There is a folder at internal memory: .space/

Inside it has one folder that is a big hash name (probably sha1sum), and inside that folder there are lots of files (also named as a hash something like 60b725f10c9c85c70d97880dfe8191b3.space) occupying 2.7GB of my smartphone precious internal memory.

In hexa/chars/bytes, thru X-Plore File Manager, I saw that they begin with "PK", which means they are ZIP files. So, after renaming them to .ZIP, I saw many pictures inside them that were all about games, and the manifest.xml was Uber annoying to try to read.

My conclusion, they were all unwanted, unasked, auto-downloaded .ZIP (.APK?) games.

Now I need to stop the app doing that kind of thing on my precious cellphone's memory.

  • It is possible to monitor a certain path for file-system changes. Unfortunately it is not possible to get the information which process/app did perform the change :(
    – Robert
    Dec 25, 2018 at 12:29
  • @Robert is there some kind of lsof (linux like) to catch the culprit in action? Dec 25, 2018 at 18:30

2 Answers 2


It looks like a malicious or spamming app. Did you download any app from a suspicious looking website in a date close to the date the .space files were created/modified, as mentioned in the explorer app? Then that downloaded app could be the culprit.

It is not usually possible to directly check what app downloads a specific file, but you can try checking Data Usage and look for apps using suspiciously large bandwidth amounts.

The location of the Data Usage statistics is sometimes different depending on the device and the Android version, but you can usually find the statistics in Settings > Wireless & Networks > Data Usage. If you can't find it there you can try typing "Data Usage" in the settings search box. You can choose to show Wi-Fi usage from the menu button on top right corner, and then you can look for any suspicious apps using large amounts of bandwidth and uninstall them.

  • mmm... data usage may give tips, but it didnt necessarily download it all in a short time :/, I forgot to check the files date time b4 deleting them! ahhhh dammit!! too late now! :( Dec 25, 2018 at 18:31

Since Android is based on Linux kernel, you can make use of its Auditing System to find the process which is making changes to your device. For that you need to use auditctl tool for defining rules (root required), and you would get details about the changes in logs through dmesg or logcat. Fo more details on how to define rules, see this answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .