A smartphone without connection to an operator, what could be worse? Without communication, we just get a player with the function of playing music, video and other little things. Communication is the soul of a smartphone; that’s what it was created for. There may be several reasons for the lack of communication with the operator: problems on the part of the operator, the SIM card needs to be replaced, a hardware defect in the smartphone, etc.

But there is another reason when the phone does not connect to the network - your phone does not have an IMEI (International Mobile Equipment Identity). IMEI and cellular are closely intertwined and therefore the vast majority of phones from major manufacturers have IMEI. There are Chinese phones for two/three/ten SIM cards that somehow work without IMEI, but if you have a smartphone from a large manufacturer, it will not register on the network without the correct IMEI.

In simple terms, losing IMEI is your smartphone's worst nightmare. And as practice shows, this happens with Samsung phones much more often than with other manufacturers. In fact, the IMEI of Galaxy series smartphones is stored in a separate section - EFS in the root of the flash memory. Sometimes, for a variety of reasons, this partition is erased or the data in it is damaged. As a result, your phone does not have an IMEI and cannot register on the network.

Reasons for missing IMEI:

1. Firmware update via OTA or other method
2. Installation official firmware(yes, yes, official)
3. Installing third-party firmware

These are the three most common reasons for the disappearance of IMEI or damage to the EFS partition on smartphones of the series Samsung Galaxy. Many custom firmwares already include a script for backing up the EFS partition to external media during firmware installation. But this is all good only if you have root access. What if he is not there?

We save IMEI on phones Samsung series Galaxy

1. You must have access to phoneutil menu. The default is *#7284# . If this code does not fit, then you need to find the appropriate one for your model. All necessary drivers for the phone must also be installed.
2. Download NV-Items_Reader_Writer_Tool.zip - 2.43 MB
3. Enable USB debugging on your phone.
4. We are recruiting *#7284# .
5. Let's go to Qualcomm USB Settings and choose RMNET + DM + MODEM.
6. Now we connect the phone to the computer, run NV-items_reader_writer.exe as administrator.
7. Save the block Range (Dec) 550-550. The block must be preserved 00550 . This will be yours IMEI.
8. We are recruiting *#7284# . Let's go to Qualcomm USB Settings and choose MTP+ADB.
9. Ready:)

Repairing IMEI on Samsung Galaxy series phones

1. Find IMEI your phone, for example by battery.
2. Create a backup block with IMEI according to the instructions above, even if it is damaged. And open it with the editor NotePad++.
3. Divide your name into blocks of two numbers, leaving the first number separately. For example 35516705558781901 divide by 3 55 16 70 55 58 78 19 01
4. Adding Latin A after the first digit, and swap all the rest. Add 08 to the begining IMEI. We get the following 08 3A 55 61 07 55 85 87 91 10
5. Now in text editor NotePad++(we already opened this file earlier) replace the first nine blocks with our correct one IMEI, which we received in the last step.
6. Let's write it down IMEI back to phone button Write V NV-items_reader_writer.
7. Reboot the phone.

This article is about recovery
encrypted file system (efs) performance, import
keys from the old user profile in
new system for gaining access to
encrypted information. To start
let's decide what you can do first
try a number of existing utilities for
this work, the work performed in the article
requires certain knowledge and skills.

• Our favorite elcomsoft offers advanced
  efs data recovery for 2K/XP for $99 with
  demo version available.
• Our beloved Microsoft also has in its
  arsenal recovery program
  reccerts.exe, which can be obtained via
  paid support service.
• Well, unknown to us, Passware offers efskey,
  which is said to be slower
  aefsdr, but costs exactly the same - 95 conventional
  raccoons

Let's return to our sheep. By default names
efs in XP are colored green. If everything fails
keys are naturally lost, and when opened
file creates a blank document with
description of the error. For example:

• notepad: cannot open the c:\documents and settings\foo\my
  documents\report.txt
• file: make sure a disk is in the drive you specified.
• wordpad: access to c:\docume~1\foo\mydocu~1\report.txt was denied.

This error usually appears
indicates that for everyone
users who had access to the file,
The wrong encryption key is being used.
There may be several reasons for this -
the most common is reinstallation
systems.

Everyone is recommended before the first
using efs to export
public and private keys, and
preferably on another medium (cipher /?) - these
keys are randomly generated upon creation and
when reinstalling the system
naturally do not repeat. Surprisingly,
maybe on purpose, at the first
no warnings when using efs
valiant Microsoft does not give out and there is a real
completely forget about the danger.

In 2K and XP, data on efs is here:

c:\documents and settings\user\application data\microsoft\crypto\ -
private key
c:\documents and settings\user\application data\microsoft\protect\ -
password entry to the private key
c:\documents and settings\user\application data\microsoft\systemcertificates\ -
public key. In general, not so
important.

Let's say the files have been saved and you need them
use. To work with file
the system requires the same account with the same
computer number, which is what it was originally.
You can find this data here:

c:\documents and settings\%username%\application data\microsoft\crypto\rsa\s-1-5-21-1078081533-
1606980848-854245398-1003

Computer number: 1078081533-1606980848-854245398
User number: 1003

In hex, respectively: fd374240 f094c85f 16c0ea32 and 3eb.

Go to hklm\sam\sam\domains\account\users\%usernumbers% and
check if there is an account with the same number in
system. If there is, then you need to find the name
user and create a profile with
original password. If it doesn’t exist, we create it,
having previously changed hklm\sam\sam\domains\account\f to
offset 48 to the required number, and add
him to the admin group. Next: in
hklm\sam\sam\domains\builtin\aliases\00000220\c change the machine SID
to the original one. We do the following and
here: hklm\sam\sam\domains\account\v. From hklm\software\microsoft\windows
nt\currentversion\profilelist\ export the key,
describing the car number with the suffix of
user numbers, change to
original numbers and import them back.
Copy the folders with keys to c:\documents and
settings\%username%\application data\microsoft\, reboot...
and everything should work.

In the next part we will look at the situation
in which there are no key files.

We have already looked at how it is possible. I said there that by default only the given user. I also said there that the private key, which is used to decrypt encrypted EFS files, is stored in the personal certificate store. But what happens if the user loses access to his private key? How then to recover files encrypted using EFS?

EFS Recovery Agent

EFS Recovery Agent is an Administrator account local computer or domain administrator, depending on where you are. The administrator account can decrypt files encrypted by other users and return them to the owner. But to do this, you need to create an EFS Recovery Agent certificate and allow it access to all newly encrypted files. I hope you remember how in the previous article we allowed another user to access encrypted files. This is exactly what happens with the recovery agent, only it's all done automatically.

How to create an EFS recovery agent?

In this article, I will not cover creating an EFS recovery agent within a domain. Let's consider only creating an Encrypting recovery agent File System on the local machine. To do this, use the default administrator account to run the following command in a command prompt window:

cipher /r:recoveryagent

The response to this command will be the creation of two files:

1. recoveryagent.cer
2. Recoveryagent.pfx

They will both be located in the root folder of the computer administrator. The next step is to let the operating system know that an EFS recovery agent has just been created. To do this you need to open Local editor group policy and go to node Computer Configuration/Windows Configuration/Security Settings/Public Key Policies/Encrypting File System and find the item Add data recovery agent. Opening this policy certificate must be specified recoveryagent.cer. Then save the changes and .

How to recover EFS encrypted files?

After creating the EFS Recovery Agent, all newly encrypted files can be recovered using an administrator account. To do this, the computer administrator needs to find and run the file Recoveryagent.pfx. After launching, you need to go through all the newly opened windows in hamster mode, after which the computer administrator will be able to access all encrypted files. And he will also be able to remove encryption from them and return them to the user. This is how EFS recovery is possible.

Today we will talk about an application developed by the guys from XDA. It can be installed on any phone Samsung. Thus, creating a backup copy for the folder EFS will not be difficult, which will allow you to install custom ROM and recovery images to your smartphone without worrying about the presence or absence of network access. Folder EFS contains important information about your phone, for example, IMEI number. Additionally, every time you decide to update your Android Samsung device with new custom or beta firmware, it can be destroyed, which in turn leads to loss of network connection, and the smartphone becomes useless. For this reason, we strongly recommend that you do backup copy EFS along with other important data stored on your device. A backup is always installed without problems, so don’t be shy about making it before making any changes to your gadget.

