[Thinkpad Tablet General] jnw07:
TLDR: trying to understand whether decrypting Android 9 FDE off-device is possible, and/or whether the factory reset upon unlocking the bootloader will change TEE keys in a way that will make on-device recovery impossible.

Backstory: My 3rd grader reset the screen lock password/PIN on a Lenovo Tab M10 HD to a long string of numbers that he can't quite remember. It's down to 8 entry retries until it does a factory reset. There are some files we would like get off the device (memories from the last few years 😔), if possible.

Admission of guilt: I know that things are designed in such a way as to "protect" user data, so there aren't really a lot of options, but I'd like to explore what the options actually are before I give up entirely. And yes, I know I should've had a backup strategy in place on this tablet—I just didn't really think ahead about third-grader-proofing the device (and thought I had some sort of backdoor access because it was set up with Google Family Link ... yeah, I know ...).

Some basic info about the device:

Model: TB-X606F

Current ROM: stock 10/QP1A.190711.020/TB-X606F_USR_S301068_2309191816_V9.56_BMP_ROW (I believe Android 9?)

Never was rooted or otherwise unlocked.

Appears to use TDE.

This is what I've done so far:

I can start up in recovery mode, bootrom mode, and fastboot mode.

I have successfully used MTKClient with bootrom mode to grab images of all the partitions. The userdata partition is the one I care about, but is encrypted, of course (can't mount it, binwalking it returns garbage, has extremely high entropy. There are also tee1 and tee2—I understand they aren't actually useful for much, but they also point to FDE.)

I have been able to get MTKClient into stage2 to get various keys, including the FDE key.

I have been able to push a TWRP image using fastboot, but since the device is not unlocked, it refuses to boot from it:

$ fastboot boot twrp_X606F_11.img
< waiting for any device >
Sending 'boot.img' (27954 KB) OKAY [ 0.710s]
Booting FAILED (remote: 'not allowed in locked state')
fastboot: error: Command failed

I also flashed the TWRP image to the recovery partition (I realise this skips some other important steps if I actually wanted to use it...), and this (predictably) resulted in a bootloop (the device powered on with a message about being in "Red State" and that it would reboot in 5 seconds). I flashed back the recovery partition I'd copied an image of, and it was back to normal—asking for the screen lock PIN.

I have decided for now NOT to try to unlock the bootloader. My understanding is that unlocking the bootloader will trigger a factory reset, and permanently change something in the TEE, and render any hope of recovery forever moot, however slim current hope might already be.

My current understanding includes the following:

Modern implementations of TDE usually mean there's no straightforward way to decrypt a disk image off-device.

Some potential way to decrypt the image off-device might involve extracting the key from the end of the image and using the lock-screen PIN (in this case, probably writing a little script to run through the several hundred possibilities of what it could be). But I think this still might need access to the TEE, or some sort of TEE exploit.

TWRP can often do TDE decryption, but to get it running I would need to unlock the bootloader, and an unlock would factory-reset the TEE (changing the salt, maybe?). So even unlocking the bootloader, installing TWRP, and restoring my userdata partition wouldn't work for decrypting on-device. On-device decryption would need to happen before a factory reset, regardless of the fact that I've made a copy of the encrypted partition. Perhaps my understanding of this point is wrong, though?

So there are a few paths I'd like to explore:

Is there no way to do off-device decryption, even if it's very involved?

Is there any way to use what I have (encrypted partition image, FDE key, fastboot/recovery/brom access, etc.) to check possibilities for lock-screen PINs off-device? I see a few tools here and there on GitHub (some might not be for modern implementations) and the like that seem to suggest this might be possible, but I don't fully understand what the various options I've looked at expect as inputs. I believe the key at the end of the partition is what some of them attempt to brute-force decrypt with the lock-screen PIN? And then that decrypted key would normally be used in conjunction with the TEE to decrypt the partition? But I haven't quite figured out how to get that first key out of the partition image yet. If I could do the first step here (successfully decrypt that first key with one of a list of possible lock-screen PINs), then I'd have the lock-screen PIN and could regain access to the device and the data on it.

Is my understanding in point 3 above correct? Specifically, would unlocking the bootloader result in a factory reset that would make it impossible to later do on-device decryption, even with the current encrypted userdata partition restored? And is unlocking the bootloader the only way to run TWRP or another tool that can do on-device decryption?

Any other ideas anyone has?

Please let me know if anything wasn't clear, or if there's any additional information that would help.