Where is the Android graphic key stored: physical and logical location, recovery methods

A pattern on Android is not just a convenient way to unlock the screen, but also one of the key elements of protecting personal data. However, many users are faced with a situation where they forget the combination of dots or the device locks after unsuccessful input attempts. In such cases, a logical question arises: where exactly is this key stored in the system, is it possible to remove or reset it without losing data?

In this article we will analyze physical and logical location the graphic key in different versions of Android (from Android 5.0 Lollipop to Android 14), we will explain why it cannot simply be “spied” in the system files, and we will offer legitimate ways to restore access from standard Google functions to advanced methods using ADB and Fastboot. You will also learn how to protect yourself from losing access in the future and what to do if your smartphone is locked after a factory reset.

Important: the information in the article is for informational purposes only. Unauthorized access to other people's devices is punishable by law (Article 272 of the Criminal Code of the Russian Federation). All methods are applicable only to your personal gadget.

Physical storage of a pattern key: where and how

A pattern key (like a PIN code or password) is not stored in clear text in the Android file system. Instead, it is converted to hash value a unique string of characters that cannot be reversed. This hash is stored in several protected sections of the device:

• 📁 Section /data/system — files are located here gesture.key (for older versions of Android) or locksettings.db (for new ones). These files contain encrypted locking data, but without the encryption key they cannot be read.
• 🔐 TrustZone —hardware security module (on chips Qualcomm Snapdragon, Samsung Exynos etc.), where cryptographic keys are stored. Even with physical access to memory, it is impossible to extract data from here without special equipment.
• 🛡️ TEE (Trusted Execution Environment) —an isolated execution environment where operations with keys are processed. Used in modern devices (for example, Google Pixel, Samsung Galaxy S22+).

Starting with Android 6.0 Marshmallow, Google has tightened the protection: the pattern key is tied to the unique hardware identifier device. This means that even if you copy the section /data to another smartphone, you will not be able to unlock it - the system will require the original key from "hardware".

⚠️ Attention: On devices with file system encryption (FBE) — for example, Samsung Knox or Google File-Based Encryption — access to /data without unlocking the screen is impossible even through ADB or Recovery. Attempts to modify the partition will lead to data loss.

Interesting fact: on some older devices (before Android 5.1) the pattern key was stored in a file /data/system/gesture.key in a weakly protected form. Today, such vulnerabilities have been eliminated, but traces of them can be found in the firmware for Lenovo A6000, Xiaomi Redmi 2 and other budget models of 2014–2015.

Logical structure: how Android handles graphics key

When you enter a graphic key, the system performs several steps:

1. Reading coordinates — the sequence of touches is recorded (for example, “2-5-8-6”).
2. Conversion to hash — algorithm (usually SHA-256 or PBKDF2) converts the combination into a unique string.
3. Comparison with the stored copy — the hash from the input is compared with the hash in locksettings.db.
4. Unlocking —if there is a match, the system launches KeyMaster (security module) to decrypt the data.

Important: pattern key hash is not staticIt can change when:

• 🔄 Android update (for example, when moving from Android 11 to Android 12).
• 🔧 Resetting settings via Recovery (even if you did not format /data).
• 🔒 Enabling/disabling device encryption.

On devices with Samsung Knox or Huawei TEE the process is even more complicated: the hash is additionally associated with Hardware root of trust (hardware root of trust). file locksettings.db, he will not be able to use it on another device.

Android version	Key storage location	Protection level	Possibility of extraction
4.4 KitKat and below	/data/system/gesture.key	Low (hash without hardware connection)	Possible on rooted devices
5.0–7.1	/data/system/locksettings.db	Medium (hash + partial connection to device)	Partially (requires root and encryption keys)
8.0–9.0	/data/system/locksettings.db + TEE	High (hash + hardware key)	Impossible without exploits
10–14	locksettings.db + KeyMaster 4.x	Very high (FBE + hardware key)	Impossible without physical access to the chip

Is it possible to find out the graphic key through system files?

Short answer: no, if we are talking about modern devices (after 2017). On old smartphones (before Android 6.0), it was theoretically possible to extract the hash from /data/system/gesture.key and try to find a combination using brute force, but today this is impossible for several reasons:

• 🔒 Partition encryption /data - without unlocking the screen, access to files closed.
• 🛡️ Hardware binding — the hash is useless without a unique key from the processor.
• ⏳ Brute force protection — after 5 unsuccessful attempts, Android introduces a delay (from 30 seconds to full blocking).

