop hard drive. You are able to recover them back before new files overwrite them. Therefore, getting back lost files from a laptop is not a big deal if you stop using your laptop or laptop hard drive at once when you find the files are lost, and then use a professional Coolmuster recovery program.

One-click to restore lost files from laptop hard drive! Really?

Instead of connecting your laptop hard drive with another computer to process the recovery, Coolmuster Data Recovery (for Windows 8/7/XP) or Coolmuster Data Recovery for Mac is able to work directly on Windows laptop and Mac notebook and retrieve a variety of deleted files from your laptop without any trouble, including videos, photos, music, documents, emails and etc. It can deeply scan your entire laptop hard drive and robustly retrieve files from laptop, MacBook, Notebook, iBook, etc. within minutes.

You can get a free trial version of Coolmuster Data Recovery right now to experience its functions in advance. Just download it from the buttons below according to your own system.

How to Retrieve Deleted Files from Laptop? Only 3 Steps Needed!

 

Now, let's take Windows version of Coolmuster Data Recovery as an example. Mac users can use the Mac version and follow the similar operations from Mac notebook.

Step 1. Run the software and choose recovery mode

After downloading and installing the recovery program on your PC, launch it and select a recovery mode in the primary window to begin the process. To retrieve data from laptop, you can choose Deleted File Recovery mode as a try.

Step 2. Scan the partition on your laptop for lost files

The software will automatically detect and show all the partitions on your laptop. Just choose the partition where you lost files were originally located and click the button of "Scan" to scan for lost files.

After a few while when the scan finishes, all the scanned out contents will be found and shown in categories. You are allowed to preview the found files one by one to confirm which are the ones you want to recover.

 

Step 3. Mark the lost files and start to recover

Mark those files you want to recover and click the "Start" button to bring out the "Path" dialog box. Choose an output folder where you want to save the recovered data and then the recovery will begin. Please note that you should choose another partition to save the recovered data instead of the original one where you lost them.

 

How can I recover data if the laptop no longer run?

Above solution works on the premise that we can run the program on the laptop. But what if the laptop is crashed or failed to run? You can take off the hard drive of your desktop and try connecting it to another computer. Once the hard drive runs well on another computer, you can use Coolmuster Data Recovery to perform the recovery process on that computer, too.