I'm looking for the best way to recover data from an android phone that isn't unlocked or rooted.
Long story short, I was arrested for disorderly conduct and "resisting arrest." The police took my phone and arrested me when I told them I was recording. They took me in a car, and we waited for about 15 minutes, then they brought my phone back. When I got out of jail, the recording only went up to a few seconds before a key moment and then ended before the time the police arrived.
Under file properties, the time 'edited' does add up to the length of the recording after another short recording had stopped. I started and stopped recording, and the started again shortly afterward. If you trim the end of a video, does it also change the time it was edited?
The Trash folder on my phone was empty, I have never emptied this folder, perhaps I've never deleted anything in 1.5 yrs? I still have 40 gb left in storage.
One of three things happened:
- I bumped the phone, and it stopped recording, I wasn't looking at the screen at all and was just holding it against my chest.
- My phone overheated and stopped recording. It is a pixel 5a 5g, it has overheated on me from just sitting in the sun, so I can see it overheating while recording, it was very hot out at the time.
- The police officer trimmed the video down and then emptied my trash folder to make it harder to recover.
I've tried several different apps and haven't been able to recover anything relevant, only old files that I deleted (Again, I don't remember ever emptying my trash folder)
All the options for copying a full disk image require root, which requires unlocking the bootloader, which requires wiping the entire phone. I might still be able to recover data that way, but who knows.
I'm almost willing to have it sent off to have the data pulled from the physical storage inside the device if I have to.
I feel like I'm going crazy, it would really help to have the rest of the video since it does show someone threatening my life with a weapon.
I already explained this to my attorney. If the police claim they watched the video on my phone, they are lying since my phone would have been locked by the time they got there if it wasn't recording, right?
For visibility: https://www.aclu.org/issues/criminal-law-reform/reforming-police/mobile-justice - If this is a situation you (or anyone you know) could end up in, this app may be a game changer. It streams the video to your friends and the ACLU, so nothing can be edited afterwards.
I can't say for sure how editing the file will work, but it may have deleted the original or overwritten it.
If you want to send the phone off to be analysed, TURN IT OFF NOW. If the file was deleted, the OS is free to write over the "blank" parts of your storage, which may overwrite the original. Getting this done professionally is the most likely chance be sure that it works, but there are never any guarantees when it comes to data recovery. I don't even know who you would want to send it to, and it won't be cheap.
A data recovery service like drive savers may be able to do it for you. If you really care about the data, turn the phone off and don't try to recover it yourself. This is a high skill thing to do
The issue is that I'm just totally unsure if they did anything or not. It's been several weeks at this point so the data could be lost anyway, and it might not even matter.
Your next comment in this thread ended up in the wrong place.
Yeah, I dont envy your position. I don't think there is a way for you to know without sending the phone off, but if it's been weeks then perhaps it is too late. Sometimes bad people get away with doing bad things.
I personally would chalk it up as a learning experience, and use your experience to sell the ACLU app to your friends and family.
I think I’m still going to poke around and see if I can find some workaround to get it rooted without wiping. I know that there are more robust tools out there that the police and governments have that allow them to do it. They always say there’s no way to delete something, so there are ways they just aren’t widely available.
I think this comment is supposed to be here:
https://beehaw.org/comment/988489
woops, thanks, my mind isn't where it should be at the moment.
Yeah no problem. I actually posted a top level comment fwiw. I think I maybe remember that Google's solution for trimming videos was broken (in a way that is apparently now fixed) in a way that meant it was much easier than it should be to get the data back. Potentially worth googling for a bit to see if I'm right and if it can help you.
Iirc (which I'm not entirely confident I do), whilst it has been patched there was some sort of issue where the I built Google tools for things like trimming video were not actually deleting the trimmed portion at all. Worth googling about it (using a different device.) Could be there's an unpatched issue with the way your phone deletes trimmed video that makes it relatively easy to get that footage back.
Fundamentally though I doubt they have any right whatsoever to trim your recording so it might be best to just try to consult with a lawyer. If there's any sort of legal action you could take they will be able to advise on exactly what evidence you would need and how to gather it.
I have a lawyer for the criminal case, unfortunately without evidence, there's not much to be done. If under questioning, the officer states that he did review the footage, then I can assume that he did do something. If the recording is unedited, then my phone was theoretically locked when they grabbed it since it stopped before they got there, so my phone should have been locked by then. Unfortunately, any chance to ask questions will be weeks away from now.
That sounds frustrating. FWIW, I had a quick look for this thing I thought I remembered. The results I found referred to the issue I ly effecting cropped images however I'm sure I remember seeing something when I first read about it that suggested it also effected trimmed videos. Certainly the nature of the bug is such that it's conceivable that it does.
https://www.theregister.com/2023/03/20/google_pixel_acropalypse/
Thank you for that. The video is .mp4 1920x1080 7 minutes and 15 seconds, 1.21 GB in size! frame rate was set to "Automatic" in the stock photo app. that's quite a big video file for 1080p. maybe there is a tool for analyzing that instead?