Question about Data recovery prevention in Nexus 5 - Nexus 5 Q&A, Help & Troubleshooting

Hello,
I have decided to replace my nexus 5 because it has developed dead pixels. But i have my personal data like videos, photos and other sensitive information on the device. After doing some research I've realized that its very easy to recover data even after Factory Resetting the N5 or formatting in recovery with help of Disk Digger and other similar sorta apps.
So my question is how will i be able to prevent the recovery of my data if Google employee decides to recover it ? [Because on phone the customer care executive told me my phone will go through a thorough inspection]
I don't want my data to be recovered.
Please suggest me a surefire way to prevent the recovery of my data on nexus device.
PS: Nexus is rooted and running on Android L dev preview

Data is recovered because data is never deleted. It just empties the index for the data in the file system (more details on that in my n5 data loss and recovery thread via signature)
Data is only gone for ever when you actually overwrite it.
So factory reset then put say 12 GB of video on there. That will overwrite old data. Then delete that.
Sent from my Nexus 5 using Tapatalk

rootSU said:
Data is recovered because data is never deleted. It just empties the index for the data in the file system (more details on that in my n5 data loss and recovery thread via signature)
Data is only gone for ever when you actually overwrite it.
So factory reset then put say 12 GB of video on there. That will overwrite old data. Then delete that.
Sent from my Nexus 5 using Tapatalk
Click to expand...
Click to collapse
thank you so much. I just need a little clarification about overwriting the data, Do i need to overwrite and delete data just once or should i do it several times to be completely sure?

Theoretically, there is no surefire method of deletion short of physical destruction of the storage medium. But overwriting the data, even once, will make it too costly and difficult for most people to even bother.

rachel_taylor said:
thank you so much. I just need a little clarification about overwriting the data, Do i need to overwrite and delete data just once or should i do it several times to be completely sure?
Click to expand...
Click to collapse
When you write a file to your device, it is written to a block. Let's say you write a file to block 1 then another to block 2. The file system knows which file is in block 1 and 2. When you open the file, the file system tells the is where the file is and retrieves it. If you delete the file in block 1 and 2, the data remains but the file system forgets ota location so it appears gone. Most data recovery methods involve scanning the actual block s and record what it finds to allow access.
If you then write a file to block 1, what used to be there is gone. Standard recovery methods cannot retrieve it.
Sent from my Nexus 5 using Tapatalk

Wakamatsu said:
Theoretically, there is no surefire method of deletion short of physical destruction of the storage medium. But overwriting the data, even once, will make it too costly and difficult for most people to even bother.
Click to expand...
Click to collapse
So if i erase (format) and fill up the storage with random data like 10-15 times it would be impossible to restore even for a expert? right?
Im sorry ive become really paranoid about this

rachel_taylor said:
So if i erase (format) and fill up the storage with random data like 10-15 times it would be impossible to restore even for a expert? right?
Im sorry ive become really paranoid about this
Click to expand...
Click to collapse
Not impossible per se, but it becomes prohibitively expensive (in terms of time and cost) to do so. You don't need to do it 10-15 times though...3 to 5 should be sufficient (and I'm talking really paranoid here, 3 to 5).

rachel_taylor said:
So if i erase (format) and fill up the storage with random data like 10-15 times it would be impossible to restore even for a expert? right?
Im sorry ive become really paranoid about this
Click to expand...
Click to collapse
If a person had a million dollars, he could rent electron microscope time and have a trained tech scan your flash media sector by sector and hope to get something useful. I just say, if a dude wants to spend that kind of money to find out the PIN to my bank account with next month's rent in it, he can have at it.
In short, a person has to be SURE that it's worth it or he won't even bother.

