How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data, which gets split across several files in the backup.


cat data.ext4.win??? | tar xvfi -

What this does is concatenate each file matching the pattern data.ext4.win??? and then pipe the concatenated files to tar for extraction. the - as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.

In this example I used the ext4 formatted data partition. Change data.ext4 to match the partition you are extracting.

Disclaimer: This has not been tested in a windows environment.

For a less hacky solution found here

for f in data.ext4.win???; do tar xvf "$f"; done

This is a bit simpler without relying on the ignore zeros option of tar to operate properly

Edited to reflect davidgo's comment.

31-Jan-2020 Edited to reflect Code Bling's comments.

17-Feb-2021 Edited to reflect alecxs's comments.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Andrew T.
    Sep 19 '21 at 1:31

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right.

There is a slight difference, depending on the TWRP version used to create the backup. The watershed seems to be 3.2.* or before.

If the backup was created with an older version:

The files are in standard TAR format which any Unix-like OS should understand. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

If the backup was created with a recent version:

The file format uses custom TAR extensions, which the standard tar tools cannot process, see https://github.com/TeamWin/Team-Win-Recovery-Project/issues/1472. You need to extract the file with TWRP’s own flavor of tar:

  • If the backup is no longer on the device, copy the required file back. (Should work on any device with TWRP, regardless of where the backup was created.)
  • Boot into TWRP.
  • adb shell into the device.
  • cd to a folder where you want to store your extracted files (I recommend creating a temporary one, extracting files there and then copying them to their intended destination – gives you some security against accidentally overwriting parts of your filesystem).
  • Extract those files with TWRP’s custom tar build:
    • tar -tvf data.ext4.win000 will list all files in that particular backup archive (use grep to search for something particular).
    • tar -xvf data.ext4.win000 path/to/file will extract the specified file. In my case, TAR removed the leading / from file names and placed the extracted file in the current folder, with the path appended.

Another option would be to build TWRP’s custom tar tool on a system of your choice, then do the extraction on that system.

  • 2
    On Ubuntu opening them with double click errors: format not supported but I can extract them with tar -xvf And on Windows I can't extract them with 7-Zip unfortunately.
    – Shayan
    Aug 5 '19 at 21:05
  • tar: Ignoring unknown extended header keyword 'TWRP.security.e4crypt' the command line client is successful in extracting files, but spams the above warning.
    – Kevin
    Oct 18 '21 at 14:25

Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.


Just extract it with winrar to a folder on desktop and that's it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.