How can i tell if my phone has ever been rooted before factory reset

Search This thread

Jenjenjney

Member
Nov 15, 2022
31
0
Banking apps can be not running when they think the phone is not safe even the phone is “not” rooted .

And factory reset or OTA update after rooting can make root access botched. Just like unrooting phone. So root checker apps can’t detect rooting after factory reset.

Then can i tell whether my phone has ever been rooted before factory reset without checking knox?
(Cuz broken knox doesnt necessarily mean rooting.)

My phone is reset . Root checking apps say its not rooted. But banking apps dont work.

Is thery any way to check..?
 

Arealhooman

Senior Member
Banking apps can be not running when they think the phone is not safe even the phone is “not” rooted .

And factory reset or OTA update after rooting can make root access botched. Just like unrooting phone. So root checker apps can’t detect rooting after factory reset.

Then can i tell whether my phone has ever been rooted before factory reset without checking knox?
(Cuz broken knox doesnt necessarily mean rooting.)

My phone is reset . Root checking apps say its not rooted. But banking apps dont work.

Is thery any way to check..?
know triggered pretty much means custom recovery, custom rom, or root, and they can all break banking apps. Did you buy the device used?
 

V0latyle

Forum Moderator
Staff member
You might find better support in the specific forum for your device. What is the make and model of the device in question? Additionally, which banking apps aren't working?

Outside of Knox, there's not really any way to tell if a device has been rooted, if it is currently on OEM firmware with a locked bootloader. If the bootloader is unlocked, it most likely has been rooted at some point., but none of that should matter if the device is restored to factory state with OEM firmware and a locked bootloader.
 

Jenjenjney

Member
Nov 15, 2022
31
0
You might find better support in the specific forum for your device. What is the make and model of the device in question? Additionally, which banking apps aren't working?

Outside of Knox, there's not really any way to tell if a device has been rooted, if it is currently on OEM firmware with a locked bootloader. If the bootloader is unlocked, it most likely has been rooted at some point., but none of that should matter if the device is restored to factory state with OEM firmware and a locked bootloader.
My phone is galaxy note4 910k and samsung phone’s bootloader is already unlocked in korea.
 

Jenjenjney

Member
Nov 15, 2022
31
0
I mean whether it is currently unlocked now, not whether it is unlockable.

If your bootloader is unlocked, your device will fail Play Integrity, and banking apps may not work.
Samsung phones in korea dont have bootloader locked. They are sold with bootloader unlocked in the first place.
Thats default. So i dont need to unlock it to root or install ROM.,,
 

V0latyle

Forum Moderator
Staff member
Samsung phones in korea dont have bootloader locked. They are sold with bootloader unlocked in the first place.
Thats default. So i dont need to unlock it to root or install ROM.,,
Ah. Well, you have two choices:
  • Lock your bootloader (only do this if your firmware is completely stock)
  • Root using Magisk and read this thread, and use the linked module
An unlocked bootloader will result in the device failing integrity attestation, which DRM and banking apps rely on. The only way to fix this is to either use a Magisk module for a partial workaround, or to relock the bootloader.
 
  • Like
Reactions: blackhawk

Jenjenjney

Member
Nov 15, 2022
31
0
Ah. Well, you have two choices:
  • Lock your bootloader (only do this if your firmware is completely stock)
  • Root using Magisk and read this thread, and use the linked module
An unlocked bootloader will result in the device failing integrity attestation, which DRM and banking apps rely on. The only way to fix this is to either use a Magisk module for a partial workaround, or to relock the bootloader.
Thanks but i wonder
Is there way to check if my phone was rooted before factory reset…?

I mean reset is not like installing stock rom, so even if files related to rooting are gone after factory reset, i think there are some traces to check,,,
Please…?:(

I ve never thought factory reset can wipe rooting trace like installing stock rom
 

V0latyle

Forum Moderator
Staff member
Thanks but i wonder
Is there way to check if my phone was rooted before factory reset…?

I mean reset is not like installing stock rom, so even if files related to rooting are gone after factory reset, i think there are some traces to check,,,
Please…?:(
No - you can reflash factory firmware using Odin, but there's not really any easy way to tell if your device was previously modified.
I ve never thought factory reset can wipe rooting trace like installing stock rom
Factory reset just wipes /data and does not remove the SU binary. In my case, with my Magisk rooted Pixel 5, I could perform a factory reset...but because the boot image is patched, my device would still be rooted, unless I selected "Complete Uninstall" in Magisk. Factory reset and clean flashing factory firmware are not the same thing.

