Extracting data from a TWRP backup

Question

How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data, which gets split across several files in the backup.

Answer 1

cat data.ext4.win??? | tar xvfi -

What this does is concatenate each file matching the pattern data.ext4.win??? and then pipe the concatenated files to tar for extraction. the - as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.

In this example I used the ext4 formatted data partition. Change data.ext4 to match the partition you are extracting.

Disclaimer: This has not been tested in a windows environment.

For a less hacky solution found here

for f in data.ext4.win???; do tar xvf "$f"; done

This is a bit simpler without relying on the ignore zeros option of tar to operate properly

Edited to reflect davidgo's comment.

31-Jan-2020 Edited to reflect Code Bling's comments.

17-Feb-2021 Edited to reflect alecxs's comments.

Answer 2

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right.

There is a slight difference, depending on the TWRP version used to create the backup. The watershed seems to be 3.2.* or before.

If the backup was created with an older version:

The files are in standard TAR format which any Unix-like OS should understand. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

If the backup was created with a recent version:

The file format uses custom TAR extensions, which the standard tar tools cannot process, see https://github.com/TeamWin/Team-Win-Recovery-Project/issues/1472. You need to extract the file with TWRP’s own flavor of tar:

• If the backup is no longer on the device, copy the required file back. (Should work on any device with TWRP, regardless of where the backup was created.)
• Boot into TWRP.
• adb shell into the device.
• cd to a folder where you want to store your extracted files (I recommend creating a temporary one, extracting files there and then copying them to their intended destination – gives you some security against accidentally overwriting parts of your filesystem).
• Extract those files with TWRP’s custom tar build:
  • tar -tvf data.ext4.win000 will list all files in that particular backup archive (use grep to search for something particular).
  • tar -xvf data.ext4.win000 path/to/file will extract the specified file. In my case, TAR removed the leading / from file names and placed the extracted file in the current folder, with the path appended.

Another option would be to build TWRP’s custom tar tool on a system of your choice, then do the extraction on that system.

Answer 3

Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.

Answer 4

Just extract it with winrar to a folder on desktop and that's it