Android 4.4.2(Kitkat): Screen Lock and Reaching Files Through USB

[jaarisnow]

Hello.

I have an Android 4.4.2(Kitkat) mobile phone which needs to be repaired.(It doesn't charge)

I have some important files in it. I don't want the people who repairs it to reach my files.

Before my phone had this problem, it had a password which worked as a screen lock. I had to enter it each time I unlocked the screen.

If they fix the phone and, lets say connect it to their PC via USB, will they be able to reach the files or will my screen lock is going to prevent them from reaching my files? I don't remember
1) if it asked for permission when connected to USB, to show the files. (it probably does)
2) if I had to enter my password in such situation to give permission.

I'd like to learn if its going to ask my password before that permission message pops up, after being connected to a USB. So they won't be able to see my files as they don't know the password.

Thanks in advance.

 

[Dannydet]

Your screen lock is a safety feature which should still work no matter if connection by usb or installation of a new battery.

 

[The_Chief]

With an operating system as old as Android K, there is no "maintenance mode" that would allow service personnel to work on the device without accessing everything. They will need your password to unlock the phone - once they do, they can view, copy, and move files as easily as you can.

If you are able to, you might consider backing up those critical files to a PC or other device; deleting them from your phone (or factory reset it), and reinstall everything once service is complete.

I might seriously encourage you to get a newer device, as KitKat is not being updated with security patches for vulnerabilities.

 

[jaarisnow]

Your screen lock is a safety feature which should still work no matter if connection by usb or installation of a new battery.

Thank you for your reply Dannydet. It's nice to hear that.

With an operating system as old as Android K, there is no "maintenance mode" that would allow service personnel to work on the device without accessing everything. They will need your password to unlock the phone - once they do, they can view, copy, and move files as easily as you can.

If you are able to, you might consider backing up those critical files to a PC or other device; deleting them from your phone (or factory reset it), and reinstall everything once service is complete.

I might seriously encourage you to get a newer device, as KitKat is not being updated with security patches for vulnerabilities.

Thank you for your reply The_Chief. I'm unable to back up my files because the phone doesn't even start and doesn't charge. Nothing happens when I try. So I thought they'd just replace some components of it without needing my password. If it gets charged and starts -and asks my password- there won't be any problems left, I suppose.

But after they repair it, what if they plug a USB cable into it and connect it to a computer? I'm concerned about this because if file transfer is possible without entering the screen lock password (like, the permission message about file transfer pops up without the requirement of entering the password, so they can click to allow it), then they'll be able to reach the files in it.

According to what I could understand from Dannydet's reply it seems not possible because they shouldn't be able to reach that permission message without entering the password. Then it seems okay.

Please tell me if I've misunderstood anything.

And thank you for your warning about using an old Android version. I need to use this device and the phone cannot be updated to a newer version so I have to use Android 4.4.2 for now.

 

[svim]

Keep in mind that yes your lock screen will block them from being able to access your files, but this also prevents them from being able to confirm their work did or did not work out properly. By intentionally not allowing them to log into your phone to interact with the Settings menu that could be a good loophole on their end to not having to support any kind of service guarantee.

I'd suggest you back up your all your data, and then do a Factory Reset to wipe your user account data. Turn over your phone for servicing, then when you get it back do another Factory Reset (a good practice for whenever you give your phone to someone else outside of your oversight), and then restore your data from your backup. From your wording it doesn't sound like you already have a backup solution in place. Really, that's not a good practice. Don't expect your smartphone to be a good place for long-term file storage. If there's data that's stored only on your phone, that's a big risk you'll eventually lose it. Backups are important.

 

[Hadron]

I can't remember fine details of KitKat, but the norm for Android is that file transfer over USB requires unlocking the screen.

If the phone won't charge then you can't do much anyway, since you can't change any of its settings, remove any data, or whatever unless you can power it up. So your choice is either to trust them or to buy a replacement battery or USB port (the 2 most obvious reasons why a phone might not charge) and look up how to do it yourself.

I'd almost be more concerned about the opposite problem: if you don't have a backup of those files, are you sure they won't be lost during this repair? Some service centres reset phones as a matter of procedure, so without a backup that would be the end of them. A less official repairer probably won't, but it's something to check. Also bear in mind that if it is the battery or USB port that's faulty then it should be possible to repair this without data loss, but if it's any component that's fixed to the motherboard, or the motherboard itself, then the repair will consist of replacing the motherboard, and as your storage is soldered to that motherboard your data would be lost in that case. If the data are important and you don't have a copy you might want to let them know that they shouldn't do anything that may cause data loss (and of course if anything is important you should always back it up somewhere else: phones break, get lost, get stolen, so keeping the only copy of something important on a phone is never safe).

 

[The_Chief]

There's the problem - OP cannot access the phone to back it up. It's effectively a dead phone with critical data on it.

The problem, @jaarisnow is that the technicians have no idea what components to replace without full access to the entire device and the data stored on it. I don't know why a newer phone can't be used, but I assume you have researched it and have valid reasons.

From my limited perspective, then, I see two options for you... neither of which are good. You can either (a) have a phone repair technician work to recover your data, with full access to it; or (b) consider your data unrecoverable and wipe the device, with a permanent loss of data.

Personally, as a technician, I can assure you that cell phone technicians have seen it all: financial accounts, naked selfies, sex videos, and the most intimate, secret data people have. Unless your data is patently illegal, it's doubtful the technician will even blink at the content.

You can try to find a technician who shares your values and is, perhaps, willing to sign an NDA (Non-Disclosure Agreement) to keep your secrets secret; otherwise, you have very few options.

I don't like being the bearer of bad news: from my perspective, however, that's the best I can offer you.

 

[jaarisnow]

Keep in mind that yes your lock screen will block them from being able to access your files, but this also prevents them from being able to confirm their work did or did not work out properly. By intentionally not allowing them to log into your phone to interact with the Settings menu that could be a good loophole on their end to not having to support any kind of service guarantee.

I'd suggest you back up your all your data, and then do a Factory Reset to wipe your user account data. Turn over your phone for servicing, then when you get it back do another Factory Reset (a good practice for whenever you give your phone to someone else outside of your oversight), and then restore your data from your backup. From your wording it doesn't sound like you already have a backup solution in place. Really, that's not a good practice. Don't expect your smartphone to be a good place for long-term file storage. If there's data that's stored only on your phone, that's a big risk you'll eventually lose it. Backups are important.

Thank you for your reply svim. It's good to hear that they cannot reach the files without unlocking the screen. If they can get it charged and make it work that's going to be enough for me for now. At least I'll be able to take my files before it needs another possible repair.

I agree with you and The_Chief about backups, and I think I'll be more careful next time.

I can't remember fine details of KitKat, but the norm for Android is that file transfer over USB requires unlocking the screen.

If the phone won't charge then you can't do much anyway, since you can't change any of its settings, remove any data, or whatever unless you can power it up. So your choice is either to trust them or to buy a replacement battery or USB port (the 2 most obvious reasons why a phone might not charge) and look up how to do it yourself.

I'd almost be more concerned about the opposite problem: if you don't have a backup of those files, are you sure they won't be lost during this repair? Some service centres reset phones as a matter of procedure, so without a backup that would be the end of them. A less official repairer probably won't, but it's something to check. Also bear in mind that if it is the battery or USB port that's faulty then it should be possible to repair this without data loss, but if it's any component that's fixed to the motherboard, or the motherboard itself, then the repair will consist of replacing the motherboard, and as your storage is soldered to that motherboard your data would be lost in that case. If the data are important and you don't have a copy you might want to let them know that they shouldn't do anything that may cause data loss (and of course if anything is important you should always back it up somewhere else: phones break, get lost, get stolen, so keeping the only copy of something important on a phone is never safe).

Thank you for your reply Hadron. If its the norm and file transfer over USB requires unlocking the screen on Kitkat too, then I won't have any problems giving my phone to them. I could find an old phone with Android 2.3, I'll try this on that and if it also requires unlocking the screen before allowing it to connect via USB on 2.3, it's probably like that for Kitkat, too. I'll add the result as a new message here after I test it.

Official repair service told me that they remove all the data in it, for this reason I'm going to give it to another repairer. I guess the unofficial one won't be strict about it. I should tell them about the importance of data in it, thanks for your warning about it.

And I agree with you about backups, you're right.

There's the problem - OP cannot access the phone to back it up. It's effectively a dead phone with critical data on it.

The problem, @jaarisnow is that the technicians have no idea what components to replace without full access to the entire device and the data stored on it. I don't know why a newer phone can't be used, but I assume you have researched it and have valid reasons.

From my limited perspective, then, I see two options for you... neither of which are good. You can either (a) have a phone repair technician work to recover your data, with full access to it; or (b) consider your data unrecoverable and wipe the device, with a permanent loss of data.

Personally, as a technician, I can assure you that cell phone technicians have seen it all: financial accounts, naked selfies, sex videos, and the most intimate, secret data people have. Unless your data is patently illegal, it's doubtful the technician will even blink at the content.

You can try to find a technician who shares your values and is, perhaps, willing to sign an NDA (Non-Disclosure Agreement) to keep your secrets secret; otherwise, you have very few options.

I don't like being the bearer of bad news: from my perspective, however, that's the best I can offer you.

Thanks for your reply The _Chief. The data isn't something illegal, but it's important. So wiping the device isn't a choice for me. I can't give full access to the repairer neither, as long as he's not going to repair it next to me. I think I'll have to rely on android's screen lock to not allow anyone connect it to a computer with a USB cable. Thank you for the options you've informed me about.