Practical Mobile Forensics - Fourth Edition

Deleting the gesture.key file

Deleting the gesture.key file will remove the pattern lock on the device; however, it's important to note that this will permanently change the device, as the pattern lock is gone. This should be considered if you are conducting covert operations. The following shows how the process is done:

1. Connect the device to the forensic workstation (a Windows machine, in our example) using a USB cable.

2. Open the command prompt and execute the following instructions:

adb.exe shell
cd /data/system rm gesture.key  

3. Reboot the device. If the pattern lock still appears, just draw any random design and the device should unlock without any trouble.

This method works when the device is rooted. This method may not be successful ...