Android Keystore file grep search

[pclab]

Hi

I have a case here, where a client lost the Android Keystore file which is unique and needed to update the app on the Play Store.
I need to search on the drive for that file, but I'm not sure which type of file to search, since it's not a usual file that R-Studio or similar would search for.
So, how to only search for that specific file?
One other thing: I need to find it on a MacOS laptop with a SSD drive. Can TRIM make this worse? The file seems to be lost for a few months already and the laptop didn't stopped working....
Thanks

 

[jol]

but I'm not sure which type of file to search, since it's not a usual file that R-Studio or similar would search for.
So, how to only search for that specific file?

the type doesn't make a different, as long you have the signature right

 

[hipo]

You can search for deleted files. Or you need to find good file and look for signature and manually add to R-Studio.

 

[Jared]

You can search for deleted files. Or you need to find good file and look for signature and manually add to R-Studio.

Actually you need to get three or four sample files to analyze. I can write the R-Studio xml file for you, I just need to see some samples to figure out it's unique signature.

 

[pclab]

Hi Guys

I will try to get some examples of the file to get the header.
Thanks

 

[DRUG]

[post]4772[/post]
One other thing: I need to find it on a MacOS laptop with a SSD drive. Can TRIM make this worse? The file seems to be lost for a few months already and the laptop didn't stopped working....
Thanks

If TRIM was enabled and file deleted, no chance I'd say.
I had the header of those keys somewhere, used it to test some things on a rooted phone. I'll search as soon as I'm at office.