If you don't know what state your device was in previously, the only thing you can really do is perform a reflash of the factory firmware using Odin. This overwrites all partitions including /boot, /recovery, and /system.

Again, even after a complete clean flash, your device will still fail Play Integrity until you lock the bootloader, meaning that banking/DRM apps may not work.
 
  • Like
Reactions: blackhawk

tutibreaker

Senior Member
Thanks but i wonder
Is there way to check if my phone was rooted before factory reset…?

I mean reset is not like installing stock rom, so even if files related to rooting are gone after factory reset, i think there are some traces to check,,,
Please…?:(

I ve never thought factory reset can wipe rooting trace like installing stock rom
no,no way to check if was rooted, samsung device to check own security uses knox, is tripped means device has been modded but not in a specific way like rooting
 

Jenjenjney

Member
Nov 15, 2022
31
0
No - you can reflash factory firmware using Odin, but there's not really any easy way to tell if your device was previously modified.

Factory reset just wipes /data and does not remove the SU binary. In my case, with my Magisk rooted Pixel 5, I could perform a factory reset...but because the boot image is patched, my device would still be rooted, unless I selected "Complete Uninstall" in Magisk. Factory reset and clean flashing factory firmware are not the same thing.

If you don't know what state your device was in previously, the only thing you can really do is perform a reflash of the factory firmware using Odin. This overwrites all partitions including /boot, /recovery, and /system.

Again, even after a complete clean flash, your device will still fail Play Integrity until you lock the bootloader, meaning that banking/DRM apps may not work.
Thank you.
So factory reset affected the rooting and root checker apps can’t detect rooting , then
No other way to check whether my phone was rooted before reset right?
But still wonder reset can not touch system partition but how come root checker cant detect …


This is another question…
if i rooted my phone and then used rooting hide or unrooting or rootcloak to make banking apps run on my phone then i do factory reset,
would banking apps still run While root checker apps dont detect rooting anymore??

Or those efforts that i make to run banking apps are gone with other rooting traces..?
 

V0latyle

Forum Moderator
Staff member
Thank you.
So factory reset affected the rooting and root checker apps can’t detect rooting , then
No other way to check whether my phone was rooted before reset right?
But still wonder reset can not touch system partition but how come root checker cant detect …
Again, factory reset doesn't necessarily affect root, especially with modern system-as-root, or with recovery hijacks. Factory reset just wipes the /data partition - removing user apps and data. In the case of Magisk, this would remove the Magisk manager app, but would not remove the Magisk patch from the boot image.
This is another question…
if i rooted my phone and then used rooting hide or unrooting or rootcloak to make banking apps run on my phone then i do factory reset,
would banking apps still run While root checker apps dont detect rooting anymore??
No, because as I stated above, performing a factory reset does not remove root nor does it hide your unlocked bootloader. Using Magisk as the example yet again, a factory reset would remove the Magisk app as well as installed modules. However, if there were "permanent" system modifications, these would persist after a factory reset.
Or those efforts that i make to run banking apps are gone with other rooting traces..?
Yes.

So to use my device as an example again: Pixel 5 on OEM firmware, rooted with Magisk 25.2, using Universal SafetyNet Fix 2.3.1 mod 2. I pass BASIC and DEVICE integrity and am able to use banking apps.
If I perform a factory reset, the boot image will still be patched with Magisk, and the bootloader will still be unlocked, so Play Integrity will fail DEVICE at the very least, and most likely BASIC too. Because the Magisk app is installed as a user app, this would be removed during a factory reset, meaning there would be no manager available to manage root permissions or load modules until I installed Magisk again.

The only thing a factory reset does is wipe the /data partition and internal userspace storage. It does not reset or restore anything else, so any modifications to any system partitions will persist after a data wipe.
 
  • Like
Reactions: blackhawk

Jenjenjney

Member
Nov 15, 2022
31
0
Again, factory reset doesn't necessarily affect root, especially with modern system-as-root, or with recovery hijacks. Factory reset just wipes the /data partition - removing user apps and data. In the case of Magisk, this would remove the Magisk manager app, but would not remove the Magisk patch from the boot image.

No, because as I stated above, performing a factory reset does not remove root nor does it hide your unlocked bootloader. Using Magisk as the example yet again, a factory reset would remove the Magisk app as well as installed modules. However, if there were "permanent" system modifications, these would persist after a factory reset.

Yes.

So to use my device as an example again: Pixel 5 on OEM firmware, rooted with Magisk 25.2, using Universal SafetyNet Fix 2.3.1 mod 2. I pass BASIC and DEVICE integrity and am able to use banking apps.
If I perform a factory reset, the boot image will still be patched with Magisk, and the bootloader will still be unlocked, so Play Integrity will fail DEVICE at the very least, and most likely BASIC too. Because the Magisk app is installed as a user app, this would be removed during a factory reset, meaning there would be no manager available to manage root permissions or load modules until I installed Magisk again.

The only thing a factory reset does is wipe the /data partition and internal userspace storage. It does not reset or restore anything else, so any modifications to any system partitions will persist after a data wipe.
Oh i got it!
But i used that phone before magisk came out. So i think if my phone was rooted , defintely via one click rooting apps .
Then the answer to my qustion can be different..?

Btw i also saw people saying that they rooted phone with kingroot app and then they did factory reset, root checker apps dont detect rooting.


Its another curioustiy,

Can i bring back stock camera app via OTA update that i deleted with rooting?
 

V0latyle

Forum Moderator
Staff member
Oh i got it!
But i used that phone before magisk came out. So i think if my phone was rooted , defintely via one click rooting apps .
Then the answer to my qustion can be different..?
No. Regardless of how the device is rooted - whether it's the "old" system-as-root way, where su was installed as a system app, or the "new" systemless root way, a factory reset aka data wipe makes no difference. The only way to get rid of it is to reflash the factory firmware.
Btw i also saw people saying that they rooted phone with kingroot app and then they did factory reset, root checker apps dont detect rooting.
Regardless of the "vendor" the process generally remains the same. Either /recovery is hijacked and the system is forced to load root, or root is installed as a system app, or the boot image is patched to allow user root access.

As an aside, Kingroot is dangerous because of some serious security issues. Magisk avoids these through signature verification and private keys.
Its another curioustiy,

Can i bring back stock camera app via OTA update that i deleted with rooting?
Yes.

Reflashing factory firmware, as I stated previously, overwrites everything with the firmware Samsung originally installed on the device - meaning all included apps.

So if you want to return your device to complete bone stock, you'd reflash the factory firmware in Odin, and you'd use the CSC.tar instead of HOME_CSC.tar (the latter is for updating when you want to keep your user data and apps)

Then, you would lock your bootloader.
 
  • Love
Reactions: blackhawk

Jenjenjney

Member
Nov 15, 2022
31
0
No. Regardless of how the device is rooted - whether it's the "old" system-as-root way, where su was installed as a system app, or the "new" systemless root way, a factory reset aka data wipe makes no difference. The only way to get rid of it is to reflash the factory firmware.

Regardless of the "vendor" the process generally remains the same. Either /recovery is hijacked and the system is forced to load root, or root is installed as a system app, or the boot image is patched to allow user root access.

As an aside, Kingroot is dangerous because of some serious security issues. Magisk avoids these through signature verification and private keys.

Yes.

Reflashing factory firmware, as I stated previously, overwrites everything with the firmware Samsung originally installed on the device - meaning all included apps.

So if you want to return your device to complete bone stock, you'd reflash the factory firmware in Odin, and you'd use the CSC.tar instead of HOME_CSC.tar (the latter is for updating when you want to keep your user data and apps)

Then, you would lock your bootloader.
Just updating software that pops up in phone reinstalls stock apps??

But only updating software via ota in phones still dont allow banking apps run. I mean flashing a stock rom and just updating firm ware in phone via ota is different.
 

V0latyle

Forum Moderator
Staff member
Just updating software that pops up in phone reinstalls stock apps??

But only updating software via ota in phones still dont allow banking apps run. I mean flashing a stock rom and just updating firm ware in phone via ota is different.
Yes, because OTA is generally a partial update, as opposed to a full factory flash.

I've told you several times...If you want banking apps to run on your device, and you don't want to use a root solution, you need to clean flash the factory firmware and lock your bootloader. That is the bottom line.
 

Jenjenjney

Member
Nov 15, 2022
31
0
Yes, because OTA is generally a partial update, as opposed to a full factory flash.

I've told you several times...If you want banking apps to run on your device, and you don't want to use a root solution, you need to clean flash the factory firmware and lock your bootloader. That is the bottom line.
just doing ota update is going to reinstall stock cam app i deleted -amazing thanks.


Honestly… I am worrying malware app could root my phone . Cuz my phone got factory reset by malware app suddenly. So what i have now is reset phone .Thats why i want to know if my phone was rooted..

+ i used data recovery program after reset So i think thats maybe reason banking apps dont run now . But not sure the name of program so cant check if that programs have rooting feature.
So i just want to know if my phone has ever been rooted before reset. So worrying… i cant even sleep.
 

V0latyle

Forum Moderator
Staff member
just doing ota update is going to reinstall stock cam app i deleted -amazing thanks.


Honestly… I am worrying malware app could root my phone . Cuz my phone got factory reset by malware app suddenly. So what i have now is reset phone .Thats why i want to know if my phone was rooted..

+ i used data recovery program after reset So i think thats maybe reason banking apps dont run now . But not sure the name of program so cant check if that programs have rooting feature.
So i just want to know if my phone has ever been rooted before reset. So worrying… i cant even sleep.
We have gone around and around this topic in this discussion. I have provided the answers for you. Without somehow comparing every partition against untouched firmware, there is no way to know what is currently modified. If everything is stock, there is no way to know whether it was previously modified. Your best option, once again, is to perform a clean flash of the factory firmware, and lock your bootloader. Locking your bootloader enables additional security features that verify whether or not the images have been modified, and will prevent boot if they are, which is why you need to perform a clean flash first. Doing this will remove any potential rootkit or hijack, because you'll be overwriting everything to bone stock.
 
  • Like
Reactions: blackhawk

Jenjenjney

Member
Nov 15, 2022
31
0
We have gone around and around this topic in this discussion. I have provided the answers for you. Without somehow comparing every partition against untouched firmware, there is no way to know what is currently modified. If everything is stock, there is no way to know whether it was previously modified. Your best option, once again, is to perform a clean flash of the factory firmware, and lock your bootloader. Locking your bootloader enables additional security features that verify whether or not the images have been modified, and will prevent boot if they are, which is why you need to perform a clean flash first. Doing this will remove any potential rootkit or hijack, because you'll be overwriting everything to bone stock.
Thanks.. i really appreciate it
I dont use that phone anymore . Just wanted to know how to tell ,,

For the last ..
can i check if my stock camera app was modified? Or hackers can delete stock cam and install modified stock cam with rooting.
Can i analysis this app..?
 

V0latyle

Forum Moderator
Staff member
Thanks.. i really appreciate it
I dont use that phone anymore . Just wanted to know how to tell ,,

For the last ..
can i check if my stock camera app was modified? Or hackers can delete stock cam and install modified stock cam with rooting.
Can i analysis this app..?
Yes, there are ways to compare files to determine whether a copy has been tampered with by comparing it with a known trustworthy original. A Google search turns up several results.
 
  • Like
Reactions: blackhawk

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Samsung phones in korea dont have bootloader locked. They are sold with bootloader unlocked in the first place.
    Thats default. So i dont need to unlock it to root or install ROM.,,
    Ah. Well, you have two choices:
    • Lock your bootloader (only do this if your firmware is completely stock)
    • Root using Magisk and read this thread, and use the linked module
    An unlocked bootloader will result in the device failing integrity attestation, which DRM and banking apps rely on. The only way to fix this is to either use a Magisk module for a partial workaround, or to relock the bootloader.
    1
    Thanks but i wonder
    Is there way to check if my phone was rooted before factory reset…?

    I mean reset is not like installing stock rom, so even if files related to rooting are gone after factory reset, i think there are some traces to check,,,
    Please…?:(
    No - you can reflash factory firmware using Odin, but there's not really any easy way to tell if your device was previously modified.
    I ve never thought factory reset can wipe rooting trace like installing stock rom
    Factory reset just wipes /data and does not remove the SU binary. In my case, with my Magisk rooted Pixel 5, I could perform a factory reset...but because the boot image is patched, my device would still be rooted, unless I selected "Complete Uninstall" in Magisk. Factory reset and clean flashing factory firmware are not the same thing.

    If you don't know what state your device was in previously, the only thing you can really do is perform a reflash of the factory firmware using Odin. This overwrites all partitions including /boot, /recovery, and /system.

    Again, even after a complete clean flash, your device will still fail Play Integrity until you lock the bootloader, meaning that banking/DRM apps may not work.
    1
    Thank you.
    So factory reset affected the rooting and root checker apps can’t detect rooting , then
    No other way to check whether my phone was rooted before reset right?
    But still wonder reset can not touch system partition but how come root checker cant detect …
    Again, factory reset doesn't necessarily affect root, especially with modern system-as-root, or with recovery hijacks. Factory reset just wipes the /data partition - removing user apps and data. In the case of Magisk, this would remove the Magisk manager app, but would not remove the Magisk patch from the boot image.
    This is another question…
    if i rooted my phone and then used rooting hide or unrooting or rootcloak to make banking apps run on my phone then i do factory reset,
    would banking apps still run While root checker apps dont detect rooting anymore??
    No, because as I stated above, performing a factory reset does not remove root nor does it hide your unlocked bootloader. Using Magisk as the example yet again, a factory reset would remove the Magisk app as well as installed modules. However, if there were "permanent" system modifications, these would persist after a factory reset.
    Or those efforts that i make to run banking apps are gone with other rooting traces..?
    Yes.

    So to use my device as an example again: Pixel 5 on OEM firmware, rooted with Magisk 25.2, using Universal SafetyNet Fix 2.3.1 mod 2. I pass BASIC and DEVICE integrity and am able to use banking apps.
    If I perform a factory reset, the boot image will still be patched with Magisk, and the bootloader will still be unlocked, so Play Integrity will fail DEVICE at the very least, and most likely BASIC too. Because the Magisk app is installed as a user app, this would be removed during a factory reset, meaning there would be no manager available to manage root permissions or load modules until I installed Magisk again.

    The only thing a factory reset does is wipe the /data partition and internal userspace storage. It does not reset or restore anything else, so any modifications to any system partitions will persist after a data wipe.
    1
    Oh i got it!
    But i used that phone before magisk came out. So i think if my phone was rooted , defintely via one click rooting apps .
    Then the answer to my qustion can be different..?
    No. Regardless of how the device is rooted - whether it's the "old" system-as-root way, where su was installed as a system app, or the "new" systemless root way, a factory reset aka data wipe makes no difference. The only way to get rid of it is to reflash the factory firmware.
    Btw i also saw people saying that they rooted phone with kingroot app and then they did factory reset, root checker apps dont detect rooting.
    Regardless of the "vendor" the process generally remains the same. Either /recovery is hijacked and the system is forced to load root, or root is installed as a system app, or the boot image is patched to allow user root access.

    As an aside, Kingroot is dangerous because of some serious security issues. Magisk avoids these through signature verification and private keys.
    Its another curioustiy,

    Can i bring back stock camera app via OTA update that i deleted with rooting?
    Yes.

    Reflashing factory firmware, as I stated previously, overwrites everything with the firmware Samsung originally installed on the device - meaning all included apps.

    So if you want to return your device to complete bone stock, you'd reflash the factory firmware in Odin, and you'd use the CSC.tar instead of HOME_CSC.tar (the latter is for updating when you want to keep your user data and apps)

    Then, you would lock your bootloader.
    1
    just doing ota update is going to reinstall stock cam app i deleted -amazing thanks.


    Honestly… I am worrying malware app could root my phone . Cuz my phone got factory reset by malware app suddenly. So what i have now is reset phone .Thats why i want to know if my phone was rooted..

    + i used data recovery program after reset So i think thats maybe reason banking apps dont run now . But not sure the name of program so cant check if that programs have rooting feature.
    So i just want to know if my phone has ever been rooted before reset. So worrying… i cant even sleep.
    We have gone around and around this topic in this discussion. I have provided the answers for you. Without somehow comparing every partition against untouched firmware, there is no way to know what is currently modified. If everything is stock, there is no way to know whether it was previously modified. Your best option, once again, is to perform a clean flash of the factory firmware, and lock your bootloader. Locking your bootloader enables additional security features that verify whether or not the images have been modified, and will prevent boot if they are, which is why you need to perform a clean flash first. Doing this will remove any potential rootkit or hijack, because you'll be overwriting everything to bone stock.