34

I just deleted a file on my Nexus S that I really need back. (It was actually part of an app using a sqlite database that did a drop table when upgrading to a new version.)

Presumably I need to root the phone first (which I hear is easy on Nexus phones) but am I in a catch-22 here? Namely, does rooting the phone mean wiping/overwriting the partition where the data lives?

If not, what do you recommend for data recovery tools? Presumably the file was just unlinked and not actively overwritten (per usual when "deleting" a file) so technically the data must be there...

  • I cannot post an answer, the system goes against me. Worse for them... The most easy way when you have Linux system and your device with TWRP recovery is. 0. First of all! Stop creating new files, close all apps. If you will need to run something, better DELETE first some needless files as much as possible to free more space and get more chances to keep your deleted files intact. Of course you will have to know what partition you need to free. High chances its the one that is mounted as /data (your local and deleted files are in /data/media or something like that). – midenok May 14 at 14:37
  • 1. In TWRP recovery copy your partition with dd to micro SD card by 4Gb pieces: ``` dd if=/dev/dm-0 of=/sdcard/x1...n bs=1048576 count=4095 skip=... ``` Well, you have an option to mount external OTG drive (find some external power source though). But mine didn't work, so I had to put pieces to micro-SD. In skip parameter you will put: 0, 4095, 8190, 16380, etc. – midenok May 14 at 14:39
  • 2. Move all pieces to linux system, concatenate with cat. – midenok May 14 at 14:40
  • 3. Use testdisk to recover. This is most versatile tool for extfs undelete. It allows to undel from specific directory and undeletes even broken files and works really fast (apart from heuristic scanners). So you will be sure that everything that is possible is undeleted or overwritten. – midenok May 14 at 14:41
  • Or: always install testdisk as part of busybox bundle and keep it on your phone. – midenok May 14 at 14:47
35

Manual way

Luckily data recovery on Android isn't different from any other PC/Linux with a flash storage device. You first need root and the dd binary on your device to make a full backup of the block storage device your deleted file was on. dd is sometimes already installed in your system.

Then it's just 3-steps to find out if the file could be recovered:

  1. Find out on which block device the file was on. Via mount
  2. Acquire and image of that block device with dd: dd if=/dev/<blockdevice> of=/sdcard/image bs=4096
  3. Get a data recovery forensics tool and let it search /sdcard/image for the lost file. You can of course try to run multiple tools on the image. Foremost and Scalpel are a good start.

"Undelete" App

There is a new App called "Undelete Beta" which can recover files on the internal storage and the SD card. The App is beta and has some restrictions.

If the file is really important, I would always choose the "Manual Way".

  • Flow, thanks so much; great answer! I'm feeling less despondent now. :) I'm slightly intimidated by the rooting though. Do you know anything about rooting the Nexus S? Will I lose any data or applications or anything? Will I need to unroot it to get automatic OS updates in the future? Is unrooting simple too? – dreeves Nov 21 '11 at 16:56
  • For rooting see this question. I have no Nexus S, but I would say: No, no and sometimes. – Flow Nov 21 '11 at 19:24
  • 1
    @Flow: a) I really wouldn't touch the affected partition any further but unlock the Nexus and 'fastboot boot cwm.img' for a tmp recovery. b) Preferably use adb on the fly to transmit the partition data off the phone (no intermittent storing on /sdcard) using stdout+gzip+uuencode c) carving: sqlite3 has no footer, but a header "SQLite format 3". Using foremost it's best to define a max-size and maybe 'NEXT' (indicating EOF if any other new header is found). OK if I edit? – ce4 Jul 12 '12 at 17:33
  • 1
    +1 for 'scalpel'! Haven't known before. BTW: Testdisk's photorec is also quite useful (for standard file types like .jpg ans such) – ce4 Jul 12 '12 at 17:37
  • what if the device to backup is bigger than 4gb ? – David V. Sep 28 '13 at 8:16
10

As of Android 4.3+ and the implementation of TRIM it is now incredibly difficult to recover deleted files on the internal memory.

Some of the suggested solutions probably will not be worthwhile unless you are able to scan the memory for the deleted file(s) very rapidly after deletion.

Moreover, in the case of recovery after a factory reset, as of Android 4.0+ a factory reset now ends up doing a secure erase (or similar operation) so that all data is irrevocably gone.

Reference:

  • I assume this is the correct answer in 2019? – ripper234 Nov 3 at 4:26
7

The new Undelete Beta may be helpful here if you don't want to involve a PC. Any time you write to storage you risk overwriting the deleted file, but rooting shouldn't wipe.

Not the answer you're looking for? Browse other questions tagged or ask your own question.