I can add more detail to this post with later revisions, and you can ask questions in the comments.

The situation

  • My sister dropped her Samsung Galaxy Nexus Android phone and shattered the screen, so she gave it to me for my birthday.
  • The screen is blank - it displays nothing - and it cannot be used to control the phone at all. Otherwise though, the phone, including the power and volume buttons, is fully functional.
  • The phone is protected with a PIN that you have to enter when you first power it up or unlock it. It's running stock Android; it's not rooted; the bootloader is locked; and it's never had USB debugging enabled.

Objectives

  • Retrieve the contents of the phone's storage, including photographs, which are not backed up anywhere.
  • Make the phone useful for something, like as a Squeezebox player. This would let me plug it into a hifi and stream music to it.

The approach

You need to unlock the phone in order to access its storage. The Samsung Galaxy Nexus supports USB On-The-Go. This means that if you buy a USB OTG adapter, you can plug a USB keyboard into it, in order to input keystrokes. Power the phone up, and use this technique to unlock it. My sister told me her PIN, which I just typed on the keyboard's row of numbers that appear above the letters (i.e. the number pad didn't work); and you hit enter to submit the PIN and unlock the phone.

Quickly, while it stays unlocked, plug the phone into your computer, and its storage will appear in your computer's file browser. Copy the contents somewhere safe. Once you've started copying, the copy process won't be interrupted by the phone locking again.

In order to be able to have any practical control over the phone, we want to be able to see and 'touch' its screen remotely. So, next step: put the phone into bootloader mode, and unlock the bootloader. You'll need the platform tools that are part of the Android SDK. Be aware, this step will wipe the phone's data, which is why we did steps 1 and 2 above first.
Now that the bootloader's unlocked, you can flash a custom recovery that has USB debugging enabled by default. I used ClockworkMod.

Next, put the phone into Recovery mode. On the Samsung Galaxy Nexus, this is easy enough without being able to see the screen: from the bootloader, you press the volume down key twice, then the power key.

Now, you need to enable USB debugging in Android, i.e. for when the phone is booted normally. Read this post on Stack Overflow. Use ADB to edit /system/build.prop and /data/data/com.android.\\providers.settings/databases/\\settings.db. You'll need sqlite3 to edit the database file.

You'll also need Android to recognise and accept your computer's control via ADB. Normally, when you run ADB this authorisation is granted through an on-screen dialog; but with a broken screen you won't be able to see or touch that dialog. Instead, you need to manually add your computer's ADB public key to Android's list of authorised keys. Read this blog post. Your computer's key is in ~/.android/adbkey.pub and this needs adding to /data/misc/adb/adb_keys on the phone.

So that you can remotely 'touch' the phone's screen, you'll need to root the phone. This is done by installing a su binary: you need to install a zip file on the phone. You can get a su binary zip file here. Still in recovery mode, use ADB to push the zip file onto the phone's storage. Read this post on Android Forums. Run recovery --update_package=/sdcard/\\whatever.zip to install the zip.

Now, you can boot the phone normally. USB debugging should be enabled and your computer should be authorised for ADB. You can use androidscreencast to see the screen, and you can input keystrokes using ADB. Tab and Enter are really useful keystrokes!

Install Webkey remotely, from Google Play.

You need to start the Webkey app now, which you can do easily with ADB. This post on Stack Overflow tells you how to start an app when all you know is the package name. Webkey's package name is com.webkey.

Webkey needs root permission. When you start it, you'll see (via androidscreencast) a SuperSu dialog open. You'll need to quickly issue the tab and enter keystrokes required to grant root permission to the Webkey app.

You'll also need to create a Webkey user account, so that you've got credentials with which to log into the phone remotely. You'll be able to use ADB input commands to do this.

Webkey's up and running, so now access the phone's IP address (on your local network) in your computer's web browser. Log in with the credentials you created previously.

You can now remotely see and 'touch' the phone's screen. You don't need the phone plugged in by USB anymore. You can install apps, like SqueezePlayer, and enjoy.'