My brother died unexpectedly two weeks ago and I am trying to access data on his Google Pixel 2 XL. At this time, I have access to the google account that he used with the phone but I changed the password so "Find My Device" via Google cannot locate his device. I've verified that the phone was backed up at some point on the day he died, but am unsure of the time and am unsure of exactly what was backed up. I've done lots of research online and I've come to the conclusion that the only way to access the phone now is to enter recovery mode via the phone and wipe the phone and restore from the back up. I've found conflicting information about what the downside is to this approach. First, I know that I can only restore what was backed up. I'm okay with that. But I saw somewhere that the passcode for the phone is still necessary if you want to go this route. Is this true? I do not have the passcode and do not want to get stuck in the middle of trying to restore the phone. Second, will this approach erase all logins and passwords for all the apps that he currently had on the phone? What problems could this approach create as I try to further piece together his digital accounts/ information? Would it be possible to find out what his passcode was? This would help with all the other devices he has.
Finally, is there any way to look at the backup stored on the google drive without wiping and recovering the data to the actual phone? I do not want to do anything illegal; I'm just trying to piece together his last days. I'm the legal next of kin.
Thanks in advance for your help.
Someone else made a very similar post the other day....
The best thing to do do is this: https://support.google.com/accounts/troubleshooter/6357590
This is the only legal way to try and access someones account after death, and even then it my be limited:
In certain circumstances we may provide content from a deceased user's account. In all of these cases, our primary responsibility is to keep people's information secure, safe, and private. We cannot provide passwords or other login details. Any decision to satisfy a request about a deceased user will be made only after a careful review.
If Google themselves cannot provide password and logins, or data, then sorry, but no one here is able or going to help you break google security.
Knowing the passcode of one device wont help you with others, they can be different
Not knowing what youre hoping to recover, no one can tell you whether it accessible via google services
Depending on the phone there may be a lock that survives recovery wiping and is linked to the account, because its designed for preventing exactly what youre trying to do, and beat security.
Security is there for a reason, and not trivial.
So i refer you again to the google link above....
And a good reminder to not forget to enable inactive account manager, to avoid all this yourself: https://support.google.com/accounts/answer/3036546?hl=en
npchilders said:
My brother died unexpectedly two weeks ago and I am trying to access data on his Google Pixel 2 XL.
Click to expand...
Click to collapse
When setting up a device after a factory reset Android will ask for the email address and password of the last account used. Based upon your post, you have that information so you will be able to continue. If I recall correctly it won't ask for the pin as that is a local security feature and not backed up. His contacts and text messages should be restored after the factory reset. Usernames and passwords for non-Google apps may be restored, if I recall correctly, but keys for 2FA apps will not be restored. If your brother used 2FA you won't be able to access the accounts using 2FA unless he had backup codes stored somewhere on his PC.
Unfortunately, there is no way to look at the backup, as Google doesn't make the backup visible to the user in Google Drive.
Thank you.
Strephon Alkhalikoi said:
When setting up a device after a factory reset Android will ask for the email address and password of the last account used. Based upon your post, you have that information so you will be able to continue. If I recall correctly it won't ask for the pin as that is a local security feature and not backed up. His contacts and text messages should be restored after the factory reset. Usernames and passwords for non-Google apps may be restored, if I recall correctly, but keys for 2FA apps will not be restored. If your brother used 2FA you won't be able to access the accounts using 2FA unless he had backup codes stored somewhere on his PC.
Unfortunately, there is no way to look at the backup, as Google doesn't make the backup visible to the user in Google Drive.
Click to expand...
Click to collapse
Thank you! I have the information I need. I was just concerned that I would need a passcode and then I would get stuck. Otherwise, I located the backup on the google drive and can see that it was actually backed up on the day he died, so there should be very little data loss. Thanks so much.
Related
I got a nasty bit of adware from the internet--clicked a banner by mistake. Now I get popups telling me my SIM card is 58% infected, etc, and it wants to redirect me to download some app to remove it, etc. I never downloaded their app, but the persistent popups need to go.
I've tried running ~5 anti-virus/anti adware apps, none of which can even identify a suspicious program. I've done factory resets, which seem to fix the issue for 2 weeks, but then the popups recur. I figured it was either somewhere deep in my phone that didn't get erased with a factory reset, or it was being synced to my phone from my linked google account (I use project FI, and have to have a google account linked to the phone to have service).
So most recently, I installed TWRP, and wiped everything (cache, dalvik, data, system...completely removed the OS). While the phone was in that state, I used my laptop and cleared all my google sync data, removed all stored google data, and reset all settings to default. I then reinstalled stock Bullhead Oreo 8.1 over a USB. However, it again worked fine for 2 weeks before popups returned.
Is there some deep recess in my phone that I am not effectively deleting? Could it be syncing over my google account somehow (I don't have this problem on any other device with my google account on it)? Could it actually be my SIM card that infected?
I appreciate your help!
It's possible for a Sim card to get malware, but I haven't heard of anything specific. Are you restoring apps from Google? And if so, are there any sketchy apps you're restoring? Those are the only two areas I can think of where malware could be coming from. A complete os restore with the factory image should remove any malware. I'd get a new SIM card from your carrier, then restore the firmware. Use the flash-all batch file in the factory image.
Sent from my [device_name] using XDA-Developers Legacy app
Thanks for the reply. I don't restore apps as best as I can tell. When I reset the phone I select the option that says "start from scratch" or something like that, and at every choice during setup I choose to not import anything. I do have to link the phone to my google account for my Project Fi service, which does sync my contacts, so possibly something something gets transferred that way? Like I mentioned above, I've scrubbed my google data every way I could find.
I don't have any risky apps, just standard ones from the play store (outlook, pandora, etc). No risky online websurfing, just the one banner I clicked some months ago. I even rooted my phone not too long ago and used the ES File Explorer to try and find suspicious looking files, but didn't find anything. Phone is no longer rooted since flashing factory image recently.
My phone even had the bootlooper issue common to Nexus 5Xs, and I sent it to LG for free repair. They replaced some hardware (not exactly sure what), but still had the popup problem occur 2 weeks later. Bootlooping was fixed though.
I talked to Project Fi about a SIM card. They weren't keen on sending me a new one, but I'll try them again.
Aloha!
As per the title, I haven't encountered this before. OTA to Android 10 performed, no longer rooted. Back up performed from settings, definitely completed. Can see said backup file in google drive on both mobile and desktop however upon setting up the phone from a clean flash just now, it states no backup associated with my google account.
Things I've tried -
adb shell bmgr list sets - no restore sets found
Reverted to android 9 - no associated backups found
Updated from 9 to 10 via OTA (as had done originally) and tried to set up from backup - no associated backups found
Tried clean flashes of both Android 10 images, one ending 19 and one ending 20. Same situation.
I thought it could be something to do with android version etc, but have backed up this morning as my drive shows.
Just wondering what went wrong or if I'm now simply out of luck.
It's things like my text messages I'm upset at losing etc
Anybody able to shed some light on this? I've had a quick search around but came up short so apologies.
Thanks in advance
info added in main post
I'm having the opposite problem. I can get my phone to back up, but it doesn't show up in Google Drive. I did have to uninstall Magisk 19.3 for the backup feature to work at all. I spent an hour with Google support trying to remedy this, but it didn't work.
Backup used to show up in Drive, and restore just fine. I figure it was one of the monthly updates, I just don't know which one. I really wanted a backup before upgrading to Android 10.
Really odd. I had no issues backing up, and it's still sat in Google Drive now, but nada, apparently no backups associated.
Wish there was a button there in drive that said restore.
Tried on my partner's phone as well which has never been touched in terms of root or bootloader unlocked. Still claims no backups associated.
