Methods for decrypting the data encrypted by the latest Samsung smartphone backup programs in Windows and macOS

Abstract

A smartphone is a personal device, so the information is always tied to its user. Possibly, as the smartphone usage increase, more relevant data of the respective users end up. The smartphone manufacturers, who provide data backup services, prevent users from losing data in the event of physical damage, such as loss or breakage of the smartphone. The backup data store the same data as the user data in the smartphone, but the personal data related to the user are encrypted, and some data related to data restoration and information are stored in plain text format. When it is difficult to analyze the smartphone itself in a digital forensic investigation, the backup data are a useful analysis target to replace the data from the smartphone itself. In particular, smartphones made by Samsung, a leading manufacturer in the smartphone market, have been continually studied. In this paper, we analyzed the latest version of Smart Switch, a backup program provided by Samsung, in Windows and macOS environments. We analyzed the encryption method used in the latest version of Smart Switch and found that nine algorithms were used in both Windows and macOS environments. Using the analysis results, we decrypted all encrypted backup data and classified the backup data based on the encryption method. We identified the differences through comparison with previous studies. In addition, assuming that the PIN could not be obtained, we measured the time and resources required to recover the PIN. To the best of our knowledge, it is the first time Smart Switch has been analyzed in the macOS environment.