1

My S6 Edge was stolen so this question is intended to answer some of my fears. Phone was PIN locked.

  1. Can data from internal storage (like photos) be accessed if a new ROM is flashed and lock is cleared?
  2. Can a new ROM be flashed if device is encrypted?
  3. Does reset via recovery mode console remove the encryption and data?

EDIT:
Some notes
- ROM was all stock
- Usb debug disabled
- No SD card storage expansion on it

  • Was the device rooted and with custom recovery? – beeshyams Apr 14 '17 at 15:07
  • sorry should have mentioned - no, it was all stock, USB debug disabled. – w00t Apr 14 '17 at 17:42
2
  1. See 2. :)
  2. Yes. But to answer the question behind it: without knowing the passphrase, that wouldn't mean encrypted storage became accessible. Passphrase and key are required to decrypt.
  3. A just cuts the power. A should remove data and reset the encryption (as it would clear the encryption key along)

What you left out is data on your SD card. If the card was not encrypted, the data of course can be accessed. Otherwise, see 2. again.

As you report your device stolen, beeshyams pointed out another fact that might be of interest to you (in the now cleaned-up comments): Factory reset protection would be an added complication to the thief. That is, if it was available and enabled on your device (FRP was introduced around Android 5.1.1 but only automatically enabled for devices which originally shipped with Android 5+), even when flashing a new ROM the "possessor" would still need your Google credentials in order to use it. There are ways to work around that, but they don't work on all devices and are also not easy to perform.

  • @beeshyams not flash. Think e.g. of adb shell and adb pull, which are often possible via a custom recovery. Not sure how that deals with encryption then (I know e.g. TWRP can), which is why I originally didn't mention it. I assume, though, that it would require to first enter the passphrase in the custom recovery (how should it decrypt otherwise?) In short, to your original comment: FRP has nothing to do with protecting your data – it's about making the device useless for the "illegal possessor". Which is not what OP wanted to know ;) – Izzy Apr 14 '17 at 16:18
  • thanks. How about if there was no encryption for 1)? Also, by hard reset I meant Volume Up+Home button+Power button which boots in recovery mode and allows wipe. I'm not sure how FRP would work in this case. Not a problem re SD card, didn't have one. – w00t Apr 14 '17 at 20:46
  • Might be worthwile to note that the device does not show up in my findmymobile.samsung.com account anymore, which I think means the device has been wiped - or at least this is what the samsung rep tried to explain. – w00t Apr 14 '17 at 20:49
  • 1
    @w00t without encryption, a so called "dirty flash" would be able to access your files, provided the lock can be worked around. IOW: that flash wouldn't change anything in this regard, as the lock remains intact – unless it comes with different system defaults (e.g. ADB enabled and no security check on that). And no, a hard-reset is "pulling the battery"; what you describe is a factory reset. I'm not sure concerning FRP either; vaguely remember only one of the two approaches (settings vs. recovery) can kill it; IMHO the one via settings, as there the user was authentified. – Izzy Apr 14 '17 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.