Now, as we already noted earlier, to make a backup EFS for anyone Samsung you will need to download, install and use the device special application - EFS Pro. But to use it you need root access(and the OS Android). Before proceeding to download, make sure that you have root access, if it is missing, then work on getting it. And do not forget that this always leads to loss of warranty. You can return it only by restoring stock ROM or installation official updates from Samsung. If lost EFS you can follow the same steps to restore.

To carry out this operation you will need a PC (Windows XP, Vista, 7), your Samsung device and USB cable. Let us remind you once again that your smartphone must have root access. Must be installed on the computer Microsoft. NET Framework 4.0 , otherwise EFS Pro won't work. After downloading the file, unzip it and install it on your PC. Then connect your device to your computer. Now you can make a backup for EFS using the application EFS Pro. For more details go to THIS link (you can also download it there) EFS Pro app).

That's all, now you know how to do it EFS backup for your Samsung device, but do not forget that there are other methods, and the one indicated in the article is the easiest.

How to restore EFS for any Android Samsung device:
rating 80 out of 80 based on 80 ratings.
There are 80 reviews in total.

When working with operating rooms Windows systems XP/Vista/7 and recovering passwords for mail and Internet sites. The next task that often has to be done when investigating incidents is recovering passwords to archives, mail clients and EFS (Encrypting File System). This will be discussed in this article.

EFS Key Recovery

In fact, the best thing to do in this situation is to recover the user's password. Then decrypting EFS will be much easier, we will return to this later. However, you need to understand that even if you do not have a password, you can still try to decrypt the corresponding files and folders. This is what Advanced EFS Data Recovery software is designed for.

In this software For the convenience of the user, a corresponding Advanced EFS Data Recovery wizard has been created, with which you can go through the entire decryption process step by step. Or you can use "Expert Mode" to perform the actions yourself.

In my opinion, if a person using Advanced EFS Data Recovery does not feel confident, it is much more convenient to use the Advanced EFS Data Recovery Wizard. Let's look at this mode in more detail.

At the first stage of the Advanced EFS Data wizard Recovery system will ask for the personal certificate used for EFS.

Let's assume you have such a certificate (this is an extremely rare situation, because for some reason users either neglect to export certificates or simply forget where they exported it). In this case, everything is quite simple. You are required to select the certificate file and enter the certificate password. Next, a search is made for all folders and files encrypted with its help on local partitions. You receive a list of files encrypted with this certificate that you can decrypt. Naturally, if you examine your computer, you will have to decrypt it onto another hard drive or external storage device so as not to damage anything.

But what if you don't have a certificate? In this case, the Advanced EFS Data Recovery wizard will prompt you to search for it on your hard drive. Please note that you can search for a certificate not only among existing files, but also among deleted ones. But to do this, you need to enable the "Scan sector by sector" checkbox. It is recommended to enable this mode when rescanning, if on the first pass you did not find the required certificates.

Next, it will take you some time to find the keys. As a result of the search, a wizard window will be displayed. If the keys are not found, you must enter the username (EFS owner) and his password or, as a last resort, a HEX code. How to obtain a user password was described in the previous article.

If you know the user's password, you enter the name of the corresponding account and her password and press the "Forward" button. Next, the found folders and files encrypted using EFS are decrypted. As you can see, even if you reinstalled operating system, this does not mean that you have lost data encrypted with EFS.

Don't forget that if you know the name and password of the account under which encryption was carried out, the decryption process will take much less time. Otherwise, you can try to decrypt using expert mode. Although it must be admitted that the probability of a positive result in this case is noticeably lower. You will be prompted to add a password from the dictionary. Naturally, it is assumed that you have the dictionary files.

I would like to note the following. As we can see, today there are quite powerful tools for recovering (cracking) passwords. Therefore, to ensure their durability we have three options:

1. Further increase in length and complexity (in my opinion, the path is a dead end, because sooner or later users begin to get confused, forget passwords, use the same one for all occasions, etc.).
2. Use of biometric authentication tools.
3. Use of multi-factor authentication and certificates. This path again, in my opinion, much more promising, but it is worth considering that the proposed solutions, of course, cost money, and sometimes quite a lot.

The choice, of course, is yours.

Vladimir BEZMALY