Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I just deleted a file on my Nexus S that I really need back. (It was actually part of an app using a sqlite database that did a drop table when upgrading to a new version.)

Presumably I need to root the phone first (which I hear is easy on Nexus phones) but am I in a catch-22 here? Namely, does rooting the phone mean wiping/overwriting the partition where the data lives?

If not, what do you recommend for data recovery tools? Presumably the file was just unlinked and not actively overwritten (per usual when "deleting" a file) so technically the data must be there...

share|improve this question
Editors: this question states specifically that the data in question was not on the SD card and the answer from @Flow is detailed and great. I think it is different and useful from the so-called-duplicate question (and answer) linked above. –  Bee Nov 21 '11 at 18:21
Apologies, I thought the other question was another I can't find at the moment. This one is better and has a better answer, so I've re-opened. Thanks for following up! –  Matthew Read Nov 21 '11 at 20:40

3 Answers 3

Manual way

Luckily data recovery on Android isn't different from any other PC/Linux with a flash storage device. You first need root and the dd binary on your device to make a full backup of the block storage device your deleted file was on. dd is sometimes already installed in your system.

Then it's just 3-steps to find out if the file could be recovered:

  1. Find out on which block device the file was on. Via mount
  2. Acquire and image of that block device with dd: dd if=/dev/<blockdevice> of=/sdcard/image bs=4096
  3. Get a data recovery forensics tool and let it search /sdcard/image for the lost file. You can of course try to run multiple tools on the image. Formemost and Scalpel are a good start.

"Undelete" App

There is a new App called "Undelete Beta" which can recover files on the internal storage and the SD card. The App is beta and has some restrictions.

If the file is really important, I would always choose the "Manual Way"

share|improve this answer
Flow, thanks so much; great answer! I'm feeling less despondent now. :) I'm slightly intimidated by the rooting though. Do you know anything about rooting the Nexus S? Will I lose any data or applications or anything? Will I need to unroot it to get automatic OS updates in the future? Is unrooting simple too? –  dreeves Nov 21 '11 at 16:56
For rooting see this question. I have no Nexus S, but I would say: No, no and sometimes. –  Flow Nov 21 '11 at 19:24
@Flow: a) I really wouldn't touch the affected partition any further but unlock the Nexus and 'fastboot boot cwm.img' for a tmp recovery. b) Preferably use adb on the fly to transmit the partition data off the phone (no intermittent storing on /sdcard) using stdout+gzip+uuencode c) carving: sqlite3 has no footer, but a header "SQLite format 3". Using foremost it's best to define a max-size and maybe 'NEXT' (indicating EOF if any other new header is found). OK if I edit? –  ce4 Jul 12 '12 at 17:33
+1 for 'scalpel'! Haven't known before. BTW: Testdisk's photorec is also quite useful (for standard file types like .jpg ans such) –  ce4 Jul 12 '12 at 17:37
what if the device to backup is bigger than 4gb ? –  David V. Sep 28 '13 at 8:16

The new Undelete Beta may be helpful here if you don't want to involve a PC. Any time you write to storage you risk overwriting the deleted file, but rooting shouldn't wipe.

share|improve this answer

As of Android 4.3+ and the implementation of TRIM it is now incredibly difficult to recover deleted files on the internal memory.

Some of the suggested solutions probably will not be worthwhile unless you are able to scan the memory for the deleted file(s) very rapidly after deletion.

Moreover, in the case of recovery after a factory reset, as of Android 4.0+ a factory reset now ends up doing a secure erase (or similar operation) so that all data is irrevocably gone.


share|improve this answer

protected by eldarerathis May 21 '13 at 15:21

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.