I recently took my phone to a mobile repair service (unofficial, 3rd party). The phone had fallen into water and had severe water damage - it was non-functional, I was not able to turn it back on and so far the service has not been able to get it to turn on.

I have a mild suspicion they might be doing something shady. So I started thinking - what sensitive data could they possibly be able to access?

The phone model is OnePlus. It's locked with fingerprint, and pattern, which I did NOT give to them. Also, the phone did NOT have full disk encryption, unless there's some kind of default one.

Edit: Phone model comes with Android 6 out of the box, but 90% sure it was upgraded to Android 9. Also, SIM card was removed, I did NOT give it to them.

I'm mostly concerned about:

  • 2FA - AFAIK these are encrypted and impossible to access without unlocking the phone.
  • Google Account passwords (the ones that are auto-saved by Chrome) - I'd assume these are also encrypted, hopefully, someone can confirm that.
  • Photos - since disk encryption was NOT enabled, I'd assume these are freely accessible if you take out the data drive and put it into some special device that's able to read the data?
  • SMS ???
  • app data - notes (Evernote), FB messenger, WhatsApp, Telegram ???
  • cache/temp data ???
  • anything else ???

Any info/input would be greatly appreciated!

  • As long as you don't use an eSIM you can always remove the SIM card before giving your phone to an repair service (no SIM means no SMS reception). Android devices that come with Google services pre-installed have to be encrypted by default since about Android 8.
    – Robert
    Jul 24 at 13:54
  • Forgot to mention - SIM was also removed, I did NOT give it to them. It was an older device, it had Android 6 out of the box, but it was updated to Android 9. Does that mean I had full disk encryption enabled by default?
    – anon111
    Jul 24 at 13:59
  • Then I don't know. Some devices came pre-encyrpted starting with Android 6 but it was not enforced by Google at that time (Google thought about this but later postponed it to a later Android version). For the encryption enforcement the initial Android version is relevant, not the updated.
    – Robert
    Jul 24 at 14:06
  • My only real question here is the bootloader unlocked? If it is, then they can access everything on your device... If it is not and they do not have the security credentials, it is possible without encryption, but extremely unlikely as it would require physical connection the eMMC chip which most repair shops do not have access to. If the bootloader is unlocked, it cannot be done without wiping the devices, so you should be good.
    – acejavelin
    Jul 24 at 17:55
  • The bootloader is NOT unlocked. Thanks!
    – anon111
    Jul 25 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.