Hi, I'm using an LG Optimus L9 and running 4.3 bassed PAC-man rom.
The internal memory is 4GB and after installing a few apps, I started getting "Not enough storage space" warnings.
So, I checked the /data folder and found that there's directory called lost+found which is taking up a lot of space (Above 1.5GB).
I tried deleting files using ES Explorer with the data folder mounted as R+W, but it says "error deleting files"
Is it safe to delete the lost+found folder?
And if yes, how can I delete it since I'm unable to delete it with a file explorer app.
It would be really great if could recover thelost internal memory
void00 said:
Hi, I'm using an LG Optimus L9 and running 4.3 bassed PAC-man rom.
The internal memory is 4GB and after installing a few apps, I started getting "Not enough storage space" warnings.
So, I checked the /data folder and found that there's directory called lost+found which is taking up a lot of space (Above 1.5GB).
I tried deleting files using ES Explorer with the data folder mounted as R+W, but it says "error deleting files"
Is it safe to delete the lost+found folder?
And if yes, how can I delete it since I'm unable to delete it with a file explorer app.
It would be really great if could recover thelost internal memory
Click to expand...
Click to collapse
I don't think there is a problem doing that and change the permission to rwx-rwx-r try and report
sangalaxy said:
I don't think there is a problem doing that and change the permission to rwx-rwx-r try and report
Click to expand...
Click to collapse
I tried deleting the folder through adb shell.
Issued following commands:
adb shell
su
# cd /data
# rm -r lost+found
Click to expand...
Click to collapse
The output was "rm failed for lost+found. Operation not permitted"
Also tried this mounting /data as rw but no luck.
Tried chmod 775 on lost+found but no luck either.
Always getting operation not permitted message.
void00 said:
I tried deleting the folder through adb shell.
Issued following commands:
The output was "rm failed for lost+found. Operation not permitted"
Also tried this mounting /data as rw but no luck.
Tried chmod 775 on lost+found but no luck either.
Always getting operation not permitted message.
Click to expand...
Click to collapse
try r+w+x
sangalaxy said:
try r+w+x
Click to expand...
Click to collapse
Still getting the same error. Operation not permitted.
void00 said:
Still getting the same error. Operation not permitted.
Click to expand...
Click to collapse
may be something preventing it
try a reset and simply format the data in cwm do backup first
sangalaxy said:
may be something preventing it
try a reset and simply format the data in cwm do backup first
Click to expand...
Click to collapse
Using TWRP.
If I backup first, it will also back up the lost+found data
And restoring data will bring it back.
I did format data and system before flashing the rom. So I don't know why the lost+found has so large size.
What should I do?
void00 said:
Using TWRP.
If I backup first, it will also back up the lost+found data
And restoring data will bring it back.
I did format data and system before flashing the rom. So I don't know why the lost+found has so large size.
What should I do?
Click to expand...
Click to collapse
ok so don't backup
if anything goes wrong you can still flash the stock right??
sangalaxy said:
ok so don't backup
if anything goes wrong you can still flash the stock right??
Click to expand...
Click to collapse
hmm, i'll try flashing CWM and then do a format of every partition and freshly flash the rom.
Will report back if there's the same problem.
UPDATE:
Formatted all the partitions including /data/media using CWM
Did a fresh install of rom.
I've got my internal memory back
Thanks!
my 2 cents...
my 2 cents... I've opened the lost+found folder with the file manager (this https://play.google.com/store/apps/details?id=com.rhmsoft.fm), after enabling the root explorer functionality, and deleted a bunch of the biggest files, just checking they were at least 2-3 months old. Rebooted to make sure everything is fine and dandy, and now I've got enough free space, sun is chirping, birds are shining, life is beautiful :silly: :victory:
fabiosirigu said:
my 2 cents... I've opened the lost+found folder with the file manager (this *edited original link*), after enabling the root explorer functionality, and deleted a bunch of the biggest files, just checking they were at least 2-3 months old. Rebooted to make sure everything is fine and dandy, and now I've got enough free space, sun is chirping, birds are shining, life is beautiful :silly: :victory:
Click to expand...