Jeez.
Sent from my Nexus 5 using Tapatalk

Related

[Q] PANIC

If I break forum etiquette in some way please excuse the lapse - this is my first post to any forum. Honestly, it's a bit intimidating but I'm more than a little desperate right now. Near panic would be a better description of my state.
My Droid Incredible is stuck in a continuous boot loop. 24-48 hours after downloading a sleep sound generating app (if this is relevant), I was trying to use a different app and a pop-up stated "internal error" and would not load the app. I tried another and same result. I tried to kill all running apps with advanced app killer and same result. I turned off the phone thinking that it would correct when turning it back on but no luck. Now it just power cycles in a continuous boot loop. There has been no solution through tech support or a store visit. I don't care about the phone. At this point I would like to strap it to a steak and throw it in a lion cage. I do care about the data its holding - none of which is backed up in any way. There is no sd card and no back-up in my gmail account. I need to try and rescue the following data: voice memos from the HTC app, notes from the 3bannana (catch notes) app, photos, videos, apps, bookmarks from the dolphin HD browser and the Android browser, pdf downloads, text messages, call log settings, etc.
I have tried to boot the phone with a sd card installed. I have tried to view the data from a Celebrite machine at the Verizon store - it sees the drive but not the data. I tried to get into a "safe mode" menu by depressing down volume+center click+menu. Nothing has worked.
Is there any desktop software (or any other solution) that would enable me to restore (rescue) the data from the phone while it is in this state?
If there isn't, please just make something up so I can continue for a while in a delusional state of hope and get over this gradually.
Thank you for your wisdom and mercy.
Kandinsky1 said:
If I break forum etiquette in some way please excuse the lapse - this is my first post to any forum. Honestly, it's a bit intimidating but I'm more than a little desperate right now. Near panic would be a better description of my state.
My Droid Incredible is stuck in a continuous boot loop. 24-48 hours after downloading a sleep sound generating app (if this is relevant), I was trying to use a different app and a pop-up stated "internal error" and would not load the app. I tried another and same result. I tried to kill all running apps with advanced app killer and same result. I turned off the phone thinking that it would correct when turning it back on but no luck. Now it just power cycles in a continuous boot loop. There has been no solution through tech support or a store visit. I don't care about the phone. At this point I would like to strap it to a steak and throw it in a lion cage. I do care about the data its holding - none of which is backed up in any way. There is no sd card and no back-up in my gmail account. I need to try and rescue the following data: voice memos from the HTC app, notes from the 3bannana (catch notes) app, photos, videos, apps, bookmarks from the dolphin HD browser and the Android browser, pdf downloads, text messages, call log settings, etc.
I have tried to boot the phone with a sd card installed. I have tried to view the data from a Celebrite machine at the Verizon store - it sees the drive but not the data. I tried to get into a "safe mode" menu by depressing down volume+center click+menu. Nothing has worked.
Is there any desktop software (or any other solution) that would enable me to restore (rescue) the data from the phone while it is in this state?
If there isn't, please just make something up so I can continue for a while in a delusional state of hope and get over this gradually.
Thank you for your wisdom and mercy.
Click to expand...
Click to collapse
If you have a custom recovery image and the partitions aren't corrupt you should be able to recover everything with adb.
If you don't have a custom recovery then it might be impossible to recover anything.
Have you rooted the phone and installed a custom recovery?
With respect to backups - GMail for example is stored in the cloud - so the data on your phone is just a clone - you won't loose your mail - other apps I don't know, you'll have to check each.
If you can't get stable adb access you will need to research a factory reset for your phone which should fix it (but will wipe your data).
djmcnz said:
If you have a custom recovery image and the partitions aren't corrupt you should be able to recover everything with adb.
If you don't have a custom recovery then it might be impossible to recover anything.
Have you rooted the phone and installed a custom recovery?
With respect to backups - GMail for example is stored in the cloud - so the data on your phone is just a clone - you won't loose your mail - other apps I don't know, you'll have to check each.
If you can't get stable adb access you will need to research a factory reset for your phone which should fix it (but will wipe your data).
Click to expand...
Click to collapse
Unfortunately, I have not rooted my droid, have no custom recovery image and don't even know what adb is. As you can tell, I am a complete novice - but a novice in serious trouble if I can't recover the data. When you say stable adb access, what do you mean?
I was hoping to find some type of desktop recovery software that may be able to recognize the drive on the phone and then view and copy the data. Is it possible that this might exist. By the way is there a more appropriate sub-forum to place this post?
Thanks for your help,
Caleb
Kandinsky1 said:
Unfortunately, I have not rooted my droid, have no custom recovery image and don't even know what adb is. As you can tell, I am a complete novice - but a novice in serious trouble if I can't recover the data. When you say stable adb access, what do you mean?
I was hoping to find some type of desktop recovery software that may be able to recognize the drive on the phone and then view and copy the data. Is it possible that this might exist. By the way is there a more appropriate sub-forum to place this post?
Thanks for your help,
Caleb
Click to expand...
Click to collapse
lol ADB is the Android Debugging Bridge - in layman's term, it's a way to gain terminal access to your phone and do several other things with your phone. Mostly for debugging, but can be used for these purposes if you're rooted/installed a custom recovery.
That said, it would be at this point in time, virtually impossible to save your data that hasn't been backed up. Even if you had root, this might have been a bit more accomplishable (though usually a custom recovery never hurt ). If you're REALLY desperate, there might still be a way, though the chances of it working and providing good results is a mixed bag of results.
I'm assuming that if you didn't have an SD card in there in the first place that it has some built-in memory, right? Well, If not, then Catch notes would not have worked as it depends on an SD card to hold backups and (if i believe correctly) notes. Also, I'm assuming that you had some accounts set up on your phone (HTC/Google). If not, then I don't know how you've gone this long without it, but I'm almost positive you did have at least those two. In that case, the voice memos might be saved as well as the call log settings. Contacts might also be synced, so its more of the physical stuff we need to worry (texts/pdfs/bookmarks/pictures/videos)
Now, there are ways to recover using a computer. It all requires that you get your phone to work again (don't throw it to the lions yet!) So, we'll need to try and unbrick it. Follow the instructions here to try and get your phone back into factory state. It's true this will delete all your data, but as you are now, you have even less of a chance of recovering it.
From here, you're going to just skip past the setups and everything. After that, you're going to mount the phone as a disk drive. Now, this is where things can either go really good or really bad for you.
Get a recovery software for Windows, Linux, or Mac here. I honestly prefer Recuva as it has worked well for me in the past and this other program I had to pay for (can't remember the name. Search google and you might find it ;P), but Recuva should serve these purposes well.
The reason why these things work very inconsistently is that when you delete stuff in your phone/computer, they don't actually get "deleted". Rather, they are flagged as "not needed" and is left there until the phone/computer needs more space. It'll search out any flags, then overwrite them. In our case, that will work for and against us. Since we have to rewrite about 1 GB of data to reinstall the system (or was it +- 500 MBs?) we'll have to assume that about that much will be lost to us. That's why usually videos are unrecoverable. They are large and usually take up the most space, so they will be hard to recover if anything.
However, this works out for us as we can recover things like texts, contacts, your color note files, bookmarks, pictures, and whatever else you can dream of with a very high success rate. This is because they are small enough and if they don't get touched, you can probably get them in their original form. However, if parts of it is overwritten (i.e. texts, video) , you'll know cause the texts will have funky characters that dont make sense and the video wont load. Use this to your advantage and recover only small things first. Rule of thumb: if its small and seen by the software, most likely untouched. Grab these first.
I apologize for this really really long post. I just wanted to explain every part to you so you can understand the thinking behind why I'm asking you to do something as delete your precious data. However, like I stated earlier, there is almost 100% chance you won't get everything back and you could still possibly lose all your data should the software not see it. However, I feel this is much better than not having any chance at all and just staring at your phone waiting for it to grow brains and spit out the data in a conveniently-hidden SD card. So, I hope this works for you and if things go well, let me know! =]
~jojojohnson7410
In case hard reset didn't work...
You can follow the following section by clicking here:
How to revert to factory (stock, S-ON, no root):
Get S-ON by flashing THIS FILE (218.5kb) via recovery the same way you would flash a ROM. If you're not on the stock radio, you'll first need to FLASH THE STOCK RADIO. If you don't know how to do this, then you've never flashed off the stock radio, so you're good.
Revert your phone back to the stock, unrooted ROM. You have two options.
Option 1: Download HTC Sync and run the RUU. You can download the RUU HERE (180MB).
Option 2: Download THIS FILE (172.5MB) and place it on the root of your SD card. Reboot your phone into HBOOT (Bootloader, NOT RECOVERY!!!). Once the bootloader checks the image, it will ask you if you want to update. Select Yes and let the update run. After the phone reboots, you will have a stock, factory Droid Incredible running the November update.
Click to expand...
Click to collapse
It's all the way at the top. Do this only if the hard reset didn't work. If you need help using this or encounter any problems, let me know =] (oh, PM me cause sometimes I forget to check >.>)
~jojojohnson7410

Android lacks the security

I read somewhere that Android keeps your personal data even after hard resetting the phone as it only delete the path of files nd original files are remain untouched. I just want to know if it is true or not..
Sent from my A110Q using XDA Premium 4 mobile app
Isn't that true for just about every storage device? I think the issue is when you erase the storage media, traces of the files can be recovered from the storage. This is true for your phone and also your personal computer. If you formatted your hard drive, someone could still use a data recovery to recover your data. Short of totally destroying your physical media, there may be no 100% way of erasing all data. The realistic goal would be erasing the data to the point where an average person can't recover it.
Based on what I read from the article, the issue is that if you erase your phone, the data can still be recovered from the phone using off-the shelve tool. Apple is a bit better since later generation of iphone handles encryption better. If you want to avoid this situation, look into an android phone with encryption features.
Paul
Check the settings, you might have the option to encrypt your data in there. Takes around an hour if your device is fairly new.
Glompish said:
Check the settings, you might have the option to encrypt your data in there. Takes around an hour if your device is fairly new.
Click to expand...
Click to collapse
Good way of making sure your 'deleted' files, if they're still there, are inacessable.
But can make backup and recovery a real *****....
paul.siu said:
Isn't that true for just about every storage device? I think the issue is when you erase the storage media, traces of the files can be recovered from the storage. This is true for your phone and also your personal computer. If you formatted your hard drive, someone could still use a data recovery to recover your data. Short of totally destroying your physical media, there may be no 100% way of erasing all data. The realistic goal would be erasing the data to the point where an average person can't recover it.
Based on what I read from the article, the issue is that if you erase your phone, the data can still be recovered from the phone using off-the shelve tool. Apple is a bit better since later generation of iphone handles encryption better. If you want to avoid this situation, look into an android phone with encryption features.
Paul
Click to expand...
Click to collapse
Yes some of the data can be recovered but that is only as long as it has not been over written. The easiest thing to do is to wipe the device and use a Stock rom flash file to over write the system a few times formatting all partitions.
After hard-reset, data will be erased from device.
But, if your data was synchronized with Google cloud services, they will remain alive after Android hard-reset.
All user data have been lost after hard reset
I imagine that after a factory reset, all information stored on the device previously will be erased, however, i believe that information synced with email accounts or applications will be saved
A factory reset is theoretically the best way to clear data and should work for most phones, see Settings > Backup & reset > Factory data reset. However, a company called Avast Software did a study recently and found they were able to recover photos from 20 handsets bought on Ebay. They say the owners did a factory reset but I'm a bit skeptical that maybe they claimed to but didn't.
Marc
i think the same thingh.
google keeps all of our information in its database... we are not its user but just product...
As zelendel said, data can be recovered after a factory reset. Have a look at this thread 'Deleting data' part.

