How to back up and restore personal data safely from possibly exploited android phone?

Question

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is probably running on the OS/firmware level, I'm going to try and do a clean install of the OS. However, I'm not sure as to how I can safely back up my personal data first. I don't want to back up any app data or settings whatsoever, just some documents and pictures and a messenger chat backup, using Google drive and an external USB drive. But every time I plug the USB in via OTG cable, all these unnecessary system files like com.kms.free, com.sec.android.gallery3d, com.google and such automatically get loaded onto the USB. I'm guessing these files are coming from my external sd card, as I read in another thread here that the OS creates some back up files on external media in case it fails to boot from the system partition. But assuming some malicious exploit is running on firmware level, these files could potentially infect both the USB and sd card, and thus by restoring any files from them, I will probably risk reinfection.

Is there any way to stop this autobackup of system files and safely backup and restore only my personal data from the USB and Google Drive? I learnt that if the exploit is in firmware or OS level, formatting doesn't help either, so I'll probably have to ditch the external SD card altogether. But I want my USB drive to avoid this infection, so that the personal data on it can be restored safely on the clean device. Same goes for the documents I have on Google drive, how can I be sure that the data uploaded to it is clean and therefore safe to restore?

Please help me out a little, I'm really in a bind here. Need some guidance urgently, phone has become very unstable.

Answer 1

Great question. Sorry to hear about your phone. If your phone still functions, you can back up to cloud. Google Drive being one highly integrated options. Just save your files to your cloud (I'd create a separate folder so you can clearly see if any malicious looking files end up there somehow, unlikely but worth looking). Then do a OS reset and wipe the SD.

This phone also has a wifi-direct option so you could use that to transfer files. https://www.verizonwireless.com/support/knowledge-base-210398/

If you can't make those happen, and assuming you are correct that the USB backup options is dumping malware... really the only option left is manually wiring into the storage on the phone and that is pretty next level hardware stuff. I'd say worse case take the full back up to usb, then sort through for your files and delete the rest. Be careful to make sure you do the backup to a computer you can "wipe" if needed or infected (not likely as different OS, but I'd be careful).

Answer 2

Assuming your attacker has no way to persist through firmware flashing then I advice you check and see if you can install Lineage OS or other custom ROMs to your android Infecting firmware is one thing but I know rare cases where it’s much deeper than that. Hopefully it’s not else you’ll really have to throw away your phone and get a new one. I also suggest finding a way to check and see if your modem/router has been infected too as most threat actors of this level infects even network devices.