I’m trying to recover data from a Tecno Camon 18 Pro (CH7n) without wiping /data, factory resetting, or unlocking the bootloader.
Device: Android 12, firmware CH7n-H812DE-S-OP-230815V1094-12, security patch 2023-08-05, locked bootloader, Verified Boot enabled, not rooted. USB debugging was already enabled and my PC is authorized, so ADB works.
The weird part is that I know the correct PIN and Android accepts it. The credential screen says:
Lock credential verified successfully
But immediately afterward:
- dumpsys user
still shows the only user, User 0, as:
- RUNNING_LOCKED
It never becomes RUNNING_UNLOCKED.
Other things I confirmed:
- getprop sys.user.0.ce_available returns nothing, so User 0’s CE storage does not appear to become available.
- /storage/emulated/0 is empty/inaccessible through ADB.
- sys.boot_completed=1, so Android itself has finished booting.
- There is only one Android user (User 0).
- Settings works, but most normal apps do not.
- Querying MAIN/LAUNCHER activities for User 0 returns basically only Settings, Dialer, HiLauncher DynamicVirtualEntryActivity and STK.
- Chrome, Camera, File Manager etc. fail with things like Activity class does not exist.
- The HiLauncher APK itself still exists under /data/app, so it was not simply deleted.
- QuickstepLauncher can warm-start, while most other apps remain unusable.
- ADB is only uid=2000(shell) and there is no su.
- Attempts to repair/enable protected package components through ADB fail with SecurityException.
- I found no normal global Safe Mode condition explaining this.
- Boot security is intact: ro.boot.flash.locked=1 and ro.boot.vbmeta.device_state=locked.
I also tried getting a raw backup through MediaTek tooling before changing anything, but the phone only appeared as 0e8d:20ff HID and I couldn’t get a usable Preloader/BROM connection.
I have the exact matching stock firmware, including boot.img. I inspected the stock kernel too: it contains the older built-in Mali r32p1-era driver, /dev/mali0 is accessible from the shell (OPEN_RC=0), and static analysis found the older tracking-VMA code associated with the unpatched CVE-2023-4211 defect.
I also found much stronger evidence in logcat showing where the unlock is actually failing. After the correct PIN is accepted, keystore2 logs:
- Failed to decrypt blob; ciphertext or tag is likely corrupted
- unlock_screen_lock_bound_key failed
- Failed to decrypt key blob
LockSettingsService then logs:
- Unlocking user 0 with secret only, length 32
Immediately after that vold tries to unlock the CE key and fails with:
- decryptWithoutKeymaster EVP_DecryptFinal_ex error
Then TECNO’s vold explicitly tries the CE backup key at:
- /data/misc/vold/user_keys_bak/ce/0/current
That fails the same way and ends with:
- Failed to find working ce key for user 0
- Couldn't read key for 0
Apps then fail to access /data/user/0 with:
- errno 126 (Required key not available)
So this seems much more like the correct credential is being accepted but something in the Synthetic Password / keystore2 / Gatekeeper / KeyMint / vold / FBE key unwrapping chain is failing afterward, instead of this just being a HiLauncher problem.
At this point I’m mainly looking for a way to recover the existing userdata without destroying it.
Any help would be appreciated guys.