I did every things. installing all USB driver. my phone driver. ADB driver. enabling USB debugging. every thing. but still i have problem with fastboot commands. like if i type : fastboot devices. it tell me waiting for any device . every thing is work perfectly in adb commands like adb devices, but not fastboot. i also installed SDK and google drivers.

I wanna install a custom recovery (twrp) to back up my EFS folder and then root it and then install custom rom :) . but at the first level i got stuck and i cant install the custom recovery. i can do any command like adb reboot download but in downloading mode i cant use fastboot command as fastboot flash recovery. after typing this fastboot command the next line it tells me that "waiting for any device".

  • i used odin to instal that custom recovery and every thing was ok but after 3 second my phone rebooted and the message showd in odin textbox was "removed" after 2min odin text box said passed. "0faild/1 succesfull" but nothing changed
    – Darth
    Dec 7, 2017 at 13:17

2 Answers 2


Samsung devices have no fastboot mode. To install a custom recovery, flash a recovery image for your device with Odin/Heimdall.

Do note that although Odin can automatically reboot the phone after flashing, it will not automatically boot it into the recovery you just flashed. To boot into recovery, the moment Odin automatically reboots your phone, immediately hold the key combo to boot the device into recovery. On most Samsung devices it's VOL_UP+HOME+POWER. You should see "recovery booting..." on the top-left of the screen, at which point you can release the keys. You will land in the custom recovery seconds after, from which you could proceed to backup /efs (using nandroid backup) or flash a custom ROM.


The only possible way to backup EFS partition on a non rooted Samsung is using Odin to flash TWRP which corresponds to your device and after that boot to recovery using key combo. Power+Home+Volume^. At recovery access TWRP Terminal. Copy the /factory_init.rc to /sdcard. Copy the file to your desktop and open it with wordpad. It should look something like this:

import /init.environ.rc
import init.fon.rc
import init.trustonic.rc
import init.nvdata.rc
import init.microtrust.rc
import factory_init.usb.rc

on early-init
    # Set init and its forked children's oom_adj.
    write /proc/1/oom_score_adj -1000

    # Set the security context of /adb_keys if present.
    restorecon /adb_keys

    start ueventd

    write /proc/bootprof "INIT: usr/eng build setting"

sysclktz 0

loglevel 5

# Backward compatibility
    symlink /system/etc /etc
    symlink /sys/kernel/debug /d

# Link /vendor to /system/vendor for devices without a vendor partition.
    symlink /system/vendor /vendor

# Create cgroup mount point for cpu accounting
    mkdir /acct
    mount cgroup none /acct cpuacct
    mkdir /acct/uid

    mkdir /system
    mkdir /data 0771 system system
    mkdir /cache 0770 system cache
    mkdir /config 0500 root root

# Mount staging areas for devices managed by vold
    # See storage config details at http://source.android.com/tech/storage/
    mkdir /mnt 0755 root system
    mount tmpfs tmpfs /mnt mode=0755,uid=0,gid=1000
    restorecon_recursive /mnt
    # Support legacy paths
    symlink /sdcard /mnt/sdcard

    mkdir /mnt/secure 0700 root root
    mkdir /mnt/secure/asec 0700 root root
    mkdir /mnt/asec 0755 root system
    mkdir /mnt/obb 0755 root system
    mkdir /mnt/media_rw 0750 root media_rw
    mkdir /mnt/user 0755 root root
    mkdir /mnt/user/0 0755 root root
    mkdir /mnt/expand 0771 system system

    # Storage views to support runtime permissions
    mkdir /storage 0755 root root
    mkdir /mnt/runtime 0700 root root
    mkdir /mnt/runtime/default 0755 root root
    mkdir /mnt/runtime/default/self 0755 root root
    mkdir /mnt/runtime/read 0755 root root
    mkdir /mnt/runtime/read/self 0755 root root
    mkdir /mnt/runtime/write 0755 root root
    mkdir /mnt/runtime/write/self 0755 root root

