1

My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can android 5's own encryption mechanism be hijacked by ransomware? (and not by means of some custom implementation manually encrypting contents of the photo folder for example)

Right now I'm trying to get to the data using TWRP, but I think to no avail as the internal storage folder is empty..

The android she was using was cyanogenmod 12.1 (android 5.1.1) for a galaxy s3 gt-i9300.

Why the encryption process itself failed, I don't know but it could be due to low battery as when finding it in this state it was at 3% or so. Though as I did encrypt my s3 manually and on purpose, encryption would only start with battery being at 100% and the phone being plugged in. Otherwise it would refuse if my memory serves me right.

  • Have you received any request for ransom? Modded/Custom OS's are not known for having stellar QA departments - my guess is that the encryption process was started by either an accident or bug. – Cowthulhu Aug 1 at 14:46
  • No request is displayed. Since the encryption process itself failed the OS is in a broken state. Only option left is to factory reset it from there. So if it's ransomware then it in itself has failed, due to what I assume interruption by low battery. Regardin quality of the OS verison itself: yeah, it's the downside of custom ROMs, but still better than bloated stock android 4 on this old spare phone. – Steff Aug 1 at 16:52
0

Okay, the issue was in a corrupted filesystem. Whether this is caused by a software or hardware issue I don't know. So when android booted it interpreted a corrupted ext4 data partition wrongly as being partially encrypted.

What I did to fix was following this comment on reddit here

Quickly summarized:

boot into recovery, start adb from a linux system, pull the partition, fix it locally, push it back:

adb pull /dev/block/mmcblk0p12 data.img
sudo fsck.ext4 -y data.img
adb push data.img /dev/block/mmcblk0p12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.