OnePLus stuck trying to encrypt

So I wanted to do the full encryption on my device. Let the device charge, and started the encryption process. The screen went blank, and then a green figure of the android came on the screen and has been there since. Its been almost three hours now? If my phone loses all its data thats ok, but I dont know if a bad encryption could brick the device?
Not sure if this is significant, but I have been on Facebook messenger since my phone was encrypting, and several msgs and text msgs have been showing on the screen?
Any ideas or advice would be great.
The encryption process may take quite a long time; it's not uncommon to see some phones take 6+ hours to encrypt, depending on the internal storage capacity.
AFAIK, Android will encrypt all of the internal storage, even the empty space. So if you have the 64GB version, that's a lot of storage space to encrypt at one go.
I would leave the phone plugged in and running the encryption for at least 24 hours if it's taking a while. It shouldn't take that long, and something might be broken, but better safe than sorry, I suppose.
Interrupting encryption will probably, if not definitely, result in data corruption or loss on the device. Depending on how far along the encryption was, you may end up with a bricked device, but it's pretty much impossible to say for certain what the outcome will be if you interrupt it.
There's a bug in CM11S 33R that broke full device encryption.
Normally, soon as you set a PIN and click encrypt, you will see a green bot, then you phone should restart into the Encryption Progress 1%, 2%, 3%, etc. screen.
As it is right now on CM11S, which is the stock software that the OnePlus One come in, you will see the green bot screen but the damn tying won't restart. OnePlus confirmed this is a bug that should be fixed in next OTA update.
In the mean time, if you unlock your bootloader, encryption will start. Or flash CM11 nightly.
Sorry, might be the wrong thread to ask, but what is the point of encryption, if there is no storage to be removed from this phone?
Send from OnePlus One using Tapatalk
Satras said:
Sorry, might be the wrong thread to ask, but what is the point of encryption, if there is no storage to be removed from this phone?
Click to expand...
Click to collapse
Someone could boot a stolen phone to boatloader, access the partitions (data, internal sd, etc) by adb and copy the contents of your device to an alternate location. One could also flash a custom recovery and create backups and push them over to a pc.
It also seems possible for some devices to unlock the bootloader without wiping data. So there are some unlocked doors, if device is not encrypted.
You can compare it to a WindowsPC -> Just boot from USB-Stick / CD and mount the Harddisk and you can access all of its contents, if device encryption isn't used.
Your should see a percentage indicator when it's encrypting. My 64gb took around an hour or so to finish
nsmart said:
Someone could boot a stolen phone to boatloader, access the partitions (data, internal sd, etc) by adb and copy the contents of your device to an alternate location. One could also flash a custom recovery and create backups and push them over to a pc.
It also seems possible for some devices to unlock the bootloader without wiping data. So there are some unlocked doors, if device is not encrypted.
You can compare it to a WindowsPC -> Just boot from USB-Stick / CD and mount the Harddisk and you can access all of its contents, if device encryption isn't used.
Click to expand...
Click to collapse
Fair Point.
So once they fixed the bug, can I do a nandroid Backup and simply test it. If it ain't my cup of tea, can I simply apply the nandroid Backup again and my phone is unencrypted again?
Send from OnePlus One using Tapatalk
No, nandroid wont apply over an encrypted partition. It requires the partition to be decrypted first.
Hm, so I need to move the Backups to my computer first.
Send from OnePlus One using Tapatalk
Yeh something like that. Worst comes to worst if you forget you can just boot the phone normally and copy SD contents across by USB. Then format and restore nandroid.
I haven't had any issues with encryption, TWRP 2801 fixed it.
Possibly off topic also, sorry, but what are the downsides to full device encryption? Reasons why every isn't doing it? Seems much more secure, although I'm not using it myself at the moment.
Sent via quantum entanglement, focused through my OnePlus One.
Lower performance, less battery life, harder to troubleshoot if it does not boot correctly.
Make sure to have off-site backups when starting the encryption
Send from OnePlus One using Tapatalk
As an addendum, on a fast device like our OPO, the performance penalty is negligible. The security benefits far outweigh the costs, as pin locks are easy to defeat and even without, data can be accessed from bootloader/recovery. Remote wipes are not always reliable and for others like me who keep sensitive emails, company info, SSH/GPG keys, it's peace of mind.
It's also rumored that Android 5 will bring by-default encryption.
Strange, you say pin locks are easy to defeat, but isn't this the default for unlocking your encrypted phone?
Send from OnePlus One using Tapatalk
I changed my decrypt password to 16+ characters, and screen unlock remains at 4 digits. That way inconvenience is minimized.
There is an app on Play Store to set separate screen unlock / decryption passwords.
SenK9 said:
I changed my decrypt password to 16+ characters, and screen unlock remains at 4 digits. That way inconvenience is minimized.
There is an app on Play Store to set separate screen unlock / decryption passwords.
Click to expand...
Click to collapse
Do you know if that app will work with TimePIN? I rather like the app, though it's currently removed from play store while developer works on ART issues, because it changes the screen unlock to the current time which enhances the security of the device. I've thought about doing full device encryption previously but that always made me hesitate with the amount of hassle to check it.
I dont know what TimePIN is, but it should be fine. Changing the decryption password doesn't affect the lockscreen pin/password, they are independent.
Now that I'm back on my computer, I can drop some links here.
Cryptfs password changer
https://play.google.com/store/apps/details?id=org.nick.cryptfs.passwdmanager
This changes the pre-boot decryption password ONLY, not your lockscreen password. It's good for people who want a very secure encryption password, but without the hassle of typing it in each time they unlock the device (by default, Android will use the same for both, which has been a long-debated point).
Manually:
If you want to do it manually, you can configure Android's vold module (https://source.android.com/devices/tech/storage/config.html)
At prompt (with root):
Code:
vdc cryptfs enablecrypt inplace <password>
Security:
I can't find the link, but there was a Github script I ran across that was able to extract the encrypted filesystem header from an Android device in recovery mode, to an attached computer and brute force it. For a 4 digit PIN (which is what many people use), it takes less than a minute on an average home PC.
Hopefully that helps somebody ...
SenK9 said:
Yeh something like that. Worst comes to worst if you forget you can just boot the phone normally and copy SD contents across by USB. Then format and restore nandroid.
I haven't had any issues with encryption, TWRP 2801 fixed it.
Click to expand...
Click to collapse
twrp 2801 did allow me to encrypt, but the password will not decrypt in twrp. Color me confused.
Sent from my A0001 using XDA Premium HD app
Error message in TWRP?
SenK9 said:
Error message in TWRP?
Click to expand...
Click to collapse
"Password Failed. Please Try Again"
&
"E: Failed to decrypt data"
I have tried changing the password too, and get the same error.
Sent from my A0001 using XDA Premium HD app

