Yesterday, when I was leaving Russia through Pulkovo, I was questioned by both the border police and FSB. They asked me to unlock my Android phone and took it out of my sight for a while. I don't know exactly what they did with it, and it's possible they connected it to another device.
I've already run malware scans and done a fairly extensive check using ADB: files modified during the relevant time window, installed packages and installation timestamps, accessibility services, device administrators, VPN configuration, and user-installed CA certificates. Nothing suspicious has shown up so far. USB debugging was also disabled when I got the phone back.
I'm replacing the phone in about 10 days anyway, but in the meantime, does anyone with experience with Russian border phone inspections or Android forensics recommend any additional checks? I'm particularly interested in anything that could detect persistent changes that wouldn't show up in the checks above.