The Problem and Mystery
My ZTE Axon 7 [Android 7] inexplicably wiped its emulated storage area
/storage/emulated/0 while retaining all installed applications, albeit with settings wiped clean. There was also a 256GB sd-card mounted as a add-on, system space. I think it was configured as F2FS and encrypted. I've stopped using it and bought a new phone. I want to image the phone's internal memory and the sd-card, and recover what I can that wasn't backed up. I don't know the best approach, but know there are some hurdles, which I'm unsure how to approach.
What is the best way to image phone memory? Recovery mode and ADB?
- The F2FS and internal memory may have been re-partitioned and/or reformatted
- Getting the image would allow me to scan for text, strings, and file signatures
Where is the encryption key normally kept? Is it backed up anywhere?
- The original file systems are likely encrypted, and would need a key
- I know the phone would store this somewhere, but unsure how to retrieve it.
- Key may have been overwritten or reset, since I didn't immediately realize something happenend, plus don't fully comprehend what did.
Is there any way to view the contents of a GDrive backup? Any chance it contains key?
- There is some backup data on Google Drive, but haven't viewed yet
- This backup may also have been overwritten, since I see no versioning info
- Backup data is not very large. Maybe a few megabytes.
How did this happen? Does my story below add up?
- I'm hoping there's an alternative cause and fix to this
How it happened
Not sure since I was using Android Auto for navigation and music, and the phone was normal. At some point the phone became "weird" with the wrong launcher, which I ascribed to accidentally pressing a wrong button and activating another launcher (I had several installed), and I switched to my wife's phone. Later I realized every app was "weird" and then checked the FS and realized everything, photos, docs, were missing even at the file system level.
Maybe I pushed a system upgrade prompt, or confirmed some other crazy phone action. I was driving and don't know.