Factory reset recovery

Hi
I factory reset my Samsung A300 few days back but I need my photos recovered. Nothing was backed up. I have tried dumpster app no luck and I have downloaded a recovery software on my laptop to connect phone to but it says it needs rooting? I have tried downloading kingoroot apk on phone but nothing seems to happen . Any help please to get back my photos
Almost every 14 days this question is asked here.
Search this forum for given answers.
cymro24 said:
Hi
I factory reset my Samsung A300 few days back but I need my photos recovered. Nothing was backed up. I have tried dumpster app no luck and I have downloaded a recovery software on my laptop to connect phone to but it says it needs rooting? I have tried downloading kingoroot apk on phone but nothing seems to happen . Any help please to get back my photos
Click to expand...
Click to collapse
Sorry if u did a factory reset than all of your photos are gone with no way on recovering them however if u backup the photos using google photos Facebook or if u transfer them to your computer before doing a factory reset the photos still should be their
Well, if you want to use the recovery software, root is necessary. There is no other way.
bobii said:
Well, if you want to use the recovery software, root is necessary. There is no other way.
Click to expand...
Click to collapse
Nothing will get that data back and even if you could it's juxtaposed in a million pieces.
A data recovery $ervice might be able to recover some of it if its not already overwritten.
blackhawk said:
Nothing will get that data back and even if you could it's juxtaposed in a million pieces.
A data recovery $ervice might be able to recover some of it if its not already overwritten.
Click to expand...
Click to collapse
No, factory reset in recovery is a formatting process, not a deletion process. "Deleted" data can be retrieved but "formatted" data can not be retrieved, bits of the formatted data can be retrieved but none of the files will be complete, they will all be corrupted and unreadable.
bobii said:
Well, if you want to use the recovery software, root is necessary. There is no other way.
Click to expand...
Click to collapse
Data recovery software and root won't do any good in this situation. Their data has been "formatted", not "deleted"
So what your saying then the opposite of lots of posts out there on Google is I can't get this data back after reset ?
Droidriven said:
No, factory reset in recovery is a formatting process, not a deletion process. "Deleted" data can be retrieved but "formatted" data can not be retrieved, bits of the formatted data can be retrieved but none of the files will be complete, they will all be corrupted and unreadable.
Click to expand...
Click to collapse
My point exactly. That remaining data isn't easily accessible for internal memory and even then of little use.
The only way to prevent critical data lose is to redundantly back it up. Some of my data has 5 backup copies, all on separate hdds in different locations. Cloud backup isn't enough; you need hard copies and all hdds need to be recopied every 5 years minimum. They should preferably be enterprise class hdds. Do Not password protect them.
DO NOT CLONE data drives, copy them always.
If you lose the null spacing on the data it can damage some files.
cymro24 said:
Hi
I factory reset my Samsung A300 few days back but I need my photos recovered. Nothing was backed up. I have tried dumpster app no luck and I have downloaded a recovery software on my laptop to connect phone to but it says it needs rooting? I have tried downloading kingoroot apk on phone but nothing seems to happen . Any help please to get back my photos
Click to expand...
Click to collapse
Unfortunately, there's nothing left to do. You can try to root the phone and try to recover it, if you value these photos so much, but I can't guarantee you the data is not already rewritten.
cymro24 said:
So what your saying then the opposite of lots of posts out there on Google is I can't get this data back after reset ?
Click to expand...
Click to collapse
A Factory Reset reformats phone's internal storage memory, designating the old data on it as logically deleted. “Logically” is the key word here. It means that the pieces of data are not permanently erased ( i.e. erased to 0 ), means writing over them has been made possible. In Windows OS it's called Quick Format.
However, it's proven that user files are easy to recover after a Factory Reset as long as they didn't get overwritten, even with off-the-shelf forensics apps.
jwoegerbauer said:
A Factory Reset reformats phone's internal storage memory, designating the old data on it as logically deleted. “Logically” is the key word here. It means that the pieces of data are not permanently erased ( i.e. overwritten with zero bytes or similar ), means writing over them has been made possible.
However, it's proven that user files are easy to recover after a Factory Reset as long as they didn't get overwritten, even with off-the-shelf forensics apps.
Click to expand...
Click to collapse
If you're not rooted can you access them with software?
No guarentee the critical files weren't overwritten and I do mean files because the folder structure is already destroyed.
Even if you were able to, a jigsaw puzzle of disjionted files not worth the time it would take to reconstruct. Jpeg's missing their exif data alone quickly become a headache best forgotten if not that important.
One corrupted flash card for about a hundred RAW images on it taught me some things are better left dead
Droidriven said:
Data recovery software and root won't do any good in this situation. Their data has been "formatted", not "deleted"
Click to expand...
Click to collapse
It's not zero filled but I agree even if recovered it be a nightmare that keeps on giving. The jpeg images may be intact less their exif files; you'd need to reconstruct all other details from memory about the images
How would I do the rooting to give it try ?
cymro24 said:
So what your saying then the opposite of lots of posts out there on Google is I can't get this data back after reset ?
Click to expand...
Click to collapse
No, data recovery is definitely possible in certain cases, but not in the case of the data being formatted, this is a completely different type of wipe at a deeper, more thorough level than in the case of the data being simply deleted.
Deleted data actually still exists in its full form after being deleted, it is merely "tagged" or "marked" so that the system ignores the data, or more specifically, it ignores the physical storage space where that data is stored until such a time that the system needs that space to write "new" data to be stored. That data can be retrieved by removing the "tag" or "mark" so that the data can read, but only if the physical storage space where that data was stored has not been overwritten by new data.
Factory reset, on the other hand, is an actual physical wipe of the entire physical storage space/partition where said data is stored. This physical wipe, in effect, digitally "shreds" or maybe another analogy would be that it scrambles the data like a blender so that the data is disjointed and out of order so that it is torn apart and no longer readable because the ties that united the data into its cohesive, useable file associations have been torn apart.
It "might", and I strongly stress the word "might", be possible to retrieve the data but it would be a gargantuan task to completely decipher the recovered data in a manner that would allow you to stitch the random bits of data back into their original files. A difficult and virtually impossible task even for the best of the best digital and cryptographic forensic investigators.
Droidriven said:
No, data recovery is definitely possible in certain cases, but not in the case of the data being formatted, this is a completely different type of wipe at a deeper, more thorough level than in the case of the data being simply deleted.
Deleted data actually still exists in its full form after being deleted, it is merely "tagged" or "marked" so that the system ignores the data, or more specifically, it ignores the physical storage space where that data is stored until such a time that the system needs that space to write "new" data to be stored. That data can be retrieved by removing the "tag" or "mark" so that the data can read, but only if the physical storage space where that data was stored has not been overwritten by new data.
Factory reset, on the other hand, is an actual physical wipe of the entire physical storage space/partition where said data is stored. This physical wipe, in effect, digitally "shreds" the data so that it is torn apart and no longer readable.
Click to expand...
Click to collapse
So a factory reset toggles all the logic gates back to zero?
I didn't think it have enough time to do that even with flash memory.
blackhawk said:
So a factory reset toggles all the logic gates back to zero?
I didn't think it have enough time to do that even with flash memory.
Click to expand...
Click to collapse
