Backup Hygiene for Mobile

A photo, a PDF, a contacts export, a chat media folder — those are data. Restoring them after a malware wipe does not execute the trojan. An APK, a "full device backup," an OEM clone of every app's private storage, a copied WhatsApp Gold MOD, a "cleaner" you saved "just in case" — those are programs and program state. Restoring them can re-grant Accessibility, unpack the dropper, and put Device admin back before you finish the setup wizard. After infection, the rule is brutal and simple: restore media and documents from a channel you trust; reinstall apps fresh from Play (Module 2 checklist); sign in again with the unique passwords and MFA you rotated from a clean device in the last lesson. Cloud backup of media (Google Photos, OEM gallery cloud, a folder you copy to a computer you own) should be on before you need it, on an account with unique password and MFA. Confirm it is actually uploading full-resolution originals, not only device thumbnails. Open one recent photo on another device or the web gallery as a restore drill — Topic 1 already said untested backups are wishes. Contacts sync to the Google account you control, or export a file you keep with the documents. Passport and tax scans belong in encrypted storage you control (password-manager attachments, an encrypted disk image, a reputable cloud drive with MFA) — not in a random "scanner APK" from Module 1's fake listings.

Do not treat "I copied the whole Internal storage folder" as safe by default. That tree can include Download/*.apk, unknown OBBs, and backup archives malware dropped. After a suspected infection, copy DCIM, Pictures, Documents, and specific files you can name — not every directory because you were in a hurry. Never restore a sideloaded APK from that pile "because I might need that tool." Need is Play or official site. The malware's favorite second chance is your sentimentality toward a file named Bank_Update.apk.

Authenticator apps live on the device you are about to wipe. If the only copy of TOTP seeds and backup codes is that phone, a righteous factory reset becomes an account-lockout. Print codes or store them in the password manager vault / a paper packet in a place you control — Topic 4 Module 2 recovery — not in the same Photos album that will be the first thing a thief opens, and not only as a screenshot on the infected handset. After malware wipe you re-enroll MFA from those offline codes on a clean install. SMS-only 2FA is what notification-access malware wanted; prefer authenticator or a key when the site offers it, and still keep the backup codes off the phone. 3-2-1 on mobile is not three identical USB sticks in the same bag. Working copy: the phone. Second copy / different system: cloud photos + documents on an account you MFA, or a computer/drive you own. Off-site: that cloud, or a drive that does not live in the same apartment. The phone in your pocket plus an SD card that stays in the phone is one theft, not two media. A laptop that always sits beside the phone and auto-syncs every APK is a correlated failure — and a restore path for malware. Version history on a reputable cloud helps you roll back a ransomed or deleted album without paying anyone. Public share links to the entire vault are not a backup; they are a leak.

What you reinstall from Play after a wipe should be a short list you already wrote: bank, mail, messenger, maps, authenticator, password manager. What you restore as files: DCIM, Documents, maybe a contacts export. What you never blind-restore: unknown APKs, full Titanium/OEM "all apps" images taken during the infection window, "MOD" messengers, battery savers that wanted Accessibility. If a work profile or MDM backs up the phone, ask IT whether app restore is in scope — still only on a device you are allowed to wipe. Family tablets you do not own are not your restore lab.

Two columns, both yours. Restore as files: albums and documents you can name. Reinstall from Play: the apps that hold money, mail, and chat — official listings only (Module 1 fake Play still applies). Third line: where 2FA backup codes live that is not this phone. You will not paste those codes into the notes file. You will not download malware to test a restore. You will not wipe a device you do not own to "practice 3-2-1." chmod 600 on a shared computer.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/android-backup.txt"

{
  echo "android backup hygiene — MY device and MY accounts only"
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo ""
  echo "3-2-1 MOBILE:"
  echo "  copy_1_working: this phone"
  echo "  copy_2_other_system: (Google Photos / OEM cloud / PC folder I own)"
  echo "  copy_3_offsite: (same cloud with MFA / drive not in this bag)"
  echo "  restore_drill: I opened one recent photo from cloud on another device: yes/no"
  echo ""
  echo "RESTORE AS FILES after a malware wipe (name folders, not 'everything'):"
  echo "  photos_videos: DCIM / Pictures / ..."
  echo "  documents: ..."
  echo "  contacts: account sync or export file"
  echo "  I will NOT copy Download/*.apk or unknown backup archives by default"
  echo ""
  echo "REINSTALL FROM PLAY (not from APK backup):"
  echo "  bank:"
  echo "  mail:"
  echo "  messenger:"
  echo "  authenticator / password manager:"
  echo "  maps / other:"
  echo "  I will NOT restore MOD APKs, cleaners, or 'all apps' images from the dirty window"
  echo ""
  echo "2FA BACKUP CODES: stored OFF this phone (paper / vault) — location described, codes NOT written here:"
  echo "  off_phone_store: yes/no/working_on_it"
  echo ""
  echo "CLOUD ACCOUNT: unique password + MFA (Topic 4). No public album links as 'backup.'"
  echo ""
  echo "ETHICS:"
  echo "Factory reset = a device I own. No restore of someone else's backup without consent."
  echo "No keeping malware APKs. No hack-back. No wipe of a phone I do not own."
} > "$NOTES"
chmod 600 "$NOTES"
ls -l "$NOTES"

You now split a mobile backup into files that survive a wipe and programs that can resurrect malware, keep 2FA recovery off the device you might erase, and adapt Topic 1's 3-2-1 so one stolen bag is not three copies of nothing — or three copies of the trojan. Next — Quiz — Android Security Final — twelve APPLY scenarios across sideloading, fake Play, banking overlays, spyware clues, permissions, privacy, safe install, rooting, the permission-lab rubric, updates and encryption, IR order, and this backup split, then Python for Security (Topic 7). Recovery stays YOUR phone and YOUR accounts. No hack-back. No someone else's wipe.