Even if you gain root access (for example, through Magisk), files with the key will be encrypted. For example, in locksettings.db data is stored in the table locksettings c field lockscreen.password_salt, but without knowledge master key (which is generated when you first set up the device), they cannot be decrypted.

⚠️ Attention: There are fraudulent services on the Internet that offer to “hack a pattern key” for money. All of them either use social engineering (asking for your Google account) or distribute them. malware. No legitimate method allows you to bypass the blocking without resetting data on modern devices.

The only working method for devices up to Android 5.1 is using the utility SQLite Editor on rooted smartphone to view the content gesture.key. However, even in this case you will need:

1. root access (for example, through KingRoot or Magisk).
2. Disabled encryption section /data.
3. Knowledge of the hashing algorithm (most often SHA-1).

What does the graphic key hash look like in locksettings.db?

In the database data locksettings.db the key is stored in the table locksettings in the form of binary data. For example, for the combination "1-2-3-4-5" the hash may look like this:

x'3A2B1C0D9F8E7A6B5C4D3E2F1A0B9876' (this is a conditional example, the real hash depends on the salt and the algorithm).

Without knowledge of the "salt" (an additional random string) and the hashing method, it is impossible to restore the original combination.

How to restore access if you forgot your pattern key

If you forgot your pattern key, the options depend on whether an account is linked to the device. Google and whether the function is enabled Find My DeviceLet's consider all legitimate methods:

1. Unlocking via Google account (for Android 4.4–7.1)

On older versions of Android, after 5 unsuccessful entry attempts, the “Forgot your pattern key?” button appeared by clicking on it, you could enter your username and password Google account, associated with the device. However, since Android 8.0 Oreo this function has been removed for security reasons.

If you have a device on Android 5.0–7.1, try:

1. Enter the key incorrectly 5 times.
2. Click on the "Forgot your key?" button that appears.
3. Enter data from your main Google account.

⚠️ Attention: On some firmware (for example, MIUI from Xiaomi or EMUI ot Huawei) this method may not work even on older versions of Android. Manufacturers often modify standard locking functions.

2. Reset via Find My Device (for all versions)

If the function Find My Device is enabled on the device (located in Settings → Google → Security), you can:

1. Go to the site google.com/android/find from another device.
2. Select a blocked smartphone in the list.
3. Click "Block device" and set a new PIN code.
4. Use a new PIN to unlock.

This method works even on Android 14, but requires:

• 📶 Internet connection (via mobile network or Wi-Fi).
• 🔄 Synchronization with Google turned on.
• 🔒 No factory locking (FRP).

3. Reset via Recovery Mode (data loss)

If the previous methods did not work, you can still hard reset through recovery mode. This will delete all data, including photos, messages and applications.

Instructions:

1. Turn off the device.
2. Hold the key combination to enter Recovery (for example, Power + Volume Up for Samsung or Power + Volume Down for Google Pixel).
3. In the Recovery menu, select Wipe data/factory reset (controlled by the volume and power buttons).
4. Confirm the reset and reboot the device.

⚠️ Attention: On devices with Samsung Knox or Huawei after the reset, you may need to enter data from your previous Google account (FRP lock). service center.

Make a backup copy of important data (if the device at least somehow responds to connecting to a PC)

Charge your smartphone to at least 50% (reset may take up to 10 minutes)

Find out the exact combination of buttons to enter Recovery for your model

Prepare data from your Google account (in case of FRP blocking)-->

4. Advanced methods (for experienced users)

If you have skills in working with ADB or Fastboot, you can try the following methods (they do not work on all devices!):

• 🔧 Removing gesture.key via ADB (only for Android 5.0–6.0):

adb shell
su
rm /data/system/gesture.key
reboot

• 📱 Flashing via Fastboot (requires an unlocked bootloader):

fastboot flash system system.img
fastboot reboot

• 🔐 Using exploits (for example, DirtyCOW for older versions of Android).

On devices with encryption enabled (FBE), these methods will not work - after deleting gesture.key, the system will require you to enter an encryption key, which is generated based on the original graphic key.

How to protect yourself from losing access in the future

To avoid having your smartphone blocked, follow these recommendations:

• 📝 Write the key in a safe place —for example, in a password manager (KeePass, Bitwarden) or on paper (but do not store it with phone!).
• 🔄 Set up a backup PIN code — in Settings → Security → Screen lock you can add an alternative unlocking method.
• 📱 Turn on Smart Lock —the function allows you to unlock the device in trusted places (home, work) or when connected to trusted devices (for example, Smart Watch).
• 🔒 Link a Google account and turn on Find My Device is the only legitimate way to remotely unlock.
• ⚡ Make backups regularly —use Google Drive or local storage to save contacts, photos and documents.