Click to collapse
I was having the same problem. My phone is Samsung Galaxy S2 (GT-i9100). I was on stock Jellybean. But it was starting to feel sluggish and slow. So, having heard about the new Android Kitkat's lower memory requirements and smoother performance, i decided to install Cyanogenmod 11 on it.
Installation was not without problems. At first i flashed Clockworkmod Recovery 6.0.2.9. The phone bricked into a bootloop with a yellow triangle on it. Flashing the Cyanogenmod 11 resulted an error of "Status 7". So i searched for the latest Clockworkmod Recovery, which was at 6.0.4.5. After flashing the 6.0.4.5, Cyanogenmod 11 installed successfully. Performance was really smooth. No lags, no jitter, and everything worked like a charm.
The problem started when i re-installed my applications. Suddenly i got a message of "insufficient storage". This has never happened before. Note, that i previously had large games on my phone like Real Racing 3 and Bard's Tale. This time, i haven't even installed those large games. So i looked at my Storage, and found out that i only had 141mb of free space. But the weird thing is, my reported Apps was only 353mb, from 1.97GB internal storage. So there was over 1GB of storage just vanished.
I browsed for a solution to this problem, and landed on this thread. After reading reply from fabiosirigu, i decided to brave myself, and deleted the content of the lost+found folder (but not the folder itself). I accessed the folder with the built-in File Manager from Cyanogenmod, and set it to "Root Access Mode", and select all folder in the folder, and deleted it. The deletion took quite a few minutes, which felt like ages. Just sat on my bed, crossed my fingers, hoped that nothing will go wrong.
After the deletion, i rebooted my phone. the cyanogenmod logo appeared, and the system booted as usual. I just exhaled a massive sigh of relieve. I went straight to the internal storage, and now it is showing the correct report, 1.67GB of free space.
Thank you for your reply fabiosirigu. Really solved my problem.
lost+found genesis
Let somebody correct me if I'am wrong.
lost+found directory is standard for some unix/linux filesystems. All ext(s) 2, 3 and 4 contains it by default.
The operating system collects unidentified, broken files and its parts inside of l+f dir.
No one of these junks is used by running system.
So - you can look in l+f for some lost, missing files. If you don't miss for any (who knows it better?) then you don't need l+f content.
Related
I need the community's help. I have never posted on XDA cause I have always been able to find the answers I was looking for by searching these forums. This time I am stumped. I am not a noob, but I'm also not a dev or programmer. I have managed, thanks to XDA, to unlock, root and flash a dozen different android devices I've owned without bricking any of them (I admit I'm a flash-a-holic and refuse to get treatment ).
I have a TFP (201) that refuses to download anything from anywhere except the Google Play Store. Cannot download via browser, Amazon app store, Goo Manager, Rom Manager or any other means. In each case it almost immediately tells me that the download was unsuccessful or download errored. I have done dozens of searches and have tried an equal number of so-called fixes with no luck. I have tried every custom rom on the forum, have switched between CWM and TWRP. I have flashed previous backups from TWRP. All to no avail.
Two other issues that may be related; 1- when i run the fix permissions script from inside Rom Manager or from Recovery screen, I get a "an error occurred while attempting to run priviliged commands!" 2- in CWM, when I try to flash older nandroid backups, it tells me that the files are not valid because it can't find the checksum (MD5) corresponding file.
I am currently running aokpcb_tf201_r2.1 with the kernel it comes with, everything else works except no downloading.
Any help would be greatly appreciated.
Can you check to see if your internal SdCard folder has the correct permissions using root explorer? I forget the details of exactly where it is, as I dont have my prime with me, however it is a folder within /data partition... something like /data/media/sdcard or something of that nature.
GooglePlay I believe uses the /cache partition for its downloads, thus I believe these are not throwing errors, whilst everything else is done into the internal sdcard folder.
Same oribkem
kokopuphz said:
Can you check to see if your internal SdCard folder has the correct permissions using root explorer? I forget the details of exactly where it is, as I dont have my prime with me, however it is a folder within /data partition... something like /data/media/sdcard or something of that nature.
GooglePlay I believe uses the /cache partition for its downloads, thus I believe these are not throwing errors, whilst everything else is done into the internal sdcard folder.
Click to expand...
Click to collapse
having the same problem , and you solution didn't work man .
kokopuphz said:
Can you check to see if your internal SdCard folder has the correct permissions using root explorer? I forget the details of exactly where it is, as I dont have my prime with me, however it is a folder within /data partition... something like /data/media/sdcard or something of that nature.
GooglePlay I believe uses the /cache partition for its downloads, thus I believe these are not throwing errors, whilst everything else is done into the internal sdcard folder.
Click to expand...
Click to collapse
This seemed to work. If you go to data/media/download and change the permissions this should fix the problem. I was unable to download anything using any browser or an email attachment.
Sent from my Transformer Prime TF201 using xda app-developers app
This is a mystery. I have a Verizon Samsung Galaxy Note 2, running 4.1.1, rooted. A few days ago I ran out of space on the internal storage so I wanted to move /data/media/Download to /mnt/extSdCard/ and then symlink to it. But I screwed up and accidentally moved all of /data/media to the external SD card. I realized I did that and immediately moved it back to /data/. I did this using the Move command in RootExplorer.
Now I find I can no longer write to /storage/sdcard0/. For example, my S-Note files go there but when I try to save a note it says "Unable to save file". I have another app that also keeps data there and it too complains that it can't write to its own directory on /storage/sdcard0/. I also find there are files on sdcard0 I can't delete myself either with RootExplorer or from a terminal window, even with a "#" prompt.
/sstorage/sdcard0 has perms of 775, owned by root in group sdcard_rw. /storage has perms 775, owned by system in group sdcard_r.
I'm really stumped here. What the heck did I do to my phone? Any help would be *greatly* appreciated. Thanks!
Michele31415 said:
This is a mystery. I have a Verizon Samsung Galaxy Note 2, running 4.1.1, rooted. A few days ago I ran out of space on the internal storage so I wanted to move /data/media/Download to /mnt/extSdCard/ and then symlink to it. But I screwed up and accidentally moved all of /data/media to the external SD card. I realized I did that and immediately moved it back to /data/. I did this using the Move command in RootExplorer.
Now I find I can no longer write to /storage/sdcard0/. For example, my S-Note files go there but when I try to save a note it says "Unable to save file". I have another app that also keeps data there and it too complains that it can't write to its own directory on /storage/sdcard0/. I also find there are files on sdcard0 I can't delete myself either with RootExplorer or from a terminal window, even with a "#" prompt.
/sstorage/sdcard0 has perms of 775, owned by root in group sdcard_rw. /storage has perms 775, owned by system in group sdcard_r.
I'm really stumped here. What the heck did I do to my phone? Any help would be *greatly* appreciated. Thanks!
Click to expand...
Click to collapse
Do you have a nandroid backup? extsdcard and sdcard0 will stay untouched but maybe all you need its the system and data back to working order. I figure that's the first idea. I couldn't say what's happened though.
MunkinDrunky said:
Do you have a nandroid backup? extsdcard and sdcard0 will stay untouched but maybe all you need its the system and data back to working order. I figure that's the first idea. I couldn't say what's happened though.
Click to expand...
Click to collapse
That would be nice but unfortunately I don't have nandroid. I just back up my files to the external SD card with Titanium Backup and then store a copy on my PC. To be honest, I was afraid of screwing up something by running nandroid so I never got it.
In the meantime, none of my apps that are parked on /storage/sdcard0 run anymore, all claiming they can't create files there. The only thing I've been able to do there is chmod and chown but it doesn't seem to help. If I delete a file with Root Explorer, it says it's deleted but when I refresh the directory, it's still there.
I don't see how the two could be related, but I keep coming back to /data/media. I also have a Galaxy S3 that's working. /data/media on the S3 is 775, whereas it was 770 on the Note 2. I changed it to 775 and rebooted - didn't help. I changed the group of /storage from sdcard_r to sdcard_rw - didn't help either.
Could you tell me what the properties are on your Note 2 of /data, /data/media, /storage, and /storage/sdcard0? I'm thinking that Root Explorer munged up something when I moved /data/media/ to the extSdCard and then back again. The subdirectories and files are all there but sdcard0 isn't happy now.
Thanks very much for the reply.
Michele31415 said:
That would be nice but unfortunately I don't have nandroid. I just back up my files to the external SD card with Titanium Backup and then store a copy on my PC. To be honest, I was afraid of screwing up something by running nandroid so I never got it.
In the meantime, none of my apps that are parked on /storage/sdcard0 run anymore, all claiming they can't create files there. The only thing I've been able to do there is chmod and chown but it doesn't seem to help. If I delete a file with Root Explorer, it says it's deleted but when I refresh the directory, it's still there.
I don't see how the two could be related, but I keep coming back to /data/media. I also have a Galaxy S3 that's working. /data/media on the S3 is 775, whereas it was 770 on the Note 2. I changed it to 775 and rebooted - didn't help. I changed the group of /storage from sdcard_r to sdcard_rw - didn't help either.
Could you tell me what the properties are on your Note 2 of /data, /data/media, /storage, and /storage/sdcard0? I'm thinking that Root Explorer munged up something when I moved /data/media/ to the extSdCard and then back again. The subdirectories and files are all there but sdcard0 isn't happy now.
Thanks very much for the reply.
Click to expand...
Click to collapse
Did you want to know what permissions those directories have?
/data rwx rwx --x
/data/media rwx rwx ---
MunkinDrunky said:
Did you want to know what permissions those directories have?
/data rwx rwx --x
/data/media rwx rwx ---
Click to expand...
Click to collapse
Yes, thanks. That's the same I have on the Note 2, so that's not the problem (though oddly enough, on the S3, /data/media is rwxrwxr-x).
Still, it has to be *some* permission somewhere that's wrong and is preventing apps from writing or deleting files they have in sdcard0. What about /storage? I've got:
/storage r-xr-x--- owner=system, group = sdcard_r
/storage/sdcard0 rwxrwxr-x, owner = root, group = sdcard_rw
/storage in particular doesn't seem correct. ???
FWIW, here's someone else with the exact same problem - unfortuntely he didn't get a resolution: http://androidforums.com/android-lounge/716573-unable-delete-move-files-directories-sdcard0.html
And this one too: http://android.stackexchange.com/questions/30113/cant-delete-any-files-in-my-download-folder I tried the same things suggested there and they didn't work for me either.
I dont know enough about the permission system. You said you tried terminal. Maybe try another root enabled file explorer. I've only used es and root browser. Maybe your binaries need to be updated.
You might consider starting fresh if you can't find a solution. From here on out I'd take care to be meticulous and read up on the how to threads for rooting and unlocking bootloader just so you have an idea of where what your going to do fits in with everything else. It sounds like you've just beet rooted and left your phone stock.
Perhaps the internal memory need to be reformatted and everything taken back to a stock working order? If your bootloader is unlocked and you have a custom recovery (like twrp or cw) you could back up all contents of your ext and internal sd to a computer, do a nandroid backup(just in case), and back up your apps with titanium, then wipe everything, system data cache dalvick through recovery then reformat internal sd and re flash the stock rooted image of 4.1.1 or 4.1.2.
If your bootloader is locked up still you could use Odin to get back to stock factory image. You would no longer be rooted but you can then reroot. This is always the end of the line and one can run into some bigger problems here.
MunkinDrunky said:
I dont know enough about the permission system. You said you tried terminal. Maybe try another root enabled file explorer. I've only used es and root browser. Maybe your binaries need to be updated.
Click to expand...
Click to collapse
Yup - I've tried Root Explorer, File Expert, Terminal Emulator, and adb USB from the PC. Same result from all of them. Oddly enough, Root Explorer and FE both claim that files I select on /storage/sdcard0 have been deleted, but when I refresh the file list, they're baaaack...
MunkinDrunky said:
You might consider starting fresh if you can't find a solution. From here on out I'd take care to be meticulous and read up on the how to threads for rooting and unlocking bootloader just so you have an idea of where what your going to do fits in with everything else. It sounds like you've just beet rooted and left your phone stock.
Click to expand...
Click to collapse
Yes, I only flashed the Verizon rooted stock ROM because that's all I needed. I just want to be able to use apps like Titanium Backup, get rid of that stupid clicking sound the camera makes, and other things you need root for. I'm happy with the other features of the standard ROM. I never bothered unlocking the boot loader.
MunkinDrunky said:
Perhaps the internal memory need to be reformatted and everything taken back to a stock working order? If your bootloader is unlocked and you have a custom recovery (like twrp or cw) you could back up all contents of your ext and internal sd to a computer, do a nandroid backup(just in case), and back up your apps with titanium, then wipe everything, system data cache dalvick through recovery then reformat internal sd and re flash the stock rooted image of 4.1.1 or 4.1.2.
Click to expand...
Click to collapse
Yes, I've considered that, and it may come to that. But it's not a very intellectually appealing solution. It's sort of like burning down your house because you've got termites. I'm still hoping there's a less drastic solution. In the meantime, this may be locking the barn door after the horse is gone, but I downloaded a nandroid app and took a nandroid backup. Don't know if wiping and then restoring that will also restore the problem.
MunkinDrunky said:
If your bootloader is locked up still you could use Odin to get back to stock factory image. You would no longer be rooted but you can then reroot. This is always the end of the line and one can run into some bigger problems here.
Click to expand...
Click to collapse
Yup, if that doesn't do it, it's time for a new phone
UPDATE:
I started looking at /data/media and comparing permissions there to what my S3 was showing. It seems /data/media was owned by media_rw in group media_rw on the Note2, but owned by root in group root on the S3. So in adb on the Note 2 I did #chown root:root /data/media. To my surprise, that worked. I then changed the permission from 770 to 775 to match what the S3 has. I then tried saving an S-Note - didn't work. So I went into /data/media/S Note and changed *its* owner/group to root, and permissions to 777 also. I tried saving a note and ... success! It saved it OK.
I'm starting to think that when I copied /data/media back to /data from /mnt/extSdCard/data/media, Root Explorer bollixed up the owner/group/permissions. I'm going to try some other directories there and see if that helps too. And see if this survives a reboot. So that's some progress at least...
That is indeed good news. At least the permission will work through terminal on a subdirectory basis in the media dir. You could recursively change permission for all subdirectory in media. I belive -R probably best to Google that.
MunkinDrunky said:
That is indeed good news. At least the permission will work through terminal on a subdirectory basis in the media dir. You could recursively change permission for all subdirectory in media. I belive -R probably best to Google that.
Click to expand...
Click to collapse
Well that seems to have done it. Everything is working once again. In the final analysis, it appears that you just can't change permissions or delete files from /storage/sdcard0/. However, this is apparently just a mount point (I may be wrong here) for /data/media/ and you *can* change permissions/owners/etc. there. Once I did that, the apps I had that had installed themselves on sdcard0/ started working again. Go figure.
And as a bonus, I got the motivation I needed to start doing nandroid backups and learned a little about the storage hierarchy of Android. So big thumbs up for taking the time to read all this and help me out.
Michele31415 said:
Well that seems to have done it. Everything is working once again. In the final analysis, it appears that you just can't change permissions or delete files from /storage/sdcard0/. However, this is apparently just a mount point (I may be wrong here) for /data/media/ and you *can* change permissions/owners/etc. there. Once I did that, the apps I had that had installed themselves on sdcard0/ started working again. Go figure.
And as a bonus, I got the motivation I needed to start doing nandroid backups and learned a little about the storage hierarchy of Android. So big thumbs up for taking the time to read all this and help me out.
Click to expand...
Click to collapse
Yeah I leaned more bout this too. As an after thought, I have only ever moved items from sdcard0 to extsdcard by going to /storage then copying items from one to another. I too believe this is just a mount point. Nevertheless, probably most items in /data/media you were trying to move to extsdcard are found in sdcard0 and accessible through the mounting folder: /storage, well at least /downloads are there in /storage/sdcard0/ and i have always navigated to /storage first then to /sdcard0/ to grab /downloads or /android/data/ to copy to external whatever.
I know the thread is more than a year old, but I have the same issue here on the Xperia T.
Can't write on /storage/sdcard0
However, I have no idea what to do to fix it. I found a step by step actionplan here:
http://forum.cyanogenmod.org/topic/104879-cm12-issue-with-sd-card-and-wifi-network-detection/
is this what you did?
Unhappy [Q] Problems with deleting files and replacing sounds
HI all! New use here.
I superuser'd my phone, routed my phone, installed CM11 and all is well. It was my understanding that with apps like RootBrowser and or SuperManager i could browse to files change permissions and delete and remove them or replace them.
I am unable to change my lock sound or boot animation.
Ive granted the permissions to the apps and am operating the root browsers in Root mode. (sorry if my terminology is wrong but im new to this) When i try to replace the files in system/media or system/media/audio/ui they simply dont work, "operation failed". I am able to change the permissions on the replacement files going into these directories to match those im overwriting but its still fails.
Ive even successfully deleted the default lock sound but when i paste the new one into the folder it fails and says stuff like "out of space" or "no room" and then when i shut app and go back in the original file is back!
Can anyone help with this as my lovely rooted phone is being very difficult.
Your partition is mounted as read-only, that`s why you get "operation failed".
Mount it as read / write and should be ok.
ngl_ro said:
Your partition is mounted as read-only, that`s why you get "operation failed".
Mount it as read / write and should be ok.
Click to expand...
Click to collapse
Thank you. I now know what to do but not how to do it? Are you able to help or link me to a post on how to do that?
Many thanks
ngl_ro said:
Your partition is mounted as read-only, that`s why you get "operation failed".
Mount it as read / write and should be ok.
Click to expand...
Click to collapse
When i use the app SuperManager to browse the file system to "system" folder it asks me "If you want to modify the file in teh system, you have to mount the system image first. Please choose access mode: System IMage: R/O"
then
"Do nothing Read only R/W" so i chose R/W but that does not fix the problem?
My errors i get are "not enough free space" well there is plenty of that!
So confused....
Any thoughts
Just ignore the "not enough free space".
Cant help you with RootBrowser or SuperManager because I never used them. I use ES File Explorer, and mounting partitions with it always solved my problems with not being able to delete / modify system files / apps.
Hi,
I'm rooted yet cannot mount system folders as r/w. I am definitely rooted (confirmed by using su command in terminal and the fact apps that require root are working) and noticed this issue when trying to install busybox pro.
It warned me that there was an existing busybox in /sbin and would remove it before trying to install in system/xbin but the installation failed.
I tried to remove busybox from /sbin but the folder would not mount as r/w in root explorer OR solid explorer.
I managed to remove the file in TWRP recovery though.
Weirdly, I've been using titanium backup to uninstall system apps without any issues.
How can I fix this? Repair permissions int wrp?
I presume you followed the same instructions as I. I am on the 621 and currently have the same issue (also rooted). But on my end it is actually worse. I cannot mount the system partition in TWRP either (I mean I can mount it but when I try to delete or move a file I get error messages), and something happened to my download manager (which basically means that for the time being I cannot download apps from Google Play or from the internet, etc). I have a good download manager apk, but when I try to install it it asks me if I want to update the existing app, and the operation fails - I have to try and find a 3rd party alternative for the time being). It is kind of a problem.
(to update, I have very limited r/w permissions in TWRP. If I get lucky I can make small changes.)
WastedJoker said:
How can I fix this? Repair permissions int wrp?
Click to expand...
Click to collapse
I don't think so. I tried this, and I eventually was able to view/attempt to edit file permissions inside of X-plore file explorer (don't know if it is a coincidence, but I first had that success opening X-plore in 'mount system r/w' mode after changing the i/o scheduler to cfq). Anyways, it consistently shows all 755/644 permissions, so the permissions are not being re-written upon boot from what I can gather. But if I try to edit permissions or copy files to System folders, I still got error messages to the effect of "you cannot do this,' even though it is a root file explorer and the system partition is purportedly mounted as r/w.
Try flashing this in recovery: SonyRICDefeat by dosomder.
CubicU07 said:
Try flashing this in recovery: SonyRICDefeat by dosomder.
Click to expand...
Click to collapse
Thank you for this. Has anyone ever tried this on the Z3TC? Mine is running smoothly enough such that I am reluctant to fix what isn't broken. It seems that early issues I had with freezes, TWRP, etc, probably had to do with my SD card and the Android media scanner.
I've tried it on the Z3TC SGP621. Thus the recommendation.
CubicU07 said:
Try flashing this in recovery: SonyRICDefeat by dosomder.
Click to expand...
Click to collapse
I have the exact issue in lollipop and I have tried flashing RICDefeat and I get errors.
Sorry for the Hijack :/
Use my RICDefeat from here and run it from terminal. Works only if you are rooted. Afterwards you should have r/w access.
lowtraxx said:
Use my RICDefeat from here and run it from terminal. Works only if you are rooted. Afterwards you should have r/w access.
Click to expand...
Click to collapse
Do you thing that your zip can be used on a Z1C?
Envoyé de mon D5503 en utilisant Tapatalk
Ok, so my wife has a BLU R1 Plus, rooted w/Magisk. She never gets around to telling me what goes on and what problems she's having, but today I had her phone and when I went to charge it, watched a browser window pop up...never a good sign. So I checked it out with MalwareBytes, and yes, kids, there's a trojan, the (in)famous Preinstall Data2, probably installed by BLU itself (although I've had her phone before and never noticed it). Ok, thinks I, this is simple. First freeze it, then rip it from the bowels of the /system directory by the roots (pun intended).
But I can't.
Tried using the paid version of Titanium Backup to freeze it. It reports frozen, but the app is still running and a reboot shows it not frozen. Used Titanium Backup's "open system details" (it doesn't appear in the list of installed apps in the Settings) and used Disable there, with the same results; everything thinks it's frozen until a reboot when it's not again.
So I tried using Root Explorer to make the /system mount R+W, and it couldn't - first time I've ever seen that, and I gotta tell you that concerns me. Next I booted into TWRP recovery and mounted /system there...in this case it WAS writable, which I verified by using TWRP's file manager to move a folder from /system/app to the sdcard partition, checking after a reboot to make sure it was there, then moved it back to /system/app again checking after a reboot to verify it returned. Tried remounting /system with a root terminal, but since there are so many different mount command changes now for the different phones, this one may have been my error.
So apparently I have two separate, and possibly unrelated, issues. Which leads to two questions:
1) Short-term: Since it's intentionally hiding, anyone know what the "Preinstall Data2.apk" is hiding as? (Or does anyone know how to find the location of an APK in the file system from Titanium Backup, either in the UI or inside the backup itself? I poked it pretty hard and can't find it.) If I know it's bogus name, in /system/app or /system/priv-app, I can use TWRP to get rid of the d*mned thing one and for all.
2) Long-term: WTF can I do to fix this thing not allowing me write access to /system ? That's just...wrong, isn't it?
Ok, handled the virus APK...as the folks from TitaniumBackup gently showed me, clicking on the "Current" line in the backup window will show the path to the APK...in this case it was in /data/app, so I didn't need the /system filesystem unlocked to kill the sucker.
Still, would love to know why I can't mount /system R+W...
Even if the app creates something in /data/app/, the real APK is /system/app/preinstallprovider-***_blu_***.apk. You might want to remove it through TWRP.