1

The Problem and Mystery

My ZTE Axon 7 [Android 7] inexplicably wiped its emulated storage area /storage/emulated/0 while retaining all installed applications, albeit with settings wiped clean. There was also a 256GB sd-card mounted as a add-on, system space. I think it was configured as F2FS and encrypted. I've stopped using it and bought a new phone. I want to image the phone's internal memory and the sd-card, and recover what I can that wasn't backed up. I don't know the best approach, but know there are some hurdles, which I'm unsure how to approach.

  1. What is the best way to image phone memory? Recovery mode and ADB?

    • The F2FS and internal memory may have been re-partitioned and/or reformatted
    • Getting the image would allow me to scan for text, strings, and file signatures
  2. Where is the encryption key normally kept? Is it backed up anywhere?

    • The original file systems are likely encrypted, and would need a key
    • I know the phone would store this somewhere, but unsure how to retrieve it.
    • Key may have been overwritten or reset, since I didn't immediately realize something happenend, plus don't fully comprehend what did.
  3. Is there any way to view the contents of a GDrive backup? Any chance it contains key?

    • There is some backup data on Google Drive, but haven't viewed yet
    • This backup may also have been overwritten, since I see no versioning info
    • Backup data is not very large. Maybe a few megabytes.
  4. How did this happen? Does my story below add up?

    • I'm hoping there's an alternative cause and fix to this

How it happened

Not sure since I was using Android Auto for navigation and music, and the phone was normal. At some point the phone became "weird" with the wrong launcher, which I ascribed to accidentally pressing a wrong button and activating another launcher (I had several installed), and I switched to my wife's phone. Later I realized every app was "weird" and then checked the FS and realized everything, photos, docs, were missing even at the file system level.

Maybe I pushed a system upgrade prompt, or confirmed some other crazy phone action. I was driving and don't know.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.