How do I know which root method was used to root a phone?

Question

Let's say you got a rooted Android phone but you want to find out how it was rooted. Is there a way to know which method was used to root it?

Answer 1

In general, no.

The basic goal of rooting is to place an executable su binary somewhere accessible via $PATH. Nothing else needs to be left behind. The specific exploit that was used need not have side-effects, and multiple different tools could use the same exploit anyways. In fact, there need not even be an exploit — many devices just let you unlock the bootloader and flash or otherwise load su in a straightforward manner.

If you know that a specific root tool does leave behind a signature, you could check for it, but in my experience that is not typical.