On devices Samsung an additional function is available Samsung Find My Mobile, which allows you to unlock the screen via the web interface. To do this:

1. Go to findmymobile.samsung.com.
2. Login using your account Samsung.
3. Select the device and click "Unlock".

⚠️ Attention: Details of the services Find My Device and Find My Mobile are subject to change. Before use, check the current conditions in official sources or your personal account.

What to do if the smartphone is blocked after a reset

After a reset via Recovery some devices (especially Samsung, Huawei, LG) require entering data from a previous Google account - this is called FRP lock (Factory Reset Protection). It appeared in Android 5.1 Lollipop and is designed to protect the device from theft.

If you do not remember the password from the old account, the options are:

• 📧 Restore access to your Google account via recovery page. If a backup email or phone number is linked, the chances are high.
• 📞 Contact the service center —some workshops have legal methods bypass FRP (for example, through official firmware).
• 🔧 Use legal workarounds (only for personal devices!):

For Samsung (on some models):

1. Insert a SIM card with Internet.
2. At the Wi-Fi setup stage, click "Add network" and enter a custom name.
3. In the password field, enter any combination, select it and click "Share" → "Message" → "Gmail".
4. This will open access to your account settings, where you can add a new Google profile.

For Huawei (on devices with EMUI 9.0+):

1. Connect to Wi-Fi.
2. At the input stage Google account, click on the email field and select “Mode for the visually impaired” (TalkBack).
3. Activate TalkBack, then go back and try to enter the data again - sometimes this resets the verification.

⚠️ Attention: FRP bypass methods are often covered by security updates. Do not use dubious apps for “hacking” - they are. may contain viruses or violate the law.

Myths and misconceptions about the graphic key

There are many myths spread on the Internet about how you can “hack” or bypass the graphic key. Let's look at the most popular ones:

• 🔄 "You can connect the keyboard via OTG and enter the key from it" —does not work on newer devices Android 7.0. The system blocks alternative input methods on the lock screen.
• 📱 "If you remove the SIM card, it will be blocked. will be reset" - this is incorrect. The pattern key is stored in the device memory and is not associated with the SIM.
• 🔒 "You can pick up the key through brute force" —on modern devices, after 5 unsuccessful attempts, a delay is introduced, and after 20–30, the device is completely blocked.
• 💻 "You can read the key through a computer" —without root access and an unlocked bootloader, this is impossible. Even ADB in sideload does not give access to protected partitions.
• 🔧 "Flashing will remove the lock" - only if you flash a custom Recovery (for example TWRP) and manually delete the key files But this. will only work on devices without FBE.

Another common misconception - "pattern key is less secure than PIN"In fact:

• 🔢 3×3-point key has 389,112 possible combinations.
• 🔢 4-digit PIN —a total of 10,000 combinations.
• 🔢 6-digit PIN — 1 000,000 combinations.

Thus, a pattern is more difficult to find. brute forcethan a short PIN. However, it is vulnerable to “peeping” - fingerprints on the screen can give away the combination.

FAQ: Frequently asked questions about the graphic key

Is it possible to find out the graphic key through the engineering menu (##4636##)?

No, the engineering menu does not provide access to screen lock data. It is designed to diagnose the network, battery and sensors. The pattern key is stored in protected sections that are inaccessible through standard service codes.

Will flashing via Odin (for Samsung) help remove the pattern key?

Partially. If you flash full firmware (AP, BL, CP, CSC) with the flag CSC_HOME, the data in the section /data will be saved, but the screen lock may be reset. However, on devices with FBE (encryption) this will not work - a full reset will be required (without full firmware (AP, BL, CP, CSC) data-i="319">No.CSC without HOME).

Is it possible to restore a pattern key via Titanium Backup?

No. Titanium Backup does not have access to screen lock files, even if you have root access. Backups of applications and data do not include locksettings.db or gesture.key.

What should I do if, after resetting via Recovery, the phone asks for an old PIN that I don’t remember?

This means that the device has been enabled encryption (FBE). In this case, it is impossible to unlock the smartphone without losing data - even service centers will not be able to help. data-i="327">Are there legal apps for resetting the pattern key? Fastboot or flashing with deleting the partition /data.

Are there legal apps for resetting the pattern?

No. All apps that promise to “break” the lock (for example, Dr.Fone, iMyFone) either use vulnerabilities in older versions of Android (before 2017) or require root access that cannot be obtained on a locked device. Be careful - many of them distribute malicious software. Software.