11

How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data, which gets split across several files in the backup.

4 Answers 4

20

cat data.ext4.win??? | tar xvfi -

What this does is concatenate each file matching the pattern data.ext4.win??? and then pipe the concatenated files to tar for extraction. the - as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.

In this example I used the ext4 formatted data partition. Change data.ext4 to match the partition you are extracting.

Disclaimer: This has not been tested in a windows environment.



For a less hacky solution found here

for f in data.ext4.win???; do tar xvf "$f"; done

This is a bit simpler without relying on the ignore zeros option of tar to operate properly



Edited to reflect davidgo's comment.

31-Jan-2020 Edited to reflect Code Bling's comments.

17-Feb-2021 Edited to reflect alecxs's comments.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Andrew T.
    Sep 19, 2021 at 1:31
8

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right.

There is a slight difference, depending on the TWRP version used to create the backup. The watershed seems to be 3.2.* or before.

If the backup was created with an older version:

The files are in standard TAR format which any Unix-like OS should understand. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

If the backup was created with a recent version:

The file format uses custom TAR extensions, which the standard tar tools cannot process, see https://github.com/TeamWin/Team-Win-Recovery-Project/issues/1472. You need to extract the file with TWRP’s own flavor of tar:

  • If the backup is no longer on the device, copy the required file back. (Should work on any device with TWRP, regardless of where the backup was created.)
  • Boot into TWRP.
  • adb shell into the device.
  • cd to a folder where you want to store your extracted files (I recommend creating a temporary one, extracting files there and then copying them to their intended destination – gives you some security against accidentally overwriting parts of your filesystem).
  • Extract those files with TWRP’s custom tar build:
    • tar -tvf data.ext4.win000 will list all files in that particular backup archive (use grep to search for something particular).
    • tar -xvf data.ext4.win000 path/to/file will extract the specified file. In my case, TAR removed the leading / from file names and placed the extracted file in the current folder, with the path appended.

Another option would be to build TWRP’s custom tar tool on a system of your choice, then do the extraction on that system.

2
  • 2
    On Ubuntu opening them with double click errors: format not supported but I can extract them with tar -xvf And on Windows I can't extract them with 7-Zip unfortunately.
    – Shayan
    Aug 5, 2019 at 21:05
  • tar: Ignoring unknown extended header keyword 'TWRP.security.e4crypt' the command line client is successful in extracting files, but spams the above warning.
    – Kevin
    Oct 18, 2021 at 14:25
2

Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.

0

Just extract it with winrar to a folder on desktop and that's it

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .