remove decryption for forensic imaging of android device when an android device is imaged, some of the partitions are usually imaged from a running system rather than an offline system, due to encryption
it's possible this encryption could use a hardware key there are processes for using devices without this enabled, so that offline images can retain decrypted data. it is also possible to extract the key to use for decryption of an image later -- from a running device
