How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data
, which gets split across several files in the backup.
cat data.ext4.win??? | tar xvfi -
What this does is concatenate each file matching the pattern data.ext4.win???
and then pipe the concatenated files to tar for extraction. the -
as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.
In this example I used the ext4 formatted data partition. Change data.ext4
to match the partition you are extracting.
Disclaimer: This has not been tested in a windows environment.
For a less hacky solution found here
for f in data.ext4.win???; do tar xvf "$f"; done
This is a bit simpler without relying on the ignore zeros option of tar to operate properly
Edited to reflect davidgo's comment.
31-Jan-2020 Edited to reflect Code Bling's comments.
17-Feb-2021 Edited to reflect alecxs's comments.
-
1Really cool solution. I used a slightly refined version of this command to ignore the sha1 files - "cat data.ext4.win00? | tar -xv" – davidgo Aug 8 '18 at 8:38
-
1This does not work. I only get the first tar's contents. Each file is a separate tar file and they cannot be concatenated this way. user149408's answer is correct. – Codebling Jan 30 '20 at 5:02
-
1@JohnathonHavens The tar file format specifies that a tar file is terminated by 1024 null bytes ("terminated by an end-of-archive entry, which consists of two 512 blocks of zero bytes") and these blocks are present at the end of the
.win000
archive (I checked two of them,system
anddata
). This means that they are not continuation files and therefore not meant to be concatenated. EACH file is its own tar archive. Where did you get the idea that they could be concatenated? Have you ever tried? – Codebling Jan 31 '20 at 22:24 -
1@CodeBling, You are correct, will change the answer to reflect, I must have just been lucky the files I was looking for were in the 000 archive. – Johnathon Havens Feb 1 '20 at 0:02
-
1Fair enough, the best answer may be to use a for loop.
for f in data.ext4.win???; do tar xvf "$f"; done
. The-i
option is a hack, but it is a documented hack here – Johnathon Havens Feb 17 at 17:21
The files created by TWRP with a *.win
or *.win???
extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right. Simply rename each file, giving it a .tar
extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).
-
1On Ubuntu opening them with double click errors: format not supported but I can extract them with
tar -xvf
And on Windows I can't extract them with 7-Zip unfortunately. – Shayan Aug 5 '19 at 21:05
Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.