My wife's phone can't boot into android and instead displays a message that encryption has failed and all data is lost. She did not start the encryption process by herself. Now my question is: can android 5's own encryption mechanism be hijacked by ransomware? (and not by means of some custom implementation manually encrypting contents of the photo folder for example)
Right now I'm trying to get to the data using TWRP, but I think to no avail as the internal storage folder is empty..
The android she was using was cyanogenmod 12.1 (android 5.1.1) for a galaxy s3 gt-i9300.
Why the encryption process itself failed, I don't know but it could be due to low battery as when finding it in this state it was at 3% or so. Though as I did encrypt my s3 manually and on purpose, encryption would only start with battery being at 100% and the phone being plugged in. Otherwise it would refuse if my memory serves me right.