0

Note: the original problem was solved in another way.

Can Ī̲ access memory of an app without (already obtained) root to extract some lost data? A weaker version: can Ī̲ see which files does the app access? Or, possibly, looking in the file system’s deleted/unused space would provide better chances? To be specific:

  • the device is Explay sQuad 7.82 3G
  • the OS is Android 4.2.2 kernel 3.4.5 (the one supplied by manufacturer)
  • the app has the word “Tips” on its icon (its name is presumedly “com.mediatek.notebook”; it has android.permission.READ_NOTEBOOK and android.permission.WRITE_NOTEBOOK permissions)

My problem is trying to recover a chunk of text lost after some UI glitch and recklessly pressed back (↶) that caused the crappy software to save the damaged record. The text in question was saved many times during several days and lost just before Ī̲ stood for copying-and-pasting it to ssh client’s window. Any help will be appreciated; just note that Ī̲ have fairly strong skills locating and extracting various data from memory dumps, but am not a frequent Android user.

Update: Ī̲ rooted the device via USB using instructions from there and there, located the process, and entered its /proc/pid. The system even has gdbserver already installed. Now what?

Update: Found all data needed in files in /data/data/com.mediatek.notebook/databases/ and am not very interested in obtaining memory dumps.

Improve this question
3
  • You said you copy/pasted text to ssh client window. So it will be easy to ssh again into a machine and see history of commands :D really bad if you need to recover a piece of text. The worse case is that text containing login credentials for ssh. Anyway, try with eclipse and see in logcat what app do (there are chances to find explicit location for files used).
    – ares777
    Commented Aug 14, 2015 at 15:32
  • If you think app store files on sd card, there are chances to recover deleted file via sd card adapter and pc... (if you're on windows, there are some programs running (free) to recover under an amount of data (let's say 100 mb I don't really remember what was the cap/limit for easeus Free SD Card Data Recovery). Also read stackoverflow.com/questions/9017073/… ...and now a question :D did you manage to dump memory from ms-dos games in your life? you know, full dump breaking the 500 k limit of mem.process :D
    – ares777
    Commented Aug 14, 2015 at 15:36
  • @user3344236 is sd card the thing accessible through USB as a VFAT storage? No, it’s unlikely the data in question were ever written there.
    – Incnis Mrsi
    Commented Aug 14, 2015 at 16:08

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .