Recovery approach for lost partition and encrypted F2FS

by TonyH   Last Updated August 13, 2019 17:11 PM

The Problem and Mystery

My ZTE Axon 7 [Android 7] inexplicably wiped its emulated storage area /storage/emulated/0 while retaining all installed applications, albeit with settings wiped clean. There was also a 256GB sd-card mounted as a add-on, system space. I think it was configured as F2FS and encrypted. I've stopped using it and bought a new phone. I want to image the phone's internal memory and the sd-card, and recover what I can that wasn't backed up. I don't know the best approach, but know there are some hurdles, which I'm unsure how to approach.

  1. What is the best way to image phone memory? Recovery mode and ADB?

    • The F2FS and internal memory may have been re-partitioned and/or reformatted
    • Getting the image would allow me to scan for text, strings, and file signatures
  2. Where is the encryption key normally kept? Is it backed up anywhere?

    • The original file systems are likely encrypted, and would need a key
    • I know the phone would store this somewhere, but unsure how to retrieve it.
    • Key may have been overwritten or reset, since I didn't immediately realize something happenend, plus don't fully comprehend what did.
  3. Is there any way to view the contents of a GDrive backup? Any chance it contains key?

    • There is some backup data on Google Drive, but haven't viewed yet
    • This backup may also have been overwritten, since I see no versioning info
    • Backup data is not very large. Maybe a few megabytes.
  4. How did this happen? Does my story below add up?

    • I'm hoping there's an alternative cause and fix to this

How it happened

Not sure since I was using Android Auto for navigation and music, and the phone was normal. At some point the phone became "weird" with the wrong launcher, which I ascribed to accidentally pressing a wrong button and activating another launcher (I had several installed), and I switched to my wife's phone. Later I realized every app was "weird" and then checked the FS and realized everything, photos, docs, were missing even at the file system level.

Maybe I pushed a system upgrade prompt, or confirmed some other crazy phone action. I was driving and don't know.



Related Questions


Updated June 03, 2017 08:11 AM

Updated August 19, 2019 18:11 PM

Updated May 02, 2016 08:04 AM

Updated November 04, 2018 12:11 PM

Updated July 06, 2019 03:11 AM