Gospel Library app deleted all my photos

I was trying to access a hymn via the apps Hymnbook, and noticed the page wouldn't open after a couple of tries.
I thought I might just need to update the app, but then a pop-up read the following:

'The 620 pictures and 18 videos in your album has been deleted by Gospel Library. Is it completely deleted?' followed by the options: 'Completely' and 'Immediate' I did not press any of the buttons, in case it might be malware. I then found that I could not access the phone without pressing one of these options.
I turned the phone off then on again. All the photos and videos in my phone were deleted, as well as all my files and music in file explorer.

After a short while, the same prompt popped up as before. I turned the phone off and on several times. I turned off the WIFI which paused the Gospel Library app update. Then, after 20 or so seconds, the prompt would appear again after turning the phone back on. I decided to press the 'Completely' button, and the screen froze for a couple of seconds (which strangely changed the font on one of the phones processes: Google Keep).

Now the phone works just as before, but without all my photos and files.
I couldn't find any answers online and am worried my files and pics have been scraped.
I also haven't updated my phones OS in some time either.

Has anyone had this problem with the Gospel Library app before?

That prompt isn't coming from Gospel Library.

I agree with scgallafent that that prompt is not from Gospel Library. Did you install Gospel Library through Google Play or from some other source?

Did the app in the background from your screenshot appear at the same time as the alert?

Are your photos in a "recently deleted" or "trash" folder in your photos app, where they can be recovered?

Are you able to check in Android settings to see which apps have permission to modify photos or access device storage?

I'm sure sbradshaw will correct me if I'm wrong, but I'd expect GL to delete GL content on a upgrade and then re-download it. But that shouldn't affect any other applications.

By chance, did you do something to re-direct GL content to another storage area? If done improperly, there's a chance that when GL cleared it's data, things that were in subdirectories got wiped as well. For example, if you directed GL to the root of a SD card (instead of it's own directory), then when GL cleared it's data, it would have wiped the root of the SD card and everything else in it.

I agree with scgallafent that that prompt is not from Gospel Library. Did you install Gospel Library through Google Play or from some other source?

Yes, from Google Play. I've since deleted and re-downloaded the GL app.

Did the app in the background from your screenshot appear at the same time as the alert?

No. I had it open in the background when I took the screen shot

Are your photos in a "recently deleted" or "trash" folder in your photos app, where they can be recovered?

No. They were all immediately wiped once the prompt popped up. About 40 GB of files.

Are you able to check in Android settings to see which apps have permission to modify photos or access device storage?

After updating the OS and running a couple of full antivirus checks, I did find some music apps with many unnecessary permissions.
The next day, after running another virus scan, I got a prompt about a malicious phone calling app, which I deleted.

scgallafent wrote:That prompt isn't coming from Gospel Library.

Judging by the way the prompt is worded, I'm guessing that's the case too.
Just strange that it should mention the GL app just as it crashed on me.

russellhltn wrote:I'm sure sbradshaw will correct me if I'm wrong, but I'd expect GL to delete GL content on a upgrade and then re-download it. But that shouldn't affect any other applications.

By chance, did you do something to re-direct GL content to another storage area? If done improperly, there's a chance that when GL cleared it's data, things that were in subdirectories got wiped as well. For example, if you directed GL to the root of a SD card (instead of it's own directory), then when GL cleared it's data, it would have wiped the root of the SD card and everything else in it.

I'm having trouble confirming this. From what I can see online:

"All apps (root or not) have a default data directory, which is /data/data/<package_name>. By default, the apps databases, settings, and all other data go here. If an app expects huge amounts of data to be stored, or for other reasons wants to "be nice to internal storage", there's a corresponding directory on the SDCard (Android/data/<package_name>)."

GL has permissions to delete contents from the SD card, as do some music apps I've downloaded. GL may have redirected to the SD card, since I had only about 15% total storage left on the phone, and the SD is where I stored all my files. It may be possible that the GL app cleared its data, and the SD card files, as you say? (or that another app is equally capable of doing the same).

I'm not too fussed about the files, as I back everything up regularly. I'll just have to do a bit of research to figure out whether the above is the case.

TroyEgan wrote:I'm having trouble confirming this. From what I can see online:

"All apps (root or not) have a default data directory, which is /data/data/<package_name>. By default, the apps databases, settings, and all other data go here. If an app expects huge amounts of data to be stored, or for other reasons wants to "be nice to internal storage", there's a corresponding directory on the SDCard (Android/data/<package_name>)."

GL has permissions to delete contents from the SD card, as do some music apps I've downloaded. GL may have redirected to the SD card, since I had only about 15% total storage left on the phone, and the SD is where I stored all my files. It may be possible that the GL app cleared its data, and the SD card files, as you say? (or that another app is equally capable of doing the same).

That all sounds reasonable. What I'm wondering about is if something directed GL to save to /data/data or Android/data. When it went to clear it's data, it would have wiped out all the <package_name> folders.

I suppose it's possible it's a GL bug, but if that's the case, you're the first to report it here.

The message you posted strikes me as coming from some type of file manager that was a bit unsettled that GL did something "out of character" (acting outside of it's own <package_name> directory.) Which raises another question - how did GL get the permission needed to alter those directories? I was of the understanding that by default all apps were restricted to their own data - which prevented some desired interoperability.

russellhltn wrote:The message you posted strikes me as coming from some type of file manager that was a bit unsettled that GL did something "out of character" (acting outside of it's own <package_name> directory.) Which raises another question - how did GL get the permission needed to alter those directories? I was of the understanding that by default all apps were restricted to their own data - which prevented some desired interoperability.

This is my understanding as well, so my assumption is that either 1) Gospel Library was infected with some kind of virus on the device, or 2) there was a malicious app of some sort (not Gospel Library) with too many permissions, which scanned the device for a list of installed apps, and chose a random one to impersonate, to put the user off the trail.

I'm very glad to hear you have good backups!

As an alternative to the popup coming from a file manager, the popup could also have come from the app or virus that deleted the files. Maybe Android requires permission from the user before an app is able to delete files. This popup could be the app/virus' "request" for "permission" by using a confusing or deceiving message.

At minimum, it sounds like something escaped the "each app can only work with it's own data" restriction.

If it was my phone, I'd give serious thought about a full factory reset and critically examine all apps that are re-installed to verify that they are useful to you and haven't been reported as malware. Since the data was already gone, there wasn't much to lose.

Thank you both for your feedback. Judging by the dubious wording and nature of the prompt, I'm confident that the origin is malicious:
(Since my first post, other suspicious phone activity has included a malicious app deletion, a few rapid battery drains and an unrequested app upload).

Since the file deletion is not a known GL app occurrence (and I've never encountered it before), I can only conclude it not likely to be related to the GL app, and has come from somewhere else.
I'll need to work through this further and be extra vigilant with app security.

Thanks again!

russellhltn wrote:At minimum, it sounds like something escaped the "each app can only work with it's own data" restriction.

If it was my phone, I'd give serious thought about a full factory reset and critically examine all apps that are re-installed to verify that they are useful to you and haven't been reported as malware. Since the data was already gone, there wasn't much to lose.

Agreed