10

How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data, which gets split across several files in the backup.

Improve this question
18

cat data.ext4.win??? | tar xvfi -

What this does is concatenate each file matching the pattern data.ext4.win??? and then pipe the concatenated files to tar for extraction. the - as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.

In this example I used the ext4 formatted data partition. Change data.ext4 to match the partition you are extracting.

Disclaimer: This has not been tested in a windows environment.



For a less hacky solution found here

for f in data.ext4.win???; do tar xvf "$f"; done

This is a bit simpler without relying on the ignore zeros option of tar to operate properly



Edited to reflect davidgo's comment.

31-Jan-2020 Edited to reflect Code Bling's comments.

17-Feb-2021 Edited to reflect alecxs's comments.

Improve this answer
22
  • 1
    Really cool solution. I used a slightly refined version of this command to ignore the sha1 files - "cat data.ext4.win00? | tar -xv" – davidgo Aug 8 '18 at 8:38
  • 1
    This does not work. I only get the first tar's contents. Each file is a separate tar file and they cannot be concatenated this way. user149408's answer is correct. – Codebling Jan 30 '20 at 5:02
  • 1
    @JohnathonHavens The tar file format specifies that a tar file is terminated by 1024 null bytes ("terminated by an end-of-archive entry, which consists of two 512 blocks of zero bytes") and these blocks are present at the end of the .win000 archive (I checked two of them, system and data). This means that they are not continuation files and therefore not meant to be concatenated. EACH file is its own tar archive. Where did you get the idea that they could be concatenated? Have you ever tried? – Codebling Jan 31 '20 at 22:24
  • 1
    @CodeBling, You are correct, will change the answer to reflect, I must have just been lucky the files I was looking for were in the 000 archive. – Johnathon Havens Feb 1 '20 at 0:02
  • 1
    Fair enough, the best answer may be to use a for loop. for f in data.ext4.win???; do tar xvf "$f"; done. The -i option is a hack, but it is a documented hack here – Johnathon Havens Feb 17 at 17:21
7

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

Improve this answer
1
  • 1
    On Ubuntu opening them with double click errors: format not supported but I can extract them with tar -xvf And on Windows I can't extract them with 7-Zip unfortunately. – Shayan Aug 5 '19 at 21:05
2

Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.

Improve this answer
0

Just extract it with winrar to a folder on desktop and that's it

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.