I'm not certain on that, I'm not versed at that deep of a level in exactly what is going on at the bit by bit level during the format process. I would assume it would not be able to wipe the physical space to the point of being "virgin" space the way it was before any kind of data was ever written to that physical space. "Something" more than likely remains unless you get into deeper levels of formatting or "nuking" the storage space with multiple formatting passes layer by layer. Even then, some kind of data would remain but nothing could ever be pieced back together in any kind of manner. Similar to trying to piece a paper book back together after each page, word and letter have been physically cut apart from each other, you'd only have a vast collection of individual letters with nothing to guide you to tell which letters went with which letters to even form the words they formerly spelled on the page, to piece a paragraph or even a page together would be infinitely more impossible than piecing just a single word back together.
Droidriven said:
I'm not certain on that, I'm not versed at that deep of a level in exactly what is going on at the bit by bit level during the format process. I would assume it would not be able to wipe the physical space to the point of being "virgin" space the way it was before any kind of data was ever written to that physical space. "Something" more than likely remains unless you get into deeper levels of formatting or "nuking" the storage space with multiple formatting passes layer by layer. Even then, some kind of data would remain but nothing could ever be pieced back together in any kind of manner. Similar to trying to piece a paper book back together after each page, word and letter have been physically cut apart from each other, you'd only have a vast collection of individual letters with nothing to guide you to tell which letters went with which letters to even form the words they formerly spelled on the page, to piece a paragraph or even a page together would be infinitely more impossible than piecing just a single word back together.
Click to expand...
Click to collapse
I'm not sure either my guess is it destroys the indexing system. Files but not folders may still exist intact. Like a quick format for a hdd.
I know when I do a low level format on a flash card it takes some time. A .5tb flash drive takes much longer to low level format than a factory reset takes.
All this reminds me of the Fred Gwynn line in Pet Cemetery: "Some things are better left dead."
Many times data recovery turns into a horror tale
blackhawk said:
I'm not sure either my guess is it destroys the indexing system. Files but not folders may still exist intact. Like a quick format for a hdd.
I know when I do a low level format on a flash card it takes some time. A .5tb flash drive takes much longer to low level format than a factory reset takes.
All this reminds me of the Fred Gwynn line in Pet Cemetery: "Some things are better left dead."
Many times data recovery turns into a horror tale
Click to expand...
Click to collapse
If you were to use something like DBAN(Derek's boot and nuke) to run its highest level of secure wipe, it would take many hours to wipe a 5TB drive, possibly even days. There is another higher level of secure wipe that can be achieved by using a certain paid software(I don't remember the name off the top of my head), it could take up to a week or more.
Droidriven said:
If you were to use something like DBAN(Derek's boot and nuke) to run its highest level of secure wipe, it would take many hours to wipe a 5TB drive, possibly even days. There is another higher level of secure wipe that can be achieved by using a certain paid software(I don't remember the name off the top of my head), it could take up to a week or more.
Click to expand...
Click to collapse
The most I'll do is a zero fill and yeah that takes a while for hdds. On flash drives I think a low level format wipes everything, it can recover an unreadable drive. It's not a secure wipe though.
For hdds the 5# sledge hammer erase can do a secure mil spec zero out in less then 30 seconds

Data erasure by password wrongly entered

Hi all,
I'm looking to find a "kill switch" for android phones. I know android already erases data when the wrong password is entered either within android or on boot in some cases. But there is ways of recovering that.
I need to have data completely unrecoverable if a phone is lost or stolen due to business and client data. (Gdpr and all that)
does anyone know or have a solution? Even if the device itself is not usable ever again.
If you override the data in question with zeroes or random numbers then these data are really unrecoverable, IMHO.
jwoegerbauer said:
If you override the data in question with zeroes or random numbers then these data are really unrecoverable, IMHO.
Click to expand...
Click to collapse
I mean the entire phone data
With regards to a mobile my understanding of "data" is that this term is used for account info, settings, saved activity data, game scores, and whatever is need to be kept permanently.

Categories

Resources