Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So it came to pass, that Amanda did have a blonde moment and deleted all her threads in the SMS app by mistake. Yeah, "Delete all threads" probably shouldn't be quite so easy to invoke.

The phone's a ZTE Blade, with all its user data inconveniently stored on a YAFFS2 filesystem.

I have an old back up, but the SMS I need to recover are from since then. There are probably some on the SIM card, so I've ordered a SIM reader. I suspect that the twenty or so it holds are mostly network operator spam, anyway.

So, I curse my ineffectual backup plan and vow to back up SMS to GMail in future.

Meanwhile, I resolve to recover mmssms.db, or what's left of it.

First up, I connect adb and check the mounts, then attempt to copy the block to an image on the SD card:

dd if=/dev/block/mtdblock6 of=/sdcard/data.img 

No such luck. I reason forcibly dismounting would be a bad idea, and probably won't work in any case.

So, I upload a statically linked copy of busybox to the SD card and use the conv=noerror option.

What I ended up with was a file that kept increasing in size until the SD card filled up.

What am I doing wrong? Does ClockworkMod take an image in the true sense or does it just back the files up and pack them into an image? Is there a YAFFS2 recovery program? (The two papers I've read make it seem feasible but I haven't seen even PoC code)

Any clues gratefully received/

Edit: The phone is rooted. Very rooted :)

Further edit:

Most of the messages found in mmssms.db-wal:

ls -al /data/data/
drwxrwx--x    1 radio    radio         2048 Jul 17 20:16 .
drwxr-xr-x    1 radio    radio         2048 Oct 26  2011 ..
-rw-rw----    1 root     root         60416 Jul 17 20:16 mmssms.db
-rw-rw----    1 radio    radio        32768 Jul 17 16:18 mmssms.db-shm
-rw-rw----    1 radio    radio       628832 Jun 30 19:23 mmssms.db-wal
-rw-rw-rw-    1 root     root         60416 Jul 17 20:16
-rw-rw----    1 radio    radio       132096 Jun 18 13:25 telephony.db
-rw-rw----    1 radio    radio        32768 Jul 16 22:14 telephony.db-shm
-rw-rw----    1 radio    radio       106928 Jul 16 22:14 telephony.db-wal

With any luck, SMS Backup & Restore will allow a merge.

share|improve this question
Is your blade rooted? – t0mm13b Jul 16 '12 at 18:56
@Mandy: Regarding your other question: Yaffs2 is a flash file system that has wear leveling protection for the underlying flash storage (it has a log structered data model where writes are not in place but instead go always to the tail of the "log" and old unused space is reclaimed from the head. Very simply explained). If you didn't write too much you probably can find older instances of files. By ignoring the part of the tail from just before the delete you could be lucky. Haven't done file carving for YAFFS2 so far tho. – ce4 Jul 19 '12 at 8:12
up vote 18 down vote accepted

The sms database is stored in /data/data/ which is what you want to do.

Best thing to do, is this, do not plug in USB cable yet:

  1. Reboot into ClockWorkmod Recovery.
  2. Go into Mounts and Storage
  3. Select mount /data
  4. Plug in the USB
  5. From the windows command shell or terminal, adb shell
  6. Since you are in ClockworkMod Recovery, you are root by default, now do this cp /data/data/ /sdcard/MySmsDatabase.db
  7. exit out of the adb shell by typing in this: exit
  8. Now your database is copied to the SD-Card.
  9. Back out of ClockworkMod recovery and just reboot, the recovery will unmount /data for you.

At this stage your database is now copied across. And can be safely extracted via using something like SqliteMan. HTH.

Edit: The OP was interested to know how a dump can be done. - Read on :)

When you invoke this (with USB plugged in and within the adb shell)

sh-4.1# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00500000 00020000 "recovery"
mtd1: 00500000 00020000 "boot"
mtd2: 00120000 00020000 "splash"
mtd3: 00080000 00020000 "misc"
mtd4: 02580000 00020000 "cache"
mtd5: 0d700000 00020000 "system"
mtd6: 0cb80000 00020000 "userdata"
mtd7: 00020000 00020000 "oem"
mtd8: 00180000 00020000 "persist"

Knowing which partition is the key.. So for example from my Blade, I can see that userdata is on the partition mtd6, in which the actual partition information can be found within /dev/mtd/mtdX so its a matter of doing this using cat:

cat /dev/mtd/mtd6 > /sdcard/myuserdata.dump

And from there, taking the /sdcard/myuserdata.dump, depending on the filesystem used on that partition, it can be mounted via loop-back. The mileage will vary and of course, its a chicken-and-egg situation, in order to do all of that, the handset needs to be rooted.

share|improve this answer
That was most helpful, all (or at least most) of the deleted SMS were in mmssms.db-wal: Many thanks for the useful pointer! – Mandy Jul 17 '12 at 19:32
My question stands, though - is it possible to dump an image if the situation demanded it? – Mandy Jul 17 '12 at 19:32
Yes, I will amend the answer... :) – t0mm13b Jul 17 '12 at 19:42
@t0mm13b Now this is a great answer :) +1 – Zuul Jul 17 '12 at 21:48
You, sir, are '#@!%ing awesome. Kicking myself for not persisting with find -iname and grep, but panic does that to you. Also, I'd have looked a proper eejit piping all my SMS into strings and less to read them, so thanks again ;) – Mandy Jul 18 '12 at 21:52

protected by Community Nov 25 '14 at 6:28

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.