In the early stages of our reversing workflow, we can look through the filesystem of this app to see if there are any leads. This could include things like shared preferences, databases, or basically anywhere within the app's sandbox.
If you're using the lab kit, a complete copy of the data directory has been provided under 'app_data_directory'. If you wanted to pull it off the device, it's located at:
A couple of artifacts of interest include the shared preferences xml (com.enchantedcloud.photovault_preferences.xml), content shown here:
Of interest are the
enc_keys_pin entries. Let's make a note of them and continue.
There's also a file called
crypto.xml - which hits on a certain subject were interested in! So let's take a look:
You might also notice
simplenosql.db , which is stored in the
databases folder. If you open it, there are only two tables.
Inside the table simplenosql, there are a couple of rows:
Each row appears to pertain to a 'bucket', which in our case is either albums or albums_decoy. Inside the data column is quite a bit of JSON data:
It appears that this may provide some intelligence as to where our encrypted media could be stored. Let's see if we can find these files in the
files/media/orig/ directory as indicated.
As expected, we have a number of jpg files with timestamps as names. If we view them using a hex editor we can see they appear to be high entropy crypto containers.
If we continue to look through the other encrypted media, the only obvious similarity you may note between them is that they all begin with 01 01.