Note: the original problem was solved in another way.
Can Ī̲ access memory of an app without (already obtained) root to extract some lost data? A weaker version: can Ī̲ see which files does the app access? Or, possibly, looking in the file system’s deleted/unused space would provide better chances? To be specific:
- the device is Explay sQuad 7.82 3G
- the OS is Android 4.2.2 kernel 3.4.5 (the one supplied by manufacturer)
- the app has the word “Tips” on its icon (its name is presumedly “com.mediatek.notebook”; it has android.permission.READ_NOTEBOOK and android.permission.WRITE_NOTEBOOK permissions)
My problem is trying to recover a chunk of text lost after some UI glitch and recklessly pressed back (↶) that caused the crappy software to save the damaged record. The text in question was saved many times during several days and lost just before Ī̲ stood for copying-and-pasting it to ssh client’s window. Any help will be appreciated; just note that Ī̲ have fairly strong skills locating and extracting various data from memory dumps, but am not a frequent Android user.
Update: Found all data needed in files in
/data/data/com.mediatek.notebook/databases/ and am not very interested in obtaining memory dumps.