We provide a pre-compiled, easy-to-use recovery image to deploy cold boot attacks against Samsung Galaxy Nexus devices. If you own another device, you can use our system tools given in the download section to build your own recovery image.
Let's assume you have physical access to a device that is scrambled (with Android 4.0) and locked. And that you want to gain access to its data but don't know the PIN.
First assure the phone has enough power for the next hour. If not, please charge it. Otherwise pack it into a freezer bag.
Then put the phone into a freezer. Cooling the device down under 10 degree Celsius increases the success of cold boot attacks considerably, because RAM contents fade away more slowly if RAM chips are cold.
Let the phone inside a -15 degree Celsius freezer for about 60 minutes. Damaging the phone is your own risk.
After an hour, the phone temperature should be below 10 degree. Note that the temperature varies with the point you measure (metal or plastic). Usually we measure a point of the phone's motherboard (below the SIM card slot).
If the phone is cold enough, quickly check if it is still working by pressing the power button. If so, we are now ready to deploy cold boot attacks against it.
Unfortunately, the Galaxy Nexus has no reset-button and shutting the device down in software is too slow.
So we must to reboot the device by re-plugging its battery quickly. To this end, remove the battery cover.
Raise the battery slowly, without disconnecting it from the phone, until it is a bit above the device case.
Then push the battery back and forth very quickly, such that it gets disconnected from the phone for less than half a second.
You should already be holding the power button together with the volume up and volume down buttons.
This key combination brings you into fastboot mode, rather than booting into Android. In fastboot mode, we can flash our FROST recovery image onto the device.
Connect the smartphone to a Linux PC via USB. On the Linux PC, the fastboot utilities must be installed.
Flash the frost.img file from our download section to the phone: 'fastboot flash recovery frost.img'. For this command to work, the bootloader must be unlocked.
16) After the flash operation has finished, you can choose the 'Recovery Mode' option from the fastboot menu.
Now the phone boots into FROST, without the requirement to reboot it again (which is important in the cold boot scenario).
Inside the recovery image, we suggest to try the recovery of FDE keys from RAM via quick search mode. If that fails, you can try full search, or the brute force approach. On success you can decrypt the user partition now.
Key recovery from RAM (quick search mode).
FROST user interface.
Cracked 4-digit PIN via bruteforce.
We provide a pre-compiled, easy-to-use recovery image to deploy cold boot attacks against Samsung Galaxy Nexus devices. If you own another device, you can use our system tools given in the download section to build your own recovery image.