LAB-0001
Samsung recovery and reset trail
How a Samsung phone records a factory reset, which files hold the evidence, and how the same trail looks in a full file system extraction and in a bug report.
Read the articleResearch topic
Reset and recovery
How a phone records its own resets, recovery runs and region changes, which of those records survive, and how far each can be trusted.
What this topic covers
A factory reset leaves no single date. It leaves a trail across several files: a recovery log written by the recovery program, a short history of boot reasons, and setup flags that move around updates. This topic collects what we have verified about that trail, and says plainly where it breaks.
Findings are worded as indicators. An indicator is consistent with a reset. It does not prove one, and a missing indicator proves nothing.
Articles
LAB-0006
Linking records across files
One event leaves records in several files. What a link between them needs, and how a finding changes when a store is missing.
Read the articleWhere the evidence lives
Each artifact, with the section of LAB-0001 that describes it.
Key terms
- Recovery run
- One start of the recovery program. Each run is written to the recovery log.
- Run code
- A two-letter code that names a run. The same code links a history entry to its lines in extra_history.
- Requested time
- The wall-clock time a reset was requested, written in the entry.
- Recovery clock
- The recovery program's own date in an entry header. It can read 1970 after a wipe.
- CSC
- The region and carrier software on a Samsung phone. A SIM from another carrier can switch it.
- Boot reason history
- The last few boots kept in persistent properties, each with a reason and a time.
- Indicator
- A trace that is consistent with an event. It does not prove the event.
Reading a reset question
- Find the files. Look for the recovery log in the full file system and in any recovery copies.
- List the runs. Oldest first, with command and reason.
- Link by code. A wipe has format lines under the same code. A region change has none.
- Date with care. Use the requested time. Label any estimate and name its anchor.
- State the limits. Write what is missing and why that proves nothing.
Open questions
- Does the recovery log keep the same layout on other manufacturers and on older Samsung builds?
- Does the clock rule hold on more than one device?
- Which traces survive in bug reports from other versions?
- Is a factory_reset boot reason written on current builds at all?
Open questions are research directions, not claims.