    # Symlink to keep legacy apps working in multi-user world
    symlink /storage/self/primary /sdcard
    symlink /mnt/user/0/primary /mnt/runtime/default/self/primary

    write /proc/sys/kernel/panic_on_oops 1
    write /proc/sys/kernel/hung_task_timeout_secs 0
    write /proc/cpu/alignment 4
    write /proc/sys/kernel/sched_latency_ns 10000000
    write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000
    write /proc/sys/kernel/sched_compat_yield 1
    write /proc/sys/kernel/sched_child_runs_first 0

# Temp Backward compatibility
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot /dev/bootimg 
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/recovery /dev/recovery
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/secro  /dev/sec_ro
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/kb /dev/kb
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/dkb /dev/dkb 
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/seccfg /dev/seccfg
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/proinfo /dev/pro_info 
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/nvram /dev/nvram   
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/para /dev/misc
    symlink /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/logo /dev/logo 
    #create mountpoint for persist partition
    mkdir /persist 0771 system system
#Create nvdata mount point
    mkdir /nvdata 0771 system system

    # Healthd can trigger a full boot from charger mode by signaling this
    # property when the power button is held.
    on property:sys.boot_from_charger_mode=1
    class_stop charger
    trigger late-init

    # Load properties from /system/ + /factory after fs mount.
    on load_all_props_action

    # Mount filesystems and start core system services.
    on late-init
    trigger early-fs
    trigger fs
    trigger post-fs
    trigger post-fs-data

    # Load properties from /system/ + /factory after fs mount. Place
    # this in another action so that the load will be scheduled after the prior
    # issued fs triggers have completed.
    trigger load_all_props_action

    trigger early-boot
    trigger boot

on fs
    write /proc/bootprof "INIT:Mount_START"
    mount_all /fstab.mt6735
    write /proc/bootprof "INIT:Mount_END"

Take note of codes at Internal start. The blocks that hold system images. For example mine uses nvram for IMEI but if it could have been a Samsund device the EFS location could be here:


And back to phone's terminal and write:

adb shell
dd if /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/efs of /sdcard/efs.img

Here you could have managed to backup the efs at /sdcard. Writing back the efs to phone will be the opposite.

dd if /sdcard/efs.img of /dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/efs

But if it's a rooted device, just download terminal app and run the codes right away:

If it helped just never forget to let me know

  • Unneeded - TWRP for most if not all Samsung devices can include /efs in a nandroid backup by default.
    – Andy Yan
    Dec 7, 2017 at 13:53
  • @AndyYan This is not backing up using TWRP. Since the Terminal at TWRP runs always like in rooted devices, we use the dd command to copy image partitions. The only use of twrp here is offering a rooted environment. Note the Terminal at TWRP always starts with # indicating elevated permissions instead of $ for the boot unrooted android. That's what I mean. Anyway for your information there no any other way other than this for backing up EFS on earth
    – Thally Ace
    Dec 7, 2017 at 14:03
  • Thing is, ultimately OP was looking to install TWRP in the first place, and backing up /efs was only one of the secondary objectives. With TWRP able to handle the job, I don't see it necessary to complicate the situation using another method. Genuine method on its own though so props to that.
    – Andy Yan
    Dec 7, 2017 at 14:05
  • @AndyYan Thanks but one thing you haven't got right is this TWRP Backup option backs up boot, recovery, system, cache, data partitions but not EFS that holds IMEI on Samsung. EFS is a very different entity that is unique to each Samsung device.It holds IMEI in the stock ROM. Flashing custom ROMs majorly damage or overwrite it leading to no cellular data. The only way to backup EFS is through the dd if... of... Command. Failure to back it up.
    – Thally Ace
    Dec 7, 2017 at 14:21
  • @AndyYan Your phone will end up a toy for gaming and music. Since once overwritten you can't even use another phone's EFS.img of the same model since this will show replication of IMEI and hence ban from cellular network for the both. Have you got me?
    – Thally Ace
    Dec 7, 2017 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .