my android is hacked - Android Q&A, Help & Troubleshooting

so someone hacked my android, they watched me through camera and everything and when i do factory reset i think i cant delete all files because i still have some files in hidden files and i dont have recycling bin for images like before. i also find out he was addin some kind of codes on images and on calendar and other small system apps. so what should i do.

The same happened to me. Someone had full control over my phone, even in recovery mode (I had twrp). I unrooted it and instal stock rom, but I don't know man... Is there a way to be sure my phone is clean? How to check, is the spy app or something, still there or not?

newhere321 said:
so someone hacked my android, they watched me through camera and everything and when i do factory reset i think i cant delete all files because i still have some files in hidden files and i dont have recycling bin for images like before. i also find out he was addin some kind of codes on images and on calendar and other small system apps. so what should i do.
Click to expand...
Click to collapse
Throw your phone away

Related

[Q] Is there a way to recover deleted files?

Just realized I accidentally deleted a picture from the SD card on my Hero awhile ago. The card is quite big and has never been close to being full so I'm wondering if there is a deleted folder on the card or some way to recover the file?
As far as I know, only recovery programs as used by the police, government etc can recover deleted files. You can download loads off the internet, but they are designed to reconstruct the magnetic residue on hard discs, don't know if it will work on a flash drive. Won't hurt to try though.
TheReverend210 said:
As far as I know, only recovery programs as used by the police, government etc can recover deleted files. You can download loads off the internet, but they are designed to reconstruct the magnetic residue on hard discs, don't know if it will work on a flash drive. Won't hurt to try though.
Click to expand...
Click to collapse
This person doesnt appear to know what they are talking about, no offense.
Data recovery is possible (in theory) on all types of media. When a file is deleted, the space it occupied is marked as unused by the system. The file isn't actually "deleted" until something else has written over its space.
however, due to the random nature of writes to the disk, and given that you said "while" I presume there will have been many writes to the disk since, the chances of recovering the file fully are reduced.
recovery software: a good free one is http://www.piriform.com/recuva
http://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm
Is a good piece commercial software, but the free 1gb trial should be enough to give it a try.
"reconstructing magnetic residue" is what "professional" data recovery companies might attempt I guess. sounds a little fishy to me though.
So you say I don't know what im talking about with recovery programs and the like, then point the op to 2 recovery programs. Recovery programs which, no doubt, will try to reconstruct the files from the left over magnetism of the old file.
Incidentally, I know when a file is "deleted" the memory sectors are merely market as unused, so new data can be written there, but still the only way of recovering them files is with a recovery program.
use "testdisk"
http://www.cgsecurity.org/wiki/TestDisk
Actually there is no such folder exist on card which kept the deleted files or etc but don't worry just try a good third party data recovery software for the recovery of your data and files. Try Kernel for FAT and NTFS data recovery software for the recovery of your files.
TheReverend210 said:
So you say I don't know what im talking about with recovery programs and the like, then point the op to 2 recovery programs. Recovery programs which, no doubt, will try to reconstruct the files from the left over magnetism of the old file.
.
Click to expand...
Click to collapse
Yes, You DON'T Know. And since you don' know please, don't give anyone "information". Police recovery software... BUNKO! we use the plain old software everyone else uses and there is no recovery of "left over magnetism" shXt ... Go play in your sandbox after mom changes your diaper, and let the adults do the helping here.
A good way to recover deleted files from HTC Hero android phone is to use HTC android data recovery program, here's a good one: HTC Android phone data recovery
The data recovery program recovers data from both HTC Hero phone internal memory and SD card. Recommend that you try it.
rpimps said:
Just realized I accidentally deleted a picture from the SD card on my Hero awhile ago. The card is quite big and has never been close to being full so I'm wondering if there is a deleted folder on the card or some way to recover the file?
Click to expand...
Click to collapse
Hi, you can also use Kvisoft Data Recovery for Mac to recover deleted pictures from SD card of Hero phone,
Code:
Here is the detailed guide shows you how to recover files from mobile phone
kvisoft.com/tutorials/mobile-phone-data-recovery.html
hope this helps!

Deleted Phone.apk

I deleted my the Phone.apk file on my rooted Galaxy Player 4.0 (YP-G1CWY/XAA) running the stock rom awhile back to save on battery life.
I have done the same thing on my Nook Color, and figured that it wouldn't cause any problems, as the Player isnt a phone.
Recently tried to record some video, and found I was unable to do so. After doing some research I found out that deleting phone.apk causes the stock camera app, but not 3rd party camera apps, to stop functioning.
While I was sure to backup the file when I originally deleted the file, the backup has been lost in the intervening months.
Do I just need to find a specific phone.apk file for my device and return it to the correct directory?
I assume a factory reset will solve the problem, but I would rather not try that unless I have to.
Thanks!
a factory reset will not solve the problem, since it was a system .apk it will reset everything except for that particular apk.
heet1 said:
a factory reset will not solve the problem, since it was a system .apk it will reset everything except for that particular apk.
Click to expand...
Click to collapse
In which case do I need to track down a copy of that specific apk or will I need to download odin and perform a full recovery?
put back the phone.apk file back on your device. Go to a ROM(best if its that ROM you are using) Find the phone.apk, and take it out. Then transfer it into your device, and use Root Explorer or something and put back phone.apk.
i dont think that will work because i uninstalled the screencapture.apk from my 5.0 and i backed it up so i tried to reinstal and it would not let me... but try aznflawless' way first if not you may want to flash a stock based rom...
heet1 said:
i dont think that will work because i uninstalled the screencapture.apk from my 5.0 and i backed it up so i tried to reinstal and it would not let me... but try aznflawless' way first if not you may want to flash a stock based rom...
Click to expand...
Click to collapse
I put screencapture.apk from stock rom 2 chip rom because it was missing and worked normaly..just copy it 2 root/system/app ..dont install it.
Sent from my GT-I9000 using XDA
aznflawless said:
put back the phone.apk file back on your device. Go to a ROM(best if its that ROM you are using) Find the phone.apk, and take it out. Then transfer it into your device, and use Root Explorer or something and put back phone.apk.
Click to expand...
Click to collapse
This seemed to work for me!
I tried looking in various roms before, but they were all formatted for flashing with odin.
I should have just went straight for the cwm package. *slaps forehead*
Thanks so much!
i shall try that sir thanks
As others said... find the phone.apk... preferably from the same rom you are using... use RootExplorer and copy the phone.apk to the system/apps folder. Change the permissions to match the other apps in that folder... reboot and you are good to go.
For your future reference, it is not a good idea to delete system apps without knowing what they actually do... I think you made a real good guess since phone.apk should not be on a device that is actually not a phone by function. For example, the Android Market app is actually called phonesky.apk or vendor.apk... nothing like what you would normally guess it to be, such as market.apk or something to that matter. So if I were you and I wanted to keep using my device and not brick it, I would becareful what I delete out of /system and it's sub folders...
Good luck...
Try to reinstall your custom rom!!
OrglCe said:
Try to reinstall your custom rom!!
Click to expand...
Click to collapse
this is a thread from august of 2012. please dont go digging through old threads and posting on them

Factory reset - What EXACTLY happens?

Hello,
In my question, What EXACTLY happens during a factory reset, the emphasis is, obviously, on "exactly". I will explain why I need to know this - the research I've done has failed to answer my question.
Carrier-phones come with a bunch of pre-installed apps. Of all possible scenarios, Japanese smartphones, and particularly Sharp smartphones, are the worst case. They are very difficult to root, very finicky phones that seem to go into a boot loop whenever you do something to them that you're not supposed to - all the more challenging
If we manage to root a Sharp phone, the first thing we do is freeze some of the Docomo or Softbank pre-installed apps that take up precious memory. We know that if we want to do a factory reset, we must first un-freeze all those apps, or we risk going into a boot loop, and having to ship the phone back to Japan to get repaired (for those of use who don't live in Japan).
Now, the million dollar question is, what happens if we delete/uninstall those system apps? And here I am asking about the general case, hoping that Sharp haven't invented some twisted scheme here too.
When we do a factory reset, how does the phone know what was - and what is supposed to be - in the /system/apps folder? Hence: What EXACTLY happens during a factory reset?
Does the phone look up a file which contains a list of all those pre-installed app, and verify the contents of the /system/app folder against it --- and if something is missing, it gets stuck during reboot? Or does it simply delete the contents of the /data folder, without paying attention to /system/app? And why does it go into a boot loop, if a system app was frozen?
In the end, I don't simply want to freeze some apps, I want to get rid of them completely --- you can't imagine the load of BS that Japanese carriers cram into their phones (a built-in Rakuten auctions app, a McDonald's app, a BeeTV app??? and so on and so forth) --- but I want to make sure the phone isn't checking what's supposed to be in /system/app.
---------------------
In the case of my 005SH, the rootkit came with a recovery that helps me "resurrect" the phone from a boot loop - and that has happened twice after a factory reset so far - I deleted some seemingly insignificant app, and Titanium Backup failed to restore it for some reason, so it's now gone forever. But not every rootkit comes with a proper recovery...
cheeseus said:
Now, the million dollar question is, what happens if we delete/uninstall those system apps?
Click to expand...
Click to collapse
Some system apps are important for the device to run properly and some are just bloatware that can be deleted without harm (e.g, Youtube, ChatOn.. etc). There are several app lists in the forum of safe app to remove (this is one).
But I advice you not to play with system apps if you don't know which app is safe to remove.
cheeseus said:
When we do a factory reset, how does the phone know what was - and what is supposed to be - in the /system/apps folder? Hence: What EXACTLY happens during a factory reset?
Click to expand...
Click to collapse
All app in system partition will be restored as if it was first time to be run, although all of your installed app, contacts, sms, WiFi access and data will be deleted
majdinj said:
Some system apps are important for the device to run properly and some are just bloatware that can be deleted without harm (e.g, Youtube, ChatOn.. etc). There are several app lists in the forum of safe app to remove (this is one).
But I advice you not to play with system apps if you don't know which app is safe to remove.
All app in system partition will be restored as if it was first time to be run, although all of your installed app, contacts, sms, WiFi access and data will be deleted
Click to expand...
Click to collapse
Thanks but this does not answer my question. I know perfectly well which apps are bloatware and which are essential. I will restate my question:
Is there some register or list, which the phone checks during factory reset, and which says what apps were originally installed in /system/app? That is, will the phone "know" that I have removed some of the original apps?
cheeseus said:
Thanks but this does not answer my question. I know perfectly well which apps are bloatware and which are essential. I will restate my question:
Is there some register or list, which the phone checks during factory reset, and which says what apps were originally installed in /system/app? That is, will the phone "know" that I have removed some of the original apps?
Click to expand...
Click to collapse
As I mentioned, factory reset will delete all data apps that can be found in data partition not those found in system partition.. If it happens some of original apps are installed in data partition, then they will be deleted (unless if they are found in preload partition!!).. I can't be clear more than this..
majdinj said:
As I mentioned, factory reset will delete all data apps that can be found in data partition not those found in system partition.. If it happens some of original apps are installed in data partition, then they will be deleted (unless if they are found in preload partition!!).. I can't be clear more than this..
Click to expand...
Click to collapse
Really, read my question carefully, please, not just the title of the thread. You are talking about something very different.
It is known that on Japanese Sharp phones, if you uninstall and remove completely some of the apps that are installed by the manufacturer or the carrier in /system/app, when you do a factory reset, the phone may - or even will - go into a boot loop (will be bricked). This has nothing to do with apps that are installed in /data.
Is it possible that Sharp have added an extra "security" mechanism to their phones to prevent users from removing pre-installed apps (similar to their MIYABI LSM lock)? I want to know how to find this security mechanism, if it exists, and - hopefully, how to cheat it.
How does the phone know what apps are supposed to be in /system/app, and if it doesn't find them when rebooting after a factory reset, why does it go into a boot loop?

[Q] What should I Back Up?

So now that I have root on my phone, using Titanium Backup, WHAT should I backup? I mean... my phone doesn't have inherent instability now does it?
Or does the instability (possibly) come from xposed modules I install?
Are there sets of steps I should take before installing new root apps?
Thanks!
-Matt
Root details:
Verizon S4 (sch-i545)
Stock ROM (4.4.2)
Back up anything you would miss loosing if something happed. For me thats nothing, for others thats maybe a particular apk version, or an apps data.
What do you need to do before installing root apps? Root apps are just programs that require admin rights. Nothing magic, do whatever that app might need, which is probably nothing.
It is generally good to have a full system backup from your recovery... For when you try to do _______ and **** it up.
scryan said:
Back up anything you would miss loosing if something happed. For me thats nothing, for others thats maybe a particular apk version, or an apps data.
What do you need to do before installing root apps? Root apps are just programs that require admin rights. Nothing magic, do whatever that app might need, which is probably nothing.
It is generally good to have a full system backup from your recovery... For when you try to do _______ and **** it up.
Click to expand...
Click to collapse
Okay great! I already backed up any folders (pictures, pdfs from camsacanner, roms) to my computer via usb before rooting... so...
So when people are talking about TWRP/CWmod recovery... how is it different from stock recovery?
So basically a custom recovery is an all in one answer that allows you to back up EVERYTHING but also allows you to back up EVERYTHING in one blow?
blueman189 said:
Okay great! I already backed up any folders (pictures, pdfs from camsacanner, roms) to my computer via usb before rooting... so...
So when people are talking about TWRP/CWmod recovery... how is it different from stock recovery?
So basically a custom recovery is an all in one answer that allows you to back up EVERYTHING but also allows you to back up EVERYTHING in one blow?
Click to expand...
Click to collapse
Stock recovery will let you do a factory wipe to basically clear data and reset your system to recover from something that messes up your install and makes your phone unusable.
Custom recoveries allow you to flash unofficial files, as well as take basically a snapshot of your system. With a custom recovery you can make a backup of your phone, and almost no matter what happens, you can flash that backup and it will be like nothing happened.
So when you try and run some xposed module that isn't written well, and now makes your phone crash every 2 minutes, you can boot to recovery and flash back to the backup you took right before you installed that module, and it will be like you never did it.
The recovery images are kinda large, as its all your data/apps/the OS all in one. Many custom recoveries will have a file manager that will allow you to deal with files individually, but most typically the point is taking a snapshot of your current system so you can go back to it. I make backups before trying a new rom, that way if after a little bit I am not happy I just flash back and its like I never changed anything.

Urgent: Recover deleted photos/videos from internal memory (Galaxy S6)

Dear guys,
I accidentially deleted around 70 GB of videos and photos on my Galaxy S6 128 GB (SM-G920F, Android 6.0.1, G920FXXU3DPDP). I was so stupid to try to move the camera folder instead of copying it to the computer and since the process was aborted it was gone from my phone and not on my computer. I'm missing a lot of family pictures and videos that were very very valuable for me.
My phone is rooted (odin) and the root works properly. I tried several recovery programs, some are working in general and are requesting supersuser rights (like phone paw android recovery) - but can't find any of the deleted images and videos. Others (like Wondershare Dr..Fon Android recovery) do not work properly (it gets superuser rights but in the last step before scanning the phone it tries to get (other?) super user rights that are not properly requested).
I should be gratefull for any kind of help. Please let me know if you need any additional information. It would be the biggest present to get back any of the many photos and videos I lost.
Best,
Sonstiger
Or does anybody have an idea where I could find help? The photos and videos are precious memories of my daughter and two holidays.
Thankfull for every help!
An addition: I wouldn't mind if the procedure to recover (part) of the photos / videos would break my phone.
you didn't have any back-up solution? try some photo recovery apps from play Store like: DiskDigger or DigDeep Image Recovery, i can recover almost all deleted photos but have no experience abt recover video
In the past I've had phenomenal success with Dumpster: https://play.google.com/store/apps/details?id=com.baloota.dumpster&hl=en
Of course I can't guarantee anything, as file deletion and recovery is a bit.... weird. However, with Dumpster I've been able to recover many photos on multiple occasions, even really old ones (months, maybe even a year for a few of them) I had forgotten I had deleted. I didn't even have it installed before deleting said photos either. That being said, since your photos/videos are freshly deleted, it may work out for you.
Good luck!
Thanks ubergeek77.
Unfortunately, Dumpster only recovers files that have been deleted after Dumpster has been installed. So it can't help in my case.
Any other ideas?
And there are some more promising tools for the PC. E.g. I tried Wondershare Dr.Fone for Android. It scans my phone (with superuser permission). But not a single photo / video of the ones that I deleted (70 GB) are found. What could be the problem here? Anybody out there who can help me and finds the time to reply?
Connect your phone to your Pc and try some recovery software like EaseUS..... (this is not a free software but you can install trial version).
hope it help.
Next time, if the transferring process is aborted , just undo and get back your file right from PC.
None of this tools found relevant photos or videos from the 70 GB i lost. I will now try to get an image of the data partition to recover the files on PC. Anybody can help me here?
I was now able to copy an image of the data partition on my computer -- using Photorec I could scan this partition for lost files. Unfortunately only undeleted or not relevant files were found. None of the files of the 70 GB deleted pictures and videos. But there have been tousands of files (from 4 MB each) extraced with the file extensions ".elf" and ".sqlite". I assume that these files are my lost photos and videos and that they, for any reason, cannot be assigned correctly .
This may be related to the file system ext4? Or the blocksize? Or any other reason related to the fact that these files were not deleted the standard way but while trying to move a to big folder to my PC.
What can I do here? I would be gratefull if any expert here being familiar with the ext4 filesystem or Android partititions could help me in any form. Please let me know if you need an additional information.
Looking forward to any reply. Thanks!
Sonstiger said:
Thanks ubergeek77.
Unfortunately, Dumpster only recovers files that have been deleted after Dumpster has been installed. So it can't help in my case.
Any other ideas?
Click to expand...
Click to collapse
Very sorry! I totally misremembered what app I used. I just checked, and it was definitely DiskDigger, it works without having been installed first, and works even better with root: https://play.google.com/store/apps/details?id=com.defianttech.diskdigger
Sorry for the confusion!
The results I mentioned were with root, so that may be something to keep in mind.
Also, I'm not 100% sure if TWRP backups are 1:1, but you should research a way to make a complete raw filesystem backup of your device if DiskDigger doesn't work. The more you use this phone, the more you risk losing some of those photos. With a raw disk image, you could mount it in Linux and throw every recovery tool you can find at it.
Best of luck. If I run across anything that may help, I'll be sure to post it here.
Recover Deleted Data From Galaxy Phone
It is quite sad to hear that your 70 GB data is deleted. But, don’t worry here are few steps which will help you to recover your deleted data from your Galaxy phone. Even I have tried out these steps and recovered my deleted data. Here, are the steps:
1. Connect Your Android device
2. Choose file types to Scan
3. Scan your device to find the lost data on it
4. Preview and recover deleted data on Android devices
Hope that these methods work for you. For more information go to:
androiddata-recovery.com/blog/samsung-galaxy-mega-data-recovery-recover-lostdeleted-files-from-samsung-galaxy-mega

Categories

Resources