Completely at a loss. Haven't tried Google support honestly but didn't think they'd be able to assist
My screen on my samsung galaxy is completely done and want to know how i can recover data off of it
wsperling said:
My screen on my samsung galaxy is completely done and want to know how i can recover data off of it
Click to expand...
Click to collapse
If you can't access it using a PC you're boned.
You have the ability to use an SD card as a data drive, why didn't you?
All your critical data should be stored there for reloads and... this.
I did someone hacked my Gmail and reset my phone boom therewent everything
wsperling said:
I did someone hacked my Gmail and reset my phone boom therewent everything
Click to expand...
Click to collapse
So the hardware's still good?
Check alternative 2nd email account if you have one to determine if it was unauthorized access took place.
Factory reload and change Google password after reload.
*You may have to reset Google account password if it was indeed hacked before you can regain device access. Try the original password first.
You get 3 tries before you get locked out for 72 hours.
If you got hacked, one or more of your devices was/is compromised. Always use a strong password and change it every few months.
Never use a "master" password for the Google account, it needs to be unique.
ALWAYS backup critical data on the PC and at least 2 more hdds that are physically and electronically isolated from the PC. If the your PC got hacked don't connect the backup hdds until it's clean.
I keep the laptop I use for backup offline and with no Google account on it for this very reason...
Hello, there is my problem with OP9 Pro – phone was stuck with some bug and only way to fix it was Wipe Data. Now it's ok, but I do really need to restore photos and videos. Phone is NOT rooted.
After reading tons of information I'm not sure that it's possible to get data back. As I understand I need to follow next steps:
1. Unlock bootloader without wiping data again in order not to lose old structure.
2. Root device, or at least temporary root it.
3. Use some tools to search and restore photos.
But now I'm not sure that everything would be fine. Even the first step is not 100% guarantee that it's possible to avoid data wiping.
So, If there are someone who understand this better, could you please advice me what should I do? Should I waste tons of time or it's muck more likely impossible to do?
Thanks!
mrGenry said:
Hello, there is my problem with OP9 Pro – phone was stuck with some bug and only way to fix it was Wipe Data. Now it's ok, but I do really need to restore photos and videos. Phone is NOT rooted.
After reading tons of information I'm not sure that it's possible to get data back. As I understand I need to follow next steps:
1. Unlock bootloader without wiping data again in order not to lose old structure.
2. Root device, or at least temporary root it.
3. Use some tools to search and restore photos.
But now I'm not sure that everything would be fine. Even the first step is not 100% guarantee that it's possible to avoid data wiping.
So, If there are someone who understand this better, could you please advice me what should I do? Should I waste tons of time or it's muck more likely impossible to do?
Thanks!
Click to expand...
Click to collapse
If you are not bootloader unlocked right now. All hope is lost since unlocking will force a wipe of data that can't be stopped.
MrSteelX said:
If you are not bootloader unlocked right now. All hope is lost since unlocking will force a wipe of data that can't be stopped.
Click to expand...
Click to collapse
I just wiped phone and restored some latest backup (which did not contain media ofc). I was reading about scenario, when we can backup current system, patch it somehow, unlock bootloader and keep old data somehow in place. But it looks so unstable for me.
The folder structure was destroyed when the data was deleted. Although the files still exist -if- they haven't been overwritten, they would be completely juxtaposed. A vast sea of files that could only be sorted by size and file type. No associated time stamps, exif data, original file names and no way to restore it. Let that sink in for a moment.
Just recovering a flash card with a 100 images on it and then trying to sort them is a major headache unless you have a photographic memory. The files names are gone. The recovered images will have a new assigned number generated that is unrelated to the file's original name. Now imagine trying to do that with a 100gb jigsaw puzzle from hell.
