Is it possible to know if an Android has been never rooted?

I have no doubt it is a very interesting discussion but… could we come back to the original question?

Thanks D

Sure ) of course.

If the device is rooted, then it was rooted (some time in the past) wink .

If the device is not (currently) rooted it can be three cases
1) it was never rooted
2) it was actually rooted but later was restored to original condition (factory reset) and all previous data is either overwritten or inaccessible
3) it was actually rooted but later an attempt (failed) to revert to original condition failed (or however some traces were left)

Of course the exact method that was used to attempt to erase the *whatever* was before in cases #2 and #3 makes a difference, as well as the actual specific device and android version.

JFYI

http//www.techtimes.com/articles/55837/20150527/androids-factory-reset-does-not-wipe-your-data-heres-the-solution.htm
http//www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf

YMMGV depending on specific device, specific android version in use and specific method used to "factory reset" or however hide/conceal a previous rooting (or more generally pre-existing data), no one-size-fits-all answer AFAIK.

jaclaz

I have no doubt it is a very interesting discussion but… could we come back to the original question?

Thanks D

Sure ) of course.

If the device is rooted, then it was rooted (some time in the past) wink .

If the device is not (currently) rooted it can be three cases
1) it was never rooted
2) it was actually rooted but later was restored to original condition (factory reset) and all previous data is either overwritten or inaccessible
3) it was actually rooted but later an attempt (failed) to revert to original condition failed (or however some traces were left)

Of course the exact method that was used to attempt to erase the *whatever* was before in cases #2 and #3 makes a difference, as well as the actual specific device and android version.

JFYI

http//www.techtimes.com/articles/55837/20150527/androids-factory-reset-does-not-wipe-your-data-heres-the-solution.htm
http//www.cl.cam.ac.uk/~rja14/Papers/fr_most15.pdf

YMMGV depending on specific device, specific android version in use and specific method used to "factory reset" or however hide/conceal a previous rooting (or more generally pre-existing data), no one-size-fits-all answer AFAIK.

jaclaz

That is what i was trying to tell you if you read my reply here..

Based on your 2 links here (which is TRUE in most cases) do you know WHY ITS POSSIBLE TO RECOVER (SOME) of the older data even after factory reset in Android ONLY and only Android?

and as i mentioned before that FEW USERS ONLY know how to get it back, which AFAIK from ur reply - you don`t.

am not playing smart here, but sometimes replies like yours here makes me upset really when you say something you never tried before.

As for the OP main Q, if possible or not?
here is your answer

All Android (from inside) has a ROM which contains the MAIN FW for example and let us give it a 5 BLOCKS SPACE. and there is the SYSTEM AREA where Apps. are stored and we will give it for example 10 BLOCKS.

Now simple math, when you do for example factory reset, you are writing the 5 BLOCKS into the total of 10 BLOCKS, which destroys ONLY the 5 OLD BLOCKS ONLY.

but IF and only IF your data inside the 10 BLOCKS are >> than 5 then you MAY/MAY NOT get some parial data from it.

here is where i asked my Q before for jaclaz in another word and did not get the reply.

IF you talk about Apple IOS, then from the 4S and whatever comes after are Generating a NEW ENCRYPTION KEY for your Data which means the following

Comparing Android & Apple IOS here, you cannot apply what i said so to IOS since the Key is Generated (and divided and stored in multiple places i.e. chips) and your Data is Encrypted and there is no solution for it yet. again AFAIK

to make it really easier to understand jaclaz, TRY 2 iphones, same Model and move the Internal whatever 32GB/64GB mem to the other and see what happens

do you expect to have a working iphone after that??
please think before replying here….

good luck dude

That is what i was trying to tell you if you read my reply here..

Well then you are failing at it, as right now it is not at all clear (to me at least) what exactly you meant in the original reply, nor what you are meaning now.

As for the OP main Q, if possible or not?
here is your answer

All Android (from inside) has a ROM which contains the MAIN FW for example and let us give it a 5 BLOCKS SPACE. and there is the SYSTEM AREA where Apps. are stored and we will give it for example 10 BLOCKS.

Now simple math, when you do for example factory reset, you are writing the 5 BLOCKS into the total of 10 BLOCKS, which destroys ONLY the 5 OLD BLOCKS ONLY.

but IF and only IF your data inside the 10 BLOCKS are >> than 5 then you MAY/MAY NOT get some parial data from it.

Well if it's a ROM it is a Read Only Memory ? , however each Android version, each manufacturer customization and the specific model implementation, may lead to write either the 5 or 10 blocks to follow your example, so the answer really is "it depends".

here is where i asked my Q before for jaclaz in another word and did not get the reply.

I must have missed the question.

IF you talk about Apple IOS, then from the 4S and whatever comes after are Generating a NEW ENCRYPTION KEY for your Data which means the following

Comparing Android & Apple IOS here, you cannot apply what i said so to IOS since the Key is Generated (and divided and stored in multiple places i.e. chips) and your Data is Encrypted and there is no solution for it yet. again AFAIK

Well, but we are not talking about iPhones.

to make it really easier to understand jaclaz, TRY 2 iphones, same Model and move the Internal whatever 32GB/64GB mem to the other and see what happens

do you expect to have a working iphone after that??

My guess would be that the result of that experiment would be at least one messed up iPhone (if not two).

please think before replying here….

Are you implying that I don't normally think before replying? 😯

good luck dude

Dude? ?
Thank you for the good luck, anyway ) .

jaclaz

In regards to the original question, please note the following

1. I used "Kingo Root" (http//www.kingoapp.com/) to root a Samsung Galaxy Tab 2 in order to facilitate a full physical image of the device.

2. The "Kingo Root" application created the following files and folders on the Tab

Filename & Path
system@app@KingoUser.apk@classes.dex & 1.E01\USER (EFI 17)\dalvik-cache\
com.kingouser.com & 1.E01\USER (EFI 17)\data\
KingoUser.apk & 1.E01\SYSTEM (EFI 14)\app\
.kingo & 1.E01\USER (EFI 17)\local\tmp\
data@app@com.kingoroot.com-2.apk@classes.dex & 1.E01\USER (EFI 17)\dalvik-cache\
com.kingoroot.com-2.apk & 1.E01\USER (EFI 17)\app\
com.kingoroot.com-2 & 1.E01\USER (EFI 17)\app-lib\
com.kingoroot.com & 1.E01\USER (EFI 17)\data\
kingo.png & 1.E01\SYSTEM (EFI 14)\app\KingoUser.apk\

NOTES

A. "1.E01" is the name of the forensic image file I created using FTK Imager of the rooted device. In other words, once the device was rooted by Kingo, I was able to perform a physical image of the Tab using FTK Imager.

B. The above folders and files had file creation dates and times matching the exact time I used Kingo to root the Tab.

So, I recommend performing a collection of a device yourself as a test first, then rooting the device, perform a new collection of the now-rooted device, and then look for specific files and folders that the rooting process created on your test device.

In regards to the original question, please note the following

1. I used "Kingo Root" (http//www.kingoapp.com/) to root a Samsung Galaxy Tab 2 in order to facilitate a full physical image of the device.

2. The "Kingo Root" application created the following files and folders on the Tab

Filename & Path
system@app@KingoUser.apk@classes.dex & 1.E01\USER (EFI 17)\dalvik-cache\
com.kingouser.com & 1.E01\USER (EFI 17)\data\
KingoUser.apk & 1.E01\SYSTEM (EFI 14)\app\
.kingo & 1.E01\USER (EFI 17)\local\tmp\
data@app@com.kingoroot.com-2.apk@classes.dex & 1.E01\USER (EFI 17)\dalvik-cache\
com.kingoroot.com-2.apk & 1.E01\USER (EFI 17)\app\
com.kingoroot.com-2 & 1.E01\USER (EFI 17)\app-lib\
com.kingoroot.com & 1.E01\USER (EFI 17)\data\
kingo.png & 1.E01\SYSTEM (EFI 14)\app\KingoUser.apk\

NOTES

A. "1.E01" is the name of the forensic image file I created using FTK Imager of the rooted device. In other words, once the device was rooted by Kingo, I was able to perform a physical image of the Tab using FTK Imager.

B. The above folders and files had file creation dates and times matching the exact time I used Kingo to root the Tab.

So, I recommend performing a collection of a device yourself as a test first, then rooting the device, perform a new collection of the now-rooted device, and then look for specific files and folders that the rooting process created on your test device.

If you use a tool or app to generate a physical image of a device, you may erase some areas of the file system which could be important.