Always redundantly backup critical data to at least 2 hdds that are physically and electronically isolated from each other and the PC.
blackhawk said:
The folder structure was destroyed when the data was deleted. Although the files still exist -if- they haven't been overwritten, they would be completely juxtaposed. A vast sea of files that could only be sorted by size and file type. No associated time stamps, exif data, original file names and no way to restore it. Let that sink in for a moment.
Just recovering a flash card with a 100 images on it and then trying to sort them is a major headache unless you have a photographic memory. The files names are gone. The recovered images will have a new assigned number generated that is unrelated to the file's original name. Now imagine trying to do that with a 100gb jigsaw puzzle from hell.
Always redundantly backup critical data to at least 2 hdds that are physically and electronically isolated from each other and the PC.
Click to expand...
Click to collapse
Yeah, thanks! Really, there is nothing critical, just default amount of family photos and videos (phone is my father's, I'm just investigating possibility of recovering).
And tons of different information is all across the web. Also, latest Android 12 is pretty new and I guess lots of articles are not suite for that phone.
So, I guess it's too overwhelmed even to try root phone and search files. Maybe, data value is lower that possibility to turn phone into a brick.
mrGenry said:
Yeah, thanks! Really, there is nothing critical, just default amount of family photos and videos (phone is my father's, I'm just investigating possibility of recovering).
And tons of different information is all across the web. Also, latest Android 12 is pretty new and I guess lots of articles are not suite for that phone.
So, I guess it's too overwhelmed even to try root phone and search files. Maybe, data value is lower that possibility to turn phone into a brick.
Click to expand...
Click to collapse
If you want the best possible outcome take it to a data recovery specialist. That's all they do.
Don't use any apps like FoneDoctor, they will find stuff but encrypt the drive $o only that app can unencrypt it.
blackhawk said:
If you want the best possible outcome take it to a data recovery specialist. That's all they do.
Don't use any apps like FoneDoctor, they will find stuff but encrypt the drive $o only that app can unencrypt it.
Click to expand...
Click to collapse
Thanks! A bit upset, but Im great to get useful information.
mrGenry said:
Thanks! A bit upset, but Im great to get useful information.
Click to expand...
Click to collapse
Losing critical data is never pretty.
I've lost a database with decades of data on it. The only way to help prevent this is redundant backups.
Perhaps your father had backup them up deliberately or by happenstance to a PC or other device.
My wife has a PIN on her phone. She told our 6 yr old to put the phone down as she put my our other children to bed, and when she came back the phone was erased and reset. He couldn't have got in to the phone and through the menus. Does the phone reset and wipe everything after too many failed attempts at the PIN? Is there anyway out of this? I am familiar with rooting phones. Is there any back entry and restore through ADB? The phone was not previously rooted.
Doesn't take long to navigate to settings and do a factory reset.
Data is likely lost but you can try... I hope you backed up critical data. Even if you do manage to retrieve it the file structure has been lost.
A sea of random files and no way to recreate the file structure or associations except by memory.
blackhawk said:
Doesn't take long to navigate to settings and do a factory reset.
Data is likely lost but you can try... I hope you backed up critical data. Even if you do manage to retrieve it the file structure has been lost.
A sea of random files and no way to recreate the file structure or associations except by memory.
Click to expand...
Click to collapse
So pictures and everything are gone?
He doesn't know the PIN. Is there something that comes up that's says the phone will be wiped after so many bad attempts that he could have pressed?
Schroeder09 said:
So pictures and everything are gone?
He doesn't know the PIN. Is there something that comes up that's says the phone will be wiped after so many bad attempts that he could have pressed?
Click to expand...
Click to collapse
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
blackhawk said:
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
Click to expand...
Click to collapse
How do I try to see what is left on the phone? Is there an ADB process for this?
I've never understood backing stuff up on a phone. The restoring part seems to be more the problem for me. I did used to do multiple backups with titanium backup, but never once was successful restoring from the backup. How are you backing up and how are you restoring from it? Especially on a NON-ROOTED device? The latter will be more important. When I pick up my next phone (probably an s22. Currently have rooted 2xl running A10 yet) I will not be rooting. It's too much of a time-consuming PITA, and while the gains are noticeable; they're not worth the effort.
Not sure what if anything adb can do for you. I never use that to restore as I run stock devices and assume the file decryption keys are already lost as well as file structure after a factory reset!
For backup first identify all critical data that can be backed up. DCIM folder, Documents, contacts, all needed accounts/passwords written or as text files etc, music, vids and so on.
Apps that allow backup of settings like Poweramp and Color Note (can be used for bookmarks rather than the browser). I use ApkExport to make installable copies of all my apps and updates. On reload no Playstore needed.
Copy, paste, verify size and if readable to 2 or more hdds that are physically and electronically isolated from each other and the PC. A OTG flashstick can be used for quick backups but don't use as the only backup; hdds are more reliable. Work out a sync folder for media, etc.
SmartSwitch can be used to backuo homepage but never rely on it to backup critical data! It may or may not work!!!
If you have an SD card slot use an SD card as a data drive; all critical data goes here. There can be only DCIM folder so periodically backup the DCIM folder to the SD card but name something without DCIM in the name. Only apps and the download folder go on internal memory. Then backup the SD card redundantly and regularly to the hdd backups. That gives you multiple backups should one fail. NEVER encrypt backup data drives!!!
You have to methodically plan this to do backup this way but it's pretty foolproof and has built in redundantcy. Once you get used to it, it's not hard to do.
I have over a dozen backup hdds in various locations. I may lose some data but never all my data. Syncing data is the biggest headache with this method.
blackhawk said:
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
Click to expand...
Click to collapse
how could I attempt to recover these JPEG files?
Schroeder09 said:
how could I attempt to recover these JPEG files?
Click to expand...
Click to collapse
What OS version? Not rooted?
I don't think you got a prayer but it depends on if the old data is encrypted which I assume it is because of the screen lock.
Full-Disk Encryption | Android Open Source Project
source.android.com
Of you're really hell bent on recovering some of the data a data recovery service that specializes in Samsung's is probably your best shot.
I could be wrong... do some Google searches, to search XDA simply add "XDA" to the end of the Google search parameter. XDA's search engine leaves something to be desired... and misses a lot that the all seeing Google web crawlers don't.
Leave the phone powered down until you decide what to do as any activity can now overwrite those old files.
Is this droidkit a gimic or will it work? the note 8 is on android 8 or 9.
Get Data Recovery, Screen Unlock, and FRP Bypass with DroidKit
www.xda-developers.com
Schroeder09 said:
Is this droidkit a gimic or will it work? the note 8 is on android 8 or 9.
Get Data Recovery, Screen Unlock, and FRP Bypass with DroidKit
www.xda-developers.com
Click to expand...
Click to collapse
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
V0latyle said:
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
Click to expand...
Click to collapse
Brute forced decryption be the only way as it uses random encryption. Folders are encrypted vs full disk encryption on the newer OS's if I recall correctly. The folder association with the files is already gone, lost with the factory reset. How the effects the encryption, no clue.
It's a mess.
blackhawk said:
Brute forced decryption be the only way as it uses random encryption. Folders are encrypted vs full disk encryption on the newer OS's if I recall correctly. The folder association with the files is already gone, lost with the factory reset. How the effects the encryption, no clue.
It's a mess.
Click to expand...
Click to collapse
is there a service that can recover the pictures? my wife already restarted the phone and has started downloading stuff (if that matters). I told her it would have been best to not even have restarted it and hand it to someone so they could recover from recovery mode prior to any new data being installed.
V0latyle said:
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
Click to expand...
Click to collapse
Is there any company or service who aren't criminals that I can send it to to recover the pictures?
I think it's a dead horse especially if you're wife keeps using it!
Found this one. Do some searches and research.
Keep the phone powered off until you decide.